1

Has anyone experience with exposing the web access (OWA) of an Exchange 2010 server through a Cisco ASA (my goal is to something like a DMZ)? If so could you give me some advice? I know that Exchange doesn't support DMZ and that MS recommends using TMG. Still, I'd like to know if someone has managed this (I've tried and wasn't very successsful so far). Or would it be better to ditch (read: sell) the ASA and use a TMG server instead? We're completely on Windows Server 2008 R2 and some remaining 2003 server running mostly as file servers. We don't use the VPN features much at the moment but plan on doing that in the future, but OWA should be there if VPN is not possible from outside.

Thank you very much!

2
  • I don't think I understand you correctly, you would like to open port 443 (and possible 80) to the exchange server, just as I imagine port 25 is open to the world?
    – 3molo
    Nov 3, 2010 at 17:27
  • What I'd like to do is this: Put Exchange 2010 in a DMZ. Now, Micrsoft doesn't support this scenario. Exchange needs to contact AD so needs to be member of that network. If I only do a port forwarding I have a security risk. So basically I would need to configure the ASA to allow AD traffic to and from Exchange in addition to MAPI and OWA. Which would basically render the DMZ somewhat useless. So the only way to do this safely seems to be using the Threat Management Gateway. At least this is Microsoft's recommendation (of course).
    – Gir
    Nov 4, 2010 at 10:16

3 Answers 3

1

Don't dump your ASA. TMG is very easy to manage inside of your DMZ of the ASA. The TMG will have to be dual-homed...that is, have a foot in both your DMZ network AND your inside network. Setting it up is a breeze and TMG makes it easy to publish OWA to the web. Remember that dual-homed servers only ever like to have one default gateway, so be aware of that or it can cause you issues.

I set this scenario up exactly and it works like a charm.

1
  • Thanks for your reply and also sorry about me getting back to your reply only now. Looks like we'll be going the combined ASA/TMG route. For our current situation that seems to be the best way of handling this. I've also played with giving the server to IP addresses (it has a dual NIC, no routing installed) but Exchange then either drops connection to the AD or it doesn't respond to the outside interface thus effectively disabling client access. A bit frustrating. And when it works (which did happen) usually only until the next reboot (regardsless of NIC order).
    – Gir
    Nov 30, 2011 at 12:02
0

For decent security you should consider using a Microsoft ISA server in the DMZ and open external access to the ISA box instead of direct access to your Exchange box. From the ISA box you permit http/https connections back to your Exchange server and configure ISA to reverse proxy the requests. ISA can also do form based authentication to give the user a nicer login prompt.

If you don't mind using a free product Apache HTTPD (on either Linux or Windows) can obviously do this but the standard Microsoft solution would be ISA Server.

3
  • Thank you for your suggestion. Basically the TMG is the successor to the ISA Server. Since I've also got also problems getting VPN connections through to the VPN Windows Server I'm considering switching completely to the TMG and dropping the ASA. Since we also need new switches our dealer offered us to take the ASA I might even get this done without costing additional money.
    – Gir
    Nov 19, 2010 at 8:37
  • One thing. It was also suggested to me to put a read only DC in the DMZ which can then be used by exchange. I might give this a try but I'm not sure. In either case I'll post my findings.
    – Gir
    Nov 19, 2010 at 8:39
  • As an FYI, it's no longer called ISA Server and is now known as Forefront Threat Management Gateway...
    – GregD
    Sep 30, 2011 at 1:44
0

The ASA's solution for this scenario is "Clientless SSL VPN" (aka "WebVPN"). The ASA will run a HTTPS server and handle the authentication. It then reverse proxies HTTP back to the internal server, with SSO if necessary.

The advantage of this is that you're only exposing the ASA to the outside world (rather than full HTTP access to your mail server), and they only get "deeper" access after the authentication.

It's quite neat and gives a lot more functionality (there are SSH and RDP applets available as well), but it does require additional licenses. Depending on the number of users this might make it a less attractive option (it did for me!)

1
  • Sorry for the late reply. Yes, I have also looked into this but the licenses were too much for my management's taste. It looks like we'll be going the TMG route as GregD said since we get that cheaper than the Cisco licenses.
    – Gir
    Nov 30, 2011 at 11:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .