Avatar billede kbb2 Nybegynder
09. april 2001 - 11:39 Der er 1 kommentar og
1 løsning

PIX and Microsoft Exchange

Hi!

I have a problem in my setup with my PIX firewall and Microsoft Exchange.

I have a pix515 UR with an Outside, DMZ and Inside interface. The config is as follows:

Outside
- no servers on the outside

Dmz1
- WinNT 4 - Microsoft Exchange

Inside
- WinNT 4 - PDC
- Outlook clients

When I recieve a mail, Outlook normally would say \"You have new mail\", but I have to manually check for mail myself in order to get mail. This is because the PIX dosen\'t allow the Exchangeserver to make connections to the clients on the inside. My question is how I allow that so my users won\'t have to manually check for mail all the time. Below is a list of commands that I have tried to enter into the PIX.

name 129.142.128.230 mailserver_outside
name 192.168.0.21 mailserver_dmz1
name 192.168.0.20 pdc_dmz1
name 192.168.100.20 pdc_inside

conduit permit tcp host mailserver_outside eq smtp any

conduit permit tcp host pdc_dmz1 eq 139 host mailserver_dmz1
conduit permit udp host pdc_dmz1 eq netbios-ns host mailserver_dmz1
conduit permit udp host pdc_dmz1 eq netbios-dgm host mailserver_dmz1

static (dmz1,outside) mailserver_outside mailserver_dmz1 netmask 255.255.255.255 0 0
static (inside,dmz1) pdc_dmz1 pdc_inside netmask 255.255.255.255 0 0

I sure hope somebody can help me. I\'ve visited Ciscos homepage and they explain something about having 2 Winnt servers and they also use Wins, but their example does not include a DMZ. I would prefer NOT using Wins, since I don\'t no much about it.
Avatar billede victor44 Nybegynder
09. april 2001 - 12:47 #1
You have a big problem, Your MS exchange server insists in responding to port 137 and if your connection to the DMZ is made by NAT it cant respond to the original source port from the asking maskine at your LAN.
The best solution imho. is to make a smpt proxy/relay.
Or you can make a (Dangerous) route between your LAN and DMZ.

That\'s the reason ;-)

If you want more info you are welcome to contact me by email.
Avatar billede svindler Nybegynder
12. april 2001 - 22:58 #2
A few details on the victor44s answer:
The pdc is NOT related to the mail communication between exchange and the outlook clients, except for the user authentication. The conduits you have specified are VERY dangerous.
As Victor44 states you need to allow a dangerous connection from mailserver to the clients, as you have already done for the pdc.
Then you also need to add a static that covers all the clients.
A better solution is, again as victor44 states, to throw in a cheap pc with linux or freebsd and configure it as mail relay.

The easiest solution is to lower the automatic polling interval in Outlook.
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester