Exchange Server Pro » Firewalls

Publishing Exchange 2010 POP3 with ISA Server 2006

Paul Cunningham — Sun, 27 Mar 2011 11:15:12 +0000

A business that wants to deploy Exchange Server 2010 POP3 is most likely going to do it for users to remotely access their email from outside of the network. For a network that uses ISA Server 2006 as a firewall there are a few simple steps involved in opening up access for the clients.

Creating the Mail Submission Protocol Definition

The first step is to create a new protocol definition in ISA Server 2006 for the port on which clients will send mail. As we saw in the previous articles on configuring Windows Live Mail for Exchange 2010 POP3 and publishing POP3 client settings to users the Receive Connector on the Exchange 2010 Client Access server uses TCP port 587. There is no default protocol definition in ISA Server 2006 for this port.

In the ISA management console go to the Toolbox in the right-hand pane and in the Protocols section click New -> Protocol.

Give the new protocol a meaningful name.

Click the New button to configure the port for the new protocol.

Configure the protocol for TCP, Inbound, on port 587.

Don’t configure any secondary connections.

Click Finish to complete the new protocol definition.

Creating the ISA 2006 Access Rule for Exchange 2010 POP3 Clients

The next step is to create the access rule itself. There is a mail server publishing wizard that you can use to set up access rules for POP3, IMAP and SMTP but because it doesn’t include the option to set up the correct client mail submission port we’re using in this scenario, which means a little modification is needed at the end.

Start the Mail Server Publishing Rule wizard.

Give the rule a meaningful name. This name will then be appended automatically by ISA server depending on the protocols you choose in the next steps.

Set the Access Type to Client Access: RPC, IMAP, POP3, SMTP.

Tick the boxes for secure POP3 and standard SMTP (we’ll be changing the SMTP one shortly).

Enter the IP address of the Client Access/Hub Transport server. Note if these are different servers in your network you would just need to run the wizard twice to create one rule for POP3 to the Client Access server IP, and the other for SMTP to the Hub Transport server IP.

Set the listening network to External.

Click Finish to complete the wizard.

The two newly created rules will be visible in the Firewall Policy. Double-click the SMTP rule to open it.

On the Traffic tab change the protocol from SMTP to the Client Mail Submission protocol we created earlier.

Click OK to apply the change to the rule.

The final step is to click Apply to commit the changes to the Firewall Policy.

You can now test the firewall rule with an email client outside of the network.

Get more Exchange Server tips at ExchangeServerPro.com

Well-designed security systems fail gracefully, SonicWALL does not

Paul Cunningham — Sat, 06 Dec 2008 11:31:00 +0000

To quote Bruce Schneier, “well-designed security systems fail gracefully”. This means for example when the ISA firewall service fails it closes off network connectivity entirely (ie retains security) instead of opening your entire network up (ie decreases security).

This week SonicWALL’s license servers suffered a glitch rendering thousands of customer units useless and leaving the customers’ networks open to attack. The affected devices included firewall and email security appliances.

Security appliances are popular for no good reason at all. The decision maker in many organisations falls for marketing hype that a “hardware firewall” is better than the alternative, ignoring the obvious fact that the appliance is ultimately no different to any other firewall that consists of a piece of hardware running secure OS and firewall features.

When purchasing a firewall or security product the decision should not be based on perception but rather fact. I’m sure no SonicWALL customer ever imagined that the company could make an error on their license servers that would comprimise their security in such a manner. Its worth noting that once your Microsoft ISA Server firewall is up and running it can never become “unlicensed” by an error at Microsoft.

Get more Exchange Server tips at ExchangeServerPro.com

Tom Shinder on “hardware” firewalls

Paul Cunningham — Fri, 31 Aug 2007 04:19:07 +0000

Tom Shinder of ISAServer.org takes an amusing shot at the myth in some circles that a “hardware” firewall or “firewall appliance” offers more security than a Microsoft ISA Server firewall.

I was drawn to a particular quote in his article about the relative security of ISA Server to other popular firewalls in the context of the number of reported security vulnerabilities for each product.

A quick look at www.secunia.com shows that the ISA Firewall (2004 and 2006) have no active security issues. Compare this with any “hardware” firewall and you will see that the ISA Firewall is more secure than just about any hardware firewall.

There are a lot of firewall appliances out there so I didn’t do an exhaustive search of their stats on Secunia, but I did take a look at the stats for ISA Server, Cisco Pix, and OpenBSD as those are the three firewalls I am most familiar with in my professional life.

ISA Server

Cisco Pix

OpenBSD

I found those numbers to be pretty interesting. It is not unusual to have a customer request that a two-tiered firewall infrastructure be implemented on their environment. Often this means they request that some type of “appliance”, be that a Cisco Pix or some other third party box painted red and given a secure sounding name, be placed between the internet and the ISA Server that we are implementing for them. Sometimes this is based on the principle of defense in depth, whereas other times it is based on a false belief that a product from Microsoft couldn’t possibly be secure. Maybe if they saw the stats above they would think otherwise.

Get more Exchange Server tips at ExchangeServerPro.com

Exchange Server Pro » Firewalls

Publishing Exchange 2010 POP3 with ISA Server 2006

Creating the Mail Submission Protocol Definition

Creating the ISA 2006 Access Rule for Exchange 2010 POP3 Clients

Related posts:

Well-designed security systems fail gracefully, SonicWALL does not

Related posts:

Tom Shinder on “hardware” firewalls

Related posts: