Newbee Needs Help

[WayneFusco]

I am trying to setup outlook web access (Exchange 2010) for my network.

Here is what I have done thus far:

Object -> Addresses: Setup the internal address of the exchange server.

Policy -> Security: Created a rule with the following data (Name: owa - Source Zone: untrusted - Address/User: any - Dest Zone: trusted - Dest Address: OWA - Dest Application: Outlook-web (factory defined) Dest Service: service-https (Factory Defined)

When I go to commit the changes I get this:

device: Rule 'OWA' application dependency warning:

- Application 'outlook-web' requires 'ssl' allowed in the policy

- Application 'outlook-web' requires 'web-browsing' allowed in the policy

Configuration committed successfully

Not sure what its telling me to do..

Thanks in advance

Wayne

[WayneFusco]

Never Mind - I figured it out..

Sweet!!!!

[WayneFusco]

Okay maybe not.

Dont know what needs to happen to connect from the outside world..

[gswcowboy]

Do you have an Inbound NAT rule associated with the security policy? Untrust to Untrust for the zones, public facing ip for the destination address and then dnat it to your private ip address hosting the services in question.

[WayneFusco]

Hi Thanks,

Can you break it down for me,

remember i am a newbee..

Here is the NAT policy I have

SZ: untrust DZ: trust DI: none SA: any DA: OWA ST: dyn ip & port ether1/3 & my pubic ip DT: address:owa port:433

Is this on the right track?

[jleung]

Hi,

For any incoming connection, the NAT policy shouldbe like this:

Original

SRC Zone: untrust, src IP: any

Dst Zone: untrust, dst IP: public IP of OWA

Translated:

Src IP: any any

Dst IP: private IP, Static IP

For security:

Src Zone: Untrust, src IP: any

Dst Zone: DMZ, dst IP: public IP

Application: SSL (as OWA is encrypted)

Regards,

Jones

[kamish]

- Application 'outlook-web' requires 'ssl' allowed in the policy - In your policy In services allow tcp-443

- Application 'outlook-web' requires 'web-browsing' allowed in the policy - In your policy In services allow tcp-80.

See if this helps.