OWA placement

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Nathan - 26 Sep 2006 18:02 GMT

Should the OWA servers be in the DMZ or the inside network with the mailbox
servers?

Reply to this Message

Bharat Suneja [MVP] - 26 Sep 2006 18:56 GMT

Recommended on the inside network with mailbox servers - locating them on
perimeter networks (aka "DMZ") will involve opening enough ports from FEs to
the internal network (DCs/GCs/Exchange/DNS servers) to make your firewall
look like swiss cheese.

SSL VPN appliances like Whale's e-Gap (now part of Microsoft) provide a
highly secure way of publishing applications like OWA to the internet,
should your security policies require it.

Signature

Bharat Suneja
MVP - Exchange
www.zenprise.com
NEW blog location:
www.exchangepedia.com/blog
----------------------------------------------

> Should the OWA servers be in the DMZ or the inside network with the
> mailbox servers?

Reply to this Message

Nathan - 26 Sep 2006 19:15 GMT

Thanks for the reply..We have ISA 2004 EE servers in the DMZ for web
publishing (between PIX firewalls)
Internet
PIX (outside)
ISA 2004 (not members of internal domain)
PIX (inside)
Internal network (AD, Exchange, OWA)

If I use ISA OWA publishing, what ports on the inside PIX do I need to open?

> Recommended on the inside network with mailbox servers - locating them on
> perimeter networks (aka "DMZ") will involve opening enough ports from FEs
[quoted text clipped - 6 lines]
>> Should the OWA servers be in the DMZ or the inside network with the
>> mailbox servers?

Reply to this Message

Bharat Suneja [MVP] - 26 Sep 2006 20:02 GMT

Configuring an Intranet Firewall
http://www.microsoft.com/technet/prodtechnol/exchange/guides/E2k3FrontBack/f9733
398-a21e-4b40-8601-cfb452da82ad.mspx

Signature

Bharat Suneja
MVP - Exchange
www.zenprise.com
NEW blog location:
www.exchangepedia.com/blog
----------------------------------------------

> Thanks for the reply..We have ISA 2004 EE servers in the DMZ for web
> publishing (between PIX firewalls)
[quoted text clipped - 17 lines]
>>> Should the OWA servers be in the DMZ or the inside network with the
>>> mailbox servers?

Reply to this Message

Paul from Detroit - 27 Sep 2006 20:07 GMT

"Configuring ISA Server 2004 as an Exchange Frontend Server in the DMZ"
http://www.msexchange.org/pages/article_p.asp?id=993

> Thanks for the reply..We have ISA 2004 EE servers in the DMZ for web
> publishing (between PIX firewalls)
[quoted text clipped - 16 lines]
> >> Should the OWA servers be in the DMZ or the inside network with the
> >> mailbox servers?

Reply to this Message