Outlook times out connecting to server through CISCO PIX firewall

Posted on 2008-11-05
Last Modified: 2012-05-05
I got a problem with Outlook getting stuck/disconnections when connected to
MS Exchange (intermittant).  There's a Cisco PIX 535 firewall (software version 7.22) in between the users and exchange & domain controllers.
I noticed that I could sometimes replicate the problem when clicking on address book or new mail
and clicking on "TO". I found that outlook is connecting to DC(global catalog) to retrieve
address book entries at the time of the problems. Clicking on reconnect (on outlook icon)
or closing and opening outlook solves the problem. All other client applications work with
no problems so the problem only exists with MS Outlook.  I managed to capture the problem using Ethereal - I noticed that when the issue occurs there are 'DCERPC TCP RETRANSMISSIONS'.  DCERPC inspection is NOT enabled on the PIX firewall.

Any advice would be greatly appreciated.

Question by:15moorgate
    LVL 79

    Assisted Solution

    Are you using https exchange proxy in outlook?

    Author Comment

    No, we are not using https.   We tried https and found that outlook still intermittantly freezes but you don't get the outlook ballon with the explanation symbol.
    LVL 79

    Assisted Solution

    Which ports are you forwarding on the PIX?
    Here's a good document on enabling RPC over HTTPS on Exchange 2003
    Then all you have to port-forward on the PIX is https/443

    And a Microsoft troubleshooting guide

    Author Comment

    Sorry for delay on this question. The issue is still ongoing and we have done additional testing with users. If we replace FW between users with SW, the problem does not materialise.

    Will provide further feedback soon.

    Accepted Solution

    Thank you for the feedback.
    I have since realised that the problem is definetely caused by the PIX firewall.  I opened a Cisco TAC case and after running some DCERPC debug and capture traces, Cisco confirmed that PIX was dropping non-epm uuid bind connections.  I still have the TAC case open with Cisco and the case has been escalated to their developers.
    LVL 79

    Expert Comment

    Thanks for the update. Please post back if they ever get a solution.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    Learn more about how the humble email signature can be used as more than just an electronic business card. When used correctly, a signature can easily be tailored for different purposes by different departments within an organization.
    Outlook Free & Paid Tools
    Get people started with the process of using Access VBA to control Outlook using automation, Microsoft Access can control other applications. An example is the ability to programmatically talk to Microsoft Outlook. Using automation, an Access applic…
    To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…

    732 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now