Re: Moving Exchange Server

From: Mark Arnold [MVP] (mark_at_mvps.org)
Date: 01/07/05 

Date: Fri, 07 Jan 2005 13:26:39 +0000

On Thu, 6 Jan 2005 20:25:02 -0800, Dan <Dan@discussions.microsoft.com>
wrote:

>Placing them in the LAN gives internal users 100% access with no firewall to
>protect against viruses or anything an internal user desires to do to them,
>so what you are stating is not safe at all, they are wide open! How do you
>keep the servers safe from Internal users? It is not just external users
>(Internet) you have to deal with, you must look at all sides, this is why
>there IS a DMZ! External users access the FE Exchange via HTTPS, so
>everything is encrypted and only one port is open to all users, internal or
>otherwise. The communication between BE and FE are on the same switch in the
>DMZ, thus 0% risk/ports open between them. You never want to open ANY ports
>on the LAN. This is just common security 101.

I think you misunderstand what the DMZ is for, or we misunderstand
what you have actually done.
1. The ISA Server and/or smtp gateway located in the DMZ receives all
the inbound mail and scans it using a packlage of your choice.
2. Safe mail is then sent to the Exchange servers which also have anti
virus installed.
3. The clients, which also have anti virus communicate with each other
and the Exchange server in a safe, virus free manner.

If you only have TCP443 permitted from the perimiter into the DMZ then
the DMZ isn't a DMZ, it's a badly segmented section of LAN and you
might as well collapse these two lan segments into one.

>
>What I need is to consolidate AD to one domain and ensure that everything
>will work properly. If Microsoft Exchange and/or Active Directory cannot run
>in the DMZ, then I need to know how I need to make it secure, because placing
>it in the LAN is not secure in my mind.
>
>Do I remove the child domain and then add AD to the LAN as the root?
>Then reload the AD for the root (after waiting 24 hours for replication) as
>a second server in the LAN?
>
>But then this opens up more holes between the DMZ and the LAN...so I am just
>not sure how you allow communicaton to work 100% correctly without a VPN
>connection for all external users and budgets will not allow this...so how do
>you allow POP3 SSL or Exchange Services to run and be protected and have
>authentication work properly? The books and Microsft techs are conflicting
>and they keep changing their minds...
>
>If this were a new install, what is the best (most secure) method for AD and
>Exchange? I do not see how an external user could damage a FE exchange server
>as they must have a password to gain access and only 1 port is open to the
>outside.
>
>ok now I am just rambling on again... could someone give me a straight
>answer on this one? What is the most secure method to deploy, regardless of
>cost...the ideal to keep BOTH internal and external users in check...
>
>Dan
>
>
Please see www.msexchange.me.uk/drawing12.jpg
This shows what your network should look like and yes, it's safe.
Properly configure the firewall to send all traffic to the ISA.
Properly configure the ISA to publish the OWA and RPC over HTTPS and
the POP etc. etc.

Relevant Pages

  • Re: Exchange on the Web
    ... >I have Exchange running in a DMZ. ... >Everyone in the office can access their mail via Internet explorer ... This would normally be ok BUT the exchange server is of course ... The firewall at the moment fires everything to the existing ...
    (microsoft.public.inetserver.iis)
  • RE: Exchange in the DMZ
    ... Exchange on the internet is just not very secure.. ... If the front end server is for SMTP and HTTP access, ... firweall rules so that only smtp and httpare allowed from the dmz ...
    (Focus-Microsoft)
  • Re: Moving Exchange Server
    ... Placing them in the LAN gives internal users 100% access with no firewall to ... DMZ, thus 0% risk/ports open between them. ... If Microsoft Exchange and/or Active Directory cannot run ... >> Internet is better? ...
    (microsoft.public.exchange.setup)
  • Re: xp security vulnerabilities?
    ... > OK - please don't flame me for a newbie dumbass question but I have been ... You should start by assessing your security worries. ... if you want to secure your machine from damage from the internet all you ... If you do all that you're pretty safe, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Lets talk about firewalls - what do we as a group think a firewall should be/have?
    ... NAT, and the DMZ, since it's already secured, is a good place to tack ... If the "company" is not offering services to the Internet, ... and connections to the internal LAN should ... be by means of a second interface on the server. ...
    (comp.security.firewalls)
Loading