[fw-wiz] Single Exchange/OWA on LAN with Internet Access - a good
From: Ravdal, Stig (SRavdal_at_Quiznos.com)
To: <email@example.com> Date: Thu, 17 Nov 2005 08:50:15 -0700
I hope that someone has been through this before and have some
substantial arguments for/against:
Our MS admins are proposing to implement single OWA/Exchange servers
on the LAN and allow access directly to the server through the firewall.
The primary reason for doing it this way is to reduce the cost of the
front-end server that would otherwise reside in a DMZ. Their argument
is that with OWA 2003 you have to have a bunch of ports open anyway
and so what is the reason to put a front end server in the DMZ - if
that server were compromised they would practically have access to the
network anyway. With the OWA/Exchange server inside the firewall
access from the Internet can be limited to 80 and/or 443 only.
My concern is that with the next OWA vulnerability someone will own
the server in the DMZ through a single exploit. However, I cannot
find anything that suggests that the front end server solution is
really any more secure. Yeah it's another hop but it would be an easy
one as soon as the front end server is compromised.
firewall-wizards mailing list