Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

How do I use Cisco Pix Devise Manager to create rules to allow mail to come to my Exchange 2003 Server

Posted on 2004-09-30
11
Medium Priority
?
278 Views
Last Modified: 2013-12-03
I have a Cisco Pix Firewall 506 and would like to use the Cisco Pix Devise Manager to configure it to allow Exchange 2003 mail to pass through.  How can I do this?

Thanks,
Randy
0
Comment
Question by:rmefford
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 3
  • +2
11 Comments
 
LVL 6

Expert Comment

by:vand
ID: 12193983
Hate to give just URL's, but, this is pretty involved.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v50/config/msexchng.htm

Hope this helps!
0
 
LVL 6

Expert Comment

by:vand
ID: 12194018
In anticipation of any future issues, here is another good article.

http://support.microsoft.com/default.aspx?scid=kb;en-us;q320027
0
 
LVL 79

Accepted Solution

by:
lrmoore earned 2000 total points
ID: 12194352
Much simpler to create a text command in notepad and drop it into the Command Line Tool of the PDM. Using the PDM is actually quite confusing..

Else, the steps involve
- create static port map to map port 25 from interface public IP to private IP
   static (inside,outside) tcp interface 25 192.168.1.100 25
- create inbound access-list to permit inbound port 25
   access-list inbound permit tcp any interface outside eq 25  <== note you must be using 6.3x to use "interface" in the acl
- bind the acl to the interface
   access-group inbound in interface outside
- turn off fixup
   no fixup protocol smtp 25

Using PDM:
- Configuration
- Access Rules
   - new rule
      Action: permit
        source host/network
           interface Outside
           ip add: 0.0.0.0
           Mask:   0.0.0.0
        Destination host/network
            interface inside
            ip add: 192.168.1.100
            mask: 255.255.255.255
        Protocol and Service (*) TCP, source port Service = any
                  Destination port Service = smtp
     - click OK, and you get a prompt "No static Network Address Translation (NAT) rule is configured ....
         - click OK
            NAT tab, chose (*)static     <ip address>(interface PAT)
          - click OK
        -click OK again
        - click Apply
      - Click Save
Then go into configuration | system properties
  + Advanced
       + fixup
           * SMTP  - click "delete" button
     Click    Apply
    - click Save

DONE
       
       





0
Are You Ready for GDPR?

With the GDPR deadline set for May 25, 2018, many organizations are ill-prepared due to uncertainty about the criteria for compliance. According to a recent WatchGuard survey, a staggering 37% of respondents don't even know if their organization needs to comply with GDPR. Do you?

 

Author Comment

by:rmefford
ID: 12194362
Thanks for the help, but that doesn't really discribe how to use create a new rule with the device manager.  Also that example is if I am going to have a second server outside my firewall.  I am not.  I will have just the Exchange Server on the inside.  Am I missing something?  Please help.

Randy
0
 

Author Comment

by:rmefford
ID: 12194373
I will try that, thanks everyone.
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12195287
We must have hit submit at the same time...  hehe..
0
 
LVL 2

Expert Comment

by:peteysa
ID: 12197158
Quick tip,

if you are using only 2 interfaces your static command do not require you to specify insde,outside in your command line.  Helps expediting programming the pix via commandline.  

static insideip outsideip

Cheers!

Dan
0
 
LVL 6

Expert Comment

by:vand
ID: 12201053
Hey rmefford,  

The link is Cisco's suggestion on how to make Exchange work across a PIX firewall.  If all your looking for is port forwarding, Irmoore described that.
0
 

Author Comment

by:rmefford
ID: 12203721
Thanks for the help, is that the only port I need to open to get my exchange server mail working?  I can send out but have not been able to receive an email in yet.
0
 
LVL 3

Expert Comment

by:oldhamuk
ID: 12204878
Hi,

You only need two commands to get this working.  Go to the CLI command input in the PDM and enter these commands. The third command is incase you have switched of the fixup for smtp.

Replace 192.168.0.1 with your public ip on the firewall and 10.0.0.1 with your internal ip of the exchange server.

access-list 101 permit tcp any host 192.168.0.1 eq smtp
static (inside,outside) tcp 192.168.0.1 smtp 10.0.0.1 smtp netmask 255.255.255.255 0 0
fixup protocol smtp 25

I know this works as I use it all the time with my customers.

Any questions please let me know.

Regards

Mark
0
 
LVL 79

Expert Comment

by:lrmoore
ID: 12204960
> out but have not been able to receive an email in yet.
Did you disable the fixup protocol smtp 25?
You MUST do this step.
0

Featured Post

On Demand Webinar: Networking for the Cloud Era

Ready to improve network connectivity? Watch this webinar to learn how SD-WANs and a one-click instant connect tool can boost provisions, deployment, and management of your cloud connection.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you’re involved with your company’s wide area network (WAN), you’ve probably heard about SD-WANs. They’re the “boy wonder” of networking, ostensibly allowing companies to replace expensive MPLS lines with low-cost Internet access. But, are they …
This article explains the fundamentals of industrial networking which ultimately is the backbone network which is providing communications for process devices like robots and other not so interesting stuff.
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…
Suggested Courses

670 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question