ps3cheats

Question: Here is our current setup: ISA 2004 connected to internet. ISA box has SMTP running in IIS to pass email traffic through to our Exchange 2K3 server which is behind ISA. Based on comments here I am considering removing the SMTP virtual server in IIS from ISA and making a rule that will pass email traffic through ISA to Exchange. I have a few questions regarding this...First, is this the best route to go when passing email traffic through ISA to an Exchange box? Second, others on this site have suggested not to pass email through ISA via SMTP server, but rather through a publishing rule, if this is the best route, why does Shinder's book suggest to do it via SMTP server on ISA? Third, what is the process involved in creating the Inbound and Outbound traffic rules on ISA to allow the email to flow in and out through ISA? Thanks in advance.

ps3cheats

There are a couple of points here.

1. TS is brilliant with ISA of all flavours but that does not mean his is the only way to do things or the correct way in every circumstance. This is one area that I (personally) differ. If I want a front end box to filter mail such as spam filtrering etc then I place it in front of ISA rather than being on the ISA box itself
2. He suggests using the smtp service on the ISA for two reasons (I believe). Firstly you can use the message screener and second you can use it as a filtering service.

3 The recommended approach according to the MS courses that I attended and teach use a publishing rule for smtp traffic whereby the inbound smtp traffic is forwarded to the IP address of the internal server (not the server name). For outbound smtp traffic, this is handled by a standard access rule in the firewall policy allowing smtp traffic to leave either to anywhere OR to the ip address of an external smarthost f that is the way you do things.

4. I then create a sesond publishing rule to allow access to the OWA & OMA services which in my case are on the same Exchange server.

5. To create the inbound publishing rule for Exchange, right-click the firewall policy and select new - publish a mail server selecting the smtp options within the wizard. You will be asked for the address of the internal smtp server that the traffic should be forwarded to. Hit the finish and apply the policy. For the outbound, most people cover this (by mistake) by allowing the outbound internet rule to allow all outbound protocols and of course, smtp is one of them. If you do not have this rule then simply create an access rule, allow, select smtp from internal to external, all users and done. If you really want to refine it then make a computer to represent the Exchange server and use this object in the from field rather than internal.