OWA with Cisco PIX 515..Help

[cant]

We just installed Exchange 2000 this weekend with the OWA (Outlook Web Access) option. OWA works fine from inside our network. On the outside of our Cisco PIX 515 Firewall we cannot connect to the OWA, Port 80 is open. users can send and receive e-mails from out side. any ideas, please help.
thanks

 

[DefinityCorporation]

Are you using one outside/ one inside; or are you using a DMZ? Are you using NAT, PAT, Static, or conduit for your http? I am not sure what port the OWA authentication uses but I would go the easy way and launch PDM Log in debugging mode on pix and hit it from the outside and see what is denied. If nothing comes up check the logical structure of your network. If you use fully qualified IP's on a dual subnet server then you might check what IP's your services are listening on.

 

[cant]

we are a nat command to resovel a buplic IP address to an internal one.
if i ping the public one from outside the network, it will time out.
but we are still getting our e-mails.
we have DMZ, but still not activated, nothing is attached to it yet.
this the only thing i can tell you.

 

[globalstrata]

I am not sure if this will help you, but we had similar problem (although we do not use a PIX) due to NAT so what we did was assign two ports to the default web site (ie: 8888) and from outside, we connect as

http://mail.server.com:8888/exchange

and it worked. I have not gotten the chance to find out why yet.

Gladys I. Rodriguez
GlobalStrata Solutions Inc.

http://www.globalstrata.com

 

[globalstrata]

I forgot to tell you that I think OWA uses other ports besides 80. At least Exchange 5.5 use 389 to but again, I have not gotten time to test yet.

Hope this helps.

 

[Zelandakh]

you only need port 80 open into the server.

Have you tried a statis inside,outside mapping?

 

[cant]

i read this microsoft article, and am not sure if i understand anything.
i am not sure if i want to open all of these ports.

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q280132

 

[Zelandakh]

I have a Pix 515 with ONLY 25 and 80 open. It works...

 

[cant]

thanks for the tip, but my question is, how can i determine if i have a statis inside,outside mapping.
am not a cisco expert, but i can go and check the configurations.
what statment i should find.
thanks for the help.

 

[brontosaurus]

get into privileged mode and run "show static"

 

[cant]

this is what i have, and i do not know if its the right settings.

static (inside,outside) tcp 217.94.14.221

http://www 10.0.0.100

http://www netmask

255.255.255
.255 0 0
static (inside,outside) tcp 217.94.14.221 44965 10.0.0.100 44965 netmask 255.255
.255.255 0 0
static (inside,outside) tcp 217.94.14.222 smtp 10.0.0.103 smtp netmask 255.255.2
55.255 100 0
static (inside,outside) tcp 217.94.14.222 pop3 10.0.0.103 pop3 netmask 255.255.2
55.255 100 0
static (inside,dmz) 10.0.0.0 10.0.0.0 netmask 255.255.255.0 0 0

thanks,

 

[beastie]

The following are the exact statements you need if your mail server lives on the private segment:

static (inside,outside) <public IP & MX record> <private IP of mail server> netmask 255.255.255.255 0 0

conduit permit tcp host <public IP> eq smtp any

conduit permit tcp host <public IP> eq 443 any

Couple things...the third statement is refers to port 443. Change it to port 80 if you wish but I highly recommend using SSL. You can install certificate server on your mail server and know that it will work. If you choose to not encrypt authentication and messages and simply want to use port 80, replace the third statement with the following:

conduit permit tcp host <public IP> eq

http://www any

You can also get into using access-list statements instead of conduits. In your example I do not see any conduits or access-lists so I am not sure if you just failed to include them or are missing them all together. Hope this helps. I know it will work.

 

[Zelandakh]

hey, welcome newbie Beastie - nicely put.

Only thought is that the static mapping lists 0 0 at the end - wouldn't you be better off using like 1000 500 to limit embryonic and simultaneous connections to minimise problems?

 

[beastie]

Great point Zelandakh. As quoted from Cisco:

&quot;To avoid letting applications overwhelm your maximum number of connections, it is very important to always use the connection limit and embryonic limit options with the mailhost, nat, and static commands.&quot;

Cheers,

Mike