Solved

How to configure HUB sever on DMZ?

Posted on 2008-10-30
12
690 Views
Last Modified: 2010-04-21
I am implementing the Exchange 2007 server with CCR. I am using four servers, one for ADS (catalog server), second one common server for edge and Hub, third and four for Mailbox server on cluster (CCR). All these servers are on same local network.

I want to configure HUB server on DMZ. Should I need two NIC in HUB server one for local network and one for DMZ? If this is the case then what will be the DNS servers for DMZ NIC?

Can anyone explain how to configure all these servers on network, IPs, gateway and DNS setting of individual servers?
0
Comment
Question by:amrish_IT
  • 6
  • 5
12 Comments
 
LVL 33

Expert Comment

by:Exchange_Geek
ID: 22845469
"second one common server for edge and Hub"

Are you thinking of installing both on same box - technically, practically, theoretically this is not possible.
My suggestion would be to have 2 node A/P CCR Clusters + CAS & Hub Server + Edge Server (In DMZ)

Personally i believe Hub should not be placed in a DMZ.

MSFT says:

In this scenario, the Exchange 2007 Hub Transport server can be reached directly through the Internet. We don't recommend this topology because it increases security risks by exposing to the Internet the Exchange 2007 server and all roles installed on that server. We recommend that you implement a perimeter network-based SMTP gateway, such as the Edge Transport server, instead.

0
 
LVL 32

Expert Comment

by:gupnit
ID: 22845540
Hi Amrish,
Can you explain the reason you want to place HUB in DMZ any specific reason. See you can achieve same results in LAN too....
To be able to better guide you, we would need exact scenario.
Hope this helps
Thanks
Nitin
0
 

Author Comment

by:amrish_IT
ID: 22847967
Hi,

I have only four server right now, one for AD, two for Mailbox cluster and one for HUB , thats why i have to put HUB server in DMZ.
0
 
LVL 33

Expert Comment

by:Exchange_Geek
ID: 22848051
What about CAS role - where do you plan to place that - with your calculation i could not find that role sitting on AD server for sure and if you plan to merge CAS + HUB in DMZ (This isn't supported nor recommended).

Awaiting your response.
0
 

Author Comment

by:amrish_IT
ID: 22848064
HUB and CAS role will be on same server. If i install edge server separatly then how it will communicate with HUB server because edge server is in DMZ with public IP.
0
 
LVL 33

Expert Comment

by:Exchange_Geek
ID: 22848145
If you are in shortage of servers - why not simply have hub role in your local LAN behind a firewall ??
Remember Hub (in local LAN of DMZ) will also have all those functionality (almost - all) as those of EDGE.

If you place Hub in the DMZ - you need to open port 135 (RPC)+ 389 (LDAP) + 25 (SMTP) + 53 (DNS) + 443 (SSL).

Now look at the ports used by EDGE.

    * LDAP: Port 50389/TCP
    * Secure LDAP: Port 50636/UDP
    * SMTP: Port 25/TCP
    * Optional: enable RDP: Port 3389/TCP

You basically are opening up all the ports required for Hub (if it is placed in DMZ) - so if your Hub is compromised - your AD / Exchange is compromised too. That is the reason no one recommends nor practices placing Hub in DMZ.

Oh and CAS ROLE IN DMZ IS NOT RECOMMENDED NOR SUPPORTED.
0
Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 
LVL 33

Expert Comment

by:Exchange_Geek
ID: 22848148
0
 

Author Comment

by:amrish_IT
ID: 22848623
can I add edge server later on??
0
 
LVL 33

Accepted Solution

by:
Exchange_Geek earned 250 total points
ID: 22848707
Any time. there is no time restraint for adding an Edge nor any hard code rule that if you have Hub first Edge will behave like a spoilt brat.

Do not worry if you want you can add EDGE server as and when you can arrange for another hardware for it.
0
 

Author Comment

by:amrish_IT
ID: 22848826
Information provided by you is very helpful. thank you very much.
0
 

Author Closing Comment

by:amrish_IT
ID: 31511801
thank you so much for your help
0
 
LVL 33

Expert Comment

by:Exchange_Geek
ID: 22849174
Glad to have been able to answer your queries.

God Bless.

Take Care
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This process describes the steps required to Import and Export data from and to .pst files using Exchange 2010. We can use these steps to export data from a user to a .pst file, import data back to the same or a different user, or even import data t…
Learn to move / copy / export exchange contacts to iPhone without using any software. Also see the issues in configuration of exchange with iPhone to migrate contacts.
In this video we show how to create a User Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Mailb…
To show how to create a transport rule in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Mail Flow >> Rules tab.:  To cr…

896 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now