Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 678
  • Last Modified:

Best method for securing OWA. A frontend server, ISA, or....

Hello,

I've been tasked with setting up Outlook Web Access and am unsure what is the best method for doing so.  A quick overview of the system:
We are a small company with around thrity local users and fifty offsite users (Branch offices and Mobile users).  Exchange 2003 is hosted on a Server 2003 box that also acts as the company work horse (DC, AV server, etc.) and is behind a Watchguard 700 Firewall.  In the DMZ we have a webserver sitting there running server 2000 and initially I had planned to somehow use this for OWA but can not find a way to do so with OWA 2003.  Searching through various articles on this site and others it seems that there are two schools of thought on setting up OWA, one being the use of a frontend Exchange server and the other being the use of a box running ISA.  The frontend method, however, seems to be falling out of favor recently and we don't have multiple exchange boxes so I have some reservations on it.  

Basically at this point I don't know what direction to turn.  I want a secure option for publishing OWA to the net.  I would love to be able to do this without investing anymore money in the system though, if need be, we have the resources to purchase the required components.  Can anyone provide information on what method is best for doing such and why?  Thanks.
0
CorpulantCoder
Asked:
CorpulantCoder
  • 2
  • 2
1 Solution
 
SembeeCommented:
For a solution of this size I would just purchase a SSL certificate from FreeSSL, install it on the Exchange server and allow port 443 through the firewall. This limits your exposure to 2 ports - 25 (SMTP) and 443 (HTTPS).
Putting OWA in a DMZ does not make it a more secure solution.
Both ISA and a frontend server are over the top for this size installation.

Simon.
0
 
CorpulantCoderAuthor Commented:
Yes, I've considered this however it still just doesn't sit right with me.  I'm by no means an expert in this field (I'm a software engineer who's recently been made to wear the admin hat), however, allowing internet access directly to the most sensitive box in the company just feels like I'm asking for trouble.  Am I making an issue out of nothing?  
0
 
SembeeCommented:
It is all about limiting the risks.

Having anything open to the internet is a risk. However I personally feel that having two ports only open (443 and 25) is a lot better than having the numerous ports open for an OWA server to sit in the DMZ.

I have a number of Exchange environments running in this configuration and have no problem with it. If you are a small site then the only thing that outsiders will be interested in is using your server to relay spam through. With the adjustments to Exchange you can make this almost impossible and as long as you have a good password policy you should be fine.

Simon.
0
 
CorpulantCoderAuthor Commented:
Well I went ahead installed/configured a server as a CA and allowed port 443 traffic through the firewall to the exchange box.  All appears to be working fine.  I was hoping with a 500pts reward to get more input from different sources but it appears I was mistaken.  Thanks Sembee for helping out.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now