Managing Exchange Server Connectivity Across Firewalls

Using Firewalls To Prevent Unauthorized Access

The method, by which you can physically secure the network, is through the usage of firewalls. While firewalls provide some level of physical security, you should bear in mind that firewalls are just barriers which make it difficult for intruders to attack the network.

Firewalls are categorized as follows:

Firewalls work by checking packets to determine whether packets should be permitted to be forwarded, or whether packets should be dropped. The main function of the firewall is to filter traffic. TCP/IP packets have an IP packet header, followed by the actual content of the packet. The IP packet header is either a TCP header or a UDP header. The TCP header or UDP header contains the IP addresses and port number of the sender (source), and the IP addresses and port numbers of the receiver (destination). A TCP header contains the following additional information as well: Sequence numbers and acknowledgment numbers, and conversation state.

As packets pass over the firewall, packets are examined according to the filtering parameters configured for the firewall to filter traffic on. The filtering parameters define which packets should be allowed to pass over the firewall. The default configuration is that firewalls typically deny all packets other than those which it has been explicitly set up to allow. In networking environments, firewalls are usually configured to block all incoming traffic, and to allow outbound traffic from the private internal network.

Packet filters are used to define the traffic types that should be denied by a firewall. You need to implement firewalls and router packet filters to secure the resources within your private network from Internet users.

When you configure IP packet filters, you can specify what traffic is allowed or denied, based on the following:

IP packet filters should be used for the purposes:

Advanced firewalls include a number of additional security features, including:

If the Exchange organization accesses external networks, you should use a firewall to protect the Exchange organization. A strong firewall solution should be used to protect back-end Exchange servers. Front-end servers usually exist in the demilitarized zone (DMZ) or perimeter network.

A perimeter network usually consists of the following elements:

A perimeter network is either a single firewall configuration, or back to back firewall configuration:

You can use TCP port filtering to secure network applications and services. TCP port filtering allows you to control the type of network traffic that reaches your Exchange servers through the restriction of connections to specific TCP ports.

A few common TCP ports are listed here:

MAPI Client Connection Across a Firewall

Messaging Application Programming Interface (MAPI) is a specification that provides a common method to access messaging backbones. A Messaging Application Programming Interface (MAPI) based Exchange client is a messaging application which communicates with an Exchange Server using MAPI and Exchange transport. A MAPI information service should be available for the messaging backbone prior to using a MAPI based client. Because MAPI defines standardized interfaces at two layers, a client interface and service provider interface; client applications and information services can be created. MAPI remains consistent regardless of the backbone and information services used.

RPC over HTTP makes it possible for remote users to access Exchange Server 2003 through Outlook 2003 MAPI client over the Internet.

To enable RPC over HTTP, the following configuration has to be performed on the front-end server for the remote connection:

Through RPC over HTTP, messages sent by a MAPI client are able to access the Exchange Server 2003 server through a firewall. When using RPC over HTTP, Outlook users can connect directly to an Exchange server over the Internet through HTTP. Whether the Exchange server and Outlook reside on different networks, and is behind firewalls is irrelevant. RPC over HTTP provides remote users with secure communication access to the Outlook features of the MAPI client.

When you install and configure RPC over HTTP, the Exchange front-end server becomes a RPC proxy server that defines the ports that the RPC client uses to connect to the Exchange servers, global catalog servers and domain controllers.

The RPC proxy server can be deployed or located as follows:

Configuring Exchange Server 2003 to Use RPC Over HTTP

The following steps have to be performed to configure Exchange Server 2003 to use RPC over HTTP:

How to install the RPC over HTTP Proxy Windows component

  1. Log on to the front-end Exchange server.
  2. Open Control Panel.
  3. Click Add or Remove Programs.
  4. Select Add/Remove Windows Components.
  5. The Windows Components dialog box opens.
  6. Select Network Services and click the Details button.
  7. The Networking Services Component dialog box opens.
  8. Select the RPC over HTTP Proxy.
  9. Click OK.
  10. Click Next to install the RPC over HTTP Proxy Windows component
  11. Click Finish.

