RE: PIX and mapi

Hi there.

AFAIK, PIX doesn't support stateful RPC filtering, so you should use
static port-mapping on the Exchange server.

Clients must have access to RPC port mapper (135), NSPI/RRF (depended on
version of Outlook) and Exchange Information store RPC Services. 

So, you should open 4 ports between client and Exchange server. 

For automating port-mapping you can use group policy.

Administrative template which solves this task (rpcpm.adm) can be found
here:

http://www.security.nnov.ru/articles/LANFirewall/ 

 

Regards,

Sergey V. Gordeychik,

MCSE, MCT, CISSP

 

________________________________

From: Roy Stapleton [mailto:roy@stapleton.biz] 
Sent: Wednesday, April 27, 2005 11:26 AM
To: firewalls@securityfocus.com
Subject: PIX and mapi

 

Hi,

 

I have a host in our DMZ that needs to talk to our exchange server using
outlook and mapi clients.

 

This is a small business, and the above is a situation I have inherited
when given the task of replacing our current firewall with some pix
515's.

 

Does anyone know if the pix's can keep state on a mapi connection from
the client (outlook xp) to the server (exchange 2003)?

 

Also, if you know of any other way of allowing communication, i.e. vpn
dialler... please let me know.

 

Many thanks

 

Roy