topic Re: Newbee Needs Help in General Topics

Newbee Needs Help

WayneFusco — Sat, 08 Oct 2011 12:37:47 GMT

I am trying to setup outlook web access (Exchange 2010) for my network.

Here is what I have done thus far:

Object -> Addresses: Setup the internal address of the exchange server.

Policy -> Security: Created a rule with the following data (Name: owa - Source Zone: untrusted - Address/User: any - Dest Zone: trusted - Dest Address: OWA - Dest Application: Outlook-web (factory defined) Dest Service: service-https (Factory Defined)

When I go to commit the changes I get this:

device: Rule 'OWA' application dependency warning:

- Application 'outlook-web' requires 'ssl' allowed in the policy

- Application 'outlook-web' requires 'web-browsing' allowed in the policy

Configuration committed successfully

Not sure what its telling me to do..

Thanks in advance

Wayne

Re: Newbee Needs Help

WayneFusco — Sat, 08 Oct 2011 12:42:08 GMT

Never Mind - I figured it out..

Sweet!!!!

Re: Newbee Needs Help

WayneFusco — Sat, 08 Oct 2011 13:42:46 GMT

Okay maybe not.

Dont know what needs to happen to connect from the outside world..

Re: Newbee Needs Help

gswcowboy — Sat, 08 Oct 2011 20:22:42 GMT

Do you have an Inbound NAT rule associated with the security policy? Untrust to Untrust for the zones, public facing ip for the destination address and then dnat it to your private ip address hosting the services in question.

Re: Newbee Needs Help

WayneFusco — Sun, 09 Oct 2011 00:16:20 GMT

Hi Thanks,

Can you break it down for me,

remember i am a newbee..

Here is the NAT policy I have

SZ: untrust DZ: trust DI: none SA: any DA: OWA ST: dyn ip & port ether1/3 & my pubic ip DT: address:owa port:433

Is this on the right track?

Re: Newbee Needs Help

jleung — Sun, 09 Oct 2011 11:15:44 GMT

Hi,

For any incoming connection, the NAT policy shouldbe like this:

Original

SRC Zone: untrust, src IP: any

Dst Zone: untrust, dst IP: public IP of OWA

Translated:

Src IP: any any

Dst IP: private IP, Static IP

For security:

Src Zone: Untrust, src IP: any

Dst Zone: DMZ, dst IP: public IP

Application: SSL (as OWA is encrypted)

Regards,

Jones

Re: Newbee Needs Help

kamish — Tue, 11 Oct 2011 13:46:21 GMT

- Application 'outlook-web' requires 'ssl' allowed in the policy - In your policy In services allow tcp-443

- Application 'outlook-web' requires 'web-browsing' allowed in the policy - In your policy In services allow tcp-80.

See if this helps.