Exchange and DNS

[NetworkGuy101]

Hello I hope someone could help me with my problem. PIX. I have a network set up with an internal DNS server and an Internal Mail server. The servers are on the same machine and have an internal of address is 10.53.1.2 and the external is XXX.XXX.XXX.5. I am able to send mail out but I cant recieve. I would also like to set up ping to be able to ping my exteranl staic address for testing. Here is my config:

Building configuration...
: Saved
:
PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 intf2 security10
nameif ethernet3 intf3 security15
nameif ethernet4 intf4 security20
nameif ethernet5 intf5 security25
hostname xxx
domain-name xxx
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
name x.x.x.2 penguin
access-list inside_access_in permit ip any any
access-list inside_access_in permit tcp any any
access-list inside_access_in permit udp any any
access-list outside_access_in permit udp any eq domain any
access-list outside_access_in permit tcp any any eq smtp
access-list outside_access_in permit tcp any eq domain any eq domain
pager lines 24
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto shutdown
interface ethernet3 auto shutdown
interface ethernet4 auto shutdown
interface ethernet5 auto shutdown
icmp permit any echo-reply outside
icmp permit any echo outside
icmp permit any echo-reply inside
icmp permit any echo inside
mtu outside 1500
mtu inside 1500
mtu intf2 1500
mtu intf3 1500
mtu intf4 1500
mtu intf5 1500
ip address outside x.x.x.2 255.255.255.0
ip address inside x.x.x.1 255.255.255.0
ip address intf2 127.0.0.1 255.255.255.255
ip address intf3 127.0.0.1 255.255.255.255
ip address intf4 127.0.0.1 255.255.255.255
ip address intf5 127.0.0.1 255.255.255.255
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
failover ip address intf2 0.0.0.0
failover ip address intf3 0.0.0.0
failover ip address intf4 0.0.0.0
failover ip address intf5 0.0.0.0
pdm location penguin 255.255.255.255 inside
pdm history enable
arp timeout 14400
global (outside) 10 x.x.x.15-x.x.x.254 netmask 255.255.255.0
nat (inside) 10 0.0.0.0 0.0.0.0 0 0
static (inside,outside) x.x.x.5 penguin dns netmask 255.255.255.255 0 0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 198.220.247.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
http server enable
http penguin 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet timeout 5
ssh timeout 5
terminal width 80


Thanks
Joe

 

[rjj175]

Joe,
The last time I ran Exchange it was ver 5.5 so I'm not sure if this applies to Exchange 2000 but... I found that Exchange 5.5 used some of the extended smtp commands that are not permitted by the pix fixup smtp command.
You can resolve this by issuing "no fixup protocol smtp 25".
If this works, you might want to look at your Exchange server to see if there is a way to prevent it from using those commands so you can put the fixup back in place.

Hope this helps

 

[NetworkGuy101]

I am running Exch 5.5 also. I tried it but it didnt work

 

[ChrisAC]

Have you tried telnet 25 from the outside to your mail server? If it doesn't work then look at the firewall logs and see what's stopping it!

I presume that those access lists are just for testing and are not your working rules??

Chris.
**********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[yizhar]

HI.

> internal DNS server and an Internal Mail server
> I am able to send mail out but I cant recieve
Does this server need to get mail from the Internet or just internal mail from company LAN hosts?

Check your DNS MX record for the mail server.

As iproute wrote - try to telnet to port 25 of the server, what do you get?

> ip address outside x.x.x.2 255.255.255.0
Is this a registered ip address, or an internal one?
Do you have another NAT devices in the connection to the Internet?

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar