Hoping one of you can help. I am running Exchange 2010 and it is all configured correctly and routing emails both in and out however I am wanting to allow users the use of web mail externally.

If I browse to the IP in question I am presented with ASDM login of my router and if I telnet to the IP address I am presented with CLI of my router. See the config below - What do I need to add to tell the router to forward the requests to 192.168.1.54 (Exchange Server) - I have thought of DMZ but in order to do this an additional port is required on the router and I don't have another port to do so.

I have filtered out certain bits of config.

-------------------------------------------------------------------

Router#sh run

Building configuration...

Current configuration : 6985 bytes

!

! Last configuration change at 00:39:19 London Fri Nov 30 2012

!

version 12.4

service timestamps debug datetime msec

service timestamps log datetime msec

!

hostname

!

boot-start-marker

boot-end-marker

!

!

aaa new-model

!

!

aaa authentication login default local

aaa authentication login sdm_vpn_xauth_ml_1 local

aaa authorization exec default local

aaa authorization network sdm_vpn_group_ml_1 local

!

aaa session-id common

ip cef

!

!

no ip dhcp use vrf connected

ip dhcp excluded-address 192.168

ip dhcp excluded-address 192.168

ip dhcp excluded-address 192.168

ip dhcp excluded-address 192.168

ip dhcp excluded-address 192.168

ip dhcp excluded-address 192.168

ip dhcp excluded-address 192.168

!

ip dhcp pool dhcp

network

dns-server

default-router

!

!

ip name-server

ip name-server

ip name-server

ip name-server

ip inspect name SDM_LOW cuseeme

ip inspect name SDM_LOW dns

ip inspect name SDM_LOW ftp

ip inspect name SDM_LOW h323

ip inspect name SDM_LOW https

ip inspect name SDM_LOW icmp

ip inspect name SDM_LOW imap

ip inspect name SDM_LOW pop3

ip inspect name SDM_LOW netshow

ip inspect name SDM_LOW rcmd

ip inspect name SDM_LOW realaudio

ip inspect name SDM_LOW rtsp

ip inspect name SDM_LOW esmtp

ip inspect name SDM_LOW sqlnet

ip inspect name SDM_LOW streamworks

ip inspect name SDM_LOW tftp

ip inspect name SDM_LOW tcp

ip inspect name SDM_LOW udp

ip inspect name SDM_LOW vdolive

ip auth-proxy max-nodata-conns 3

ip admission max-nodata-conns 3

!

!

crypto pki trustpoint TP-self-signed-

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-

revocation-check none

rsakeypair TP-self-signed-

!

!

username

!

!

!

!

crypto isakmp policy 1

encr 3des

authentication pre-share

group

!

crypto isakmp client configuration group

key

dns

pool

max-users

netmask

!

!

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

!

crypto dynamic-map SDM_DYNMAP_1 1

set security-association idle-time 3661

set transform-set ESP-3DES-SHA

reverse-route

!

!

crypto map SDM_CMAP_1 client authentication list sdm_vpn_xauth_ml_1

crypto map SDM_CMAP_1 isakmp authorization list sdm_vpn_group_ml_1

crypto map SDM_CMAP_1 client configuration address respond

crypto map SDM_CMAP_1 65535 ipsec-isakmp dynamic SDM_DYNMAP_1

!

!

!

interface FastEthernet0/0

description <<Internal Facing>>$FW_INSIDE$

ip address 192.168.1.1 255.255.255.0

ip access-group 100 in

ip nat inside

ip virtual-reassembly

duplex auto

speed auto

!

interface FastEthernet0/1

description <<Internet Facing>>$FW_OUTSIDE$

ip address dhcp

ip nat outside

ip inspect SDM_LOW out

ip virtual-reassembly

duplex auto

speed auto

crypto map SDM_CMAP_1

!

interface ATM0/0/0

no ip address

shutdown

atm restart timer 300

no atm ilmi-keepalive

dsl operating-mode auto

!

ip local pool

ip forward-protocol nd

!

