Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Using MS Exchange Edge Transport in the DMZ

Posted on 2011-10-17
8
Medium Priority
?
1,194 Views
Last Modified: 2012-05-12
Looking to get feedback on using MS Exchange servers running the Edge Transport role in the DMZ.

Microsoft Exchange 2010 Environment with the following:
8 Mailbox Servers, 4 in two sites ( 1 DAG, Each database on three servers two local , one remote.)
6 CAS servers, 3 each site.
4 Hub Transport Servers, 2 each site.
Now we are looking to include 2 servers in the DMZ and MS Exchange Edge Servers. Currently in the DMZ is a Unix server running Postfix. I called MS to assist with the connector config. The MS Engineer that I spoke with seems to know little about Edge server config other then out of the box click to setup.

We have a data loss prevention appliance, basically it acts as a SMTP relay and prevent messages if they have specific content. MS called me late Friday and the engineer told me that the Hub servers needed to send directly to the Edge servers, otherwise it is not supported. I asked for reference documentation.

Outbound Mail Flow After changes:
Exchange 2010 Hub Servers -> Data Loss Prevention -> MS Exchange Edge Servers in DMZ -> Unix Postfix -> MS Forefront Online Service -> Internet

( I know this seems a bit complex, we plan on phasing out the Unix Postfix later and just have the Edge send to the MS Forefront Online service)

If anyone could report back on use of MS Exchange Edge sending between mail systems other than straight MS Exchange Hub to MS Exchange Edge , I would appreciate it. I know that the automatic configuration and setup would define the connects that way, just need to find out if it is supported to use when using another SMTP relay as a middle man.

Thanks,
Mark
0
Comment
Question by:markpalinux
  • 4
  • 4
8 Comments
 
LVL 28

Expert Comment

by:sunnyc7
ID: 36979728
Exchange 2010 Hub Servers -> Data Loss Prevention -> MS Exchange Edge Servers in DMZ -> Unix Postfix -> MS Forefront Online Service -> Internet

>> What's the function of DLP appliance ?
What happens if you get hub servers to talk directly to edge ? What functionality do you lose ?
0
 
LVL 15

Author Comment

by:markpalinux
ID: 36981074
Data Loss Prevention scans for account codes and social security numbers, etc. to prevent those items from being sent out in an email.

Thanks,
Mark
0
 
LVL 15

Author Comment

by:markpalinux
ID: 36981132

Here is the second answer:
If mail goes from the Hub top the Edge servers directly then I loose the ability to have the DLP device in the internal network since the Edge should be in the DMZ.

Thanks,
Mark
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
LVL 28

Expert Comment

by:sunnyc7
ID: 36981402
Is the product called EMC RSA DLP Enterprise Manager ?
0
 
LVL 15

Author Comment

by:markpalinux
ID: 36981749
I have left the name of the product out intentionally. You let your email server send mail and it will forward to a SMTP destinations the ones it deems safe to send.

Thanks,
Mark
0
 
LVL 28

Accepted Solution

by:
sunnyc7 earned 2000 total points
ID: 36982879
Mark
You cant put the DLP between Edge and hub in the fashion you mentioned.
Exchange 2010 Hub Servers -> Data Loss Prevention -> MS Exchange Edge Servers in DMZ -

your options:
a) You have to figure out how to do DLP filtering at Edge Level.
or b) You can try this (I am just thinking out aloud, I havent done this.)
Exchange 2010 HT (internal relay)-> DLP device-> Exchange 2010 HT (external in DMZ)--> MS Exchange Edge Servers in DMZ ->Unix Postfix -> MS Forefront Online Service -> Internet

HT Servers need EdgeSync with Edge Servers to sync the mail flow.
If you put the DLP device between hub and edge, the EdgeSubscription.xml wont run and that's an issue.
If you go through this Edge WhitePaper, the contents of the .XML and the port sysnc are related to authentication services - not mailflow. You cant hack that by editing the .PS1 script to pick up mail from DLP and relay it to Edge.

With the option b) with a HT after DLP, you have sanitized emails which can be routed to Edge using EdgeSync in DMZ

Whitepaper:
http://technet.microsoft.com/en-us/library/bb310755%28v=exchg.80%29.aspx

I am not sure how other DLP devices have been configured. You can click on request attention and have other experts comment on this.

hope this helps.
0
 
LVL 15

Author Closing Comment

by:markpalinux
ID: 37111988
MS wanted to have Hub -> Edge, rather then fight with support each time and have a rare configuration other plans are being made. Thanks for your help.
0
 
LVL 28

Expert Comment

by:sunnyc7
ID: 37112073
Let me know what the final configuration looks like. Would definitely want to know how this worked out during deployment.
0

Featured Post

Veeam and MySQL: How to Perform Backup & Recovery

MySQL and the MariaDB variant are among the most used databases in Linux environments, and many critical applications support their data on them. Watch this recorded webinar to find out how Veeam Backup & Replication allows you to get consistent backups of MySQL databases.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Are you looking for the options available for exporting EDB files to PST? You may be confused as they are different in different Exchange versions. Here, I will discuss some options available.
This month, Experts Exchange sat down with resident SQL expert, Jim Horn, for an in-depth look into the makings of a successful career in SQL.
In this video we show how to create a mailbox database in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Servers >> Data…
To add imagery to an HTML email signature, you have two options available to you. You can either add a logo/image by embedding it directly into the signature or hosting it externally and linking to it. The vast majority of email clients display l…
Suggested Courses
Course of the Month21 days, 7 hours left to enroll

805 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question