Router Config for MS Exchange

[noufibrahim]

Hello,

I have a problem sending/receiving email through exchange sever outside the office network (Externally) I have already forwarded the following ports to my exchange server 25 - 26 - 80 - 110 - 143 - 443. but it's still wont work.

the internet however is working fine.

Before i use cisco 1921,I used to use a linksys router with the same ports opened and it's working fine.

Thank you in advance!

[Peter Paluch]

Hi,

Is it possible to post your configuration after removing the sensitive information (passwords, exact IP addresses)? It is hard to diagnose a problem while knowing nothing about your configuration.

You are saying that from an internal network, you are unable to communicate with an external Exchange server under its external configuration. Do I understand it correctly?

Best regards,
Peter

[noufibrahim]

Hi Peter,

I appreciate your reply.

what i mean is i'm only able to send/receive internally. but cannot send/receive externally "outside our domain"

the configs attached below.

[Mohammed al Baqari]

Hi,

Your config looks correct. However, I think this is related to per-port NAT. Why don't you allow all ports in one nat statement. If you are worried about security you can use ACLs later after getting things working to limit ports.

For example, I can see that you are missing some ports in your nat like SMTP Submission (TCP 587), Secure SMTP Submission (TCP 465), Secure POP3 (993), Secure IMAP (995).

[noufibrahim]

Hi Mohammed!

thank your for responding.

can you show me how to do so in one nat statement?

[noufibrahim]

Hi Mohammed,

I opened the three missing ports & added at the end 

ip nat inside source static     Exchange.Local.IP.x       Static.Public.IP.x

& still no luck.

[Terence Payet]

Hi,

Did you check your NAT table?

Regards,

Steve

[noufibrahim]

Hi Terence,

Yes! nothing is wrong there.

now I am able to receive and send emails (internal & external ones) as long as i'm connected to the office network.

but when I try from a 4G connection i can't access my email from OWA or outlook.

[Terence Payet]

Hi,

check your translation table to see if your exchange server is getting NAT to public by issuing the below command:

# sh ip nat translation

if it's there, you can do a debug ip packet with an access-list as per below:

(please make sure your router cpu is below 10% before doing the debug)

# access-list 101 permit ip host 'exchange server' any

# access-list 101 permit ip any host 'exchange server'

# terminal monitor

# debug ip packet 101

or if you want to be more granular, configure an access-list with the predefined ports.