Solved

Exchange 2010- Communication Issue from DMZ to internal domain

Posted on 2010-11-11
6
760 Views
Last Modified: 2012-08-13
Back ground information: I was to set up to exchange 2010 servers; One with HUB and CAS (we will call it Joker) and the other Mail server (we will call it Batman).
The mail server is to be located within the internal domain (XXXX.ad)

I set up both servers internal and both have (xxxx.ad &xxx.ad) names. I had them communicating to each other and connection to the internal domain controller’s fine.
Then I was approached that for security reasons I should move the "front -end" server (HUB/CAS- Joker) into the DMZ but keep the mail server (batman) internal. After long agreement I moved the Joker server into the dmz. Now I can not communicate with the internal DC's to authenticate and regain the communication for the complete exchange system.

Error: I have the following error from a server within the DMZ. (Please see image).

Setup...
DMZ- (xxxx.org)
OS server- Win 2K8 R2 Server
Exchange 2010 server Hub & CAS – “Joker”
Local DNS within DMZ (no trust built with internal domain)
I’ve added a new zone XXX.ad and added an “Host A” record for “Joker”.

**Also, we have an external facing DNS (external IP address, not trust to the internal domain). This is used for OWA communication.**

Internal- (XXX.ad)
Domain connection, all DC’s and Exchange 2010 Mail server.

Perimeter Firewall Routing from DMZ to internal:
ASA5520- Interface to DMZ (10.10.X.X)- Joker
ASA5520- Interface to Internal (10.100.X.X)-
ISA 2006- Second Firewall (192.X.X.X)- Internal domain XXX.ad –
– Batman, DC’s and Domain.




Exchange-DMZ-error.bmp
0
Comment
Question by:Tencha
  • 2
  • 2
6 Comments
 
LVL 24

Assisted Solution

by:Awinish
Awinish earned 500 total points
Comment Utility
Firstly, its not recomended to install hub/CAS server in DMZ zone,why the reason is explained in below link.

Exchange CAS servers require full access to all mailboxes in an AD Site,  and significant access rights to the AD. That's a level of access  privileged which you should avoid having in the perimeter network.

http://msexchangeteam.com/archive/2009/10/21/452929.aspx

From above error, i can see there is issue with the HUB/CAS server not able to contact GC & DNS which is more related to firewall & port.

Check on the firewall or remove & move to domain these roles as only edge is recommedned to be in DMZ.

Since CAS server also server OWA, Activesync, EWS & many more, so putting in dmz user will not be able to access those services.

Is better to move it into domain now.


0
 

Author Comment

by:Tencha
Comment Utility
Thank  you for that... is there anyway, after moving the server back into the domain to publish OWA. Though its not recommended placing two nics on the server with an ip address of DMZ and also one internal may help but that breaks security, right?
0
 
LVL 24

Accepted Solution

by:
Awinish earned 500 total points
Comment Utility
If you transfer role to domain CAS/HUB role will actually not facing internet directly, there will be firewall & i would recommend to install Edge security role.

If you can't move the server back to domain & till you get new hardware for edge role, let your firewall protect your server.

I would not recommend placing two NIC is a gud idea & if you are really concerned about security place edge role.

I don't know whether MS will provide support,if you out cas in dmz in issue.
0
 

Author Comment

by:Tencha
Comment Utility
I have an anti-spam device in place of edge, Ironmail 6.7 version... I'm working to find if ironmail will allow OWA throw. No solution just yet... Anyone work with edge; do I need additional licensing?
0
 
LVL 74

Expert Comment

by:Glen Knight
Comment Utility
This question has been classified as abandoned and is being closed as part of the Cleanup Program. See my comment at the end of the question for more details.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
To show how to generate a certificate request in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.:  First we need to log into the Exchange Admin Center. Navigate to the Servers >> Certificates…
In this Micro Video tutorial you will learn the basics about Database Availability Groups and How to configure one using a live Exchange Server Environment. The video tutorial explains the basics of the Exchange server Database Availability grou…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

7 Experts available now in Live!

Get 1:1 Help Now