Exchange 5.5 server behind pix 506e 1

[jray27]

I am having trouble configuring my new PIX 506e to let mail come into the server, any help would be great.

Also going to be trying to get Terminal services to go thru also.

Jerry

 

[themut]

you need a static translation and an ACL permiting traffic on poort 25:

static (inside, outside) <public-ip> <private-ip> netmask 255.255.255.255
access-list <acl-name> permit tcp any host <public-ip> eq 25
access-group <acl-name> in interface outside

Since you are using Exchange you will also need to disable fixup protocol smtp

 

[jray27]

What do I enter as <acl-name>

 

[themut]

Any name or number you want

 

[jray27]

Working Great, thank you

One other question, can I Terminal service (microsoft) thru the PIX?

 

[themut]

Yeap! You need a static translation for your terminal server and an ACL entry opening the required port.

 

[jray27]

Mail is coming thru just fine, but I have other issues now.

Only some of the workstations can access the internet, they can do nslookups thru our W2K DNS server (internal, serves all DNS queries) but cannot get out. I have 4 workstations and the server that can get out the rest will not.

How do I add more static mappings to allow port 80, 110, etc to the same server? I tried the GUI but it does not let the traffic thru, I did make sure to write the mem also.

This is my first Cisco product (as you may see) but I am eager to learn. If in any answers you can explain what the commands mean it would be appreciated.

Here is my config:

Building configuration...
: Saved
:
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password *********** encrypted
passwd *********** encrypted
hostname pixfirewall
domain-name *********.com
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
names
object-group network all
network-object 10.0.3.0 255.255.255.0
access-list kei permit tcp any host 20.30.40.50 eq smtp
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 20.30.40.50 255.255.255.224
ip address inside 10.0.3.50 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 10.0.3.2 255.255.255.255 inside
pdm group all inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 20.30.40.55-20.30.40.60 netmask 255.255.255.224
nat (inside) 1 0.0.0.0 0.0.0.0 dns 0 0
static (inside,outside) interface 10.0.3.2 dns netmask 255.255.255.255 0 0
access-group kei in interface outside
route outside 0.0.0.0 0.0.0.0 20.30.40.40 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 10.0.3.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 10.0.3.51-10.0.3.254 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
Cryptochecksum:******************
: end
[OK]

I have a W2k server running DHCP, DNS, WWW, FTP, SMTP (Exchange 5.5) - All clients are W2K

 

[dx1]

>global (outside) 1 20.30.40.55-20.30.40.60 netmask 255.255.255.224

That only allows .55 to .60 to go through. Use a single address and PAT it.
global (outside) 1 20.30.40.60

 

[jray27]

did not work...

I reset back to factory defaults

Set my outside IP, Subnet, Gateway

Set my inside IP

Set to PAT outside interface IP

Browsing works

If I enter the 3 lines from previous post to allow mail in, I have browsing problems..


HELP!!!!!!

Stress Level Rising

 

[jray27]

Here is the current config

Building configuration...
: Saved
:
PIX Version 6.3(1)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password ** encrypted
passwd ** encrypted
hostname pixfirewall
domain-name ciscopix.com
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
names
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside 216.234.108.200 255.255.255.224
ip address inside 192.0.3.50 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 216.234.108.193 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http 192.0.3.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.0.3.51-192.0.3.254 inside
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
Cryptochecksum:11623c5bd00bee11575363c725d76f29
: end
[OK]

 

[jray27]

ok, got it working, changed the PAT to another IP, set the SMTP stuff, mail is working and browsing is working...

OK I have WWW, POP, and some more ports to open, do I use the same commands just change the port #'s or do I use a different ACL?

All will be pointing to the same server as the mail.


Correct me if I am wrong but the problem was trying to use the interface ip for a static and browsing with pat on the same ip?

 

[dx1]

>I have a W2k server running DHCP, DNS, WWW, FTP, SMTP (Exchange 5.5) - All clients are W2K

It looks like you have a DHCP server on the W2K server and on the PIX. Disable the DHCP server on the PIX, create your static translation, clear xlate, and clear arp on your perimeter router.

 

[jray27]

create your static translation, clear xlate, and clear arp on your perimeter router

Not sure about this, the router is not under my control, it belongs to the ISP

DHCP is disabled on the PIX