Exchange in DMZ

Hi,
This is a big question. I try to ask you..
It's better to put Exchange 2003 in LAN or in DMZ?
I know that the best is put Exchange 2003 Front End in DMZ and Exchange 2003
Back End in LAN, but some of my client can't buy two Exchange Licenses, two
Servers, etc..
I read some news but it's not clear to me.
I prefere put Exchange Server on DMZ.. any help's? I'd like to discuss with
you of this problem.. Thank's.

Andrea

Mark
Mon Aug 22 08:27:47 CDT 2005

On Mon, 22 Aug 2005 14:59:14 +0200, "Rusty73" <rusty77@libero.it>
wrote:

>Hi,
>This is a big question. I try to ask you..
>It's better to put Exchange 2003 in LAN or in DMZ?
>I know that the best is put Exchange 2003 Front End in DMZ and Exchange 2003
>Back End in LAN, but some of my client can't buy two Exchange Licenses, two
>Servers, etc..
>I read some news but it's not clear to me.
>I prefere put Exchange Server on DMZ.. any help's? I'd like to discuss with
>you of this problem.. Thank's.
>
>Andrea
>
The scenarios in the FE/BE guide at www.microsoft.com/exchange/library
tries to make clear that the preferred method is to place any FE on
the internal network and to protect that and other services by using
an ISA server and placing that in a DMZ.

Placing the Exchange FE in the DMZ requires you to punch an
unecessarily large number of holes between the DMZ and the internal
network, and not merely to the BE, but also to GC's as well.

Don
Mon Aug 22 08:26:27 CDT 2005

Don't put any Exchange server in the DMZ and use RPC/HTTPS.
You should never put a Domain server outside your firewall.
Then put an ISA server in the DMZ if you'd like.



--
Hope it helps...........

dw

Don Wilwol
Blog - http://spaces.msn.com/members/wilwol/
Web - http://capital.net/~wilwol/dw.htm
DonWilwol(REMOVE)@yahoo.com

"Rusty73" <rusty77@libero.it> wrote in message
news:e0PuNlxpFHA.3048@TK2MSFTNGP10.phx.gbl...
> Hi,
> This is a big question. I try to ask you..
> It's better to put Exchange 2003 in LAN or in DMZ?
> I know that the best is put Exchange 2003 Front End in DMZ and Exchange
> 2003 Back End in LAN, but some of my client can't buy two Exchange
> Licenses, two Servers, etc..
> I read some news but it's not clear to me.
> I prefere put Exchange Server on DMZ.. any help's? I'd like to discuss
> with you of this problem.. Thank's.
>
> Andrea
>
>

Leythos
Mon Aug 22 08:38:25 CDT 2005

In article <e0PuNlxpFHA.3048@TK2MSFTNGP10.phx.gbl>, rusty77@libero.it
says...
> Hi,
> This is a big question. I try to ask you..
> It's better to put Exchange 2003 in LAN or in DMZ?
> I know that the best is put Exchange 2003 Front End in DMZ and Exchange 2003
> Back End in LAN, but some of my client can't buy two Exchange Licenses, two
> Servers, etc..
> I read some news but it's not clear to me.
> I prefere put Exchange Server on DMZ.. any help's? I'd like to discuss with
> you of this problem.. Thank's.

Don't put anything in the DMZ that can authenticate with the LAN. What I
mean is if you build a stand alone domain and put exchange on it and put
it in the DMZ and then you create a couple rules in the firewall that
only allow the DMZ server to communicate with the LAN device when the
LAN device makes the first contact, and the users don't have the same
User/Pwd, then putting it in the DMZ is fine.

If you put a member server in the DMZ and open an ANY rule to it, there
is no DMZ in effect as anything that compromises the server also has
access to the LAN.

If you setup as a separate domain, then users login to the LAN network
with one user/password and they get email using a different
domain/user/password. It also means you have to setup users in the LAN
and then again in the DMZ. I use the Exchange in the DMZ method, and
it's double the work, but it's never compromised the LAN and never
compromised the DMZ either.

I am starting to consider keeping a member server with Exchange in the
LAN to make management easier for non-technical types, but I'm not done
with all the security testing based on our methods.

