Pix 506e config for OWA

[hmcgillem]

Can someone please help me with what I need to add to my PIX to allow OWA access?

 

[KiscoKid]

OWA uses HTTP (TCP port 80) - ie it looks just like standard web traffic.

You just need a line similar to the following added to your existing access list:


access-list outsidein permit tcp a.b.c.d w.x.y.z eq 80

where a.b.c.d is the internal Exchange server
and w.x.y.z is the client trying to access it

 

[Supergrrover]

If you have OWA with SSL, add port 443 to that.

You will need a static to point to your inside server as well.

static (inside,outside) tcp ExternalIP 80 InternalIP 80 netmask 255.255.255.255
static (inside,outside) tcp ExternalIP 443 InternalIP 443 netmask 255.255.255.255
access-list outside_in permit tcp any ExternalIP eq 443
access-list outside_in permit tcp any ExternalIP eq 80
access-group outside_in in insterface outside

With this you can also setup RPC via HTTPS without any changes to the firewall.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[hmcgillem]

Thank you both KiscoKid and Supergrrover! This is exactly what I needed!! I was doing it right to begin with, but for some reason the Pix didn't want to accept the changes. It took the changes this morning! Thanks!

 

[mdcr]

KiscoKid,
In your post you have stated at the bottom:
"and w.x.y.z is the client trying to access it"
What if that address is everyone? Meaning, when we set up OWA, we want everyone to be able to access it. We have a similar statement in our config that may need to be changed, because our OWA is not working from the outside currently:
"access-list acl_in permit tcp any host 192.168.x.x eq www"
Should we change the

http://www to

80? and is it that w.x.y.z needs to be the external address associated with that internal address (NAT)? Thanks in advance!