لطفا منتظر باشید ...
Creating Mail Server Publishing Rules
The ISA firewall includes a Mail Server Publishing Wizard right out of the box. You can use the Mail Server Publishing Wizard to publish the following mail-related services:
Figure 8.51: The new HTTP Server Protocol Definition
Outlook Web Access
Outlook Mobile Access
Secure Exchange RPC
IMAP4 and Secure IMAP4
POP3 and Secure POP3
SMTP and Secure SMTP
The Mail Server Publishing Wizard creates the appropriate Web or Server Publishing Rules required to allow access to the published mail server through the ISA firewall. You can access the Mail Server Publishing Wizard by clicking on the Firewall Policy node in the left pane of the Microsoft Internet Security and Acceleration Server 2004 management console and clicking the Tasks tab in the Task pane. Click the Publish a Mail Server link.
On the Welcome to the New Mail Server Publishing Rule Wizard page, enter a name for the rule in the Mail Server Publishing Rule name text box. Give the rule a meaningful name so that you'll be able to identify the purpose of the rule. You may create several Web or Server Publishing Rules based on your selections, so keep this in mind when naming the rule. You can always rename the rules after the Wizard is completed. Click Next.
On the Select Access Type page (Figure 8.52), you have the following options:
Web client access: Outlook Web Access (OWA), Outlook Mobile Access, Exchange Server ActiveSync
Client access: RPC, IMAP, POP3, SMTP
Server-to-server communication: SMTP, NNTP
Figure 8.52: The Select Access Type Page
The Web client access: Outlook Web Access (OWA), Outlook Mobile Access, Exchange Server ActiveSync option publishes these services using Web Publishing Rules. The Wizard configures the Web Publishing Rules for you. You can create SSL or non-SSL connections.
The Client access: RPC, IMAP, POP3, SMTP option publishes these protocols using Server Publishing Rules. You can publish one or more of these protocols when you select this option.
The Server-to-server communication: SMTP, NNTP option publishes these two protocols. You can select one or both.
Because the options available differ based on the selection you make on this page, we will cover each one separately in the following sections.
The Web Client Access: Outlook Web Access (OWA), Outlook Mobile Access, Exchange Server ActiveSync Option
Select this option and click Next. On the Select Services page, select the Exchange Web services you want to publish via a Web Publishing Rule. Your options are:
Outlook Web Access
Outlook Mobile Access
Exchange ActiveSync
The Web Publishing Rule will contain the required paths to reach the Exchange Server services you select. The Enable high bit characters used by non-English character sets option allows users to view e-mail messages using extended characters. If you only want to support English characters, then remove the checkmark from this checkbox.
Click Next, as shown on the Select Services page in Figure 8.53.
Figure 8.53: The Select Services Page
On the Bridging Mode page, select how you want to publish the Web site. We highly recommend that you always use SSL-to-SSL bridging. This method is the most secure and minimizes compatibility issues. For more information on how to configure SSL bridging for Web Publishing Rules, see the Web Publishing section of this chapter.
On the Specify the Web Mail Server page, enter the name of the Web server on the ISA firewall Protected Network. We recommend that you use the FQDN of the machine and that this name be the same as the common name on the Web site certificate used on the Exchange OWA/OMA/ActiveSync Web site. The ISA firewall also needs to be able to resolve this name to the address that is actually bound to the Exchange Server on the corporate network and not the IP address on the ISA firewall's external interface. See the section on secure Web Publishing Rules in this chapter for more information on this subject. See Figure 8.54 for options on the Specify the Web Mail Server page.
Figure 8.54: The Specify the Web Mail Server page
On the Public Name Details page, you can configure the name that the user who accesses the published server through the Web Publishing Rule must use when connecting to the site. We highly recommend that you always use This domain name (type below) in the Accept requests for drop-down list. The other option is not secure and should be avoided, if at all possible.
Enter the name remote users use to access the site in the Public name text box. This name must resolve to the IP address on the ISA firewall that listens for the incoming connection requests. This IP address is determined by the settings on the Web listener you configure this Web Publishing Rule to use. Click Next. See Figure 8.55.
