asked on

Setting Mail and Mail Gateway servers on PIX515e

I have a PIX 515 Firewall. I am setting up an exchange server and need to send and receive e-mail thru a mail gateway. How do I allow traffic to and from the mail server thru the mail gateway. I also need to allow web-mail service. Thank you.

Setting Mail and Mail Gateway traffic on PIX515

I already did the following commands

pixfirewall#config term
pixfirewall(config)#static (inside,outside) tcp <public ip> 25 <mail_gateway ip> 25 netmask 255.255.255.255
pixfirewall(config)#access-list inbound_mail permit tcp any host <public ip> eq 25
pixfirewall(config)#access-group inbound_mail in interface outside
pixfirewall(config)#no fixup protocol smtp 25
pixfirewall(config)#clear xlate
pixfirewall(config)#exit
pixfirewall#

td_miles

where is the mail gateway ?

how does the mail gateway communicate with your mail server (is it just SMTP) ?

The way I understand what you are saying, the mail gateway is going to send/receive all the email to/from the Internet. In this case, your configuration above seems fine. You need to configure EXCH to forward all emails outbound to the gateway & you need to configure the gateway to send all emails inbound to EXCH (after it has checked them and verified that they are valid of course).

Are you going to use OWA for webmail ?

delsof

ASKER

Thanks for replying.

The mail gateway is behind the firewall. The mail gateway and the mail server communicate via SMTP.

My current configuration is exactly as you mention it above. The "mail gateway is going to send/receive all the email to/from the Internet" and foward them to the EXCH server and viceversa for outbound emails. Thus, the above configuration is correct?

Yes, we are planning to use OWA from the EXCH server. Please advice.

DF

Tim Holman

The above config looks fine. Although you may need to reboot as well, as there is a known bug with some versions of PIX.
Also DISABLE mailguard. It will upset Exchange.

td_miles

If you want to enable OWA, then you need to setup a static NAT to port 80/443 for the EXCH server. I would advise ONLY using port 443 (ie. SSL) and then educating your users that they need to type "https://....."

To setup the NAT, it is same as you have already done for SMTP, just change the ports.

It's been a while since I looked into any potential security issues from OWA, so you may want to have a search/read about this prior to using OWA.

delsof

ASKER

td_miles,

Should OWA settings looks like this?

pixfirewall#config term
pixfirewall(config)#static (inside,outside) tcp <webmail public ip> 443 <exch ip> 443 netmask 255.255.255.255
pixfirewall(config)#access-list inbound_mail permit tcp any host <webmail public ip> eq 443
pixfirewall(config)#access-group inbound_mail in interface outside
pixfirewall(config)#no fixup protocol https 443
pixfirewall(config)#clear xlate
pixfirewall(config)#exit
pixfirewall#

Thanks. DF

delsof

ASKER

td_miles,

In addition, I am in the process of converting security policies from a Checkpoint platform to Cisco Pix platform using the PDM. Any ideas.

DF

td_miles

The lines in the config are correct to allow port 443 through to the exchange server. One line that you don't need is:

> pixfirewall(config)#no fixup protocol https 443

It is only for SMTP that you need to remove the fixup. Most other protocols it doesn't cause any issues.

----

> In addition, I am in the process of converting security policies from a Checkpoint platform to Cisco Pix platform using the PDM. > Any ideas.

I assume that you are asking about automated solutions to convert from one to the other ? Not that I know of. Having a well documented security policy (in English with diagrams) means that it can then be implement on whatever platform you choose.

delsof

ASKER

Thanks td_miles,

I don't have a lot of policies in my checkpoint server. I am looking to transport the policies manually by reading the policies on checkpoint and realize what field goes where in the PDM.
For example,
checkpoint has the following fields:
Source-Destination-If VIA-Service-Action-4 more
Any -Any -Any -tcp http-accept-

Notice service got two set of information. How can I translate this to PDM?

Thx. DF

ASKER CERTIFIED SOLUTION

td_miles

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial