put exchange or owa in dmz ? which opens more ports on pix

[quell]

I plan on establishing a DMZ and can't decide if I should put the Exchange server in the DMZ or leave it in the LAN and put the OWA in the DMZ. I don't like the idea of opening up more ports on my pix 515. Basically which would open more ports on the pix? exchange on the dmz or owa? What do you guys think?

 

[Lou0686]

Hi,

I'm not sure which opens more ports but I am sure that putting the Exchange server is the least secure. I recoomend putting OWA on the DMZ.

Lou

 

[tbissett]

We struggled with this one quite a bit. If we stuck OWA on the DMZ, that menas we would be opening a ton of rules to allow it to talk to our domain. if we put OWA on the inside, then the whole concept of a DMZ would be circumvented. In the ned, we chose a slightly different approcah, which we felt was the lesser of all evils.

We put a Linux box in the DMZ, running Apache and mod_proxy. We then opened port 443 from the outside to the proxy on the DMZ. Then we added a rule on the DMZ to permit only 443 from the proxy to the OWA server, which is on the inside.

Internet users access only the proxy server. Only the proxy server can access OWA. It's not perfect, but it at least presents one more barrier to breaking in.

 

[yizhar]

HI.

Another alternate solution which is more secure, is simply not to allow access to your Exchange server from the Internet.
If you have only few specific roaming users that need web access, you can keep Exchange internaly, and instead of OWA server, implement another mail server (either Exchange or any other server that you like) which will be in DMZ.
The internal exchange server will be configured to forward a copy of all incoming mail for the roaming users to the DMZ server. The roaming users can access that server using web access.

Advantages: better security. No open ports to the inside, and you only publish and risk a copy of few mailboxes instead of your whole Exchange server.
Disadvantages: Like any solution it is not perfect, you'll have to think how to manage duplicate mailboxes, etc...
One option is to configure those roaming users to read mail only from the DMZ server and not from Exchange.

It is similar to "mail relay" but in the reverse direction.

I have not yet implemented such a solution, but you can consider it.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[haknwak]

there is a great series of discussions on this at the Firewall Wizards mailing list.

http://honor.trusecure.com/pipermail/firewall-wizards/

I was considering the same but decided to leave it where it is.

 

[Factor42]

Always put OWA inside the DMZ as you only then need to give access to port 80 from the outside world. Assuming the remainder of your PIX connected to the internet is secure, this is the best way to provide OWA.

All the best