Fortigate 50B and RPC over HTTP

[#1]

Hi, I am using the Fortigate 50B before my Small Business Server 2003. Now I want to use Outlook for my agent outside of the company. The Exchange server is configered correctly, but the agents are not able to login outside the company to Exchange over Internet. What I did in the Fortigate 50B: 1. I added The 593 Port as Virtual IP and mapped it to the Exchange server 2. I added a policy that uses this virtual IP to forward packages from wan1-->internal1. These two steps worked fine to forward the HTTP, HTTPS and Remote control port to the server, but the RPC over HTTP is not working. Has anyone an Idea? Maybe there is a problem that the Firewall is checking the certificate and /or blocks it.

[g3rman]

Z.B: Firewall externe IP: 50.50.50.1 Firewall interne IP: 192.168.10.1 Server IP: 192.168.10.100 Name: test External interface: wan1 Type: Static NAT External IP Address/Range: 50.50.50.2 Mapped IP Address/Range: 192.168.10.100 D.H. die externe IP Adresse 50.50.50.2 wird dann auf 192.168.10.100 übersetzt. Die " External IP" hat nur mit der Firewall zu tun, nichts mit dem Client. Macht das so Sinn?

[#3]

OK, ich habe testweise die extenre (internet) IP eingetragen, die sich bei uns alle 24 Std. ändert. Danach kam ich wieder mit anderen Diensten auf den Server, allerding immer noch nicht mit Outlook. Ich dachte auch 0.0.0.0 wäre eine art wildcard für alle eingehenden IPs auf wan1. Kann es evtl. an dem Zertifikat liegen, kann es sein, dass die firewall das prüft udn evtl. nicht durch lässt?

[g3rman]

Switching back to english for the benefit of our other readers ;) Try logging into the command line as admin. Then run this command: diag sniffer packet any ' host w.x.y.z' 3 Replace w.x.y.z with the IP address of your mail server. Then capture the traffic to a text file and post it to your website and let me know where. I can then take a look at what ports it' s trying to use.

[#5]

Do you mean the CLI console? I used this console in the webinterface of the firewall, but I receive: " pcap_open_live: ioctl: No such device for host 192.168.10.100" (<-- server)

[lmuir]

RPC over HTTPS is very simple. It only uses HTTPS for external connections. Provided you can get to your webmail, the FGT config is complete. Have a read of - http://www.petri.co.il/configure_rpc_over_https_on_a_single_server.htm I' m assuming your a single server envionment.

[#7]

But this is waht I did. I forwarded these ports to the server. http://www.stamm-computer.de/firewall2.jpg Server and Client are configured correctly, because old router with forwarding these ports worked fine.

[g3rman]

Can someone confirm that using 0.0.0.0 on the external interface acts as a wildcard to pickup traffic on the firewall IP?

[rwpatterson]

I use the wildcard at home, and I can VIP into my home network using my dyndns.org alias. The wildcard does work. FWF-60AM build 730.

[#10]

Does anyone have an ideo why these settinge: http://www.stamm-computer.de/firewall2.jpg are not working for Exchange via Internet?

[g3rman]

At this point I would recommend running the sniffer command I suggested above from the command line via telnet/ssh. diag sniffer packet any ' host 140.1.1.1' Please substitute your current external address of course. Look for anything that looks SYN packets which are not answered. Also feel free to post some output here so we can take a look if you are not sure. -S