Does any Part of Exchange need to be in a DMZ?

[glamprecht1]

This is a separate thread on my fact gathering mission. We will be upgrading from Exchange 2003 to Exchange 2007 and will have two servers to use.

It looks like the edge transport role is designed just for this.

We are only budgeted for two servers so I am trying to figure out how to allocate these servers to best serve the company. Admin desperately wants to use Outlook over HTTP/s and I had heard that something needed to be in a DMZ to make this work or work safely. The only thing that I have found so far that (should) be in a DMZ is a server performing the edge transport role.

With a two server setup, will I need to put one of these in a DMZ? Its seems as if the CAS along with other roles and the actual exchange servers need be in AD.

I have no ideas as to how powerful of a server that I would need to dedicate to this role if we were to go that route. As i understand it simply relays mail. I really want to use CCR and would need 3 serves to do this. I have not lost hope on that yet but at this point I am getting two.

Does anything need to be in a DMZ to get Exchange 2007 up and running. We specifically will be using the published shares and the outlook over http.

Tahnks

 

[58sniper]

The Edge Transport is the only role for the perimeter. For Outlook Anywhere (RPC over HTTPS), it's recommended you use a reverse proxy such as ISA in the perimeter.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[Zelandakh]

Simple answer: No.
Real answer: Only Edge as Pat says.
Outlook Anywhere is "recommended" but doesn't actively require a reverse proxy.