--

spam999free@rrohio.com
remove 999 in order to email me

Leythos
Mon Aug 22 09:03:13 CDT 2005

In article <ev9Bb0xpFHA.1204@TK2MSFTNGP12.phx.gbl>, donwilwol@yahoo.com
says...
> Don't put any Exchange server in the DMZ and use RPC/HTTPS.
> You should never put a Domain server outside your firewall.
> Then put an ISA server in the DMZ if you'd like.

You should also understand that a DMZ area is NOT outside the firewall
unless you are talking about those cheap home NAT routers that pretend
to be firewalls.

A real firewall has the same ability to protect in the LAN as it does in
the DMZ, the only difference is the rules YOU create - they are almost
always two separate networks.

--

spam999free@rrohio.com
remove 999 in order to email me

Ed
Tue Aug 23 13:04:40 CDT 2005

Typically a DMZ is between two firewalls.
--
Ed Crowley
MVP - Exchange
"Protecting the world from PSTs and brick backups!"

"Leythos" <void@nowhere.lan> wrote in message
news:MPG.1d73a537d0d015f989cad@news-server.columbus.rr.com...
> In article <ev9Bb0xpFHA.1204@TK2MSFTNGP12.phx.gbl>, donwilwol@yahoo.com
> says...
>> Don't put any Exchange server in the DMZ and use RPC/HTTPS.
>> You should never put a Domain server outside your firewall.
>> Then put an ISA server in the DMZ if you'd like.
>
> You should also understand that a DMZ area is NOT outside the firewall
> unless you are talking about those cheap home NAT routers that pretend
> to be firewalls.
>
> A real firewall has the same ability to protect in the LAN as it does in
> the DMZ, the only difference is the rules YOU create - they are almost
> always two separate networks.
>
> --
>
> spam999free@rrohio.com
> remove 999 in order to email me

Leythos
Tue Aug 23 15:56:25 CDT 2005

In article <#S8Jj0AqFHA.156@TK2MSFTNGP11.phx.gbl>,
curspice@mvpsnospam.org says...
> Typically a DMZ is between two firewalls.

A typical DMZ / LAN would also be setup as follows:

Imagine an appliance with three JACKS - sort of Parallel mode

INTERNAL (WAN)

TRUSTED (LAN) 10.0.0.0/16

OPTIONAL (DMZ) 192.168.0.0/24

To the firewall, the DMZ nodes are no different than the LAN nodes, each
has rules, each could actually be a LAN and as secure as the other. DMZ
is a term we use for where we put public facing systems most times.

In this case, most of the quality devices have three or more physical
ports that provide no default connection between them - you have to
setup rules to map ports/services between LAN and DMZ, and you have to
do it for both directions in most cases - meaning that just because you
create a HTTP rule from LAN to DMZ does not mean that you allow HTTP
from DMZ to LAN.

I've also seen many systems setup in Series - like you describe, but not
usually in appliances -

INTERNET <> DMZ <> LAN

We generally do it this way (series) when we use a Nix box or a Computer
based Firewall, not for appliances.

Now, there is an exception, when we setup firewalls inside networks to
protect segments - like the Accounting or Research departments, or the
Training center.

Now you have the last, and lamest DMZ mode, which we can thank the SOHO
and NAT router vendors for - the one that makes the least sense as it
basically means FULLY UNPROTECTED.

In this setup you have a NAT appliance that you designate a single IP as
the DMZ address in your LAN - which means that anything that reaches the
DMZ address (which is all inbound traffic) also reaches the same subnet
as your LAN... Talk about screwed up - and to think that people actually
fall for that stuff.


--

spam999free@rrohio.com
remove 999 in order to email me

Rusty73
Wed Aug 24 04:49:57 CDT 2005

.. and what do you think about this solution:
Exchange Server 2003 in LAN + a windows 2003 std server in DMZ that have IIS
+ relay of SMTP??

thank's

"Leythos" <void@nowhere.lan> ha scritto nel messaggio
news:MPG.1d75578ae5705e68989cd8@news-server.columbus.rr.com...
> In article <#S8Jj0AqFHA.156@TK2MSFTNGP11.phx.gbl>,
> curspice@mvpsnospam.org says...
>> Typically a DMZ is between two firewalls.
>
> A typical DMZ / LAN would also be setup as follows:
>
> Imagine an appliance with three JACKS - sort of Parallel mode
>
> INTERNAL (WAN)
>
> TRUSTED (LAN) 10.0.0.0/16
>
> OPTIONAL (DMZ) 192.168.0.0/24
>
> To the firewall, the DMZ nodes are no different than the LAN nodes, each
> has rules, each could actually be a LAN and as secure as the other. DMZ
> is a term we use for where we put public facing systems most times.
>
> In this case, most of the quality devices have three or more physical
> ports that provide no default connection between them - you have to
> setup rules to map ports/services between LAN and DMZ, and you have to
> do it for both directions in most cases - meaning that just because you
> create a HTTP rule from LAN to DMZ does not mean that you allow HTTP
> from DMZ to LAN.
>
> I've also seen many systems setup in Series - like you describe, but not
> usually in appliances -
>
> INTERNET <> DMZ <> LAN
>
> We generally do it this way (series) when we use a Nix box or a Computer
> based Firewall, not for appliances.
>
> Now, there is an exception, when we setup firewalls inside networks to
> protect segments - like the Accounting or Research departments, or the
> Training center.
>
> Now you have the last, and lamest DMZ mode, which we can thank the SOHO
> and NAT router vendors for - the one that makes the least sense as it
> basically means FULLY UNPROTECTED.
>
> In this setup you have a NAT appliance that you designate a single IP as
> the DMZ address in your LAN - which means that anything that reaches the
> DMZ address (which is all inbound traffic) also reaches the same subnet
> as your LAN... Talk about screwed up - and to think that people actually
> fall for that stuff.
>
>
> --
>
> spam999free@rrohio.com
> remove 999 in order to email me

Leythos
Wed Aug 24 05:47:05 CDT 2005

In article <#tUUzEJqFHA.2076@TK2MSFTNGP14.phx.gbl>, rusty77@libero.it
says...
> .. and what do you think about this solution:
> Exchange Server 2003 in LAN + a windows 2003 std server in DMZ that have IIS
> + relay of SMTP??

If you are talking about NO DOMAIN chatter between the two servers then
I don't have any problem with it. If both servers are part of the same
domain, then it's not secure as you would have to create and ANY rule to
allow the two servers to share the nice Microsoft ports in addition to
the service ports.

When I setup exchange servers in the DMZ there is no other domain they
connect to, they are stand alone.

Same with IIS, never had one compromised yet, and we always put them in
their own domain and it's not part of any other domain.

Since I don't know what ports you allow in what direction I can't
comment on your setup.


--

spam999free@rrohio.com
remove 999 in order to email me

Al
Wed Aug 24 06:23:52 CDT 2005

Additionally, that wouldn't be much different than if you set up a *nix
relay in a DMZ. Just be sure to properly harden the SMTP relay (regardless
of which you choose; w2K3 can handle the traffic etc. Would be a better
idea to use something that could handle anti-spam and anti-virus, but that's
your strategy to deal with).

Al


"Leythos" <void@nowhere.lan> wrote in message
news:MPG.1d761a406a0396da989cea@news-server.columbus.rr.com...
> In article <#tUUzEJqFHA.2076@TK2MSFTNGP14.phx.gbl>, rusty77@libero.it
> says...
>> .. and what do you think about this solution:
>> Exchange Server 2003 in LAN + a windows 2003 std server in DMZ that have
>> IIS
>> + relay of SMTP??
>
> If you are talking about NO DOMAIN chatter between the two servers then
> I don't have any problem with it. If both servers are part of the same
> domain, then it's not secure as you would have to create and ANY rule to
> allow the two servers to share the nice Microsoft ports in addition to
> the service ports.
>
> When I setup exchange servers in the DMZ there is no other domain they
> connect to, they are stand alone.
>
> Same with IIS, never had one compromised yet, and we always put them in
> their own domain and it's not part of any other domain.
>
> Since I don't know what ports you allow in what direction I can't
> comment on your setup.
>
>
> --
>
> spam999free@rrohio.com
> remove 999 in order to email me

