OWA2007/IIS Question

[zoeythecat]

Hi All,

We are planning on doing our Echange2007 installation this week. Right now when users connect to OWA they connect to a secure website (i.e - mail.xxxxxx.org) and connect to OWA securely (we have a redirect defined in owa) externally (via our ISP mx record and then firewalled to our internal exchange2003 server). When we go to Exchange2007 and configure IIS and owa to redirect to the mail.xxxx.org) will I need to have our ISP add another record for our new exchange2007 server while we transition our mailboxes over to the new server? We plan on transitioning mailboxes over to exchange2007 slowly over the next couple of weeks and my concern is how users will connect to OWA2007 when they get moved over to the new server. I know I need to have the ISP mx record changed to the new server after the transition is done, but do I need to add the dns for this new server during the transition?

TIA

 

[Zelandakh]

Create a new one called owa.domain.com with your ISP to point to the 2007 box. Then tell the staff individually about their new URL. Eventually remove mail or redirect it if required.

 

[zoeythecat]

We want to keep everything the same though. mail.xxxxxx.org (Can't be done?)

 

[58sniper]

Exchange 2007 CAS servers can redirect to Exchange 2003 servers when properly configured. This is documented at Microsoft.com. You essentiall would have all users going to the 2007 CAS boxes.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[zoeythecat]

Pat,

Correct...But what about when users externally hit mail.xxxxx.org (mx record points to exchange2003 server internally) externally to access owa? Do we need to have our ISP add the exchange2007 server to their dns records?

thx

 

[58sniper]

The first step in this should be redirecting OWA URLs to the CAS servers. They should handle 2003 and 2007 users. Internally and externally. This requires, of course, proper planning and configuration (and testing).

When done properly, you should not have to create any more records from your ISP.

In fact, redirecting mail flow should be done at the firewall. You shouldn't need changes to be made at your ISP.

Keep in mind that these are generalizations, and only someone intimate with your infrastructure and mailflow should say for sure what process you should use.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[zoeythecat]

I understand the redirecting part internally and the iis/owa configuration. I think another record has to be added externally. I'll be doing it this week and will post back to let you know what came of this.

 

[58sniper]

If there is an existing record for OWA externally, it points to a public IP on your firewall. You just need to change where your firewall forwards to.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[zoeythecat]

Pat,

I understand that owa points to a public ip address managed by our ISP. This is the mx record we are talking about. This mx record forwards requests to the server name of the exchange2003 server. There is a rule on our firewall that has this public ip address of that has the mx record, but this just allows services such as http, https, etc. That is the role the firewall plays into. When Exchange2007 gets installed, this will be a new server name. If I want owa to go out through this server another record would have to be added to our public ip address (mx record) to allow this to happen (This is what I believe, and is what i'm trying to confirm here). When I move a mailbox over to exchange2007 and I hit mail.xxxxxx.org from outside, it will try to find information from the public ip mail.xxxxx.org is associated with. I don't need to do anything on our firewall, unless I wanted to change the public ip address that is hosting our mx record.

 

[Zelandakh]

Zoey. Not entirely.

OWA doesn't go out, it comes in so you get the firewall to point not at the 2003OWA but at the 2007 OWA. You do that AFTER you've set 2007OWA to handle OWA for the site (not just the server).

Now anyone asking for OWA will hit 2007 from outside and will get dealt with correctly. At the moment, they hit OWA2003 and anyone on 2007 will get a redirect failure.

You are changing the inside of the firewall from the internal IP of the 2003 server to the internal IP of the 2007 server.

Hope that clarifies things.