Exchange Server / ISA / Firewalls

Hi All,
I've got a couple of questions regarding sbs2000. Firstly, can ISA be
disabled without affecting exchange server functionality? (i.e will
exchange still work?)
Can the ISA Firewall be disabled but still use the ISA proxy?
If I put a cisco firewall infront of the sbs2000 server (with ISA
Firewall enabled) would this cause any problems?

Finally, the main question that is confusing me slightly, what is the
common method of securing exchange server with a hardware firewall? I
assume most companies don't place their exchange server on the internet
with an external ip address, so what do most people do to transfer
emails coming-in to the exchange server from the external ip address
(router). Is port-forwarding a common solution to this?

Sorry for so many questions I'm just trying to get my head around it,
thanks in advance for any help.

Kevin
Mon May 09 21:05:17 CDT 2005

To secure your SBS server, you want to have two NIC cards installed -- one
nic will be attavhed to the same hub/switch as the rest of your local
workstations; the second is attached to your Internet cable.

Many SBS sites will put a simple DSL/.Cable router box between this secind
NIC card and the Internet modem/device. The only thing you then need to do
is to go into the DSL/Cable box and forward port 25 (SMTP) to your SBS
server.

Then, run the SBS wizard, and everything is configured for you,
auto'magic'ally.

So, why are you thinking about disabling ISA? Do you know that it is as
good, if not better, than most hardware firewalls?

You may find the following link interesting reading:
http://www.isaserver.org/articles/2004tales.html

--
Kevin Weilbacher [SBS-MVP]
"The days pass by so quickly now, the nights are seldom long"


<catazy@hotmail.com> wrote in message
news:1115653694.937665.288730@o13g2000cwo.googlegroups.com...
> Hi All,
> I've got a couple of questions regarding sbs2000. Firstly, can ISA be
> disabled without affecting exchange server functionality? (i.e will
> exchange still work?)
> Can the ISA Firewall be disabled but still use the ISA proxy?
> If I put a cisco firewall infront of the sbs2000 server (with ISA
> Firewall enabled) would this cause any problems?
>
> Finally, the main question that is confusing me slightly, what is the
> common method of securing exchange server with a hardware firewall? I
> assume most companies don't place their exchange server on the internet
> with an external ip address, so what do most people do to transfer
> emails coming-in to the exchange server from the external ip address
> (router). Is port-forwarding a common solution to this?
>
> Sorry for so many questions I'm just trying to get my head around it,
> thanks in advance for any help.
>

catazy
Tue May 10 03:07:19 CDT 2005

Yes, I currently have the sbs site working fine. It was more because I
am planning installing an exchange server 2003 site using the same
network and was hoping to share the internet connection and rather than
have them both setup differently I was hoping to keep a standardised
setup. What do people do if their server is not located next to the dsl
router?

I have read that article before and I am a fan of ISA it was just I
wasn't sure how ISA reacts to a hardware firewall. I do get slightly
nervous having our main server connected directly to the Internet (ISA
or no ISA). Although ISA is a good firewall, it is also based on the
Windows environment.

Andrew
Fri May 13 11:43:14 CDT 2005

In message <1115712439.276322.144450@o13g2000cwo.googlegroups.com>,
catazy@hotmail.com writes
>Yes, I currently have the sbs site working fine. It was more because I
>am planning installing an exchange server 2003 site using the same
>network and was hoping to share the internet connection and rather than
>have them both setup differently I was hoping to keep a standardised
>setup. What do people do if their server is not located next to the dsl
>router?

Personally I install a Netgear Web Router (includes a 4 port switch) on
the DSL line and then place the SBS server on that switch. With no port
forwarding the Netgear devices completely blocks ALL incoming ports to
the SBS server. You don't need to open port 25 for Exchange as it
instigates the connections to your ISP or POP boxes when required and
NAT takes over.

Only on sites where I need incoming VPN's or other incoming services do
I start port forwarding from the Netgear router to the SBS server. Still
very safe.

The other advantage on this method means you get a small DMZ for other
uses.

>I have read that article before and I am a fan of ISA it was just I
>wasn't sure how ISA reacts to a hardware firewall. I do get slightly
>nervous having our main server connected directly to the Internet (ISA
>or no ISA). Although ISA is a good firewall, it is also based on the
>Windows environment.
>

ISA should not care about the hardware firewall at all, it just needs to
use it as the gateway rather than the modem etc.

--
Andrew D. Newbould E-Mail: newsgroups@NOSPAMzadsoft.com

ZAD Software Systems Web : www.zadsoft.com