Architecture for multiple servers

Hi All,
I am about to upgrade our NT 4.0 servers with 2003 servers. I anticipate
that I will have either 3 or 4 servers operational. One will be for
Exchange, one for Oracle, one for Terminal Server connections, and a fourth
for File sharing and storage. I may be able to squeeze the file storage to
the Terminal Server, but not sure.
Anyway, our current architecture is:
public IP to Nortel Contivity box for VPN access

public IP to NIC1 in exchange server
private IP to NIC2 in exchange server
exchange server performing proxy et al to the local network

I would like to make this more secure. First, and foremost, I understand
that by default 2003 server IIS is MUCH better than 4.0 was. My question
is: should I have a hardware firewall put in place, and route the traffic
based on ports? Should I have 2 NICs in the new exchange server?

I want to do this one right, since I had no say in the original NT system we
are currently using.

Thanks for any input!

Jerry

garyw
Tue Jan 27 10:17:55 CST 2004

Jerry,

Your question on how best to secure your servers is a good one, but the
answer encompasses much more than your firewall configuration.

Please refer to these resources for additional information.

1. This is the Security Operations Guide for Windows Server 2003.

http://www.microsoft.com/downloads/details.aspx?FamilyID=8a2643c1-0685-4d89-
b655-521ea6c7b4db&DisplayLang=en

2. This is the Threat and Countermeasures document. It is a companion
document to the Windows Server 2003 SOG:

http://www.microsoft.com/downloads/details.aspx?FamilyID=1b6acf93-147a-4481-
9346-f93a4081eea8&displaylang=en

3. This document is very good regarding Web applications.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/ht
ml/ThreatCounter.asp

4. This is the Security Operations Guide for Exchange 2000.
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
prodtech/mailexch/opsguide/default.asp

5. This is the Authoratitive Security Guide for the Enterprise:

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
bestprac/default.asp

I know this is a tremendous amount of information to absorb. It covers the
important concepts of defense in depth, patch management and firewall
configuration.

Thanks.

Gary Whitley

This posting is provided "AS IS" with no warranties, and confers no rights.