I'm working on deploying Exchange 2007 into an existing Exchange 2003 environment. Microsoft does not support placing an Exchange 2007 Client Access Server (CAS) in a perimeter/DMZ network. Microsoft instead suggests placing an ISA Server in the perimeter/DMZ network and using it to reverse proxy requests to the CAS server.
What is the advantage of using the ISA server as a reverse proxy compared to forwarding port 443 from the external network through the perimeter/DMZ to the CAS server on the internal network? Will I have SSL certificate issues if I forward the port? Are there other ports that need forwarding?
Update: I found the following two advantages here:
When you publish an application through ISA Server, you are protecting the server from direct external access because the name and IP address of the server are not accessible to the user. The user accesses the ISA Server computer, which then forwards the request to the server according to the conditions of the server publishing rule.
SSL bridging protects against attacks that are hidden in SSL-encrypted connections. For SSL-enabled Web applications, after receiving the client's request, ISA Server decrypts it, inspects it, and terminates the SSL connection with the client computer. The Web publishing rules determine how ISA Server communicates the request for the object to the published Web server. If the secure Web publishing rule is configured to forward the request using Secure HTTP (HTTPS), ISA Server initiates a new SSL connection with the published server. Because the ISA Server computer is now an SSL client, it requires that the published Web server responds with a server-side certificate.
Adding a second part to the question, are these justification for purchasing a second server, licensing, setup, troubleshooting, etc. How have you done this in your environment, especially in small (<200 users) environments?