can not access dmz server from the outside

[strayrog]

I am currently running a PIX515E and running an exchange server in the dmz. I can not access the exchange web page from an outside internet connection or by IP address. Can some one take a look at my config and let me know what I did wrong.

Thanks

PIX Version 6.3(5)
interface ethernet0 100full
interface ethernet1 100full
interface ethernet2 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password xxxxxxxxxx encrypted
passwd xxxxxxxxxx encrypted
hostname IntrinsiqMApix
domain-name ciscopix.com
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol http 443
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.66.50 Isa
name 192.168.66.42 ex-mail
object-group service BCMudp udp
port-object range 51000 51200
port-object range 7000 7000
port-object range 28000 28511
object-group service ex-mail tcp
port-object eq www
port-object eq pop3
port-object eq https
port-object eq ftp
port-object eq imap4
port-object eq smtp
port-object eq telnet
port-object eq ssh
access-list outside permit icmp any host 12.170.54.23
access-list outside permit udp any host 12.170.54.23 object-group BCMudp
access-list outside permit tcp any host 12.170.54.23 eq telnet
access-list outside permit tcp any host 12.170.54.23 eq www
access-list outside permit tcp any host 12.170.54.23 eq https
access-list acl-out permit tcp any host 12.170.54.40 object-group ex-mail log 4
access-list acl-out permit tcp any host 12.170.54.39
access-list capin permit ip any host 192.168.63.255
access-list capin permit ip any host 192.168.67.255
access-list capin permit ip any host 192.168.128.255
no pager
logging on
logging timestamp
logging console alerts
logging monitor notifications
logging trap critical
logging history alerts
logging facility 16
logging device-id hostname
logging host inside 192.168.64.119
icmp permit any outside
icmp permit any inside
icmp permit any dmz
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 12.170.54.2 255.255.255.128
ip address inside 192.168.64.2 255.255.255.0
ip address dmz 192.168.66.2 255.255.255.0
multicast interface inside
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.64.119 255.255.255.255 inside
pdm location 12.170.54.100 255.255.255.255 outside
pdm location 192.168.128.2 255.255.255.255 inside
pdm location 192.168.128.0 255.255.255.0 inside
pdm location 192.168.63.0 255.255.255.0 inside
pdm location 192.168.64.119 255.255.255.255 dmz
pdm location 12.170.54.30 255.255.255.255 outside
pdm location 192.168.67.0 255.255.255.0 inside
pdm location Isa 255.255.255.255 dmz
pdm location ex-mail 255.255.255.255 dmz
pdm logging alerts 100
pdm history enable
arp timeout 14400
global (outside) 1 12.170.54.-12.170.54.38
global (outside) 1 12.170.54.4
global (outside) 10 12.170.54.39
global (dmz) 1 192.168.66.30-192.168.66.39
nat (inside) 10 192.168.64.119 255.255.255.255 0 0
nat (inside) 1 192.168.63.0 255.255.255.0 0 0
nat (inside) 1 192.168.64.0 255.255.255.0 0 0
nat (inside) 1 192.168.67.0 255.255.255.0 0 0
nat (dmz) 1 192.168.66.0 255.255.255.0 0 0
static (inside,outside) 12.170.54.23 192.168.128.2 netmask 255.255.255.255 0 0
static (dmz,outside) 12.170.54.40 ex-mail netmask 255.255.255.255 0 0
static (dmz,outside) 12.170.54.50 Isa netmask 255.255.255.255 0 0
static (inside,outside) 12.170.54.39 192.168.64.119 netmask 255.255.255.255 0 0
access-group acl-out in interface outside
route outside 0.0.0.0 0.0.0.0 12.170.54.1 1
route inside 192.168.63.0 255.255.255.0 192.168.64.1 1
route inside 192.168.67.0 255.255.255.0 192.168.64.1 1
route inside 192.168.128.0 255.255.255.0 192.168.64.1 1
route inside 192.168.128.2 255.255.255.255 192.168.64.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:30:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 0.0.0.0 0.0.0.0 outside
http 0.0.0.0 0.0.0.0 inside
snmp-server host inside 192.168.64.119 poll
snmp-server location Waltham
snmp-server contact Roger Pringle
snmp-server community public
snmp-server enable traps
tftp-server inside 192.168.64.119 /
floodguard enable
service resetinbound
telnet 192.168.64.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 dmz
ssh timeout 5
console timeout 0
terminal width 80
: end
[OK]

 

[boymarty24]

Does the server receive email? The config looks correct. Maybe your isa is the problem?

