Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Exchange 2010- Communication Issue from DMZ to internal domain

Posted on 2010-11-11
6
765 Views
Last Modified: 2012-08-13
Back ground information: I was to set up to exchange 2010 servers; One with HUB and CAS (we will call it Joker) and the other Mail server (we will call it Batman).
The mail server is to be located within the internal domain (XXXX.ad)

I set up both servers internal and both have (xxxx.ad &xxx.ad) names. I had them communicating to each other and connection to the internal domain controller’s fine.
Then I was approached that for security reasons I should move the "front -end" server (HUB/CAS- Joker) into the DMZ but keep the mail server (batman) internal. After long agreement I moved the Joker server into the dmz. Now I can not communicate with the internal DC's to authenticate and regain the communication for the complete exchange system.

Error: I have the following error from a server within the DMZ. (Please see image).

Setup...
DMZ- (xxxx.org)
OS server- Win 2K8 R2 Server
Exchange 2010 server Hub & CAS – “Joker”
Local DNS within DMZ (no trust built with internal domain)
I’ve added a new zone XXX.ad and added an “Host A” record for “Joker”.

**Also, we have an external facing DNS (external IP address, not trust to the internal domain). This is used for OWA communication.**

Internal- (XXX.ad)
Domain connection, all DC’s and Exchange 2010 Mail server.

Perimeter Firewall Routing from DMZ to internal:
ASA5520- Interface to DMZ (10.10.X.X)- Joker
ASA5520- Interface to Internal (10.100.X.X)-
ISA 2006- Second Firewall (192.X.X.X)- Internal domain XXX.ad –
– Batman, DC’s and Domain.




Exchange-DMZ-error.bmp
0
Comment
Question by:Tencha
  • 2
  • 2
6 Comments
 
LVL 24

Assisted Solution

by:Awinish
Awinish earned 500 total points
ID: 34114671
Firstly, its not recomended to install hub/CAS server in DMZ zone,why the reason is explained in below link.

Exchange CAS servers require full access to all mailboxes in an AD Site,  and significant access rights to the AD. That's a level of access  privileged which you should avoid having in the perimeter network.

http://msexchangeteam.com/archive/2009/10/21/452929.aspx

From above error, i can see there is issue with the HUB/CAS server not able to contact GC & DNS which is more related to firewall & port.

Check on the firewall or remove & move to domain these roles as only edge is recommedned to be in DMZ.

Since CAS server also server OWA, Activesync, EWS & many more, so putting in dmz user will not be able to access those services.

Is better to move it into domain now.


0
 

Author Comment

by:Tencha
ID: 34115100
Thank  you for that... is there anyway, after moving the server back into the domain to publish OWA. Though its not recommended placing two nics on the server with an ip address of DMZ and also one internal may help but that breaks security, right?
0
 
LVL 24

Accepted Solution

by:
Awinish earned 500 total points
ID: 34117785
If you transfer role to domain CAS/HUB role will actually not facing internet directly, there will be firewall & i would recommend to install Edge security role.

If you can't move the server back to domain & till you get new hardware for edge role, let your firewall protect your server.

I would not recommend placing two NIC is a gud idea & if you are really concerned about security place edge role.

I don't know whether MS will provide support,if you out cas in dmz in issue.
0
 

Author Comment

by:Tencha
ID: 34148827
I have an anti-spam device in place of edge, Ironmail 6.7 version... I'm working to find if ironmail will allow OWA throw. No solution just yet... Anyone work with edge; do I need additional licensing?
0
 
LVL 74

Expert Comment

by:Glen Knight
ID: 34700107
This question has been classified as abandoned and is being closed as part of the Cleanup Program. See my comment at the end of the question for more details.
0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Find out what you should include to make the best professional email signature for your organization.
This article explains how to install and use the NTBackup utility that comes with Windows Server.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This video demonstrates how to sync Microsoft Exchange Public Folders with smartphones using CodeTwo Exchange Sync and Exchange ActiveSync. To learn more about CodeTwo Exchange Sync and download the free trial, go to: http://www.codetwo.com/excha…

829 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question