1

I've been exhaustively Googling this issue to no avail, and am at the point where Microsoft's $2000 support quote is actually looking reasonable, but I was hoping maybe someone here would have an idea.

PROBLEM: we would like to disable Exchange access for anyone not on our corporate LAN. The location is a small offshoot of the main branch and has its email hosted locally for security reasons. We don't want anyone outside the building to be able to add their Exchange account to an Outlook install or mobile device or anything like that. We are running Exchange 2013 on Server 2012R2, IIS 8.

We tackled the mobile device thing with Exchange's quarantining function, but no such thing exists for desktop users. I have tried:

  • going into the EPC, Servers -> Outlook Anywhere and blanking the Outlook Anywhere external host name/replacing it with something that doesn't resolve - this did absolutely nothing as far as I can tell
  • running the Get-Mailbox -MAPIBlockOutlookRpcHttp command on the mailboxes I don't want to have access to Outlook outside of the network. While this used to work on Exchange 2007, in 2013 it disables access for internal users as well
  • setting up IP address and domain restrictions on the RPC website in IIS to disallow everything that isn't a local IP - also did absolutely nothing, even when set to deny every single IP range
  • blood magic

I feel like this shouldn't be this hard. We're not concerned about external access to OWA, since we have a two-factor appliance in front of it that. Disabling autodiscover won't do either; any requests to authenticate to Exchange from a public IP should be shot down, period.

I know this issue is pretty niche (given that I've found only a few similar incidents on Google), but I'm hoping someone here might be able to figure out what I'm doing wrong. Thanks in advance!

Improve this question
5
  • Where'd you get that support cost? A single incident support case is $499.00 USD.
    – joeqwerty
    Jan 29, 2016 at 16:04
  • We paid the initial single-incident support cost which was $300 CAD. The tech who took the case told us this would require a 5-pack, which is $1500. So $1800 plus tax.
    – Tarus
    Jan 29, 2016 at 16:07
  • 1
    Oh my. I think he's trying to pull a fast one. This is a single incident. They'll work this incident until it's resolved to your satisfaction. My suggestion would be to call them back and ask to speak to a support supervisor and explain the situation about the original rep trying to sell you a 5 pack. I've never had anything like this happen and I've used Microsoft PSS many times.
    – joeqwerty
    Jan 29, 2016 at 16:09
  • I suspected so as well, but his reasoning is that, since this is something we should be using a third-party product for (not sure where he's getting that), it will require a lot of work on their end. But I may try them back and try the supervisor idea, thanks.
    – Tarus
    Jan 29, 2016 at 16:13
  • 1
    Yeah, that's sketchy. The amount of work they have to do is irrelevant. They work an issue until it's resolved, regardless of how much work they have to do or how many people have to get involved. It sounds like the rep you spoke to didn't have a handle on how MS provides support, or he/she was trying to pull a fast one on you. I'd definitely recommend calling them back and getting to the bottom of it.
    – joeqwerty
    Jan 29, 2016 at 16:17

2 Answers 2

Reset to default
0

You need a reverse proxy. The Exchange product team outlined how to do it in a blog posting from 2013.

http://blogs.technet.com/b/exchange/archive/2013/07/19/reverse-proxy-for-exchange-server-2013-using-iis-arr-part-1.aspx

That will allow you to control access to 443, so you can allow OWA, ActiveSync, but block Outlook Anywhere.

Although the IP address restrictions should have worked. Did you run IISRESET afterwards so it took effect?

Improve this answer
7
  • In terms of the reverse proxy - would this only affect adding inboxes outside the network? Or will it affect mail traffic? As for the IP restrictions, I'm not sure why they didn't work. I ran iisreset, restarted IIS using the GUI, rebooted the whole server, manually restarted the processes - but even in a test scenario of disallowing every single IP range access to the entire Exchange website I could still add accounts on an external address without issue.
    – Tarus
    Jan 29, 2016 at 16:33
  • Unfortunately it looks like the ARR solution requires two NICs, which the location currently isn't set up for.
    – Tarus
    Jan 29, 2016 at 16:45
  • Email comes into your Exchange server on port 25. Anything you do to block ports 80 and 443 won't have any bearing on incoming email.
    – joeqwerty
    Jan 29, 2016 at 17:54
  • ARR would only affect the traffic that you point at it. It will require a separate server as well - this is not something that you can deploy on to the Exchange server.
    – Sembee
    Jan 29, 2016 at 18:57
  • As for the restriction - your traffic must be getting to the server in a way that you are not expecting. The blocking works in IIS, I know it does, so for it to not to work you either set it up incorrectly or the traffic is coming in a different way. This is not something that Exchange is designed to do. Restricting external traffic is a job for a firewall or application publishing system.
    – Sembee
    Jan 29, 2016 at 18:58
0

The easiest way is just to not expose your mail server on ports 80/443 to the external world if you don't want ANYONE external to be able to access it. Still allows for internal communication. If you have firewall rules allowing it then turn them off.

Improve this answer
3
  • Outside of that - you could also create IP range rules in IIS to block traffic unless it originates from your LAN for OWA/Activesync/Autodiscover/etc... (default site on exchange server)
    – Daniel Schofield
    Jan 29, 2016 at 15:58
  • The location needs to be able to receive email from public addresses, since it still has third-party contacts. As stated in the OP, I've tried creating IP range rules with IP Address and Domain Restrictions - this did nothing, even after being applied to A) the entire website B) Just RPC C) OWA, EWS, Activesync, Autodiscover, RPC. Unless you're referring to another method?
    – Tarus
    Jan 29, 2016 at 16:02
  • Disabling HTTPS access through the firewall would disable OWA as well as Outlook Anywhere, which is probably not what the OP wants to do.
    – joeqwerty
    Jan 29, 2016 at 16:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .