Accessing OWA on ISA through PIX 515

[ddunk0077]

Hi

Having a problem trying to access Outlook Web Access through a ISA server. On the firewall i have this configured:

access-list outside_access_in permit tcp any host 12.30.111.204 eq smtp

access-list outside_access_in permit tcp any host 12.30.111.204 eq www

then the static one to one:

static (inside,outside) 12.30.111.204 192.168.1.74 netmask 255.255.255.255 0 0

Is there more needed to allow the PIX to pass the traffic?

Thanks...

[ehirsel]

Here is an MS KB article detailing OWA, exhcange, and firewall ports and other config info.

http://support.microsoft.com/default.aspx?scid=kb;en-us;259240

You need to open port 135 and maybe allow udp to flow thru as well.

Are the clients coming in from parts of your network only, or can they connect from anywhere? If anywhere, then you want to look at the vpn client solution to protect the traffic.

I would also do searches on MS or Cisco's site relating to OWA, in particular key in on UDP/RPC and see if any other ports may need to be opened.

[assad2000]

Hi:

The only ports that should be opened in order for Internet explorer to access OWA server are 80 and 443. The SMTP port also should be opened to send and receive emails but it will not be used by OWA.

You should never open port 135 (RPC) of any server to the public, I think the MS article that ehirsel is referring to , is how to configure a firewall that is located between OWA server and another Exchange server which is not your case.

regards;

[ehirsel]

Yes, I did make a mistake on my prior posting.

Are the users who are wanting to access OWA needing to be authenticated to the firewall before accessing the OWA server? If so, then the pix needs to be enabled for proxy authentication, and the pix will need to see the ISA server as a Radius or tacacs+ (AAA) server.

This link is the pix 6.3 command ref doc:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/ab.htm#wp1111727

Look at the aaa authentication command for more detail. Let me know if this helps.