I am deliberating, debating, and looking for a solution to allow public access to Outlook Web Access (OWA) for our company. I would like to accomplish a high level of security, by use of existing resources, minimize expenditures, and a seemlessly implemention.
We currently have a Cisco Pix 515 firewall with 3 interface cards, one for Internal, External, and DMZ. We have a SMTP server (running Symantec Mail Security for Gateways) in the dmz that scans email for virus' and spam, and if clean it is sent internally to our Exchange 2000 std. server. I do not want to touch the EX 2000 server, as it houses about 800 mail clients, as well it currently hosts OWA. We are not currently using ssl to the OWA site, but I would like to implement it. Currently we are port forwarding from the external interface of the pix on port 80 to the internal owa site on the exchange server. No hardening of the IIS, etc. has been done.
I am thinking of a modular approach, and installing another server to host OWA externally (DMZ). I have looked at various MS documents on "front end" exchange servers, and it looks like if I went that route, I would have to install Exchange 2003 std. and make it a front end server, that would sit on the DMZ. We currently have a license for EX 2003 Std. I also have read alot of recommendations for using ISA to reverse proxy to the OWA front end server. I am not a fan of this, and again, want to use what I have. I am concerned however of opening too many ports to my internal servers.
I have also read of folks using Linux/Apache and MS ISA to reverse proxy. As far as using linux, I am not sure I could recommend this to my boss, because we are a large MS shop, and no one there really knows unix that well. I might could get this going, I have experience with several different flavors of unix in past years.
I would appreciate any suggestions, comments, recommendations, or sample configurations that might point me in the right direction if I do choose to go forward with the exchange 2003 std as a front end server, on the DMZ of my pix. Please let me know if I need to provide any further detail...
Thanks,
Bryan