!

ip http server

ip http authentication local

ip http secure-server

ip nat pool NAT

ip nat inside source route-map SDM_RMAP_2 interface FastEthernet0/1 overload

ip nat inside source static tcp 192.168.1.54 25 interface FastEthernet0/1 25

ip nat inside source route-map SDM_RMAP_1 interface FastEthernet0/1 overload

!

access-list 1 remark Allow IP Range

access-list 1 permit 192.168.1.0 0.0.0.255 log

access-list 2 remark Allow IP Range

access-list 2 permit 192.168.1.0 0.0.0.255 log

access-list 100 remark Generated by SDM

access-list 100 remark SDM_ACL Category=1

access-list 100 deny ip host 255.255.255.255 any log-input

access-list 100 deny ip 127.0.0.0 0.255.255.255 any log-input

access-list 100 permit ip any any

access-list 101 remark Generated by SDM

access-list 101 remark SDM_ACL Category=1

access-list 101 permit ip 192.168.1.24 0.0.0.7 any

access-list 101 permit udp any any eq non500-isakmp

access-list 101 permit udp any any eq isakmp

access-list 101 permit esp any any

access-list 101 permit ahp any any

access-list 101 deny ip 192.168.1.0 0.0.0.255 any log-input

access-list 101 permit udp any eq bootps any eq bootpc

access-list 101 permit icmp any any echo-reply

access-list 101 permit icmp any any time-exceeded

access-list 101 permit icmp any any unreachable

access-list 101 deny ip 10.0.0.0 0.255.255.255 any log-input

access-list 101 deny ip 172.16.0.0 0.15.255.255 any log-input

access-list 101 deny ip 192.168.0.0 0.0.255.255 any log-input

access-list 101 deny ip 127.0.0.0 0.255.255.255 any log-input

access-list 101 deny ip host 255.255.255.255 any log-input

access-list 101 deny ip any any log-input

access-list 102 remark SDM_ACL Category=2

access-list 102 deny ip any 192.168.1.24 0.0.0.7 log-input

access-list 102 permit ip 192.168.1.0 0.0.0.255 any log-input

access-list 103 permit tcp any host 192.168.1.54 eq smtp

access-list 103 remark SDM_ACL Category=2

access-list 103 deny ip any 192.168.1.24 0.0.0.7

access-list 103 permit ip 192.168.1.0 0.0.0.127 any

!

route-map SDM_RMAP_1 permit 1

match ip address 102

!

route-map SDM_RMAP_2 permit 1

match ip address 103

!

!

!

control-plane

!

!

!

line con 0

line aux 0

line vty 0 4

!

scheduler allocate 20000 1000

end

Router#

Anyone?

Might be a bit confused, but my understanding is that you have a single world IP and the router listening on this IP is using port 80 for it's own web server, running the router's admin pages? If that's the case, I think you'll be needing to do some port juggling to either move the router onto an alternative port or create a port for webmail. Once you have the Exchange ports available, just port-forward all traffic arriving on them to the Exchange server....

Chris

Thanks Chris. Already know this - What I need to know is what bit of config needs amending there to tell the router when requests are received to forward onto the exchange server.

Do I just add another ACL?

It's not your ACLs, it'll be your NAT settings. You only have port 25 forwarded to Exchange, not port 80, which is why it's being received by your router and handing you the login page.

Don't forget 443 since by default exchange 2010 will want to use that for OWA, how have you set IIS up? to take the http and forward the https /owa subdirectory?

Also, I just spotted your NAT commands are just dumping traffic out of an interface without rewriting the IP address. This probably won't work, because when it reaches your Exchange server it might still have the original destination address on it, at which point your server will see traffic that "doesn't belong" to it and is probably silently dropping it. You need to get the commands to translate the headers in the packet from your WAN IP to your Exchange server's IP and not just throw them out of a specific interface, forward the right ports rather than using overload, and you should be up and running.

edit - actually, this post is total cobblers. I read the command the wrong way round, oops!

Edited 10 December, 201213 yr by gac

Thanks. I will try add to that NAT statement. See if that helps!

you probably need to adjust the management ACL to only accept traffic from your internal subnets/interfaces. I THINK by default it will accept from anywhere.

then NAT the incoming traffic on TCP80 and TCP443 to your internal server IP

Changing the statement worked guys.

Cheers.

nice one, glad its working for you!