OWA Front Edn Server Issues 4

[thelke]

Here is my topology

Firewall
Web Server W/ Front End Exchange 2003 Enterprise and OWA
Back end Exchange 2003 Enterprise w/ the mailboxes

The firewall NATs all web traffic to the web server, when someone goes to log into OWA, it weants to redirect the user to the backend server, but I do not allow that to be live on the web through the firewall. Is there a way for the front end to pass traffic back, and the back end to do the opposite?

Did this make sense?

Thank,

Tad

 

[Silmeron]

Is your front-end server in a DMZ? If so, you'll have to open up some ports between the DMZ system and your back-end Exchange server. Unfortunately no way around it, but at least in this situation, your back-end server isn't directly open to the Internet. For a little added security, you can set up an IPSec policy to encrypt all the HTTP traffic between your front-end and back-end too.

If your situation is like this, let me know and I'll post a bunch of good links to help you get up and running.

-S-

 

[ilpadrino]

Silmeron, I'd like to see those links for setting up OWA in a DMZ. Do you consider OWA on 2003 a good remote access tool vs the hassle of a vpn?

 

[xmsre]

Your front end needs to talk to the backend, as well as the GC, on the following ports:

53 TCP & UDP DNS
80 TCP HTTP
88 TCP & UDP Kerberos
123 UDP NTP
135 TCP Endpoint Mapper
389 TCP & UDP LDAP
445 TCP SMB direct hosting
3268 TCP LDAP for GC
1024 - 1026 TCP DS port

You can set DS for a specific port with the registry key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters

Value Name: TCP/IP Port
Data Type: REG_DWORD
Radix: Decimal
Value: greater than 1024



Alternately, you could use IPSEC between the frontend and backend.

http://support.microsoft.com/default.aspx?scid=kb;en-us;821839

 

[Silmeron]

I love having our employees use OWA instead of VPN. For them, it looks and feels much like their Outlook 2003's in the office, and for me it removes the support of teaching people how to properly configure their machines to log in through VPN (e.g. making sure they have a good firewall and are anal about updating their virus defs among other things...). I would highly recommend it - just make sure to get yourself an SSL certificate so you can protect your user's logon credentials.

I used FreeSSL since it's nice and cheap and is trusted by Internet Explorer, so no weird certificate dialog box, and I don't need the insurance protection of the bigger (and thus more expensive) SSL certs. They're all the same tech.

To get started, you'll need to have *two* copies of Exchange 2003 for this to be legal. With EX2003, you can buy Standard editions for both. There might be a way to just install OWA on a DMZ server legally, but at the moment I'm not aware of it.

First install your backend server and get everything working happily. Then set up your front-end server inside your network. It'll make getting everything up much easier; once everything is properly configured, you can then move it to the DMZ and start your hack tests to make sure all the traffic goes (and not goes) where it's supposed to.

I found a great deal of information about this from the folks at MSExchange.org and on the Microsoft newsgroups for Exchange. Doing searches on Google Groups is invaluable. Here's some helpful links:

First, get yourself on Microsoft's free TechNet update service so you know when critical updates for Exchange are available:

http://register.microsoft.com/subscription/subscribeme.asp?ID=135

Go and Read the Tutorials at MSExchange.org

http://www.msexchange.org

Setting up your Front-End Server

http://www.msexchange.org/tutorials/OWA_Exchange_Server_2003.html

Installing your SSL Certificate

http://www.freessl.com/resources/install/freessl/exchange-owa.html

Eventid.net - Great spot to troubleshoot Event errors:

http://www.eventid.net

Lastly if you want to secure internal traffic between your front-end and back-end server, use IPSec. This is for EX2000, but is still relevant here.

http://www.microsoft.com/downloads/...FamilyID=AFAD8426-572E-40F8-99DA-EB7198F374C4

Good luck!

 

[ilpadrino]

thank you, those vpn troubles are exactly what i'm dealing with. the advantage of OWA obviously is that you can link it to a web site or extranet, but what about RPC over HTTP? i'm nervous about jumping that MS bandwagon after all the recent exploits of RPC in window's systems.