OWA and PDM questions on PIX 506

[columbiavol]

Never worked with a PIX before but someone asked me to take a look. They cannot access OWA. They get "Page cannot be displayed". Here is the config. Bear in mind that someone who knew nothing about PIX was trying to figure out the problem before they called me so there may be some wierd lines in here.

fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
names
access-list 102 permit tcp any host 65.207.xxx.xxx eq smtp
access-list 102 permit tcp any host 65.207.xxx.xxx eq www
access-list 102 permit tcp any host 192.168.xxx eq www
access-list nonat permit ip 192.168.0.0 255.255.255.0 10.10.1.0 255.255.255.0 (not sure what this 10.10.1.0 is - I cannot ping any of the 10.10.1 addresses)
access-list acl_out permit icmp any any
access-list 101 permit tcp any host 192.168.xxx eq www (Same as the last 102 access list -the guy added this one in because the 102 access-list entry did not work)
pager lines 24
interface ethernet0 auto
interface ethernet1 auto
mtu outside 1500
mtu inside 1500
ip address outside 65.207.xxx.xxx 255.255.255.252
ip address inside 192.168.0.2 (PIX address) 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
ip local pool wall 10.10.1.1-10.10.1.254
pdm location 0.0.0.0 0.0.0.0 inside
pdm location 192.168.0.3 (Exchange server) 255.255.255.255
inside
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside, outside) tcp 65.207.xxx.xxx domain 192.168.0.3 domain netmask 255.255.255.255 0 0
static (inside, outside) udp 65.207.xxx.xxx domain 192.168.0.3 domain netmask 255.255.255.255 0 0
static (inside, outside) tcp 65.207.xxx.xxx smtp 192.168.0.3 smtp netmask 255.255.255.255 0 0
static (inside, outside) 192.168.0.3 65.207.xxx.xxx netmask 255.255.255.255 0 0
access-group 101 in interface outside
conduit permit tcp host 192.168.0.3 eq

http://www any

route outside 0.0.0.0 0.0.0.0 65.207.xxx.xxx 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
http server enable
http 192.168.0.3 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ppptp
no sysopt route dnat
telnet timeout 5
ssh timeout 5

Can someone please look at this config (without laughing) and give me an idea why they cannot access OWA? Also, the guy said he tried PDM but it gave him a conduit error (he did not give me the exact error message and he has already gone for the day). Keep in mind, I have not worked with PIX although I feel comfortable adding in config lines.

 

[lgarner]

1. The static nat doesn't pass

http://www to

the owa server.
2. ACLs are based on the pre-translation address. The inbound ones won't use 192.168.x addresses.

I suggest:
Delete ACL 102
Delete the last line of ACL 101
Delete the conduit
Delete the static statements
Delete the acl_out (only because it's not used nor needed)
Apply "access-group 102 inbound outside"
Add "static (inside,outside) 65.207.xxx.xxx 192.168.0.3 netmask 255.255.255.255 0 0"

This is based on a couple of assumptions:
1. you don't have an internal DNS server which must be reached by the public (your DNS is hosted by your ISP). There's a static statement in your current config which indicates that you do, but the public can't see your DNS server since you have no ACL to allow it. Dump the "domain" static's.
2. you only have a single server which must be seen by the public. That's all your current config supports. If you have multiple servers and only one public IP address, then you'll need specific service-based static statements. Based on this config, a single static will work.
3. you're not using https for OWA. You ought to, even if it's only with a self-signed cert. In that case just add another acl to permit tcp port 443 as well as www.

The 10.10.1.0 network seems to be for a client VPN that hasn't been configured yet.