Exchange Server Forums

ISA in DMZ (Member Server or plain Workgroup?)

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [Microsoft Exchange 2003] >> Server Security >> ISA in DMZ (Member Server or plain Workgroup?)

Page: [1]

Message

<< Older Topic Newer Topic >>

ISA in DMZ (Member Server or plain Workgroup?) - 15.May2008 2:55:14 AM

DariusM

Posts: 35
Joined: 11.Jan.2006
Status: offline

my requirements:

1. access OWA, OMA, RPC over HTTP

my settings:

BE and FE in trusted network. plan to implement ISA 2004 Std in DMZ to become the Frontend server for my outside users.

i have watchguard firewall that has DMZ network, i will place this ISA machine in this network.

my question:

1. do i need to join the ISA as member server in my domain?
2. or is it configured as WORKGROUP only
3. can i know the exact procedure/detailed how to host my FE using ISA?

thank you for your time. please help me.

regards

< Message edited by DariusM -- 15.May2008 5:53:44 AM >

_____________________________

One of the best ways to educate our hearts is to look at our interaction with other people, because our relationships with others are fundamentally a reflection of our relationship with ourselves.
--Stephen R. Covey First Things First--

Post #: 1

Featured Links*

RE: ISA in DMZ (Member Server or plain Workgroup?) - 15.May2008 5:26:59 AM

vnsl_it

Posts: 7
Joined: 11.Apr.2008
Status: offline

Y have conf ISA client in y domain. If y want ISA to DMZ, ISA have 3 network card.
I think y visit to isaserver.org seach everthing for ISA.
good luck to y.

< Message edited by vnsl_it -- 15.May2008 5:29:23 AM >

(in reply to DariusM)

Post #: 2

RE: ISA in DMZ (Member Server or plain Workgroup?) - 15.May2008 5:51:25 AM

DariusM

Posts: 35
Joined: 11.Jan.2006
Status: offline

quote:

Y have conf ISA client in y domain. If y want ISA to DMZ, ISA have 3 network card.
I think y visit to isaserver.org seach everthing for ISA.
good luck to y.

thanks for the reply man. i am configuring ISA to become the Frontend server of my BE Exchange, i have FE inside the trusted network, and my next implementation is ISA to be place in DMZ, i have appliance firewall that has DMZ network.

in this article http://www.msexchange.org/tutorials/Configuring-ISA-Server-2004-Exchange-Frontend-Server-DMZ-Part1.html

and

http://www.msexchange.org/tutorials/Configuring-ISA-Server-2004-Exchange-Frontend-Server-DMZ-Part2.html

i didn't find any information regarding the ISA server, if placed in DMZ, should i make this machine as member server of my domain or simply workgroup?

thanks

_____________________________

One of the best ways to educate our hearts is to look at our interaction with other people, because our relationships with others are fundamentally a reflection of our relationship with ourselves.
--Stephen R. Covey First Things First--

(in reply to vnsl_it)

Post #: 3

RE: ISA in DMZ (Member Server or plain Workgroup?) - 29.May2008 5:10:31 PM

knottyrope

Posts: 3
Joined: 20.Apr.2007
Status: offline

Just use ISA as your firewall and run it in parrallel to your firedog.
Yes you can add it to domain, thats my setup.
ISA 2004 is as good as your firedog, ISA is 4 times faster than the others I use.

I have 4 fire walls here with seperate IP

xx.xx.xx.1 sonical wall for internet access
xx.xx.xx.2 ISA 2004 for rpc /https/FTP
xx.xx.xx.3 wireless access point for visitors
xx.xx.xx.4 Cisco VPN concentrator

(in reply to DariusM)

Post #: 4

RE: ISA in DMZ (Member Server or plain Workgroup?) - 30.May2008 2:27:46 PM

Sembee

Posts: 2731
Joined: 17.Jan.2008
From: Somewhere near London, UK
Status: offline

My personal opinion would be that an ISA server as a member of the domain in the DMZ is a waste of time. The ISA server gets compromised the attacker walks straight in. The number of holes required in the firewall to get a member server to work makes it look like swiss cheese.

Workgroup only for the ISA server, then if it gets compromised they don't get very far.

Simon.

_____________________________

Simon Butler,
Exchange MVP
Blog: http://www.sembee.co.uk/
Web: http://www.amset.info/
In the UK? Hire me: http://www.amset.co.uk/

(in reply to knottyrope)

Post #: 5