OWA and Remote Desktop Web Connection on 506E

[mikevogt]

Hi all,

I have been scanning the site lately to get tips on setting up my Pix 506E, but have run into a bit of a wall.

Here's the scene: My network has an Exchange server inside the firewall (using NAT) as well as a Terminal Server (NAT as well). We have one outside IP. Here is what I want to do:

I need Outlook Web Access (port tcp 80?) - not working presently.

Remote Desktop Web Connection (port tcp 3389?) accessable to the internet - not working presently.

I need email to flow to and from the Exchange Server - should it work?

Here is my config:

xxx(config)# show conf
: Saved
: Written by enable_15 at 06:02:50.806 UTC Wed Sep 14 2005
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxx encrypted
passwd xxx encrypted
hostname xxx
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
pager lines 21
mtu outside 1500
mtu inside 1500
access-list inside_ping permit icmp any any echo-reply
access-list inside_ping permit icmp any any time-exceeded
access-list inside_ping permit icmp any any unreachable
access-list outside_email permit tcp any host x.x.x.x eq smtp
access-list outside_web permit tcp any host x.x.x.x eq http
ip address outside x.x.x.x 255.255.255.0
ip address inside 10.0.0.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) tcp interface smtp 10.0.0.11 smtp netmask 255.255.255.255 0 0
static (inside,outside) tcp interface http 10.0.0.8 http netmask 255.255.255.255 0 0
access-group outside_mail in interface outside
access-group outside_web in interface outside
access-group inside_ping in interface outside
route outside 0.0.0.0 0.0.0.0 z.z.z.z 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 10.0.0.30-10.0.0.100 inside
dhcpd dns 10.0.0.8
dhcpd wins 10.0.0.8
dhcpd lease 3600
dhcpd ping_timeout 750
dhcpd enable inside
terminal width 80

Any help is greatly appreciated! I am trying to replace a very old Sonicwall with this Pix.

Mike

 

[dkraut2]

you don't need an access list for outbound access unless you want to limit outbound access to only specific protocols, IP, etc.? By default, all outbound access is allowed.
Do you only have a single external public IP address or a range? This would affect how you would setup the statics...

 

[mikevogt]

Re: outbound access... are you talking about the inside_ping list? I was under the impression that you needed that to allow pings from the inside network out and the replies back in?

Re: public IP address... I do only have one single external public IP address.

 

[dkraut2]

never mind my comments on the access lists... I read them wrong.

I would create a single access-list for inbound access and specifiy the outside address for the static >

access-list outside_in permit icmp any any echo-reply
access-list outside_in permit icmp any any time-exceeded
access-list outside_in permit icmp any any unreachable
access-list outside_in permit tcp any host x.x.x.x eq smtp
access-list outside_in permit tcp any host x.x.x.x eq http

access-group outside_in in interface outside

static (inside,outside) tcp x.x.x.x smtp 10.0.0.11 smtp netmask 255.255.255.255

static (inside,outside) tcp x.x.x.x

http://www 10.0.0.8

http://www netmask

255.255.255.255

 

[mikevogt]

Thanks for you help dkraut2. Having the single list for inbound access is to keep things simpler, correct?

Should this allow the OWA and Remote Desktop Web Connection to work?

Again, thanks for the help... I really appreciate it!

Mike

 

[colinT23]

Hi,

Have alook here for ports required for OWA, RWW, RDC etc..

http://www.smallbizserver.net/Default.aspx?tabid=36

Not sure if you're running an SBS server or standalone Exchange server but the principles will be the same (incidentally, OWA requires port 443 to be forwarded to the SBS/Exchange server).

Regards Colin.