邮件服务器-邮件系统-邮件技术论坛(BBS)

标题: Exchange 2003邮件服务器实现在外网收发 [打印本页]

作者: bensonchen 时间: 2008-5-27 11:57
标题: Exchange 2003邮件服务器实现在外网收发
各位大哥,好!

现在公司有一台Exchange 2003邮件服务器,仅能在公司收发邮件,但是市场人员长年出差,需要在公司外面收发公司邮件,请问要怎么设置服务器实现这一需求? 公司网络:邮件服务器通过CISCO PIX515 NAT 转换

作者: bensonchen 时间: 2008-5-27 17:42
补充:局域网私有IP 地址通过在CISCO PIX515防火墙设置静态映射公有IP地址出去,实现公司邮件发送和接收。

作者: 钉子 时间: 2008-5-28 00:11
使用OWA或是pop3+smtp方式，或是配置ROH的方式让他们连接服务器来收发。

作者: bensonchen 时间: 2008-5-28 08:38
请问钉子,您说的几种方式具体步骤能告诉我一下,或给出详细的文档,先老板要求尽快实现在外网收发公司邮件.

作者: xxwit 时间: 2008-5-29 23:19
我目前用的就是这种方式exchange服务器前面是pix515E,外同用户通过owa、pop3、rpc over https方式访问
在pix上做内网邮件服务器ip与公网ip的静态映射，并放邮件服务器的110 25 80 443端口，根据不同服务开放不同的端口
，我感觉在外网访问还是pop3方式比较快，不过一切功能不能使用如全球通讯簿,只要exchange服务器本身配置好，只需对pix做简单的配置就可以了．exchange与pix配合使用时要注意以下KB所提示的内容
http://support.microsoft.com/kb/320027/zh-cn
以上仅供参考希望对你有用，不正确的地方请指正．

作者: bensonchen 时间: 2008-6-3 10:05
请问XXWIT,在您这样的网络环境下，OWA 、POP3、 RPC OVER HTTPS三种方式，每一种方式的详细配置步骤能提供我吗？我现在是一头污水，小弟谢谢您！

作者: 钉子 时间: 2008-6-3 10:16
1.OWA 、POP3的情况只需要确定服务器开通了这些服务。并且在防火墙开通了这些端口或是映射（OWA/80,POP3、110，SMTP/23）

2. RPC OVER HTTPS看一下：http://www.5dmail.net/search/1/0/0/RPC

作者: bensonchen 时间: 2008-6-3 17:30
POP3服务是指microsoft exchange pop3 服务吗?另外SMTP 端口是25吧!

我现在服务器已开启了microsoft exchange pop3和SMTP服务,防火墙上做影射如下:

static(inside,outside) A B
access-list 107 permit tcp any host A eq pop3
access-list 107 permit tcp any host A eq smtp
access-group 107 in interface outside

(备注:A指公共IP 地址,B指私有IP地址)

我现在能实现发送和接受外部邮件(例如&&&@163.com),但只能在公司内发送和接受邮件,出差在外人员就不能使用公司邮箱了,我想通过POP3方式实现在公司外部收发邮件,请问问题出在哪里?

作者: jhonlone 时间: 2008-6-3 20:46
我跟你环境相同，除以上几位说的方式外，你也可以让外网用户使用cisco VPN client使用remote VPN方式连接PIX515，使用VPN方式与在内网使用没有任何分别。
具体VPN配置可以网上搜一下，有不少例子

作者: bensonchen 时间: 2008-6-4 08:33
我在八楼的问题,有谁能帮我解答一下吗?

jhonlone能把您的VPN配置发送给我看一下吗?因为我俩的网络环境相同.

