Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have one guy at my company telling me that I should put FF:TMG in between my main Internet-facing firewall (Cisco 5510) and put my Exchange server and DC on the internal network.

I have another guy telling me that I should put the Exchange server and DC in a DMZ

I don't particularly like the idea of having my mailboxes and DC's usernames/passwords in a DMZ and I think that Windows authentication would require me opening up so many ports between my DMZ and my internal network that it would be a moot point to have it out there anyways.

What are some thoughts? How do you have it set up?

share|improve this question
up vote 4 down vote accepted


It depends on what Exchange version you're using. If you have Exchange 2007 or 2010, there is a role custom made for living in a DMZ: the Edge Server. Put that server in your DMZ and configure correct ports between that server and your private-network Exchange Hub-Transport servers. If you have Exchange 2000/2003, there is no good solution as far as InfoSec is concerned, you're pretty much stuck opening up SMTP (and TCP/443 if you use OWA) to a domained machine.


Again, depends on your Exchange version. If you're at 2007/2010, the Edge server is designed to operate without any live connection to an actual domain-controller so there is absolutely no need to put a DC in the DMZ. If you're with 2000/2003 the server that's receiving Internet mail will have to be domain-connected somehow, which can be to a DC in DMZ (but with no DMZ/Internet firewall ports open) or to DCs on the private network by way of DMZ/Private firewall policy allowing the traffic.

Keep in mind that "DMZ" does not equate to "all ports open", you can open just the ports you need for both your DMZ/Internet and Private/DMZ firewalls. You can keep an Exchange 2000/2003 server in the DMZ and poke holes in your private/DMZ firewall to allow it to communicate to the DCs in the private network. Yes, it's a stepping stone to having your DC's hacked, but if that really concerns you upgrade to Exchange 2010 where Microsoft has engineered a much better solution to the problem.

share|improve this answer

Everyone will tell you the same thing - never put a DC on the DMZ. Keep your Exchange and all DC's on the internal network, protected behind your firewall/FF:TMG. Simple as that.

share|improve this answer
This.....ten chars – Tatas Aug 10 '11 at 19:11

At one point my team discussed placing a Forefront / ISA type box into the DMZ that all inbound traffic would land on prior to being bounced into the internal network. My goal was to publish Exchange 2003 via a DMZ and have all the traffic sanitized before it reached my internal network without the need to replace our PIX or otherwise make make major infrastructure changes.

This worked in my test environment with only opening 23 and 443 into the DMZ and only 23 and 443 into the internal network.

share|improve this answer

The only Exchange role Microsoft will support in a DMZ is the Edge Transport role. Everything else has to be in the internal network.

Also, whoever told you to put a DC in the DMZ needs some serious schooling on Active Directory and security. Slap him across the face a couple of times for us.

share|improve this answer
now guys, be nice. He's a Linux admin lol – blsub6 Dec 21 '10 at 19:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.