OWA SSL not accessable from internet

[Dublin73]

Hi All, Help! I cannot access Outlook Web Access from the internet. Setup is...

[Exchange front-end]---[PIX]---[DSL ROUTER]--- INTERNET

At PIX I have entered the following commands...

static (inside,outside) exchangepubip Exchangeprivip netmask 255.255.255.255 0 0

access-list 100 permit tcp any host exchangepubip eq https

My ISP has an "A" record pointing to owa.mydomain.com

From internally, on the LAN I can successfully access OWA via...

https://internalservername/exchange

I cannot access

https://owa.mydomain.com

from the internet. It fails immediately. Is there something I have left out at the PIX?

thanks in advance, Dublin73

 

[lgarner]

access-group 100 in interface outside"?

 

[Dublin73]

Thanks for the reply lgarner! I'm still in the baby steps stage of learning how to configure the PIX.

I've added "access-group 100 in interface outside" as I didn't have that entered originally.

While I'm not getting into the site...

https://owa.mydomain.com/exchange

I am getting the "Security Alert" SSL certificate screen in Internet Explorer that asks if you want to proceed etc.. This is much further than I was getting before. Hopefully nearly there!

thanks again for the reply.

Dublin73

 

[Dublin73]

Looks like I've celebrated to early! I'm still in the baby steps stage w/ the PIX and must have something misconfigured somewhere. Many thanks to anyone who can take a few minutes out to help.

When I add the line...

access-group 100 in interface outside

The line gets added to the PIX, but deletes the following line from the PIX's configuration...

access-group smtp in interface outside

which isn't a good thing as this knocks out all incoming mail.

Here's my PIX running config....

PIX Version 6.3(4)
interface ethernet0 10full
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password ggggggg encrypted
passwd gggggggg encrypted
hostname ggggg
domain-name mydomain.com
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol pptp 1723
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
no fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list smtp permit tcp any host ExchangePublicIP eq smtp
access-list 101 permit ip yyy.yyy.yy.y 255.255.255.0 zzz.z.z.z 255.255.255.0
access-list 110 permit tcp any host xx.xx.xx.xxx eq pptp
access-list 110 permit gre any host xx.xx.xx.xxx
access-list 100 permit tcp any host ExchangePublicIP eq https
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside vv.vv.vvv.v 255.255.255.255 pppoe setroute
ip address inside yyy.yyy.yy.yy 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
pdm location yyy.yyy.yy.yy 255.255.255.255 inside
pdm logging informational 100
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list 101
nat (inside) 1 0.0.0.0 0.0.0.0 0 0
static (inside,outside) ExchangePublicIP yyy.yyy.yy.y netmask 255.255.255.255 0 0
access-group smtp in interface outside
timeout xlate 0:05:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
http server enable
http yyy.yyy.yy.y 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
sysopt connection permit-ipsec
crypto ipsec transform-set viper esp-des esp-md5-hmac
crypto map corvette 1 ipsec-isakmp
crypto map corvette 1 match address 101
crypto map corvette 1 set peer yy.yy.yy.yyy
crypto map corvette 1 set transform-set viper
crypto map corvette interface outside
isakmp enable outside
isakmp key ******** address yy.yy.yy.yyy netmask 255.255.255.255
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash md5
isakmp policy 1 group 1
isakmp policy 1 lifetime 1000
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn group pppoe_group request dialout pppoe
vpdn group pppoe_group localname eircom
vpdn group pppoe_group ppp authentication chap
vpdn username eircom password *********
terminal width 80
Cryptochecksum:5bfa1dab4390bebc16819bda9ad49703
: end

Why is it that I can't have both of these lines entered at the PIX?

access-group 100 in interface outside
access-group smtp in interface outside

I'm only allowed one or the other w/ my PIX so must have the PIX misconfigured somewhere. Please help!

thanks, Dublin73

 

[Dublin73]

Figured it out!

access-list mail permit tcp any host ExchangePublicIP eq smtp
access-list mail tcp any host ExchangePublicIP eq https
access-group mail in interface outside

Also to note... the public url for OWA

https://owa.mydomain.com/exchange

was not accessable from behind the firewall. This threw me off, as the private address of the OWA server was accessable,

https://servername/exchange

you live, you learn. I'm off for a pint of Carlsberg!

thanks again to lgarner for your help