MS Exchange & PIX 515ur

[rubbaninja]

Good Evening,

I have an exchange 5.5 server that is, of course, passing it's SMTP traffic through my PIX firewall 5.3(2) with a static command and access-list:

static (inside,outside) o.o.o.o. i.i.i.i netmask 255.255.255.255
access-list acl-outside permit tcp any host o.o.o.o eq smtp 0 200
"no fixup for SMTP"


The mail server is not on a DMZ (I know I know, my boss doesn't want to have to do the work because we route email for 27 domains... yup, 27.) What I am seeing is port 137 traffic when I do a show conn.
So, i set up a access-list to block port 137 traffic and now it seems like outside sources are having issues with giving us mail and us sending it out.

Anyone have a good secure access-list(s) and configuration for a ESMTP exchange server that is not on a DMZ? Or, is my configuration OK?

Any thoughts would be appreciated.

 

[yizhar]

HI.

* You have the option to install a mail-relay in DMZ and forward incoming mail to the Exchange server. This is more secure then direct access to the "real" server.

* Why are you disabling the fixup?
In most cases there is no problem to use the basic SMTP commands via the fixup.
Are you using any ESMTP advanced features?

* If you apply any access-list to the inside interface to deny some traffic, you must then permit the legitimic traffic you wish to allow (or ip any any for all the rest not specifically denied).
You must remember to allow DNS traffic for example.

Post here your full access list configuration and more details about the errors you get (including syslog messages).

Bye

Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[rubbaninja]

Sorry for the ancient reply but I figured out why I needed to work my configuration for the mail server like I did.
No reverse DNS. Half of our connections were getting lost in the bit bucket.

My next step is to finally get the dmz configured for this. Reason it is not right now? My boss built the network 5 years ago, it used to go through Raptor Firewall which watched after the email. When switched service providers and obtained a new address space we ditched the old raptor box and bought overkill in cisco products.

Thanks for your help