Solved

Exchange 2010- Communication Issue from DMZ to internal domain

Posted on 2010-11-11
6
763 Views
Last Modified: 2012-08-13
Back ground information: I was to set up to exchange 2010 servers; One with HUB and CAS (we will call it Joker) and the other Mail server (we will call it Batman).
The mail server is to be located within the internal domain (XXXX.ad)

I set up both servers internal and both have (xxxx.ad &xxx.ad) names. I had them communicating to each other and connection to the internal domain controller’s fine.
Then I was approached that for security reasons I should move the "front -end" server (HUB/CAS- Joker) into the DMZ but keep the mail server (batman) internal. After long agreement I moved the Joker server into the dmz. Now I can not communicate with the internal DC's to authenticate and regain the communication for the complete exchange system.

Error: I have the following error from a server within the DMZ. (Please see image).

Setup...
DMZ- (xxxx.org)
OS server- Win 2K8 R2 Server
Exchange 2010 server Hub & CAS – “Joker”
Local DNS within DMZ (no trust built with internal domain)
I’ve added a new zone XXX.ad and added an “Host A” record for “Joker”.

**Also, we have an external facing DNS (external IP address, not trust to the internal domain). This is used for OWA communication.**

Internal- (XXX.ad)
Domain connection, all DC’s and Exchange 2010 Mail server.

Perimeter Firewall Routing from DMZ to internal:
ASA5520- Interface to DMZ (10.10.X.X)- Joker
ASA5520- Interface to Internal (10.100.X.X)-
ISA 2006- Second Firewall (192.X.X.X)- Internal domain XXX.ad –
– Batman, DC’s and Domain.




Exchange-DMZ-error.bmp
0
Comment
Question by:Tencha
  • 2
  • 2
6 Comments
 
LVL 24

Assisted Solution

by:Awinish
Awinish earned 500 total points
ID: 34114671
Firstly, its not recomended to install hub/CAS server in DMZ zone,why the reason is explained in below link.

Exchange CAS servers require full access to all mailboxes in an AD Site,  and significant access rights to the AD. That's a level of access  privileged which you should avoid having in the perimeter network.

http://msexchangeteam.com/archive/2009/10/21/452929.aspx

From above error, i can see there is issue with the HUB/CAS server not able to contact GC & DNS which is more related to firewall & port.

Check on the firewall or remove & move to domain these roles as only edge is recommedned to be in DMZ.

Since CAS server also server OWA, Activesync, EWS & many more, so putting in dmz user will not be able to access those services.

Is better to move it into domain now.


0
 

Author Comment

by:Tencha
ID: 34115100
Thank  you for that... is there anyway, after moving the server back into the domain to publish OWA. Though its not recommended placing two nics on the server with an ip address of DMZ and also one internal may help but that breaks security, right?
0
 
LVL 24

Accepted Solution

by:
Awinish earned 500 total points
ID: 34117785
If you transfer role to domain CAS/HUB role will actually not facing internet directly, there will be firewall & i would recommend to install Edge security role.

If you can't move the server back to domain & till you get new hardware for edge role, let your firewall protect your server.

I would not recommend placing two NIC is a gud idea & if you are really concerned about security place edge role.

I don't know whether MS will provide support,if you out cas in dmz in issue.
0
 

Author Comment

by:Tencha
ID: 34148827
I have an anti-spam device in place of edge, Ironmail 6.7 version... I'm working to find if ironmail will allow OWA throw. No solution just yet... Anyone work with edge; do I need additional licensing?
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 34700107
This question has been classified as abandoned and is being closed as part of the Cleanup Program. See my comment at the end of the question for more details.
0

Featured Post

Are your AD admin tools letting you down?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
Following basic email etiquette rules will help you write a professional email and achieve a good, lasting impression with your contacts.
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
This video discusses moving either the default database or any database to a new volume.

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question