Edge Transport Server Necessary? 2

[mapman04]

I am researching Exchange 2007 for implementation. This will be a new implementation. Is an Edge Transport server necessary? It will be a single domain infrastructure with approximately 150 users. I'm getting/finding differing opinions. Any insight will be appreciated.

Regards,

Mapman04

 

[Cstorms]

Simple answer. Nope.

Edge is a form of relay created to provide customers the ability to provide a more thorough security model in their email environment. Offering a role to do your virus scanning and spam filtering then relaying via secure link to your Hub Transport server.

Cory

 

[mapman04]

So if the present firewall/security appliance does those functions, it's just an added expense? Do you have to purchase another exchange license to run they edge transport server?

 

[58sniper]

Yes, you'd need another license. The features go a little deeper, though. Edge transport can scan mail based on individual users' spam settings.

In a perfect world, you'd have an ISA box doing reverse proxy for OWA, and an Edge box doing inbound hygiene. Both of these would be in your perimeter network.

However, this might be out of the reach of a 150 user shop, although neither box needs to be super powerful.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP

 

[mapman04]

Thanks for the responses. Having limited resources, does it make sense to implement the Edge box? I have to weigh in on how this should be implemented. The Edge could be added later, correct? Does the Edge box spool inbound mail if it can't reach the "actual" exchange box?

Thanks again,

Mapman04

 

[58sniper]

Yes, it can be added later. But it's easier to do it from the beginning.

It IS an actual Exchange box. Perhaps you mean the mailbox server?

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP

 

[mapman04]

Yes, where the mail is stored. I just don't see the advantages of adding the Edge Transport Server. Exchange 2003 didn't have such a thing and it worked fine. I know there are major differences between 2K3 and 2K7. I want to make the proper recommendation and for the size of the organization, to don't really the the benefits. Can the Edge box spool the mail if it can't reach the mailbox server.

Many thanks,

mapman04

 

[ShackDaddy]

Yes, the Edge role will spool mail.

As far as hygiene, you probably know that you can install some of the Edge anti-spam components within the Hub role and bypass the need for a separate server to SOME degree.

Another option for you might be to not deploy an Edge, but instead use a 3rd-party service for your mail hygiene and availability needs. I've been using MXLogic lately to cover hygiene, disaster recovery (mail spooling and availability) and compliance archiving for most of my clients, and it's fairly economical. The support is good too.

ShackDaddy
Shackelford Consulting

 

[strongm]

>Exchange 2003 didn't have such a thing and it worked fine

Well, it did, more-or-less. It just called it something different: a front-end server

 

[58sniper]

Well, that's not entirely true. There's quite a difference between a front-end server and an Edge Transport. A front-end server is closer in features to a Client Access Server role than the Edge Transport role.

Remember that an ET is designed to sit in your perimeter network. It's not a member server, and is designed to help lower your potential attack surface as well as provide hygiene services.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP

 

[mapman04]

Thanks for the insight. So this boils down to do you as the end user want to control your mail hygiene with Exchange or use other services to do those functions? Am I correct with that statement?

Mapman04

 

[ShackDaddy]

That's right. And if you choose Exchange, you can choose to do that with or without an Edge server.

Dave Shackelford
MCSE, CCNA, Microsoft MVP: Exchange
Shackelford Consulting

 

[gb0mb]

I was in the same boat as you. Smaller company without the budget to buy another server for an edge transport and also an ISA server.

What I did was take an older pc and made it a send mail relay in the dmz with spam filtering and anti virus. I also built a reverse apache proxy to connect the outside to he internal exchange server. The reverse apache proxy is very easy and has worked perfectly now for at least 3 months.

I used vmserver on the machine an ran the relay and reverse proxy in seperate vms. So if the server crashes I can quickly use any box and the two backup copies of the vm to bring itonline again quickly. Since the relay and reverse proxy really wont change you do not need to back it up on a regular basis.

Gb0mb

........99.9% User Error........