Solved

Exchange 2010- Communication Issue from DMZ to internal domain

Posted on 2010-11-11
6
761 Views
Last Modified: 2012-08-13
Back ground information: I was to set up to exchange 2010 servers; One with HUB and CAS (we will call it Joker) and the other Mail server (we will call it Batman).
The mail server is to be located within the internal domain (XXXX.ad)

I set up both servers internal and both have (xxxx.ad &xxx.ad) names. I had them communicating to each other and connection to the internal domain controller’s fine.
Then I was approached that for security reasons I should move the "front -end" server (HUB/CAS- Joker) into the DMZ but keep the mail server (batman) internal. After long agreement I moved the Joker server into the dmz. Now I can not communicate with the internal DC's to authenticate and regain the communication for the complete exchange system.

Error: I have the following error from a server within the DMZ. (Please see image).

Setup...
DMZ- (xxxx.org)
OS server- Win 2K8 R2 Server
Exchange 2010 server Hub & CAS – “Joker”
Local DNS within DMZ (no trust built with internal domain)
I’ve added a new zone XXX.ad and added an “Host A” record for “Joker”.

**Also, we have an external facing DNS (external IP address, not trust to the internal domain). This is used for OWA communication.**

Internal- (XXX.ad)
Domain connection, all DC’s and Exchange 2010 Mail server.

Perimeter Firewall Routing from DMZ to internal:
ASA5520- Interface to DMZ (10.10.X.X)- Joker
ASA5520- Interface to Internal (10.100.X.X)-
ISA 2006- Second Firewall (192.X.X.X)- Internal domain XXX.ad –
– Batman, DC’s and Domain.




Exchange-DMZ-error.bmp
0
Comment
Question by:Tencha
  • 2
  • 2
6 Comments
 
LVL 24

Assisted Solution

by:Awinish
Awinish earned 500 total points
ID: 34114671
Firstly, its not recomended to install hub/CAS server in DMZ zone,why the reason is explained in below link.

Exchange CAS servers require full access to all mailboxes in an AD Site,  and significant access rights to the AD. That's a level of access  privileged which you should avoid having in the perimeter network.

http://msexchangeteam.com/archive/2009/10/21/452929.aspx

From above error, i can see there is issue with the HUB/CAS server not able to contact GC & DNS which is more related to firewall & port.

Check on the firewall or remove & move to domain these roles as only edge is recommedned to be in DMZ.

Since CAS server also server OWA, Activesync, EWS & many more, so putting in dmz user will not be able to access those services.

Is better to move it into domain now.


0
 

Author Comment

by:Tencha
ID: 34115100
Thank  you for that... is there anyway, after moving the server back into the domain to publish OWA. Though its not recommended placing two nics on the server with an ip address of DMZ and also one internal may help but that breaks security, right?
0
 
LVL 24

Accepted Solution

by:
Awinish earned 500 total points
ID: 34117785
If you transfer role to domain CAS/HUB role will actually not facing internet directly, there will be firewall & i would recommend to install Edge security role.

If you can't move the server back to domain & till you get new hardware for edge role, let your firewall protect your server.

I would not recommend placing two NIC is a gud idea & if you are really concerned about security place edge role.

I don't know whether MS will provide support,if you out cas in dmz in issue.
0
 

Author Comment

by:Tencha
ID: 34148827
I have an anti-spam device in place of edge, Ironmail 6.7 version... I'm working to find if ironmail will allow OWA throw. No solution just yet... Anyone work with edge; do I need additional licensing?
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 34700107
This question has been classified as abandoned and is being closed as part of the Cleanup Program. See my comment at the end of the question for more details.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
In this video we show how to create a Shared Mailbox in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Recipients >> Sha…
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now