如何通过Cisco 2801路由器公网IP发布后端Exchange服务器

Got it, let's break down exactly how to get your Exchange server accessible to remote users via Outlook, OWA, and Mobile ActiveSync using your Cisco 2801's public IP. Since you already have NAT working for internal internet access, we'll focus on static port forwarding and access control to route the right traffic to your backend Exchange box.

Step 1: Identify Required Exchange Ports #

First, let's list the critical ports you need to expose—these are non-negotiable for the services you mentioned:

• OWA (Outlook Web App) & ECP (Exchange Control Panel): HTTPS (port 443)
• Outlook Anywhere (Remote Outlook Clients): HTTPS (port 443) – this is the modern method for remote Outlook access, replacing older RPC ports
• Mobile ActiveSync: HTTPS (port 443)
• Optional (for HTTP-to-HTTPS redirect): HTTP (port 80) – useful if users type http://mail.yourdomain.com and want to be auto-forwarded to HTTPS

Step 2: Configure Static NAT Mappings #

You'll need to map your public IP to the Exchange server's private IP for each required port. Let's assume:

• Your public IP on the 2801 is 203.0.113.10 (replace with your actual public IP)
• Your Exchange server's private IP is 192.168.1.50 (replace with your actual internal IP)

SSH into your 2801 and enter global configuration mode, then add these commands:

! Map HTTP (port 80) from public IP to Exchange's internal port 80
ip nat inside source static tcp 192.168.1.50 80 203.0.113.10 80 extendable

! Map HTTPS (port 443) from public IP to Exchange's internal port 443
ip nat inside source static tcp 192.168.1.50 443 203.0.113.10 443 extendable

The extendable keyword lets you map multiple ports from the same public IP (critical if you're using this IP for other services too). If you want a full 1:1 NAT (all ports mapped), you can use ip nat inside source static 192.168.1.50 203.0.113.10 instead, but port-specific mapping is more secure.

Step 3: Allow Inbound Traffic with ACLs #

Next, you need to create an access control list (ACL) to permit external traffic to reach those mapped ports, then apply it to your public-facing interface (let's assume your WAN interface is FastEthernet0/0):

! Create ACL 101 to allow inbound HTTP and HTTPS traffic
access-list 101 permit tcp any host 203.0.113.10 eq 80
access-list 101 permit tcp any host 203.0.113.10 eq 443

! Apply the ACL to the WAN interface's inbound direction
interface FastEthernet0/0
 ip access-group 101 in

Important: Make sure your existing NAT rules for internal internet access are still intact—this ACL only affects inbound traffic to the public IP, so it won't break internal users' internet access.

Step 4: Verify Your Configuration #

Before testing remotely, confirm everything is set up correctly:

• Check static NAT mappings: show ip nat translations – you should see entries for ports 80 and 443 pointing to your Exchange server.
• Check ACL rules: show access-lists 101 – verify the permit rules are present and no unintended denies are blocking traffic.

Step 5: Remote Testing & Additional Tips #

• OWA Test: From an external network, open a browser and navigate to https://[your-public-ip]/owa – you should see the Exchange login page.
• Outlook Test: Configure Outlook on a remote machine using your public IP (or preferred domain) with Outlook Anywhere enabled. Ensure the server settings use HTTPS.
• Mobile ActiveSync Test: Set up your phone's email account using the public IP/domain, selecting ActiveSync as the protocol.

Key Extra Considerations #

• DNS Setup: For user convenience, register a domain name (e.g., mail.yourdomain.com) and point it to your public IP. This avoids users having to remember raw IP addresses.
• SSL Certificates: Exchange requires a valid SSL certificate to avoid security warnings in Outlook, OWA, and mobile devices. Use a trusted CA-issued certificate (not self-signed) that matches your domain name (e.g., mail.yourdomain.com).
• Internal Firewalls: If your Exchange server has a Windows firewall enabled, or there's another firewall between the 2801 and Exchange, make sure ports 80 and 443 are allowed inbound to the server.
• Outlook Anywhere Enablement: On your Exchange server, confirm Outlook Anywhere is enabled (this is default in newer Exchange versions, but worth checking).

内容的提问来源于stack exchange，提问作者Oleg Agadjanyan