Module 6: Integrating ISA Server 2004 and Microsoft Exchange Server

Overview Issues in Security Configuring ISA Server to Secure SMTP Traffic Configuring ISA Server to Secure Web Client Connections Configuring ISA Server to Secure Client Connections

Lesson: Issues in Security Security Threats Overview Access Using Web Clients Access Using Outlook Clients Access Using POP3, IMAP4, and NNTP Clients SMTP Protocol-Level Exploits Unwanted and Malicious How ISA Server 2004 Secures Exchange Server

Security Threats Overview Ensuring the security of includes: Ensuring that all client connections to the server are secure Protecting the servers from SMTP exploits Preventing unwanted or malicious s from entering the organization’s network Ensuring that all client connections to the server are secure Protecting the servers from SMTP exploits Preventing unwanted or malicious s from entering the organization’s network

Access Using Web Clients Outlook Mobile Access XHTML, cHTML, HTML ActiveSync Enabled Mobile Devices ISA Server Outlook Web Access Exchange Front-End Server Exchange Back-End Servers Wireless Network

Outlook RPC Connections Outlook RPC over HTTP Connections Access Using Outlook Clients Port 135 and dynamic ports Port 80 or 443 Exchange Back-End Servers Exchange Back-End Servers Exchange Front-End Server Exchange Front-End Server ISA Server

POP3 Connections IMAP4 Connections Access Using POP3, IMAP4, and NNTP Clients Port 110 or 995 Port 25 Port 143 or 993 Port 25 Exchange Back-End Servers Exchange Back-End Servers Exchange Front-End Server Exchange Front-End Server ISA Server

SMTP Protocol-Level Exploits SMTP servers can be vulnerable to: Buffer overflow attacks when SMTP commands are sent with more than expected data, causing memory buffer overflows Mail relay attacks when an SMTP server is used to forward unwanted to Internet recipients SMTP command attacks where SMTP commands are used to compromise the server or gain information about the server or recipients on the server Buffer overflow attacks when SMTP commands are sent with more than expected data, causing memory buffer overflows Mail relay attacks when an SMTP server is used to forward unwanted to Internet recipients SMTP command attacks where SMTP commands are used to compromise the server or gain information about the server or recipients on the server

Unwanted and Malicious Unwanted is unsolicited commercial that: Consumes server and network resources Reduces user productivity and increases administrative effort Can be filtered using an application-level filter May result in exposure to legal liability Consumes server and network resources Reduces user productivity and increases administrative effort Can be filtered using an application-level filter May result in exposure to legal liability Malicious s contain viruses or worms that: Damage data or computers or consume network and computer resources Increase administrative cost and effort Increase the risk of an information leak Damage data or computers or consume network and computer resources Increase administrative cost and effort Increase the risk of an information leak

How ISA Server 2004 Secures Exchange Server Exchange Back-End Servers Exchange Back-End Servers Exchange Front-End Server Exchange Front-End Server Mail publishing wizards Filtering unwanted SMTP command filtering SMTP command filtering Secure access for Outlook clients Secure access for Outlook clients Secure access for Web clients ISA Server

Lesson: Configuring ISA Server to Secure SMTP Traffic How ISA Server Secures SMTP Traffic How to Configure ISA Server to Secure SMTP Traffic How SMTP Filtering Works How to Configure the SMTP Application Filter How SMTP Message Screener Works How to Implement SMTP Message Screener Integrating ISA Server and Exchange Server to Secure SMTP Traffic

How ISA Server Secures SMTP Traffic Exchange Back-End Servers Exchange Back-End Servers Exchange Front-End Server Exchange Front-End Server Use Mail Publishing Wizard to publish SMTP Servers Use SMTP message screener to filter unwanted Use SMTP application filter to filter SMTP commands SMTP Server ISA Server

To configure ISA Server to secure SMTP traffic: Configure the internal SMTP servers as SecureNAT clients 3 3 Configure an access rule for internal SMTP servers to send to the Internet 4 4 Configure DNS so the Internal SMTP servers can resolve Internet host names 5 5 Use the Mail Server Publishing Wizard to publish the SMTP server 2 2 Configure MX records on the Internet servers to refer to the computer running ISA Server 1 1 How to Configure ISA Server to Secure SMTP Traffic

Practice: Publishing an SMTP Server Creating the Internet DNS records Configuring a new SMTP mail server publishing rule Configuring outbound SMTP traffic Testing SMTP traffic flow Internet Den-ISA-01 Den-DC-01 Gen-Web-01 Den-Msg-01

How SMTP Filtering Works Exchange Back-End Servers Exchange Back-End Servers Exchange Front-End Server Exchange Front-End Server EHLO contoso.com Mail from: Rcpt to: Data EHLO contoso.com Mail from: Rcpt to: Data Is the … Command allowed? Command length allowed? SMTP Server ISA Server

How to Configure the SMTP Application Filter

How SMTP Message Screener Works Exchange Back-End Servers Exchange Back-End Servers IIS 6.0 With SMTP Service IIS 6.0 With SMTP Service Is the … Source Host allowed? Source Domain allowed? Attachment allowed? Keyword blocked? SMTP Server Install Message Screener ISA Server

