Thinking about setting up an Exchange server... need some direction 1

[mskennicutt]

My boss sprung this on me a week ago that he and the higher ups want our own mail server and he specifically wants Exchange 2000. I have a small network with a single Windows 2000 domain and at the moment a single DC (I also have one Win2k terminal services server not running as a DC). My domain is RMS.MPIA since I never anticipated needing outside access for an Exchange server. My biggest question right now is how can I get users the ability to get to Exchange from the Internet (we have a 1.5 mbps SDSL connection and a Cisco 2600 firewall with 5 static IPs available).

I know I would need to have an MX record setup (through my IPS?) but what can I do about the domain name? I am very early in this process and I have purchased a couple Exchange 2000 training CDs I have started going through, but this domain question popped into my head and is perplexing me. Is there a simple answer to this or do I need to change my network's domain name to a ".com" name (and by doing so recreate Active Directory from scratch)?

Also, will it cause problems if the Exchange server is behind our firewall and I use NAT to get to it from the Internet? Sorry if I sound like a newbie, but when it comes to this I guess I am.

 

[wallst32]

You can have multiple domains point to the same IP address, so DNS will not be an issue, internally or externally.

The only port you need to open on the outside is 25 for SMTP. If would need a public IP so you would have to NAT it. Whatever IP address it is given would be your new MX record. Optionally you could open HTTP or HTTPS for webmail access, and 110 or 143 for POP and IMAP.

In Exchange 2000, you would modify the recipient policy to define the domains your mail server accepts mail for. So you could add @abc.com, @xyz.com, whatever you need.

 

[mskennicutt]

Awesome, Thanks!!! That really helps me get an idea of how this will work. Also it is much more simple than I imagined. I think I will only be allowing users POP access from the Internet and have them use the full capabilities of Exchange only while at the office.

Thanks again!

 

[Zelandakh]

POP will bring the emails out of the organisation to their home. Implement OWA (if you do it during Exchange setup, it is one tick box and not a lot else) then open port 80 on the firewall and point it at the Exchange box.

BIG KUDOS from the bosses / staff who can now access work email from anywhere in the world!!!

(Tip - don't open port 80 on the firewall until AFTER Exchange is running and fully patched).

 

[mskennicutt]

Thanks! I had planned on doing that for at least a few of our users but I wasn't sure what port to open. I will jot that down for when the time comes.

The reason I don't want the whole organization to have Outlook Web Access at home is that if they come in from the Internet using that it would require a "per user" Client Access Licence and most of my planned CALs are going to be "per device" since in our environment (Hospital Imaging Center) most users share one or more PCs with several other users. I found out that POP access doesn't require CALs. I will actually be having them use OWA with Internet Explorer over the LAN (since the PCs are shared among multiple users and the PCs are autologon, I didn't think it would work to have them using Outlook.)

Thanks again for the info!

 

[Zelandakh]

Ah, there's the rub. You are using Internet Explorer for OWA and NOT Outlook. No CAL required...

Internally you are right - OWA would be the way to go.

 

[MMCCSSEE11]

I highly recommend AGAINS opening up POP# or IMAP4. OWA is the way to go, and you DON'T need CALs for it.

Also, be smart... install a second DC. It's alot easier to just install an additional DC during an outage than it is to restore Active Directory and Exchange to the domain.

Do it. You'll thank me later, and your boss will thank you later.

Also, you don't need an MX record in DNS if your e-mail and web gateways are the same box, or go through the same box on the public side, or you're planning an alternate e-mail gateway path for redundancy (The K.I.S.S. principle works here)

Also, your Active Directory domain name and your public domain name don't really care about each other. It's way better if they are different than if they are the same.

Question: When you say "..use NAT to get to it through the Internet" are you talking about an Outlook MAPI client, a web client, or administrative access?

The answer to your question depends upon the configuration of your firewall, etc.