Securing smtp traffic between 2 exchange servers on different domains 1

[aking]

Hi

I have a requirement to secure the traffic from my company domain (CompanyA.co.uk) to another domain (CompanyB.com), and also (obviously) I do not want to disrupt the rest of my company email! I have got tremendously confused researching this today and yesterday.

Currently we have one Exchange 2007 Server which does all our company email. It has one send connector which is specified to send to any address using DNS and the checkbox for 'Enable Mutual Auth TLS' is unticked. It also has two receive connectors, a server connector on port 25 and a client connector on port 587, both receive connectors will accept anonymous connections and neither have the checkbox ticked for TLS. It has been up and running for 5 years now and has worked well.


To secure traffic to one particular domain and leave the rest of my traffic alone I think I need to create a new Send Connector and specify the address space as the domain I would like to send to. Is this correct???
Tech support at GoDaddy (certificate suppliers) have just told me that this is not possible: "When you apply a certificate to your mail server, it will encrypt all outgoing email. It doesn’t allow you to specify a domain you’re sending TO."
Sadly GoDaddy tech support does not support Exchange so they cannot clarify that statement, so i'm just left wondering.....(but i'm hoping they are wrong).


The next step (I think) is to purchase a Standard SSL certificate. This is my certificate request:

New-ExchangeCertificate -generaterequest -keysize 2048 -subjectname "c=uk, l=City, s=County, o=Company Ltd,cn=mail.company.co.uk" -domainname company.co.uk,company.local,autodiscover.company.co.uk,owa1.company.local,owa1 -PrivateKeyExportable $true -path c:\temp\certrequest.txt

I am wondering if all the extra Subject Alternative Names are necessary? (e.g. autodiscover and owa1). - But this is probably a minor point.


Most of all I still can't see how it will work once I get my new certificate.
I have tried creating a new Send Connector and there is nothing in the properties where I can point the new connector at a particular certificate.
I want all mail addressed to CompanyB.com to get sent encrypted using the new certificate I'm about to buy. I want all other mail to just get sent out as it has been before. I know Exchange 2007 can do this.

If anyone can help with the points I'm stuck on I would be grateful.
Note: I have read a lot of articles on this so please don't just send me lots of links - unless they really worked for you. I think a lot of the stuff online is written by exchange experts for other exchange experts. I'm just a sysadmin who dips into exchange as and when needed, therefore I was hoping it would be possible to do this without learning every nuance of the entire Windows PKI infrastructure, especially for such a simple scenario.

 

[ShackDaddy]

On the cert side, as long as the Send and Receive connectors on your server have the same FQDN as the common name on your cert (and your cert is a valid public cert), you are fine and can skip the cert sections of any TLS documentation.

By default, Exchange 2007 attempts to encrypt all communications between servers. If the server it connects to supports TLS, it uses TLS. I think that checking the "Mutual TLS" checkbox on your main Send Connector would be enough to encrypt outbound mail between your server and the destination server, but it's probably better to set up a unique send connector for that target domain and check the "Mutual TLS" button on that one.

You also do want to use the Set-TransportConfig cmdlet to ensure that Exchange will always force TLS on any connections to the specific domain you are trying to implement TLS with:

Set-TransportConfig -TLSSendDomainSecureList companyA.com

As far as inbound connections from that server, do you have a hosted mail hygiene or Barracuda involved in the picture, or do inbound connections come straight to an Exchange server? If the latter is true, you could create a custom receive connector for that source IP address and enable TLS for it, but again, in most Exchange 2007 environments that I work on, TLS is automatically selected on the Receive connectors. It isn't enforced, but it's available if the connecting server wants to use TLS, so it's not necessary to set up a unique Receive connector. This snippet from the TechNet article (

http://technet.microsoft.com/en-us/library/bb123543(EXCHG.80).aspx)

on TLS shows this:

You must configure the Receive connector on each Edge Transport server that accepts mail from the domain from which you want to receive domain-secured e-mail. The Contoso environment is configured to have a single Internet Receive connector, with an Identity of Inet, on both Edge Transport servers. Therefore, to enable TLS while mail is sent to or received from Woodgrove Bank, the Contoso administrator must make sure that TLS is enabled on the default Internet Receive connector on both Edge Transport servers.

Note that it doesn't suggest creating a new Receive connector, while the same article does suggest creating a unique Send connector.

So the easiest thing you could do is just enable TLS on your Receive connector, set the TransportConfig setting, create a new TLS-enabled Send Connector and then monitor the SMTP logs when you get/send a test email with that organization. You will be able to tell from the logs that TLS was used. Enabling TLS will not break current functionality on the default receive connector.

Dave Shackelford
ThirdTier.net

 

[aking]

Hi ShackDaddy.

Thank you so much for that.
Yes I have a valid public cert. I thought that either I had to get a new one or I had to swap the public certificate with the other organisation - in fact I sent the other sysadmin our public key after deciding I didn't need a new one, so he probably thinks i'm crazy now....

On the inbound side I'm running Sophos Pure Message.

I will do exactly as you suggest - in fact I've already created the 2nd send connector, so I will just use the existing receive connector (and I am assuming that it is the Default Receive connector that I need to use, i.e. the one on port 25 rather than the 587 one).
I do have one question about the send connector - now that I have 2 connectors how do I make sure that the encrypted one is used first? I think that I have to make my new connector a cost of 1 and the original connector a cost of 2.?

I am sorry to ask such simple questions - but there are no simple manuals for exchange that I can find - and I know what it is like if email stops (I will have to drop everything else until it is fixed).

I have got the white paper for domain security in exchange 2007 - I'll read that, I think it is the only way with Exchange!
Thanks again for the help.

 

[ShackDaddy]

You don't need to worry about cost on the send connectors. Just narrow the scope on the targeted connector so that the domain it sends to is only the target one. The default/first connector has a * in the domains list. It will be used after the other connectors are checked for a destination domain match.

Dave Shackelford
ThirdTier.net

 

[aking]

Wow it worked
(i changed the cost of the default connector to 2 before i read this so i will change it back tomorrow).
I ticked the TLS checkbox for the default receive connector.
I created a new send connector just for that domain and tick the TLS checkbox.
A 5 minute job at the most!

After ploughing thru so much of technet and msexchange.org i cannot believe how simple it was.
Am so glad i left the public cert alone - i nearly removed it - GoDaddy support thought i needed to change my cert, but i think the whole thing about exchange confused them (definitely confused me).
Anyway thanks again. Hopefully won't have to touch exchange for another year now ;-)

 

[ShackDaddy]

Glad you found this forum helpful. Stick around!

Dave Shackelford
ThirdTier.net