Hello,
An odd problem suddenly appeared last week that affected remote clients using Outlook to connect back to our corporate Exchange 2003 server. All these clients were behind Cisco routers that were running either the CBAC or zone-based IOS firewall.
The problem was that upon launching the Outlook client on the remote PC, the client would not be able to connect the Exchange server. Using Wireshark I was able to see that there was some kind of problem with the tcp/1720 session that's created during the Outlook launch process... this session just wouldn't progress much passed the three-way handshake... it was as if the server was no longer hearing the client.
After doing some reaserch I learned that this port is used by h323 call setup, and since the problem was only affecting remote clients, we looked closer at their site routers. On a hunch, I decided to remove the ip inspect name FIREWALL h323 line from the config for one site as a test. This was found to resolve the problem on this router and the others where the CBAC IOS firewall is used. On the other routers where the ZBF is employed, I simply removed the match protocol h323 line from the appropriate class-map.
What's really puzzling me, is that we cannot figure out why this has suddenly come up! The routers configs haven't changed and neither have the Outlook clients or Exchange server. What's even more weird is that the problem didn't actually occur at all sites at the same time... it affect some sites on one day, and then the next day it spread to other sites, etc.
I believe we've band-aided it for now, but it would be nice to know exactly what happened and why. Any insight or suggestions you can provide would be really helpful.
Thanks for reading this and have a great day!
John