 

[Supergrrover]

Exchange uses ESMTP and the Pix inspects only smtp, so kill this line for exchange to work
fixup protocol smtp 25

Delete this line (The range is configed wrong)
global (outside) 1 12.170.54.-12.170.54.38

I would also change the name of one of these to something else for clarity.
name 192.168.66.42 ex-mail
object-group service ex-mail






Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[strayrog]

The ISA shouldn't be doing anything at all. That machine is just hanging in the DMZ and is not configured. I will power The isa down to ensure that is not the problem.

 

[strayrog]

Supergrrover,

I put in all of your suggestions ans still can not access the exchange web page. It works internal so I know it has to be the PIX configuration, but I don't see where the error is.

Any other suggetions?

 

[Supergrrover]

If those are the real IP's then you are up and running. I access the IPs you gave for the web server and the isa and they both come up. The Mail server is the Standard IIS under construction page for port 80 and the isa box is a Server error. I you add https and the /exchange it comes up with a login prompt. For exchange, unless you made a default redirector asp page for the standard http page, you will need to access it using

https://IP/exchange.

When you made the changes, if you didn't clear xlate the old statics sit around until they time out on their own.


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[strayrog]

Supergrrover,

I don't know why but I can not get to any exchange page fromoutside of the firewall. I am not sure why you can but I can not by name or by IP. I executed an xlate command and even reloaded the PIX but still can not access. Any other ideas?

 

[Supergrrover]

I just tried it and could not get in anymore - connection reset. It was up when I tried earlier. Have you changed anything since? Try removing this line
service resetinbound
I am not entirely sure what it does and repost your new config.

What do the log files say? Send them to a syslog server at the debug level. (Kiwi is a free windows syslog server.)


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[strayrog]

Here is the new config. Not sure what to do.

