We are a legitimate company. We have had some issues in the past with Virus attacks/ Spam bots getting our email server blacklisted.
After the most recent attack I have been tasked at coming up with a solution that would allow us to, once determined we are blocked, switch over to a clean server and IP
Here is how my superiors expect this to work... (I feel with the way email is setup and monitored by the blacklists this may not work as they expect.... though the blacklists do function on IP and not domain name....)
Determine which computer or exchange server is infected. Move to clean exchange server or remove infected computer from network Switch the company over to a functional and virus free exchange server. (a secondary is standing by) Switch the exchange server to a secondary IP address to avoid blacklisting.
The idea here is to move to a clean virus free server and an unblocked IP.
Questions:
Is this possible?
Will we just be blocked again? (let's assume we are not sending out spam on the secondary server and IP)
How can I accomplish moving the users from one exchange to the other. Moving mailboxes takes a LONG time. Both exchange servers are on site (physically beside each other)
With email reputation as heavily weighted as it is. Is it reasonable to expect email sent from the secondary IP to reach the users Inbox?
They expect this to take under 30 minutes to make the switch from (worst case) infected exchange server with blocked IP to clean exchange server with clean IP.
Server 2003 R2 Exchange 2003 SP2 Active Directory
Assistance/Advice/ or Alternatives are ALL Appreciated! Thanks everyone, Campo
EDIT: Every Machine has AVG
The Exchange Server is not an open relay and requires Authentication
I have done every step and taken every precaution and we still were infected.
EDIT: BLOCKED AGAIN
new virus name (GRUM)
This is not on our exchange server. No way, scanned with so many things. Went through the registry myself. NOTHING! Scanned all other server NOTHING scanned user computers NOTHING WTF?
Odd thing is email still goes through but we are on the CBL....
Moved SMTP to non standard port. Explicitly blocked port 25 on firewall. delisted us.
UPDATE:
I added additional IPs. Now how do I connect the users on one IP to the server on the other IP? Do I just have the Exchange server have 2 IPs (one for each internal network) or is there more to it?
UPDATE 2
This is a reply to @Madboys comment under his answer:
I have not done it yet. here is the setup. WE now have 5 IPs. I will use 2 for now. 1 for office network. 1 for exchange. Our modem contains both IPs sent to one port on the back of the machine. That LAN cable goes into a switch which then splits into 2. Each goes into our modem (dual Wan RV042) I assign the exchange to one subnet. Network to the other. Please confirm this plan. Ideally a PIX or similar FW appliance would be best. But again 0 dollars must be spent. Question is how will users on one subnet talk to the other? Should I set this up differently? Completely separate networks?
UPDATE 3
****OK I was able to do this. Modem to switch then I have 3 cables out of the switch. 1 Goes to a WRT54G for wireless and to separate outside consultants on their own network (they have no reason to be on ours). The other two cables go to my RV042 which supports Dual WAN. I setup a second sub-net. Now how to I isolate each WAN on its own sub-net? I believe the point of Daul WAN on this appliance is to maintain up time by utilizing separate ISPs.... Please assist. WE ARE SO CLOSE please advice ALSO: I do not see ANY outbound connections on PORT 25 other than from the exchange server. So that is good. And from the exchange the port 25 traffic is at a normal rate reflective of our volume.****
UPDATE 4
I have reasearched Open WRT and other solutons. I came upon PF Sense looks perfect!. Thoughts? I have an old P4 I can use. Then Just need a few compatible network cards :).
Resolved:
Modified network layout.
RV042 supports 1:1 Nat
Isolated Wifi on 1:1 Nat using WRT54G
Using 2 nics on Exchange server
1:1 IP mapped to smtp and OWA etc. Other for network traffic.
Thanks all for their help and assistance with this issue.