Leythos
Wed Aug 24 07:01:17 CDT 2005

In article <#zB$M5JqFHA.3204@TK2MSFTNGP10.phx.gbl>,
amulnick_No_SPAM@ncDOTrr.com says...
> Additionally, that wouldn't be much different than if you set up a *nix
> relay in a DMZ. Just be sure to properly harden the SMTP relay (regardless
> of which you choose; w2K3 can handle the traffic etc. Would be a better
> idea to use something that could handle anti-spam and anti-virus, but that's
> your strategy to deal with).

Yea, we run Symantec Mail Security 4.6 on all our Exchange servers -
which provides Spam, RBL, attachment filtering, white/black lists....

--

spam999free@rrohio.com
remove 999 in order to email me

Don
Wed Aug 24 07:05:19 CDT 2005

If you are going to do this, why not do it right and make that server in the
DMZ an ISA server?

--
Hope it helps

dw

_______________________________
Don Wilwol
donwilwol(DELETE)@yahoo.com
http://spaces.msn.com/members/wilwol/


"Rusty73" <rusty77@libero.it> wrote in message
news:%23tUUzEJqFHA.2076@TK2MSFTNGP14.phx.gbl...
> .. and what do you think about this solution:
> Exchange Server 2003 in LAN + a windows 2003 std server in DMZ that have
> IIS + relay of SMTP??
>
> thank's
>
> "Leythos" <void@nowhere.lan> ha scritto nel messaggio
> news:MPG.1d75578ae5705e68989cd8@news-server.columbus.rr.com...
>> In article <#S8Jj0AqFHA.156@TK2MSFTNGP11.phx.gbl>,
>> curspice@mvpsnospam.org says...
>>> Typically a DMZ is between two firewalls.
>>
>> A typical DMZ / LAN would also be setup as follows:
>>
>> Imagine an appliance with three JACKS - sort of Parallel mode
>>
>> INTERNAL (WAN)
>>
>> TRUSTED (LAN) 10.0.0.0/16
>>
>> OPTIONAL (DMZ) 192.168.0.0/24
>>
>> To the firewall, the DMZ nodes are no different than the LAN nodes, each
>> has rules, each could actually be a LAN and as secure as the other. DMZ
>> is a term we use for where we put public facing systems most times.
>>
>> In this case, most of the quality devices have three or more physical
>> ports that provide no default connection between them - you have to
>> setup rules to map ports/services between LAN and DMZ, and you have to
>> do it for both directions in most cases - meaning that just because you
>> create a HTTP rule from LAN to DMZ does not mean that you allow HTTP
>> from DMZ to LAN.
>>
>> I've also seen many systems setup in Series - like you describe, but not
>> usually in appliances -
>>
>> INTERNET <> DMZ <> LAN
>>
>> We generally do it this way (series) when we use a Nix box or a Computer
>> based Firewall, not for appliances.
>>
>> Now, there is an exception, when we setup firewalls inside networks to
>> protect segments - like the Accounting or Research departments, or the
>> Training center.
>>
>> Now you have the last, and lamest DMZ mode, which we can thank the SOHO
>> and NAT router vendors for - the one that makes the least sense as it
>> basically means FULLY UNPROTECTED.
>>
>> In this setup you have a NAT appliance that you designate a single IP as
>> the DMZ address in your LAN - which means that anything that reaches the
>> DMZ address (which is all inbound traffic) also reaches the same subnet
>> as your LAN... Talk about screwed up - and to think that people actually
>> fall for that stuff.
>>
>>
>> --
>>
>> spam999free@rrohio.com
>> remove 999 in order to email me
>
>

Leythos
Wed Aug 24 07:18:04 CDT 2005

In article <#7$sgQKqFHA.712@TK2MSFTNGP15.phx.gbl>, "Don Wilwol"
<donWilwol@(EMAIL)yahoo.com> says...
> If you are going to do this, why not do it right and make that server in the
> DMZ an ISA server?