Figure 8.55: The Public Name Details Page
On the Select Web Listener page, select or create a Web listener for this rule. For details on creating and configuring Web listeners for Web Publishing Rules, please refer to the sections on creating HTTP and SSL Web Publishing Rules earlier in this chapter.
On the User Sets page, you can configure the rule to allow all users to connect to the published Web server, or you can have the ISA firewall pre-authenticate users before allowing them access to the published Web site. If you choose to have the ISA firewall to pre-authenticate users, you must make the ISA firewall a member of the user domain or a domain that trusts the user domain. An alternative is to configure the ISA firewall to use RADIUS authentication. We discuss how to configure the ISA firewall to use RADIUS authentication and configure RADIUS groups in Chapter 7 on outbound access through the ISA firewall. Click Next.
Click Finish on the Completing the New Mail Server Publishing Rule Wizard page. Click Apply to save the changes and update the firewall policy. Click OK in the Apply New Configuration dialog box.
The Client Access: RPC, IMAP, POP3, SMTP Option
Select this option and click Next. On the Select Services page you have the following options:
Outlook (RPC)
POP3: Standard ports and Secure ports
IMAP4: Standard ports and Secure ports
SMTP: Standard ports and Secure ports
The Outlook (RPC) option creates a Server Publishing Rule that allows inbound access for secure Exchange RPC connections. Secure Exchange RPC publishing allows Outlook 2000, 2002, and 2003 to 'just work,' regardless of where the user is located.
When combined with a well-designed split DNS infrastructure, users can roam between the corporate network and remote locations, open Outlook, and access their e-mail transparently without requiring reconfiguration of their e-mail application. Secure Exchange RPC is a very secure publishing protocol, and you can configure the Secure Exchange RPC Server Publishing Rule to force Outlook clients to encrypt their communications to the Exchange Server.
The POP3, IMAP4, and SMTP options allow you to publish both secure and non-secure versions of these protocols. Secure versions of these protocols use SSL to encrypt both user credentials and data. The ISA firewall will publish these protocols using Server Publishing Rules, but you must configure the Exchange Server with the appropriate Web site certificates to complete the configuration if you want to use the secure version of these protocols. See the Select Services page in Figure 8.56.
Figure 8.56: The Select Services Page
Notice the information box on this page. It says For full SMTP filtering functionality the Message Screener must be installed. When you create the SMTP Server Publishing Rule using this Wizard, the SMTP security filter is enabled. The SMTP security filter blocks buffer overflow attacks against the published SMTP server. You can enhance the stateful application-layer inspection for SMTP messages moving through the SMTP Server Publishing Rule by installing and configuring the SMTP Message screener on the ISA firewall, on a dedicated SMTP relay, or on the Exchange Server itself. We will discuss the SMTP Message Screener in detail in Chapter 10 on the ISA firewall application-layer filtering feature set. Click Next on the Select Services page.
On the Select Server page, enter the IP address of the published server on the corporate network in the Select Server text box. Click Next.
On the IP Addresses page, select the Network representing the Interface that should accept connection requests for the published server. You can limit the IP address used to accept the incoming connection if you have multiple addresses bound to any of these interfaces by clicking the Address button. For more information on how to configure the settings on the IP Addresses page, see the discussion on this subject in the Server Publishing Rules section of this chapter. Click Next.
Click Finish on the Completing the New Mail Server Publishing Rule Wizard page. Click Apply to save the changes and update the firewall policy. Click OK in the Apply New Configuration dialog box.
You'll see a number of new rules in the Firewall Policy for the ISA firewall (Figure 8.57). You can rename these rules to clean them up and have them be more consistent with your own rule-naming policy.
Figure 8.57: Firewall Policy after Running the Mail Server Publishing Wizard
You can enhance the security for your secure Exchange RPC publishing rule by forcing the Outlook clients to use a secure connection. Right-click the Exchange RPC Server rule, and click Configure Exchange RPC. Put a checkmark in the Enforce Encryption checkbox, click Apply and then click OK. See Figure 8.58.
Figure 8.58: The Configure Exchange RPC Policy Dialog Box
