Exchange ports: Exchange, network, security, ports

by: NpatangPosted on 2009-09-10 at 22:38:29ID: 25306905

Don't open 135 port o the firewall. 135 is only used by the internal outlook clients to connect with exchange server.
For RPC over HTTPS you just need the 443 port on the firewall. opening the 135 port that for End point mapper on t he firewall will be dangerous on firewall.

by: farodanePosted on 2009-09-11 at 00:31:53ID: 25307283

Yeah, but RPC over HTTPS will never connect to Exchange without these ports open?

by: Rajith_EnchiparambilPosted on 2009-09-11 at 00:39:46ID: 25307315

On the external firewall, make sure you only have 443 open, that is all what you need for Outlook Anywhere.

Create a test account and run the Outlook Connectivity Test in the Microsoft test website. See what flags up and post the errors here for further help.

https://www.testexchangeconnectivity.com/

by: farodanePosted on 2009-09-11 at 00:48:13ID: 25307352

Im still doubting that 443 is the only port necessary to be opened.
My experience tells me, with only 443 opened, I get a laggy session thats mostlikely to crash before it can estabilish a connection, and whenever I get a connection, I can only receive email, as soon as I begin sending emails, it drops out again.

When I opened 135 tcp and 1030-1099tcp, it was like connecting to exchange locally.

by: Rajith_EnchiparambilPosted on 2009-09-11 at 01:05:23ID: 25307404

Did you run the test as per my post above? That will flag any issues you have.

by: SatnPosted on 2009-09-11 at 01:21:24ID: 25307484

Hi,
Rpc uses random ports to ensure a client can talk to the servers (called ephemeral ports). Since this is not possible over the internet (due to security and some other reasons) Rpc over http was decided, where Rpc uses Http as its transports (port 80 or 443) and connects to iis. Iis, from here uses rpc again to connect to the mailbox. This is the reason why you'd need to configure only port 443 (since exchange doesnt allow non secure connections in rpc http by default). If rpc over http doesnt work for you like this, then you'd need to continue troubleshooting basis articles and info the other folks have mentioned here. I hope this helps.

Thanks

by: MesthaPosted on 2009-09-11 at 02:07:15ID: 25307696

Outlook Anywhere only uses port 443. However because of the way that Outlook works, it will attempt to connect using the regular TCP/IP connection and should then fail over to the HTTPS connection. Have you checked that Outlook Anywhere is configured in the Outlook client ?

Simon.

by: v-jushawPosted on 2009-09-11 at 02:31:52ID: 25307794

You asked for risk involved with keeping port 135 open, here is a brief description. "You should close it immediately"

Microsoft's DCOM (Distributed, i.e. networked, COM) Service Control Manager (also known as the RPC Endpoint Mapper) uses this port in a manner similar to SUN's UNIX use of port 111. The SCM server running on the user's computer opens port 135 and listens for incoming requests from clients wishing to locate the ports where DCOM services can be found on that machine.

Port 135 is certainly not a port that needs to be, or should be, exposed to the Internet. Hacker tools such as "epdump" (Endpoint Dump) are able to immediately identify every DCOM-related server/service running on the user's hosting computer and match them up with known exploits against those services.
Any machines placed behind a NAT router (any typical residential or small business broadband IP-sharing router) will be inherently safe. And any good personal software firewall should also be able to easily block port 135 from external exposure. That's what you want.

In addition, many security conscious ISPs are now blocking port 135 along with the notorious "NetBIOS Trio" of ports (137-139). So even without any of your own proactive security, you may find that port 135 has been blocked and stealthed on your behalf by your ISP.

Going Further: Closing port 135

The widespread exposure and insecurity of this port has generated a great deal of concern among PC gurus. This has resulted in several approaches to shutting down the Windows DCOM server and firmly closing port 135 once and for all. Although applications may be "DCOM enabled" or "DCOM aware", very few, if any, are actually dependent upon the presence of its services. Consequently, it is usually possible (and generally desirable if you're comfortable doing such things) to shut down DCOM and close port 135 without any ill effects. (The fewer things running in a Windows system, the fewer things to suck up RAM and slow everything else down.)

For your other ports go to https://www.grc.com/port_1030.htm and it will tell you what the port is used for, what applications could use it, and what viruses attack that port.

Hope this helps!

by: farodanePosted on 2009-09-16 at 01:24:06ID: 25343139

Thank you for your comments.

by: farodanePosted on 2009-09-16 at 01:24:55ID: 31627419

Thank you.

Question

Exchange ports

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Exchange

network

security

ports

Windows 95 - 98 Networking

Consumer Firewalls

Exchange Email Server

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press