Why would I need ISA on a hardened box?

Why would I want to have ISA running as a "Firewall" on a non-firewall
server?

Why, if I have a real firewall appliance in front of the server in the
DMZ, and have proven rules that work fine, would I need to consider
another firewall?

Are you suggesting that you can't run servers in a DMZ properly unless
they have some soft firewall solution on them?

--

spam999free@rrohio.com
remove 999 in order to email me

Don
Wed Aug 24 08:20:03 CDT 2005



--
Hope it helps...........

dw

Don Wilwol
Blog - http://spaces.msn.com/members/wilwol/
Web - http://capital.net/~wilwol/dw.htm
DonWilwol(REMOVE)@yahoo.com

"Leythos" <void@nowhere.lan> wrote in message
news:MPG.1d762f9612f549c9989cf5@news-server.columbus.rr.com...
> In article <#7$sgQKqFHA.712@TK2MSFTNGP15.phx.gbl>, "Don Wilwol"
> <donWilwol@(EMAIL)yahoo.com> says...
>> If you are going to do this, why not do it right and make that server in
>> the
>> DMZ an ISA server?
>
> Why would I need ISA on a hardened box?

It is a recommended MS setup.


>
> Why would I want to have ISA running as a "Firewall" on a non-firewall
> server?
To provide controlled Authentication.

>
> Why, if I have a real firewall appliance in front of the server in the
> DMZ, and have proven rules that work fine, would I need to consider
> another firewall?

Why do you have 2 to start with? Is there really a such of a thing as too
much protection?

>
> Are you suggesting that you can't run servers in a DMZ properly unless
> they have some soft firewall solution on them?
Yep!
>
> --
>
> spam999free@rrohio.com
> remove 999 in order to email me

Al
Wed Aug 24 13:50:50 CDT 2005

Well, I'll play along with this one. Why is it recommended? I think
Leythos knows enough about this subject to deserve a better explanation.
To be honest, the ISA server in a SMTP situation doesn't offer a lot of
protection vs. a hardened machine. Especially one with a the firewall built
in etc. ISA is much more suited to layer-7 filtering of Microsoft products
than other firewall services. That's a true statement. But for SMTP only,
I can't see the benefit of deploying ISA server into this situation. I see
it as overkill and not providing roi to the effort I'm putting into it and
the introduction of new technology I don't already have. Translation? extra
burden on my staff if I do that with very little return.

For RPC/HTTP or HTTP (OWA) access, I highly recommend ISA. I know the
difference on the wire why it would make sense vs. the other firewall
products out there. But it's best use is as part of a bigger strategy not
just something to replace an already existing strategy/architecture that
works and certainly not for just SMTP (30+ year old protocol) which can be
secured about as much as it is going to be on just about any relay machine
whether Windows, *nix or whatever you choose. I prefer to pick relays that
have queue management possibilities (little to no code required) so I
haven't really wanted to deploy a lot of Windows servers for relay devices.
I would be loathe to deploy ISA for just SMTP relay for that same reason.
It's a gap in the strategy that hasn't been filled. It's not much better
with other vendors, but I keep holding my breath hoping that security
vendors will see the error of their ways and create devices that can be
smart about being in the mail stream. Until then, a DMZ architecture that
uses some MTA that I prefer is the way I'll continue. Unless of course it's
convenient because I also want AV, HTTP& 2-factor access, etc. Then it would
make sense to take advantage of the MTA already there.


Unless you were thinking of some other reasons why this makes sense and I
totally missed the boat. Please correct me if you see differently.

