Accessing Outlook thru SSL VPN (port to be Enabled)

We are in the process of configuring SSL VPN, we have enabled MS outlook to be available for VPN users thru tunneling. our SSL VPN box is in DMZ, and right now traffic is enabled for port any to any from VPN box to our Backend exchange server which is in different zone and vice-versa.

As part of security, we want only to enable those port which is required to get outlook working thru RPC from SSL VPN box to exchange serrver and vice-versa.

Our Exchange Farm:
Front end server in DMZ (Web mail configured)
Backend server in Server Zone
No RPC over HTTPs configured
TJOSYAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

lucidica-jamalCommented:
Hiya,

If you are using a VPN, then all you need to open is the VPN port, no other ports need to be open to allow exchange information to pass through, as it will all pass through the VPN port.

Hope that helps!

0
TJOSYAuthor Commented:
thats from external to VPN box. My requirement is from VPN box to Exchange Server
0
lucidica-jamalCommented:
Oh ok...
Exchange uses alot of ports!

A list of them are available here: http://www.petri.co.il/ports_used_by_exchange.htm

Hope that helps!
0
MesthaCommented:
What you should do is remove the frontend server from the DMZ. Whatever your reason for putting it there, I can guarantee that it is wrong. It does nothing for your security and actually weakens it.

Put the frontend server inside, configure RPC over HTTPS. It only needs one port then - 443.
You could look at using SSL offloading, which would then only need port 80, but requires very careful configuration. A lot of people have problems with it, so usually end up using conventional RPC over HTTPS with a certificate on the frontend server and just using the SSL VPN as an additional wrapper.

Simon.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Exchange

From novice to tech pro — start learning today.