I have two LAN's on different subne

[igolo]

I have two LAN's on different subnets, corplan(10.1.0.0) and paylan(192.168.40.0)located in the same building. Corplan is routed through Cisco 3640 and has the Exchange 5.5 server in it's domain. The paylan is connected to the corplan via a Cisco Pix 501.
The paylan can successfully connect the corplan, browse internet, and connect to network shares. However, the users on the paylan cannot connect to the exchange server on the corplan using Outlook. Although when I setup the mail account in control panel it finds the exchange server and authenticates the user account.

Here is a copy of my config:


PIX Version 6.1(4)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password sX8K6xZ6Rfv3H.1q encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
hostname pixfirewall
domain-name ciscopix.com
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list 100 permit icmp any any
access-list acl_in permit icmp any any
access-list acl_out permit icmp any any
pager lines 24
logging on
logging trap warnings
interface ethernet0 10baset
interface ethernet1 10full
mtu outside 1500
mtu inside 1500
ip address outside 10.1.200.254 255.255.0.0
ip address inside 192.168.40.254 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.1.0 255.255.255.0 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 10.1.200.240-10.1.200.250 netmask 255.255.0.0
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
route outside 0.0.0.0 0.0.0.0 10.1.200.254 1
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.40.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet timeout 5
ssh timeout 5
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd auto_config outside
terminal width 80
Cryptochecksum:ab375da37b5a00bf80ac3c43ac27cf9b
: end
[OK]

 

[gbiello]

It may be because you have the mailguard feature turned on:
"fixup protocol smtp 25"

See Q320027 in Microsoft's knowledgebase.

hope this helps,
-gbiello

 

[robharper]

Sorry this is more of a question

This is very similar to the problem I am having.

I have an internal IP range 192.168.10.xxx and another range of 142.142.xxx.xxx (used for external mail servers)

The 142.142.xxx.xxx range is an external IP on the inside of our firewall, everyone can access the web etc from the 192.168.10.xxx range and you can VPN in and access the 142.142.xxx.xxx range, it is simply unavailable from the inside of the PIX.

If you get a solution please let me know.

 

[igolo]

I turned fixup off but no go. Outlook will no connect.

 

[gbiello]

Have a look at Q280132. It deals with Exchange 2000, but it should help you.
-gbiello

 

[yizhar]

HI.

Try to use a HOSTS file on workstations, or instead configure internal DNS server with proper host record for the Exchange server.
Does it help?

Can paylan access OWA of the Exchange servers?
Can paylan telnet to ports 25 & 110 of the Exchange server?
If a paylan host pings the Exchange server by server name, does it get the correct ip address?

Use syslog messages on the pix at level 4.
Do you get any relevant syslog messages?

Any errors in Exchange server logs? Client logs?

Is the 10.1.0.0 a single subnet in single simple LAN, or do you have VLAN, additional routers, subnetting?

Once you solve the major issues, you should know that Exchange will not be able to notify workstations about new mail:

http://support.microsoft.com/default.aspx?scid=KB;EN-US;q305572&

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar