Exchange Front End Server - put in the DMZ?

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Phil McNeill - 31 Jul 2008 14:01 GMT

What's the general concensus on doing this? It seems to me that if you want
your front end to do recipient filtering among other things then it has to
have access to active directory data. Your choices then seem to become
making it a domain controller, thereby having your entire accounts database
replciated out into a less secure network, or you can open up a ton of ports
to allow it to communicate with the internal network. Seems like it could
almost make you less secure, rather than more.

Is an Exchange front end server on the DMZ a good or a bad idea, and if a
bad one, what's a better alternative if you're looking for it to handle
inbound mail as well as OWA?

For my specific implementation we're using Exchange 2003.

Thanks!

Phil

Reply to this Message

Lee Derbyshire [MVP] - 31 Jul 2008 14:12 GMT

> What's the general concensus on doing this? It seems to me that if you
> want your front end to do recipient filtering among other things then it
[quoted text clipped - 13 lines]
>
> Phil

Generally considered a bad idea these days, since you need to put so many
holes in the firewall in between. You may as well just let the http traffic
in to your server, since MS has IIS pretty well locked down nowadays. In
addition to SMTP, of course.

Lee.

Signature

______________________________________

Outlook Web Access For PDA , OWA For WAP
www.leederbyshire.com
email a@t leederbyshire d.0.t c.0.m
______________________________________

Reply to this Message

David Ruth - 31 Jul 2008 15:02 GMT

The current recommendation is Front End server in the production network with
an Application Layer Firewall in the DMZ in front of it. Of course Microsft
recomends ISA and it's is probably the best choice. A lot of people try and
skimp on the firewall and try and get away with port filtering only.
Probably not a good idea since you will be accessing internal resources from
the cloud.

http://technet.microsoft.com/en-us/library/bb123753(EXCHG.65).aspx
http://technet.microsoft.com/en-us/library/bb123580(EXCHG.65).aspx

> What's the general concensus on doing this? It seems to me that if you want
> your front end to do recipient filtering among other things then it has to
[quoted text clipped - 13 lines]
>
> Phil

Reply to this Message

Jamestechman - 31 Jul 2008 16:07 GMT

Still the same; not recommended.

"We do not recommend placing an Exchange front-end server in a
perimeter network because it is not designed to be a security context,
and it requires extensive connectivity to Active Directory and the
Exchange back-end servers."

Application Layer Firewall protection for Exchange Server 2003 with
ISA Server 2004
http://technet.microsoft.com/en-us/library/cc713326.aspx

James Chong (MVP)
MCITP | EMA; MCSE | M+, S+,
Security+, Project+, ITIL
msexchangetips.blogspot.com

On Jul 31, 9:01 am, "Phil McNeill"
<philmcne...@REMOVETEXTINCAPShydroottawa.com> wrote:

> What's the general concensus on doing this? It seems to me that if you want
> your front end to do recipient filtering among other things then it has to
[quoted text clipped - 13 lines]
>
> Phil

Reply to this Message

Phil McNeill - 31 Jul 2008 19:52 GMT

Thanks for the responses everyone. Pretty much what I expected, but now
it's not just me saying it. ;)

Thanks

> What's the general concensus on doing this? It seems to me that if you
> want your front end to do recipient filtering among other things then it
[quoted text clipped - 13 lines]
>
> Phil

Reply to this Message