Exchange server behind Pix 2

[derf238]

I am planning to put an Exchange server on the internal segment rather than the DMZ. We're using PAT with a single public address on the outside. We have unused public addresses available. What's the best method for opening ports and/or translating mail traffic to the Exhchange server?
Thanks in advance

 

[criticalUpdate]

you could use a seperate address for exchange

or just re-direct the port

Are you going to be using WebAccess and do you have any other webservers to support.

Jeff

 

[lgarner]

I'd also vote for using the extra public address and leaving the interface address for PAT. You can NAT the extra address to the exchange server and apply appropriate ACLs, or you could NAT only the necessary ports (25, maybe 80&443) to exchange.

Also, disable smtp fixup.

 

[derf238]

No other web servers in this location. OWA may be used later.
To clarify - i would have one ip on the outside interface PAT to the internal host IP's. I would have a second ip on the outside interface NAT 1 to 1 to the internal Exchange ip and limit traffic to smtp on port 25 (or add 443 and 808 if I'm using OWA).
Do I disable fixup for smtp because 2003 uses esmtp and causes issues?
Thanks again

 

[lgarner]

Correct on all counts.

 

[derf238]

When using 2 IP's on the outside interface, would they be configured like subinterfaces on a router?

 

[lgarner]

No, the static nat statement takes care of it. You don't need to separately specify the address on the interface.

static (inside,outside) 64.1.1.3 255.255.255.0 10.1.1.3 255.255.255.0

will effectively add the 64.1.1.3 address to the outside interface.

 

[derf238]

lgarner - got it. Thanks for your help. much appreciated