How to configure the RPC virtual directory in Internet Information Services (IIS) for basic authentication

  1. Click Start, Administrative Tools, and then click Internet Information Services (IIS) Manager on the Exchange front-end server.
  2. The IIS Manager console opens.
  3. In the left pane, expand the server node, Web sites, and then Default Web Site.
  4. Right-click Rpc and select Properties from the shortcut menu.
  5. The Rpc Properties dialog box opens.
  6. Click the Directory Services tab.
  7. Click Edit.
  8. Uncheck Enable Anonymous Access.
  9. Select Basic Authentication. Integrated Windows Authentication is by default selected.
  10. Click OK.

How to configure the registry on the back-end Exchange server to use the specific number of ports

  1. Open the Registry Editor on the Exchange front-end server.
  2. Navigate to the HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\RpcProxy registry key.
  3. Right-click Valid Ports and then select Modify on the shortcut menu.
  4. In the Edit String window provide the appropriate Exchange front-end server information.
  5. Close the Registry Editor on the Exchange front-end server.
  1. Open the Registry Editor on the Exchange back-end server.
  2. Navigate to the HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Services\MSExchangeSA\Parameters registry key.
  3. Right-click Rpc/HTTP NSPI Port and then select Modify on the shortcut menu.
  4. Select Decimal in the Base window.
  5. In the Value Data field, provide the appropriate information.
  6. Click OK.
  7. Right-click HTTP Port and select Modify from the shortcut menu.
  8. Select Decimal in the Base window.
  9. In the Value Data field, provide the appropriate information.
  10. Click OK.
  11. Navigate to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem registry key.
  12. Right-click RPC/HTTP Port and select Modify from the shortcut menu.
  13. Select Decimal in the Base window.
  14. In the Value Data field, provide the appropriate information.
  15. Click OK.
  16. Close the Registry Editor on the Exchange back-end server.

How to configure the Outlook profile for users to utilize RPC over HTTP

The following default settings provide the most secure method of user connection:

To configure the Outlook profile for users to utilize RPC over HTTP,

  1. On the back-end Exchange server, open Control Panel.
  2. In the See Also pane, select Control Panel Options and then Mail.
  3. Click Show Profiles.
  4. When the Mail dialog box opens, click Add.
  5. In the New Profile dialog box, in the Profile Name box, enter a name for the profile that you are creating.
  6. Select the Add A New E-Mail Account option and click Next.
  7. The Exchange Server Settings dialog box opens.
  8. Enter the Exchange server name and the account user name.
  9. Click Check Names and the click OK.
  10. Click More Settings.
  11. Click the Connection tab.
  12. In the Connection area of the tab, select the Connect Using Internet Explorer’s Or A 3rd Party Dialer option.
  13. In the Modem area of the Connection tab, select the Connect To My Exchange Mailbox Using HTTP option.
  14. Click Exchange Proxy Settings.
  15. In the Use This URL To Connect To My Proxy Server For Exchange box, provide the appropriate URL information.
  16. Select the Connect Using SSL Only option.
  17. Select the Mutually Authenticate The Session When Connecting With SSL option.
  18. In the Principal Name For Proxy Server box, provide the principal name information.
  19. For a user that resides on a fast network, the default connection order can be left unchanged. This is to connect through TCP/IP first and then HTTP.
  20. For a user that resides on a slow network, change the default connection order to connect through HTTP first and then TCP/IP.
  21. In the Proxy Authentication Settings area of the Exchange Proxy Settings page, select the Basic Authentication option from the Use This Authentication When Connecting To My Proxy Server For Exchange drop-down list.
  22. Click OK.
  23. Click Finish.


Top 5 Free Networking Tools

Bookmark Managing Exchange Server Connectivity Across Firewalls

Latest Blog Posts


English English GermanGerman SpanishSpanish FrenchFrench ItalianItalian PortuguesePortuguese RussianRussian DutchDutch
GreekGreek HindiHindi JapaneseJapanese KoreanKorean ChineseChinese Chinese (Simplified)Chinese (Simplified) ArabicArabic

Copyright 2009 Tech-FAQ. All rights reserved. Privacy Policy.