FWIW, I can run a hardened server of just about any flavor in a DMZ
environment. But it only takes one port to do damage, so I'm much more apt
to prefer a local host firewall and a good monitoring system for both the
application and the wires. Some folks will tell you that a DMZ is not even
necessary any longer. :)



"Don Wilwol" <donwilwol@yahoo.com> wrote in message
news:erURL6KqFHA.3516@TK2MSFTNGP15.phx.gbl...
>
>
> --
> Hope it helps...........
>
> dw
>
> Don Wilwol
> Blog - http://spaces.msn.com/members/wilwol/
> Web - http://capital.net/~wilwol/dw.htm
> DonWilwol(REMOVE)@yahoo.com
>
> "Leythos" <void@nowhere.lan> wrote in message
> news:MPG.1d762f9612f549c9989cf5@news-server.columbus.rr.com...
>> In article <#7$sgQKqFHA.712@TK2MSFTNGP15.phx.gbl>, "Don Wilwol"
>> <donWilwol@(EMAIL)yahoo.com> says...
>>> If you are going to do this, why not do it right and make that server in
>>> the
>>> DMZ an ISA server?
>>
>> Why would I need ISA on a hardened box?
>
> It is a recommended MS setup.
>
>
>>
>> Why would I want to have ISA running as a "Firewall" on a non-firewall
>> server?
> To provide controlled Authentication.
>
>>
>> Why, if I have a real firewall appliance in front of the server in the
>> DMZ, and have proven rules that work fine, would I need to consider
>> another firewall?
>
> Why do you have 2 to start with? Is there really a such of a thing as too
> much protection?
>
>>
>> Are you suggesting that you can't run servers in a DMZ properly unless
>> they have some soft firewall solution on them?
> Yep!
>>
>> --
>>
>> spam999free@rrohio.com
>> remove 999 in order to email me
>
>

Ed
Wed Aug 24 17:24:25 CDT 2005

ISA solely for SMTP is overkill, I agree; an IIS SMTP service is just fine
for that. For publishing OWA, POP and IMAP, it's a nice tool. You can buy
a hardened appliance version of ISA. My employer sells one.
--
Ed Crowley
MVP - Exchange
"Protecting the world from PSTs and brick backups!"

"Al Mulnick" <amulnick_No_SPAM@ncDOTrr.com> wrote in message
news:OKJA%23yNqFHA.1272@TK2MSFTNGP11.phx.gbl...
> Well, I'll play along with this one. Why is it recommended? I think
> Leythos knows enough about this subject to deserve a better explanation.
> To be honest, the ISA server in a SMTP situation doesn't offer a lot of
> protection vs. a hardened machine. Especially one with a the firewall
> built in etc. ISA is much more suited to layer-7 filtering of Microsoft
> products than other firewall services. That's a true statement. But for
> SMTP only, I can't see the benefit of deploying ISA server into this
> situation. I see it as overkill and not providing roi to the effort I'm
> putting into it and the introduction of new technology I don't already
> have. Translation? extra burden on my staff if I do that with very little
> return.
>
> For RPC/HTTP or HTTP (OWA) access, I highly recommend ISA. I know the
> difference on the wire why it would make sense vs. the other firewall
> products out there. But it's best use is as part of a bigger strategy not
> just something to replace an already existing strategy/architecture that
> works and certainly not for just SMTP (30+ year old protocol) which can be
> secured about as much as it is going to be on just about any relay machine
> whether Windows, *nix or whatever you choose. I prefer to pick relays
> that have queue management possibilities (little to no code required) so I
> haven't really wanted to deploy a lot of Windows servers for relay
> devices. I would be loathe to deploy ISA for just SMTP relay for that same
> reason. It's a gap in the strategy that hasn't been filled. It's not much
> better with other vendors, but I keep holding my breath hoping that
> security vendors will see the error of their ways and create devices that
> can be smart about being in the mail stream. Until then, a DMZ
> architecture that uses some MTA that I prefer is the way I'll continue.
> Unless of course it's convenient because I also want AV, HTTP& 2-factor
> access, etc. Then it would make sense to take advantage of the MTA already
> there.
>
>
> Unless you were thinking of some other reasons why this makes sense and I
> totally missed the boat. Please correct me if you see differently.
>
> FWIW, I can run a hardened server of just about any flavor in a DMZ
> environment. But it only takes one port to do damage, so I'm much more
> apt to prefer a local host firewall and a good monitoring system for both
> the application and the wires. Some folks will tell you that a DMZ is not
> even necessary any longer. :)
>
>
>
> "Don Wilwol" <donwilwol@yahoo.com> wrote in message
> news:erURL6KqFHA.3516@TK2MSFTNGP15.phx.gbl...
>>
>>
>> --
>> Hope it helps...........
>>
>> dw
>>
>> Don Wilwol
>> Blog - http://spaces.msn.com/members/wilwol/
>> Web - http://capital.net/~wilwol/dw.htm
>> DonWilwol(REMOVE)@yahoo.com
>>
>> "Leythos" <void@nowhere.lan> wrote in message
>> news:MPG.1d762f9612f549c9989cf5@news-server.columbus.rr.com...
>>> In article <#7$sgQKqFHA.712@TK2MSFTNGP15.phx.gbl>, "Don Wilwol"
>>> <donWilwol@(EMAIL)yahoo.com> says...
>>>> If you are going to do this, why not do it right and make that server
>>>> in the
>>>> DMZ an ISA server?
>>>
>>> Why would I need ISA on a hardened box?
>>
>> It is a recommended MS setup.
>>
>>
>>>
>>> Why would I want to have ISA running as a "Firewall" on a non-firewall
>>> server?
>> To provide controlled Authentication.
>>
>>>
>>> Why, if I have a real firewall appliance in front of the server in the
>>> DMZ, and have proven rules that work fine, would I need to consider
>>> another firewall?
>>
>> Why do you have 2 to start with? Is there really a such of a thing as too
>> much protection?
>>
>>>
>>> Are you suggesting that you can't run servers in a DMZ properly unless
>>> they have some soft firewall solution on them?
>> Yep!
>>>
>>> --
>>>
>>> spam999free@rrohio.com
>>> remove 999 in order to email me
>>
>>
>
>

Leythos
Wed Aug 24 19:46:57 CDT 2005

In article <OKJA#yNqFHA.1272@TK2MSFTNGP11.phx.gbl>,
amulnick_No_SPAM@ncDOTrr.com says...
> Well, I'll play along with this one. Why is it recommended? I think
> Leythos knows enough about this subject to deserve a better explanation.
> To be honest, the ISA server in a SMTP situation doesn't offer a lot of
> protection vs. a hardened machine. Especially one with a the firewall built
> in etc. ISA is much more suited to layer-7 filtering of Microsoft products
> than other firewall services. That's a true statement. But for SMTP only,
> I can't see the benefit of deploying ISA server into this situation. I see
> it as overkill and not providing roi to the effort I'm putting into it and
> the introduction of new technology I don't already have. Translation? extra
> burden on my staff if I do that with very little return.
>
> For RPC/HTTP or HTTP (OWA) access, I highly recommend ISA. I know the
> difference on the wire why it would make sense vs. the other firewall
> products out there. But it's best use is as part of a bigger strategy not
> just something to replace an already existing strategy/architecture that
> works and certainly not for just SMTP (30+ year old protocol) which can be
> secured about as much as it is going to be on just about any relay machine
> whether Windows, *nix or whatever you choose. I prefer to pick relays that
> have queue management possibilities (little to no code required) so I
> haven't really wanted to deploy a lot of Windows servers for relay devices.
> I would be loathe to deploy ISA for just SMTP relay for that same reason.
> It's a gap in the strategy that hasn't been filled. It's not much better
> with other vendors, but I keep holding my breath hoping that security
> vendors will see the error of their ways and create devices that can be
> smart about being in the mail stream. Until then, a DMZ architecture that
> uses some MTA that I prefer is the way I'll continue. Unless of course it's
> convenient because I also want AV, HTTP& 2-factor access, etc. Then it would
> make sense to take advantage of the MTA already there.
>
>
> Unless you were thinking of some other reasons why this makes sense and I
> totally missed the boat. Please correct me if you see differently.
>
> FWIW, I can run a hardened server of just about any flavor in a DMZ
> environment. But it only takes one port to do damage, so I'm much more apt
> to prefer a local host firewall and a good monitoring system for both the
> application and the wires. Some folks will tell you that a DMZ is not even
> necessary any longer. :)

Thanks for the details.

I don't think I'm ever going to give up my DMZ's as we do a lot of
medical/health care companies, and the methods work and are reliable and
proven.


--

spam999free@rrohio.com
remove 999 in order to email me