Cisco PIX 7.x MPF configuration for Exchange ActiveSync

 17 Oct 2006 02:09:27 am

We recently (finally) upgraded our Microsoft Exchange server to SP2, a nice feature that adds for us WM5 folks is the Exchange Server ActiveSync Push capabilities. Basically our device sends a long lived https query to the server which waits until something new shows up (or the timeout period expires) before sending a response.

However we quickly discovered that we were not getting “pushed” the mail, but we were getting a long string of Event 3033 Application Log errors on the Exchange server (The average of the most recent [200] heartbeat intervals used by clients is less than or equal to [540].)

Our firewall configuration is a little atypical in that we are basically using 2 firewalls. A Cisco PIX (515e) directly connected with an ISA server sitting on the DMZ. Yes I realize that it’s a bit redundant to have a firewall behind the firewall, it’s this way because when we originally deployed ISA we weren’t quite comfortable yet with sticking a Windows server directly on the internet (if we were to do it again I’d stick it on the outside). Needless to say things have yet to change and for lack of a compelling reason to do so they will probably remain the same for some time to come.

Now Cisco PIXes are pretty much a staple when it comes to corporate firewalls and the default timeout for TCP connections is 60 minutes, in addition we have plenty of customers running them with Exchange and were not having issues on their end so you can imagine our confusion. I scrubbed through the ISA configuration and made sure the HTTPS timeouts were at least 45 minutes (2700 seconds), the default maximum heartbeat interval for Exchange, but they were still failing.

Fortunately one of our other engineers who is good with PIXes came up with a better way of doing it using the Modular Policy Framework (MPF), keep in mind that this only works under 7.x:

class-map HTTPS
match port tcp eq https
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns migrated_dns_map_2
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_2
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect pptp
inspect rsh
inspect rtsp
inspect skinny
inspect sqlnet
inspect sunrpc
inspect xdmcp
inspect icmp error
inspect icmp
class HTTPS
set connection timeout tcp 0:45:00

Basically, we create a new class map for HTTPS traffic, then apply it to our policy map (“class HTTPS”) and set the timeout option to 45 minutes. Since we were unable to find a config out there (Google, etc.) relating to HTTPS timeouts with MPF I wanted to make sure to post for those of you running into similar issues.

As I mentioned we do have a lot of other clients with PIXes in front of their Exchange servers, however none with ISA on the DMZ so my hunch is that our issue may be related with this configuration. I’d love if someone else with a similar configuration could confirm/deny my theory.

Erik Szewczyk

Category : Exchange | Posted By : Erik | Comments [2] | Trackbacks [0]


The URI to TrackBack this entry is :


Could you elaborate a bit?

By : Glen @ Time : 27 Oct 2006 01:59:08 pm :

Thanks for the article. I'm a bit confused as to why you need to create a specific timeout for HTTPS of 45 minutes if the Pix default is 1 hour?

TCP Timeout

By : Erik Szewczyk @ Time : 27 Oct 2006 02:13:17 pm : Email : Home

The default TCP connection timeout for Cisco Pixes is 60 minutes. It can be altered using the timeout xlate command:
timeout xlate hh:mm:ss

You can also do a show xlate to see how it is currently configured.

The problem was even though our xlate timeout was set to 60 minutes the TCP connections back through our ISA server were getting dropped (hence the 3033 errors on the Exchange server).

To ensure that our HTTPS connections would live up to 45 minutes (which is the default maximum heartbeat lifetime set in Exchange) we used the MPF to create a custom class specifically for HTTPS traffic.

Hope that makes a little more sense,

Add Your Comment




Email Address (Optional)

Home Page (Optional)

Security Code
Click to display security code
Note:Security Code valid for only 10 minutes!
Need to enable javascript & accept cookies to work
Please enter the security code as displayed :

NOTE: All comments are now moderated and will not immediatly appear.