IT Employment

Ask something
Discussion Locked

Exchange 2K OWA Planning question

0 helpful
5 replies

by itpro

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I'm planning to setup a Exchange 2000 server in my office (about 50 person,
each mail not larger than 10MB),
I'm using the Fortigate 200 firewall. I will setup a Symantec SMTP AntiVirus
Gateway in the DMZ (just only open port 25).
If I place theExchange server in the internal LAN, the IIS & SMTP gateway
place in the DMZ, the DMZ just
open port 25, 80 & 443, is it possible & safe ?
I've the following questions in the above idea:
1) How to locate my Exchange server ? Place within the LAN or in the DMZ
is much better ? * I want more protection in the Exchange server.
2) If I enable the OWA for my user, I need to enable IIS & open port 80 in
my firewall. I think its very dangerous.
What should I do? Can I install the Exchangeserver & IIS in seperate
machine ?
Could you give me some more safety suggestion? Thanks a lot !

5 replies

by vstyles

Firstly, if security is what you're after, I suggest that you don't use the default ports on the Exchange Server, just use port mapping on the firewall (if it supports it) to avoid any easy targets. For example, place the E2K server on the lan as 10.152.168.10 (as example) and change the SMTP port from 25 to 2501, POP3 from 110 to 1001, and IIS from 80 to 5840 (just as examples). On the firewall, map the external ip's ports 25, 110, and 80 to ports 2501, 1001, & 5840 on 10.152.168.10. That keeps your exchange server behind the firewall and out of the DMZ and it still gives it access to the world. FYI, you can install OWA on a different machine. Hope this helps.

by aabtahi55

I am trying to do the seperation of IIS and Exchange.
if it is really posible please provide the road.

by gurumagic

My foremost suggestion is to pay the extra money and get the Enterprise version of Exchange for the backend and Standard Exchange for the front end. Enterprise will sit on your LAN and Standard will sit in the DMZ. Exchange 2000 uses this method so that you can protect your Exchange DB on the LAN but still make it accessible to your clients through OWA. Here is an article that explains the architecture a bit more.

http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=AFAD8426-572E-40F8-99DA-EB7198F374C4

As for your second question, yes if you do not use the front end / back end approach you would have to open port 80 and be very vulnerable to all the IIS security issues.

Hope this helps

Trevor Whitworth, MCSE

by mbeaudreault

If the world where perfect then you would be able to speing for a new server and software for the owa server and place it in the DMZ as a "front end" server (think that was mentioned and it is a great way to do it) If you only have an office of 50 or so, you can also look at alternatives to OWA such as seeting them up in PoP3 or IMAP4 and locking that down (this would of course mean some configuation on the user's remote end) I like Owa better, but keep your options open.

This discussion is closed to new replies.