ISA 2004

When you published the Exchange server that wizard created the inbound rule. In other words publishing allows access to internal servers, mail, web etc from the Internet.

You should create a protocol rule for outbound traffic port 25 SMTP from the Exchange box rather than a general rule that allows all protocols from anywhere.

Have you installed the firewall client on the workstations?

Oh and do not install the firewall client on the ISA server itself. That is a big no no.

 

Hi AJ, good luck with this project. I came across these and thought you might be interested in them

http://www.msexchange.org/articles/2004protectexch.html

http://www.msexchange.org/tutorials/2004emaildefenseindepth.html

 

Disclaimer: I don't know specifically about ISA 2004 and Exchange.

AJ,

You mention "Next we do a rule for SMTP so that we can receive mail from the internet,..." Does that mean that you are:

• a) receiving e-mail from the internet to the exchange server or
• b) receiving e-mail from the exchange server to the client?

 

AJ nice one on the move to ISA2004 (think 2006 is out now tho) :P
Cracking product and very secure when done right, I use it at home myself!

In answer to your above question I think it's been covered, ISA has a default deny all rule at the bottom, and as an educational institution i imagine you will not be having an allow all outbound so you will have to create a rule to allow SMTP access from exchange outbound, which you seem to have covered

NAT and stuff is not overly complicated, if your using it as your only firewall you can just bind multiple IPs to your external NIC and be specific with your publishing rules (at home I have 16 ips to play with so i follow the same set up for my exchange, rdp, etc etc access)

 

Wow - 16 IPs?

Blimey - If only!

Who are you with to get that number of statics? I'd dearly love to have a static IP pool to use at home but I can't even get my ISP to give me ONE - unless I go through their 'business' department (cue my wallet being chewed up & spat out on a monthly basis)

 

To be fair to Plusnet, I asked for more than one public IP on a Premier Home account and they gave them to me!
They did ask why I couldn't use NAT and i said i wanted them to help with my studies....

Si

 

I use Zen who are a power user ISP even on there residential stuff
u do pay for that power user stuff though, I pay 35 a month for 2MB uncapped or i can move to the new contracts that are 8MB but capped at 50gb, ill do some monitoring over a month or two and see if i download that much month by month

you get 1 or 8 no questions asked, for 16 you have to submit a ripe justification letter like any other corporate, i could justify the 16 though as at the time I was on the UK6X with IPv6 tunneling and all sorts of cleverness that worked better with statics