Outlook Password Change through a PIX

[kef65]

We have a PIX 515, OSI ver 5.1. Remote access users who dial-up to an ISP to get in, can access their mail fine through the PIX but they cannot change their password using the Outlook change password button (or OWA) except when "any any" all ports are opened.

Ports 135-139 UDP and TCP are open.

There are alias assinged for the private (net 10) to public addresses.
-- alias (inside) 10.x.x.x 19x.x.x.x 255.255.255.255

NAT 0 is used
-- nat (inside) 0 access-list nonat

And global addressing pool is used.
-- global (outside) 1 x.x.x.x-x.x.x.x netmask 255.255.255.0

The mail system is Exchange 2000 10.x.x.28 19x.x.x.48

I think that another server actually does the authentication fot the domain. 10.x.x.27 19x.x.x.47, The ports on the PIX are opened for both servers.

No static port has been assigned within the Exchange server itself to force it to use the same port for incoming and outgoing.

An Establish command has been entered for the port translations that Exchange does from 1024-65535.

Thanks for any helo

 

[berford]

Check to see whether Outlook tries to create an SSL session between server and client in order to secure the password exchange. If so, you'll need to open the appropriate SSL ports.

 

[kef65]

Thanks

SSL is not installed on the server just yet.

Could it be one of these?
Force Exchange to use a port?
or add DNS/WINS entries to the PIX. Which I'm not quite sure how to do.

kef