Outlook web access over pix firewall

[jeric_saldua]

Hi Firewall Guru,

Anybody here can help me to set-up my cisco firewall to work for external outlook web access.I have changed some parameters and make it run internally.. however I can not access it externally.

This means, when I open outlook web access on our lan it works, but when I try to open it via internet ISP I can't open it.. "page can not be found"

Pls advice how did you resolved it thru pix firewall configuration if any of you encountered the same.

Any help is greatly appreciated.

Best Regards,

Jeric

[froggy3132000]

post your config

[jeric_saldua]

Hi,

pls find attached files.. hope you can help me on this.. right now.. i dont have problem on my internet, everything is ok.. mail server is ok.. when I access outlook web access internally no problem as well, my only problem is I can not open it outside our network.. but i can ping it from the outside.. which means the public ip address for my mail server is reachable from the outside.

hope you can help me on this.

regards,

jeric

[a.alekseev]

pls add the following

access-list ACL_OUT permit tcp any host 2xx.1xx.xxx.xx6 eq 443

ip address outside 2xx.1xx.xxx.xx6 255.255.255.252

static (inside,outside) tcp interface 443 192.168.1.4 443 netmask 255.255.255.255 0 0

access-group ACL_OUT in interface outside

[jeric_saldua]

Hi,

thanks so much for your prompt response..I follow your suggested changes and tested it.. however it still not working..

pls check the config below.

names

name 192.168.1.4 inside_mail_server

access-list 101 permit ip 192.168.1.80 255.255.255.240 any

access-list 101 permit ip any 192.168.1.80 255.255.255.240

access-list ACL_OUT permit tcp any host 2xx.1xx.1xx.2xx eq smtp

access-list ACL_OUT permit tcp any host 2xx.1xx.1xx.2xx eq pop3

access-list ACL_OUT permit tcp any host 2xx.1xx.1xx.2xx eq https

access-list ACL_OUT permit tcp any host 2xx.1xx.1xx.2xx eq www

access-list ACL_OUT permit tcp any host 2xx.1xx.1xx.2xx eq 135

access-list ACL_OUT deny udp any any eq 1214

access-list ACL_OUT deny tcp any any eq 5000

access-list ACL_OUT deny tcp any any eq 11999

access-list ACL_OUT deny udp any any eq 5010

access-list ACL_OUT deny tcp any any eq 1214

access-list ACL_OUT deny tcp any any eq 1863

access-list outside_cryptomap_dyn_30 permit ip any 192.168.1.80 255.255.255.240

pager lines 24

ip address outside 2xx.1xx.1xx.2xx 255.255.255.252

ip address inside 192.168.1.1 255.255.255.0

ip verify reverse-path interface outside

ip verify reverse-path interface inside

ip audit info action alarm

ip audit attack action alarm

ip local pool VPN_POOL 192.168.1.81-192.168.1.94

global (outside) 1 interface

nat (inside) 0 access-list 101

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) tcp interface smtp inside_mail_server smtp netmask 255.2

55.255.255 0 0

static (inside,outside) tcp interface pop3 inside_mail_server pop3 netmask 255.2

55.255.255 0 0

static (inside,outside) tcp interface https inside_mail_server https netmask 255

.255.255.255 0 0

access-group ACL_OUT in interface outside

Hope you could guide on how to resolve it.. additional information. I use 1 ip address only for outside xlation at the same time am using it for static mapping for my mail server inside.

I will look forward for your kind response.

Thank you so much.

Jeric

[a.alekseev]

Did you try "clear xlate" after making some changes?

[jeric_saldua]

Hi,

I did. but still page can not be displayed.

Thanks,

jeric

[a.alekseev]

How did you check it?

[jeric_saldua]

Hi,

My collegue is working at home and he is the one who is testing it. he test it by doing this > open internet explorer and on the address bar he type http:2xx.1xx.xxx.xx6/exchange (ip address for outlook web access). "page can not be displayed" . But he can ping the ip address.

Thanks for your kind assistance, I really appreciate your help.

Regards,

Jeric

[a.alekseev]

use HTTPS

https://2xx.1xx.xxx.xx6/exchange

[jeric_saldua]

Hi,

thanks again for your prompt response.. I just try it but to no avail. same error...

regards

jeric

[a.alekseev]

could you show

"sh access-list ACL_OUT"

do you see any macthes for "access-list ACL_OUT permit tcp any host 2xx.1xx.xxx.xx6 eq https"?

[jeric_saldua]

Hi,

There's matches, but I think the matches came from internal users who access it on our LAN.

pls check below.

Firewall# sh access-list ACL_OUT

access-list ACL_OUT; 11 elements

access-list ACL_OUT line 1 permit tcp any host 2xx.1xx.xxx.xx6 eq smtp (hitcnt=4

71)

access-list ACL_OUT line 2 permit tcp any host 2xx.1xx.xxx.xx6 eq pop3 (hitcnt=0

)

access-list ACL_OUT line 3 permit tcp any host 2xx.1xx.xxx.xx6 eq https (hitcnt=

19)

access-list ACL_OUT line 4 permit tcp any host 2xx.1xx.xxx.xx6 eq www (hitcnt=0)

access-list ACL_OUT line 5 permit tcp any host 2xx.1xx.xxx.xx6 eq 135 (hitcnt=0)

access-list ACL_OUT line 6 deny udp any any eq 1214 (hitcnt=0)

access-list ACL_OUT line 7 deny tcp any any eq 5000 (hitcnt=0)

access-list ACL_OUT line 8 deny tcp any any eq 11999 (hitcnt=0)

access-list ACL_OUT line 9 deny udp any any eq 5010 (hitcnt=0)

access-list ACL_OUT line 10 deny tcp any any eq 1214 (hitcnt=0)

access-list ACL_OUT line 11 deny tcp any any eq 1863 (hitcnt=0)

thanks

[a.alekseev]

on 192.168.1.4 could you show

"ipconfig /all"

[jmia]

Jeric,

Q. On your internal exchange server have you created a CA (Certificate Authority) for SSL authentication? As traffic is reaching your outside interface of pix for port 443.

And I presume you have the apporiate static translation setup for this traffic?

Jay