作者: ooqiang 时间: 2008-6-4 13:44
如果内网用户的OWA和POP3都正常，那就证明这些服务都没问题了，就检查PIX的配置就好了

作者: bensonchen 时间: 2008-6-4 14:18
我公司CISCO PIX515E配置如下,请帮我检查问题出在哪里?

jianghuai-pix# show run
: Saved
:
PIX Version 6.3(4)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password a3vcCNzBkXDj15I2 encrypted
passwd a3vcCNzBkXDj15I2 encrypted
hostname jianghuai-pix
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names


access-list 107 permit tcp any host 220.178.38.92 eq pop3
access-list 107 permit tcp any host 220.178.38.92 eq smtp
pager lines 24
mtu outside 1500
mtu inside 1500
ip address outside A 255.255.255.248
ip address inside 192.168.1.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
no failover ip address outside
no failover ip address inside
pdm history enable

arp timeout 14400
global (outside) 1 inte
nat (inside) 1 192.168.1.170 255.255.255.255 0 0
nat (inside) 1 192.168.1.171 255.255.255.255 0 0
nat (inside) 1 192.168.1.172 255.255.255.255 0 0
nat (inside) 1 192.168.1.173 255.255.255.255 0 0
nat (inside) 1 192.168.1.174 255.255.255.255 0 0
nat (inside) 1 192.168.1.175 255.255.255.255 0 0
nat (inside) 1 192.168.1.176 255.255.255.255 0 0
nat (inside) 1 192.168.1.177 255.255.255.255 0 0
nat (inside) 1 192.168.1.178 255.255.255.255 0 0
nat (inside) 1 192.168.1.179 255.255.255.255 0 0

nat (inside) 1 192.168.1.181 255.255.255.255 0 0
nat (inside) 1 192.168.1.182 255.255.255.255 0 0
nat (inside) 1 192.168.1.183 255.255.255.255 0 0
nat (inside) 1 192.168.1.184 255.255.255.255 0 0
nat (inside) 1 192.168.1.185 255.255.255.255 0 0
nat (inside) 1 192.168.1.186 255.255.255.255 0 0
nat (inside) 1 192.168.1.187 255.255.255.255 0 0
nat (inside) 1 192.168.1.188 255.255.255.255 0 0
nat (inside) 1 192.168.1.189 255.255.255.255 0 0
nat (inside) 1 192.168.1.190 255.255.255.255 0 0

nat (inside) 1 192.168.1.192 255.255.255.255 0 0
nat (inside) 1 192.168.1.193 255.255.255.255 0 0
nat (inside) 1 192.168.1.194 255.255.255.255 0 0
nat (inside) 1 192.168.1.195 255.255.255.255 0 0
nat (inside) 1 192.168.1.196 255.255.255.255 0 0
nat (inside) 1 192.168.1.197 255.255.255.255 0 0
nat (inside) 1 192.168.1.198 255.255.255.255 0 0
nat (inside) 1 192.168.1.199 255.255.255.255 0 0
nat (inside) 1 192.168.1.200 255.255.255.255 0 0
nat (inside) 1 192.168.1.201 255.255.255.255 0 0

nat (inside) 1 192.168.1.203 255.255.255.255 0 0
nat (inside) 1 192.168.1.204 255.255.255.255 0 0
nat (inside) 1 192.168.1.205 255.255.255.255 0 0
nat (inside) 1 192.168.1.206 255.255.255.255 0 0
nat (inside) 1 192.168.1.207 255.255.255.255 0 0
nat (inside) 1 192.168.1.208 255.255.255.255 0 0
nat (inside) 1 192.168.1.209 255.255.255.255 0 0
nat (inside) 1 192.168.1.210 255.255.255.255 0 0
nat (inside) 1 192.168.1.211 255.255.255.255 0 0
nat (inside) 1 192.168.1.212 255.255.255.255 0 0

nat (inside) 1 192.168.1.214 255.255.255.255 0 0
nat (inside) 1 192.168.1.215 255.255.255.255 0 0
nat (inside) 1 192.168.1.216 255.255.255.255 0 0
nat (inside) 1 192.168.1.217 255.255.255.255 0 0
nat (inside) 1 192.168.1.218 255.255.255.255 0 0
nat (inside) 1 192.168.1.219 255.255.255.255 0 0
nat (inside) 1 192.168.1.220 255.255.255.255 0 0
nat (inside) 1 192.168.1.221 255.255.255.255 0 0
nat (inside) 1 192.168.1.222 255.255.255.255 0 0
nat (inside) 1 192.168.1.223 255.255.255.255 0 0