To implement SMTP message screener: Configure an SMTP mail server publishing rule that publishes the SMTP server running message screener 3 3 Configure the message screener settings on the SMTP filter 4 4 Install the SMTP message screener on the IIS server 2 2 Install the SMTP service on an IIS 5.0 or IIS 6.0 server 1 1 How to Implement SMTP Message Screener

Practice: Implementing SMTP Message Screener Install the SMTP service on the computer running ISA Server Install the SMTP message screener Configure the SMTP message screener Test the SMTP message screener Internet Den-ISA-01 Den-DC-01 Gen-Web-01 Den-Msg-01

Integrating ISA Server and Exchange Server to Secure SMTP Traffic You can deploy message screener: On the computer running ISA Server. This option is the easiest to configure but least secure On an IIS server in the internal or perimeter network. Using a server in the perimeter network is most complicated to configure, but most secure To filter only inbound messages. Configure ISA Server to publish the message screener server, and configure access rules for the internal SMTP servers to send to the Internet To filter inbound and outbound messages. Configure ISA Server to publish the message screener server, and configure the internal SMTP servers to route messages to the message screener server On the computer running ISA Server. This option is the easiest to configure but least secure On an IIS server in the internal or perimeter network. Using a server in the perimeter network is most complicated to configure, but most secure To filter only inbound messages. Configure ISA Server to publish the message screener server, and configure access rules for the internal SMTP servers to send to the Internet To filter inbound and outbound messages. Configure ISA Server to publish the message screener server, and configure the internal SMTP servers to route messages to the message screener server

Lesson: Configuring ISA Server to Secure Web Client Connections How Does ISA Server Secure OWA Connections? How to Configure ISA Server to Enable OWA Access How to Configure Forms-Based Authentication How to Configure ISA Server to Enable Access for Other Web Clients

How Does ISA Server Secure OWA Connections? Exchange Back-End Servers Exchange Back-End Servers Exchange Front-End Server Exchange Front-End Server OWA Client OWA Client Use Mail Publishing Wizard to publish OWA Servers Configure attachment blocking Use forms-based authentication to avoid secure user logon ISA Server

To configure ISA Server to enable OWA access: Configure a bridging mode. For best security, secure the connection from client to ISA Server and from ISA Server to OWA server 3 3 Configure a Web listener for OWA publishing. Choose forms-based authentication and SSL for the Web listener 4 4 Use the Mail Server Publishing Wizard to publish the OWA server 2 2 Install a digital certificate on the OWA server and configure IIS to require SSL connections to the OWA virtual directories 1 1 How to Configure ISA Server to Enable OWA Access

How to Configure Forms-Based Authentication

How to Configure ISA Server to Enable Access for Other Web Clients Publishing Exchange server virtual directories for OMA and Activesync clients Publishing Exchange server virtual directories for OMA and Activesync clients

Practice: Configuring ISA Server for Secure OWA Connections Installing a certificate on the OWA server Configuring IIS to require SSL on the virtual directories used by OWA Configuring an Outlook Web Access publishing rule Testing the Outlook Web Access publishing rule Internet Den-ISA-01 Den-DC-01 Gen-Web-01 Den-Msg-01

Lesson: Configuring ISA Server to Secure Client Connections Multimedia: Connecting MAPI Clients to Exchange Server Through a Firewall How ISA Server Secures Outlook RPC Connections About RPC over HTTP How to Configure RPC over HTTP Enabling Access for POP3 and IMAP4 Clients

Multimedia: Connecting MAPI Clients to Exchange Server Through a Firewall

How ISA Server Secures Outlook RPC Connections Outlook Client Outlook Client Exchange Servers Exchange Servers ISA Server Port 135 Exchange UUID=3000 Exchange UUID=2000

Internet Den-ISA-01 Den-DC-01Den-Msg-01 Practice: Configuring ISA Server to Secure Outlook RPC Connections Configuring an Outlook RPC publishing rule Testing the Outlook RPC publishing rule Den-Clt-01

About RPC over HTTP RPC over HTTP requires: Exchange Server 2003 running on Windows Server 2003 and Windows Server 2003 global catalog servers Outlook 2003 running on Windows XP Windows Server 2003 server running RPC proxy server with the Exchange and domain controller service port numbers defined in the registry A modified Outlook profile that connects to the Exchange server using HTTPS

How to Configure RPC over HTTP To enable RPC over HTTP, publish the /rpc/* virtual directory To enable RPC over HTTP, publish the /rpc/* virtual directory

Enabling Access for POP3 and IMAP4 Clients Configure the Required ports Configure the Required ports Configure secure Ports to enable SSL security Configure secure Ports to enable SSL security

Lab: Integrating ISA Server 2004 and Microsoft Exchange Server Exercise 1: Enabling RPC over HTTP Client Connections Exercise 2: Configuring a Forms-Based Authentication for Outlook Web Access Internet Den-ISA-01 Den-DC-01Den-Msg-01 Den-Clt-01