Welcome to ISAserver.org
Forums |
Register |
Login |
My Profile |
Inbox |
RSS 
|
My Subscription |
My Forums |
Address Book |
Member List |
Search |
FAQ |
Ticket List |
Log Out
IMAP4 on ISA 2004 with FE BE and PIX 515
|
Users viewing this topic:
none
|
Logged in as: Guest
|
Login  | |
|
IMAP4 on ISA 2004 with FE BE and PIX 515 - 3.Dec.2007 12:20:40 PM
|
|
|
mzanirato
Posts: 3
Joined: 3.Dec.2007
Status: offline
|
Hello,
I'm tring to allow internal and external connection for user that want to use mail client different from outlook.
The configuration is the following:
ISA 2004 with single network card on DMZ.
Exchange 2003 FE and Exchange 2003 BE.
Pix 515 with 3 NIC (Internal, External, DMZ).
OWA is working fine but IMAP or POP3 are not.
The following is the PIX 515 configuration:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
interface ethernet3 auto shutdown
interface ethernet4 auto shutdown
interface ethernet5 auto shutdown
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security4
nameif ethernet3 intf3 security6
nameif ethernet4 intf4 security8
nameif ethernet5 intf5 security10
enable password gr9c4nhCt/uqYaI6 encrypted
passwd nQVIdJzkbtP4A38f encrypted
hostname PE-F
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list nat permit ip host 192.168.0.13 any
access-list nat permit ip host 192.168.0.6 any
access-list nat permit ip host 192.168.0.113 any
access-list nat permit ip host 192.168.0.125 any
access-list out2in permit tcp any host 83.103.48.xxx eq citrix-ica
access-list out2in permit tcp any host 83.103.48.xxx eq www
access-list out2in permit tcp any host 83.103.48.xxx eq https
access-list out2in permit tcp any host 83.103.48.xxx eq www
access-list out2in permit tcp any host 83.103.48.xxx eq https
access-list out2in permit tcp any host 83.103.48.xxx eq imap4
access-list out2in permit tcp any host 83.103.48.xxx eq smtp
access-list dmz2in permit tcp host 192.168.200.10 host 192.168.0.57 eq www
access-list dmz2in permit tcp host 192.168.200.10 host 192.168.0.57 eq https
access-list dmz2in permit tcp host 192.168.200.10 host 192.168.0.57 eq imap4
access-list dmz2in permit tcp host 192.168.200.10 host 192.168.0.57 eq smtp
access-list dmz2in deny ip any 192.168.0.0 255.255.0.0
access-list dmz2in permit ip any any
access-list no-nat-in permit ip 192.168.0.0 255.255.0.0 192.168.200.0 255.255.25
access-list no-nat-dmz permit ip 192.168.200.0 255.255.255.0 192.168.0.0 255.255
pager lines 24
mtu outside 1500
mtu inside 1500
mtu dmz 1500
mtu intf3 1500
mtu intf4 1500
mtu intf5 1500
ip address outside 83.103.48.xxx 255.255.255.248
ip address inside 192.168.0.43 255.255.254.0
ip address dmz 192.168.200.1 255.255.255.0
no ip address intf3
no ip address intf4
no ip address intf5
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
no failover ip address dmz
no failover ip address intf3
no failover ip address intf4
no failover ip address intf5
pdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list no-nat-in
nat (inside) 1 access-list nat 0 0
nat (dmz) 0 access-list no-nat-dmz
static (inside,outside) 83.103.48.xxx 192.168.0.7 netmask 255.255.255.255 0 0
static (dmz,outside) 83.103.48.xxx 192.168.200.10 netmask 255.255.255.255 0 0
access-group out2in in interface outside
access-group dmz2in in interface dmz
route outside 0.0.0.0 0.0.0.0 83.103.48.xxx 1
route inside 192.168.2.0 255.255.255.0 192.168.0.46 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 192.168.0.8 255.255.255.255 inside
telnet 192.168.0.10 255.255.255.255 inside
telnet 192.168.0.60 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:ac00e757eeabae54ea691299c09f62e6
: end
If I try to telnet on port 143 I receive a "Could not open connection to the host, on port 143: Connect Failed".
Does anyone know why?
Thanks for your help.
MZ
|
|
|
|
|
RE: IMAP4 on ISA 2004 with FE BE and PIX 515 - 3.Dec.2007 8:18:11 PM
|
|
|
Rotorblade
Posts: 976
Joined: 27.Feb.2007
Status: offline
|
quote:
ISA 2004 with single network card on DMZ.
If ISA is single NIC, the only protocols supported are HTTP, HTTPS and FTP.
HTH
RB
|
|
|
|
|
RE: IMAP4 on ISA 2004 with FE BE and PIX 515 - 4.Dec.2007 8:04:15 AM
|
|
|
mzanirato
Posts: 3
Joined: 3.Dec.2007
Status: offline
|
Is that true even using a PIX with three NIC?
Ciao.
MZ
|
|
|
|
|
RE: IMAP4 on ISA 2004 with FE BE and PIX 515 - 4.Dec.2007 4:08:38 PM
|
|
|
Rotorblade
Posts: 976
Joined: 27.Feb.2007
Status: offline
|
quote:
Is that true even using a PIX with three NIC?
If you are publishing through ISA and having a single NIC it would be.With only having a single NIC, server publishing is not supported.
Quoted from - http://www.microsoft.com/technet/isa/2004/plan/single_adapter.mspx
quote:
Unsupported Scenarios
When you install ISA Server on a computer with a single network adapter, the following ISA Server features and scenarios are not supported:
•
Multi-network firewall policy. In single network adapter mode, ISA Server recognizes itself (the Local Host network). Everything else is recognized as the Internal network. There is no concept of an External network. Microsoft Firewall service and application filters operate only in the context of the Local Host network. (ISA Server protects itself no matter what network template is applied.) Because the Firewall service and application filters operate in the context of the Local Host network, you can use access rules to allow non-Web protocols to the ISA Server computer itself.
•
Application layer inspection. Application level filtering is not functional, except for the Web Proxy filter (for HTTP, HTTPS, and FTP over HTTP).
•
Server publishing. Server publishing is not supported. There is no separation of Internal and External networks, so ISA Server cannot provide the network address translation (NAT) functionality required in a server publishing scenario.
•
Firewall clients. The Firewall Client application handles requests from Winsock applications that use the Firewall service. This service is not available in a single network adapter environment.
•
SecureNAT clients. SecureNAT clients use ISA Server as a router to the Internet, and SecureNAT client requests are handled by the Firewall service. Because the Firewall service is not available in a single network adapter configuration, such requests are not supported.
•
Virtual private networking. Site-to-site virtual private networks (VPNs) and remote access VPNs are not supported in a single network adapter scenario.
RB
|
|
|
|
|
RE: IMAP4 on ISA 2004 with FE BE and PIX 515 - 5.Dec.2007 3:10:24 AM
|
|
|
mzanirato
Posts: 3
Joined: 3.Dec.2007
Status: offline
|
Thanks for the information. I will install addtional NIC on the ISA server to implement IMAP4 and POP3.
The strange issue is that on the internal network both IMAP4 and POP3 are working fine but not from outside.
Thanks for your help.
MZ
|
|
|
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
 Locked w/ New Messages |
 Locked w/o New Messages |
|
 Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts |
|
Printable Version