nat (inside) 1 192.168.1.225 255.255.255.255 0 0
nat (inside) 1 192.168.1.226 255.255.255.255 0 0
nat (inside) 1 192.168.1.227 255.255.255.255 0 0
nat (inside) 1 192.168.1.228 255.255.255.255 0 0
nat (inside) 1 192.168.1.229 255.255.255.255 0 0
nat (inside) 1 192.168.1.230 255.255.255.255 0 0
nat (inside) 1 192.168.1.231 255.255.255.255 0 0
nat (inside) 1 192.168.1.232 255.255.255.255 0 0
nat (inside) 1 192.168.1.233 255.255.255.255 0 0
nat (inside) 1 192.168.1.234 255.255.255.255 0 0

nat (inside) 1 192.168.1.236 255.255.255.255 0 0
nat (inside) 1 192.168.1.237 255.255.255.255 0 0
nat (inside) 1 192.168.1.238 255.255.255.255 0 0
nat (inside) 1 192.168.1.239 255.255.255.255 0 0
nat (inside) 1 192.168.1.240 255.255.255.255 0 0
nat (inside) 1 192.168.1.241 255.255.255.255 0 0
nat (inside) 1 192.168.1.242 255.255.255.255 0 0
nat (inside) 1 192.168.1.243 255.255.255.255 0 0
nat (inside) 1 192.168.1.244 255.255.255.255 0 0
nat (inside) 1 192.168.1.245 255.255.255.255 0 0

nat (inside) 1 192.168.1.247 255.255.255.255 0 0
nat (inside) 1 192.168.1.248 255.255.255.255 0 0
nat (inside) 1 192.168.1.249 255.255.255.255 0 0
nat (inside) 1 192.168.1.250 255.255.255.255 0 0
nat (inside) 1 192.168.1.251 255.255.255.255 0 0
nat (inside) 1 192.168.1.252 255.255.255.255 0 0
nat (inside) 1 192.168.1.253 255.255.255.255 0 0
nat (inside) 1 192.168.1.254 255.255.255.255 0 0
static (inside,outside) B  C netmask 255.255.255.255 0 0

access-group 107 in interface outside

route outside 0.0.0.0 0.0.0.0 220.178.38.89 255
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
telnet 0.0.0.0 0.0.0.0 outside
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 30
console timeout 0
terminal width 80
Cryptochecksum:1dbe431e159ba99655616f3d933db5f9
: end

(备注:A、B分别指公共IP地址）

作者: jhonlone 时间: 2008-6-4 14:56
楼主恐怕没仔细看这个KB吧：
http://support.microsoft.com/kb/320027/zh-cn
fixup protocol smtp 25 这条得拿掉，当然得另外开放25端口；
因偶的是映像是PIX7.0版，所以命令也不同，配置我就不发了；

楼上几位老大说的很清楚了，要实现外网收发，建议还是OWA/POP3/或VPN；ROH稍嫌复杂些。

你只需开启exchange中的 pop3，http协议，外网即可收发邮件

作者: bensonchen 时间: 2008-6-5 13:07
我已经使用了NO FIXUP PROTOCOL SMTP 25,但如何另外开启25端口呢?使用下面语句可以吗?
static (inside,outside) 220.178.38.92 192.168.1.248 netmask 255.255.255.255 0 0

access-list 107 permit tcp any host 220.178.38.92 eq pop3
access-list 107 permit tcp any host 220.178.38.92 eq smtp
access-group 107 in interface outside

欢迎光临邮件服务器-邮件系统-邮件技术论坛(BBS) (http://bbs.5dmail.net/)