PIX Version 6.3(5)
interface ethernet0 100full
interface ethernet1 100full
interface ethernet2 100full
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password aVFhsHvvb67xfMVH encrypted
passwd aVFhsHvvb67xfMVH encrypted
hostname IntrinsiqMApix
domain-name ciscopix.com
clock timezone EST -5
clock summer-time EDT recurring
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol http 443
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
name 192.168.66.42 mail
name 12.170.54.40 mail1
object-group service BCMudp udp
port-object range 51000 51200
port-object range 7000 7000
port-object range 28000 28511
object-group service ex-mail tcp
port-object eq www
port-object eq pop3
port-object eq https
port-object eq ftp
port-object eq imap4
port-object eq smtp
port-object eq telnet
port-object eq ssh
access-list outside permit icmp any host 12.170.54.23
access-list outside permit udp any host 12.170.54.23 object-group BCMudp
access-list outside permit tcp any host 12.170.54.23 eq telnet
access-list outside permit tcp any host 12.170.54.23 eq www
access-list outside permit tcp any host 12.170.54.23 eq https
access-list acl-out permit tcp host mail1 object-group ex-mail host mail1 log 4
access-list acl-out permit tcp any host 12.170.54.39
access-list capin permit ip any host 192.168.63.255
access-list capin permit ip any host 192.168.67.255
access-list capin permit ip any host 192.168.128.255
no pager
logging on
logging timestamp
logging console alerts
logging monitor notifications
logging trap critical
logging history alerts
logging facility 16
logging device-id hostname
logging host inside 192.168.64.119
icmp permit any outside
icmp permit any inside
icmp permit any dmz
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside 12.170.54.2 255.255.255.128
ip address inside 192.168.64.2 255.255.255.0
ip address dmz 192.168.66.2 255.255.255.0
multicast interface inside
ip audit info action alarm
ip audit attack action alarm
pdm location 192.168.64.119 255.255.255.255 inside
pdm location 12.170.54.100 255.255.255.255 outside
pdm location 192.168.128.2 255.255.255.255 inside
pdm location 192.168.128.0 255.255.255.0 inside
pdm location 192.168.63.0 255.255.255.0 inside
pdm location 192.168.64.119 255.255.255.255 dmz
pdm location 12.170.54.30 255.255.255.255 outside
pdm location 192.168.67.0 255.255.255.0 inside
pdm location mail 255.255.255.255 dmz
pdm location mail1 255.255.255.255 outside
pdm logging alerts 100
pdm history enable
arp timeout 14400
global (outside) 1 12.170.54.30-12.170.54.38
global (outside) 1 12.170.54.4
global (outside) 10 12.170.54.39
global (dmz) 1 192.168.66.30-192.168.66.39
nat (inside) 10 192.168.64.119 255.255.255.255 0 0
nat (inside) 1 192.168.63.0 255.255.255.0 0 0
nat (inside) 1 192.168.64.0 255.255.255.0 0 0
nat (inside) 1 192.168.67.0 255.255.255.0 0 0
nat (dmz) 1 192.168.66.0 255.255.255.0 0 0
static (inside,outside) 12.170.54.23 192.168.128.2 netmask 255.255.255.255 0 0
static (dmz,outside) mail1 mail netmask 255.255.255.255 0 0
static (inside,outside) 12.170.54.39 192.168.64.119 netmask 255.255.255.255 0 0
access-group acl-out in interface outside
route outside 0.0.0.0 0.0.0.0 12.170.54.1 1
route inside 192.168.63.0 255.255.255.0 192.168.64.1 1
route inside 192.168.67.0 255.255.255.0 192.168.64.1 1
route inside 192.168.128.0 255.255.255.0 192.168.64.1 1
route inside 192.168.128.2 255.255.255.255 192.168.64.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:30:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http 0.0.0.0 0.0.0.0 outside
http 0.0.0.0 0.0.0.0 inside
snmp-server host inside 192.168.64.119 poll
snmp-server location Waltham
snmp-server contact Roger Pringle
snmp-server community public
snmp-server enable traps
tftp-server inside 192.168.64.119 /
floodguard enable
service resetinbound
telnet 192.168.64.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 dmz
ssh timeout 5
console timeout 0
username rpringle password Y/YM.CoiayQqpifQ encrypted privilege 15
terminal width 80
Cryptochecksum:1d0034463a422b78713306829ab05e5b
: end
[OK]

 

[Supergrrover]

This line is off
access-list acl-out permit tcp host mail1 object-group ex-mail host mail1 log 4
change to
access-list acl-out permit tcp any host mail1 object-group ex-mail log 4


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[strayrog]

Supergrrover,

Made the change, but for some reason I can not see the server from the outside, either from home or on the wireless card. What else could be causing me no to find the site?

 

[Supergrrover]

Well, that should be good. What do the logs say?
Look for translations to see if one is built, and then look at the connections made.

I did a portqry and this is what was returned
TCP port 80 (http service): LISTENING
TCP port 443 (https service): LISTENING
TCP port 21 (ftp service): LISTENING
TCP port 25 (smtp service): LISTENING
Data returned from port:
421 Cannot connect to SMTP server 12.170.54.39 (12.170.54.39:25), connect error
10061
TCP port 110 (pop3 service): LISTENING
Data returned from port:
-ERR Cannot connect to POP server 12.170.54.39 (12.170.54.39:110), connect error
10061

So it looks like it is getting through. Are you sure about the box? Does it have a firewall on it? They can be set to allow only the local lan to connect and forbid other networks.

This works (although it throws a server error.)
static (inside,outside) 12.170.54.39 192.168.64.119 netmask 255.255.255.255 0 0


Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[strayrog]

Supergrrover,

Thank you very much for your help. It finally works. I don't know why but I deleted and recreated the mangage service group and everything started working again. maybe curupted? Not sure, but it is working again.

Once again thank you. This is the second time you helped me and I don't know what I would do without Tek-Tips as a resource.