Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 270
  • Last Modified:

Exchange Administrative center external access

One of the concerns that has been raised is the ability to access Exchange Control panel for Exchange 2010 and Exchange Administrative Center for 2013/2016 externally.  Is there a way to prevent external access maybe by limiting the IP ranges that could access it to internal IP ranges only.
0
georgedschneider
Asked:
georgedschneider
2 Solutions
 
Adam BrownSr Solutions ArchitectCommented:
For information, the only way to block ECP without resorting to an application aware firewall is to create a second version of the ECP site that is only accessible using an Internal IP address that is assigned as a secondary IP on the Exchange server. Todd's second link explains the process, but be aware that it is a fairly involved process.
2
 
El FierroNetwork EngineerCommented:
Here are some steps for 2013..good luck

1) Add a second IP address to the Exchange 2013 CAS server
   
2) Create the folder in this path %SystemDrive%inetpubwwwroot2
 
3)  Create a second website in IIS pointed to the wwwroot2 folder and call it CustomEAC
 
4) Bind the website on ports 80 and 443 to the new IP address
 
5) Create a new ECP virtual directory using the command
    New-EcpVirtualDirectory -Server ServerName -WebSiteName "CustomEAC" -InternalUrl  
    "https://eac.yourdomain.com/ecp"
   
 6) Create a new OWA virtual directory with this command
     New-OwaVirtualDirectory -Server ServerName -WebSiteName "CustomEAC" -InternalUrl   "https://eac.yourdomain.com/owa"     
   
7) Set the original ECP virtual directory to restrict admin access with this command
   
Set-ECPVirtualDirectory -Identity "MailServerNameecp (default web site)" -AdminEnabled $false
   
8) Edit the IP Address restrictions to only allow access to the EAC website from the internal subnets
 
  Add a host record in DNS for the new EAC URL
2
 
CodeTwo SoftwareSoftware DeveloperCommented:
Hi George,

All of the above suggestions should get you on the right track.

If you would like to check out our guide on this topic with screenshots, go to:

http://www.codetwo.com/admins-blog/how-to-disable-external-access-to-ecp/?sts=6423

Best regards (and good luck!),
- CodeTwo
2

Featured Post

NEW Veeam Agent for Microsoft Windows

Backup and recover physical and cloud-based servers and workstations, as well as endpoint devices that belong to remote users. Avoid downtime and data loss quickly and easily for Windows-based physical or public cloud-based workloads!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now