Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 773
  • Last Modified:

Exchange 2010- Communication Issue from DMZ to internal domain

Back ground information: I was to set up to exchange 2010 servers; One with HUB and CAS (we will call it Joker) and the other Mail server (we will call it Batman).
The mail server is to be located within the internal domain (XXXX.ad)

I set up both servers internal and both have (xxxx.ad &xxx.ad) names. I had them communicating to each other and connection to the internal domain controller’s fine.
Then I was approached that for security reasons I should move the "front -end" server (HUB/CAS- Joker) into the DMZ but keep the mail server (batman) internal. After long agreement I moved the Joker server into the dmz. Now I can not communicate with the internal DC's to authenticate and regain the communication for the complete exchange system.

Error: I have the following error from a server within the DMZ. (Please see image).

Setup...
DMZ- (xxxx.org)
OS server- Win 2K8 R2 Server
Exchange 2010 server Hub & CAS – “Joker”
Local DNS within DMZ (no trust built with internal domain)
I’ve added a new zone XXX.ad and added an “Host A” record for “Joker”.

**Also, we have an external facing DNS (external IP address, not trust to the internal domain). This is used for OWA communication.**

Internal- (XXX.ad)
Domain connection, all DC’s and Exchange 2010 Mail server.

Perimeter Firewall Routing from DMZ to internal:
ASA5520- Interface to DMZ (10.10.X.X)- Joker
ASA5520- Interface to Internal (10.100.X.X)-
ISA 2006- Second Firewall (192.X.X.X)- Internal domain XXX.ad –
– Batman, DC’s and Domain.




Exchange-DMZ-error.bmp
0
Tencha
Asked:
Tencha
  • 2
  • 2
2 Solutions
 
AwinishCommented:
Firstly, its not recomended to install hub/CAS server in DMZ zone,why the reason is explained in below link.

Exchange CAS servers require full access to all mailboxes in an AD Site,  and significant access rights to the AD. That's a level of access  privileged which you should avoid having in the perimeter network.

http://msexchangeteam.com/archive/2009/10/21/452929.aspx

From above error, i can see there is issue with the HUB/CAS server not able to contact GC & DNS which is more related to firewall & port.

Check on the firewall or remove & move to domain these roles as only edge is recommedned to be in DMZ.

Since CAS server also server OWA, Activesync, EWS & many more, so putting in dmz user will not be able to access those services.

Is better to move it into domain now.


0
 
TenchaAuthor Commented:
Thank  you for that... is there anyway, after moving the server back into the domain to publish OWA. Though its not recommended placing two nics on the server with an ip address of DMZ and also one internal may help but that breaks security, right?
0
 
AwinishCommented:
If you transfer role to domain CAS/HUB role will actually not facing internet directly, there will be firewall & i would recommend to install Edge security role.

If you can't move the server back to domain & till you get new hardware for edge role, let your firewall protect your server.

I would not recommend placing two NIC is a gud idea & if you are really concerned about security place edge role.

I don't know whether MS will provide support,if you out cas in dmz in issue.
0
 
TenchaAuthor Commented:
I have an anti-spam device in place of edge, Ironmail 6.7 version... I'm working to find if ironmail will allow OWA throw. No solution just yet... Anyone work with edge; do I need additional licensing?
0
 
Glen KnightCommented:
This question has been classified as abandoned and is being closed as part of the Cleanup Program. See my comment at the end of the question for more details.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now