ginnipig41
asked on
RPC over HTTP Pix firewall troubles
Our company is trying to enable RPC over HTTP on our SBS. I have the HTTPS portion working internally but as soon as I move to an external network Outlook isn't able to connect any longer. I am guessing this has to do with our Pix firewall and the settings there. I have went through several of the troubleshooting questions here and tried different settings on the pix but can't get it to work. I can access https://mail.ourserver.com with a web browser externally and internally with no problems so I don't know where the issue could be.
PIX Version 6.2(2)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password *
passwd *
hostname firewall
domain-name *.org
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol ils 389
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list 80 permit ip 10.10.0.0 255.255.0.0 192.168.1.0 255.255.255.0
access-list acl_out permit tcp any host ourserver eq smtp
access-list acl_out permit tcp any host ourserver eq www
access-list acl_out permit tcp any host ourserver eq https
access-list test permit esp any any
access-list test permit udp any any eq isakmp
pager lines 24
logging console debugging
logging buffered debugging
logging queue 0
interface ethernet0 auto
interface ethernet1 auto
mtu outside 1500
mtu inside 1500
ip address outside ouripaddy1 255.255.255.192
ip address inside 10.10.10.1 255.255.0.0
ip audit info action alarm
ip audit attack action alarm
ip local pool nirsa-pool 192.168.1.1-192.168.1.10
pdm history enable
arp timeout 14400
global (outside) 1 ouripaddy2 netmask 255.255.255.192
nat (inside) 0 access-list 80
nat (inside) 1 10.10.0.0 255.255.0.0 0 0
static (inside,outside) ourserver 10.10.80.2 netmask 255.255.255.255 0 0
access-group acl_out in interface outside
route outside 0.0.0.0 0.0.0.0 204.13.8.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt security fragguard
sysopt connection permit-ipsec
sysopt ipsec pl-compatible
no sysopt route dnat
crypto ipsec transform-set nirsa esp-3des esp-sha-hmac
crypto dynamic-map nirsa-dynamic 5 set transform-set nirsa
crypto map nirsa 20 ipsec-isakmp dynamic nirsa-dynamic
crypto map nirsa client configuration address initiate
crypto map nirsa interface outside
isakmp enable outside
isakmp key ******** address 0.0.0.0 netmask 0.0.0.0
isakmp client configuration address-pool local nirsa-pool outside
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption 3des
isakmp policy 1 hash sha
isakmp policy 1 group 1
isakmp policy 1 lifetime 86400
isakmp policy 5 authentication pre-share
isakmp policy 5 encryption 3des
isakmp policy 5 hash sha
isakmp policy 5 group 2
isakmp policy 5 lifetime 86400
vpngroup nirsa address-pool *-pool
vpngroup nirsa dns-server 10.10.80.2
vpngroup nirsa wins-server 10.10.80.2
vpngroup nirsa default-domain *.org
vpngroup nirsa split-tunnel 80
vpngroup nirsa idle-time 1800
vpngroup nirsa password ********
telnet 192.168.1.0 255.255.255.0 outside
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh 64.215.252.0 255.255.255.248 outside
ssh 67.250.103.45 255.255.255.255 outside
ssh timeout 60
terminal width 80
Cryptochecksum:*
: end
The certificate refers to https://mail.ourserver.com yes and not an internal name?
You didn't remove all of your passwords. I have hit request attention to get a mod to remove the enable password at the top of your config file.
If OWA works on port 443, it isn't the firewall at fault. RPC over HTTPS goes straight through the PIX. I know as I have been using one for years.
Did you run the Configure Email and connect to the internet wizard to enable the Outlook over the Internet feature (as that is what SBS 2003 calls it).
If you did, I would suggest creating a test account and then using the Microsoft test site to confirm if it is working correctly or not: https://testexchangeconnectivity.com/
Simon.
If OWA works on port 443, it isn't the firewall at fault. RPC over HTTPS goes straight through the PIX. I know as I have been using one for years.
Did you run the Configure Email and connect to the internet wizard to enable the Outlook over the Internet feature (as that is what SBS 2003 calls it).
If you did, I would suggest creating a test account and then using the Microsoft test site to confirm if it is working correctly or not: https://testexchangeconnectivity.com/
Simon.
ASKER
Raghuv - I can confirm that on my account here that I get HTTPS all the way down with no TCP/IP. I spent a day getting it to work internally now it is time to move it outside our network since that is where the real benefit is for our users.
shauncrocher- The certificate is generated by our CA here in the office and it does match our MX record. The only error I get when accessing the https: is that the certificate isn't from a trusted provider. Which doesn't matter since I will setup the certificate manually on the laptops.
Mestha - I saw you post that link in another Pix thread so I tried it and everything tests fine except the certificate since it is from an unknown provider since our CA generated it.
shauncrocher- The certificate is generated by our CA here in the office and it does match our MX record. The only error I get when accessing the https: is that the certificate isn't from a trusted provider. Which doesn't matter since I will setup the certificate manually on the laptops.
Mestha - I saw you post that link in another Pix thread so I tried it and everything tests fine except the certificate since it is from an unknown provider since our CA generated it.
it is important that the certificate is added to trusted root authorities on the laptops (you should be able to open owa without any errors). does the issue remain after you have imported the certificate onto laptops so that owa does not show a warning at all.
shaun
shaun
Trying to get RPC over HTTPS to work with your own CA has a very high failure rate. I actually don't bother. I can get the feature working in less than an hour using a US$30 certificate. Means I do not have to install something on every device, particularly when the certificate expires.
Simon.
Simon.
I have to agree with simon that it is far far better to use a commercial certificate. however if you ensure the certificate name matches your fqdn and your CA is in the trusted root authority list on your devices, it should work ok.
Hope this helps
How to configure RPC over HTTP in Exchange Server 2003
http://support.microsoft.com/kb/833401
How can I configure RPC over HTTP/S on Exchange 2003 (single server scenario)?
http://www.petri.co.il/how-can-i-configure-rpc-over-https-on-exchange-2003-single-server-scenario.htm
- Dream
How to configure RPC over HTTP in Exchange Server 2003
http://support.microsoft.com/kb/833401
How can I configure RPC over HTTP/S on Exchange 2003 (single server scenario)?
http://www.petri.co.il/how-can-i-configure-rpc-over-https-on-exchange-2003-single-server-scenario.htm
- Dream
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
How did you test RPC over HTTP is working fine internally ?
Can you try and confirm -> Open Outlook (using Rpc over http) -> Press & hold Ctrl key on keyboard -> Right click on Outlook icon on the system tray (besides time) and then choose Connection Status. Now verify of the column which says Conn has all HTTPS only and no TCP/IP..