Need help getting started with EXCHANGE 2003

[John O'Neill_6]

Hi All,

I've got to get Exchange 2003 up and do it quick, and nope, I've never dealt with it before and don't have time for training nor budget to outsource it.

OK, here's the deal:

I have a server running windows server 2003 (Standard).

I want the server to host all of our data, such as Mail, users, shared folders, printers and so on.

At present our PC's in the organisation downloads mail from our ISP via the POP3 protocol (yes I know this isn't the best but that's the place did when I joined).

Do I need to put the Exchange server into the DMZ?

If so, I then become worried about securty of our data, can I have some arrangement whereby I have a front end server that is on our DMZ/Optional interface and another server that is on our Trusted interface?

I imagine that the server on the trusted interface is what deals withs users and stores the data while the front end interface communicates with the back end server?

This sounds awfully complicated for a mail server and the ability to have shared calendars etc.

Also, do I have to update something called an 'MX' record to redirect mail traffic from our ISP to one of OUR IP addresses?

I take it then that I've got to port forward from our router to our firewall and somehow get our firewall to route this to our DMZ?

Then, I'd need to get our server on the trusted interface to talk to the server on the DMZ...

I'd really appreciated any pointers or places where I can start reading to find out how this all works... time is not a luxury I have on this task.

-John

[Jon Finley]

Hopefully you'll get additional posts back, but....

What you are referring to is a bridgehead server. You can find some good articles on Technet http://www.microsoft.com/technet referring how to setup exchange in this fashion.

You can place either a windows, linux, or other unix flavored box at the firewall, as a mail relay agent. The agent will then forward only mail to the exchange server behind the firewall.

http://search.microsoft.com/search/results.aspx?st=b&qu=bridgehead+server&view=en-us

http://search.microsoft.com/search/results.aspx?st=b&View=en-us&na=82&qu=bridgehead+server+2003

Jon

[David Holbrook]

John,

You have not given us any idea what your Domain structure is, nor if you even have a Domain in place.

I have not installed Exchange 2003 yet, but Exchange 2000 has to be installed on a Domain Controller with Active Directory installed. I therefore presume that Exchange 2003 will also require this, so you will need to run DCPROMO to promote this server you now have to become a DC.

Be aware that the first Exchange server you install in the Domain will make many changes to the Active Directory Schema that can not be reversed, so you need to really plan this out to avoid having lots of nasty headaches in the future. I would seriously consider outsourcing the Exchange work to at least get it correctly built if you do not have the experience with Exchnage. You can seriously impact you entire Domain structure if you make a big mistake. Not to alarm you too much, but what ever you do,make sure you have a complete good Domain Controller back up before you begin, in case you have to rebuild the domain from scratch.

You do not really want to put a DC and the Exchange mail server in the DMZ, as this will expose your entire Domain to the world. By setting up a relay point in the DMZ (a vaild option)you can then ban any direct traffic from the Internet to your internal LAN network Exchnage server, and only allow external mail traffic to come through from your DMZ server. You will need new rules in the Firewall to allow this relay server to talk with the LAN Exchnage server, but this is no big deal. Putting your Exchange server inside on your LAN is the best place for performance also, as most of your users traffic is probably located there also.

I presume you are using a firewall with NAT, so you will need to have a valid fixed Internet address for the Exchange address, and will need to point all SMTP traffic to the Exchange server (or to the relay server)via the NAT in the firewall. If you forward ONLY SMTP traffic to the valid mail IP address you will reduce the exposure risk considerably. If you have external users that need POP3 access you have additional concerns, as you will if you decide to let users accesss the Exchange through the firewall with web access.

I highly recommend you do not run a web site on this server, because of the additional high risk this would expose the server to.

HTH,

David

[John O'Neill_6]

Hi,

Firstly, outsourcing is not an option, It's too expensive, my organisation can not afford $1850 AUD per day for someone to come in and set things up, so the task is with me, also our organisation has had some truly dreadful experiences of IT outsourcing in the past.

Simply put, I don't trust outsourcers.

In effect, the situation I am facing is a bit different, my users are not in a domain, they're still on Novell Netware 3.1 (Yes, I'm talking about a 12 year old NW server).

So, this Domain server is brand new. It is the Primary Domain controller, it is running active directory and the following 'roles':

1. File Server
2. Active Directory Domain Server
3. Print Server
4. DNS Server (with DNS forwarding for
external queries to ISP's DNS Server).
5. DHCP Server (takes over roll from our
firewall unit, which took over from
fixed IP Addresses everywhere).

The Domain seems to be working nicely, roaming profiles work, file sharing works, DNS works, print sharing works... and 2003 is nice and quick too.

I've done away with the idea of putting anything into our DMZ, the risks are too high, as you said.

I think that I'll forward SMTP traffic to our firewall and run an SMTP proxy on the traffic.

Has to have less risky than downloading mail over POP3...

-John

[David Holbrook]

John,

This is too much load to also put the Exchange server on this single server. The Exchange server should be dedicated to only supporting Exchange plus it also supports the AD and the DC functions. Exchange needs lots of RAM, and a good performance CPU.

The Exchange server needs to be set up with lots of room on the C: drive (6 GB min, 10 is better), and even then put the Exchange on its own drive. Make sure you provide enough drive space to do the system maintainence on the Exchange database also.

I am suffering right now because the idiot that set my Exchange 2000 up only gave the C: drive 4 GHz of space. I have run out of space because even though the Exchange is on D:, the swapspace has to be big (Remember, GBs'of RAM, and the more the number of users, the larger the RAM has to be, increasing the swapfile size, etc.!). In addition, all the patches that Microsoft has published for fixing the security holes has literally wiped out all available drive space on my C: drive, and this is now impacting the Exchange operation.

You need to also understand that Exchange sets up an M: drive that is a virtual drive which is the same size as the C: drive.

By the way, you did not say exactly why you need to use Exchange 2003, and only hinted at using shared calenders. Just a thought, that since you are still using a Novell structure, perhaps you would should consider using Exchange 5.5 instead, as it does not need AD, nor does it have to be on the Primary DC, and it works well with a mixed user configuration. It is not a complex as the new Exchange systems, and might fit better into your configuration.

HTH,

David

[Doug Wogan]

Exchange, no matter what version, does not need to be installed on a domain controller. If you have the money it would be best to install it to another "member" server in your domain. I assume you are getting rid of pop and converting your users to Outlook talking to Exchange? If you already have a firewall in place then all you need to do is change your external mx record to point to the public ip address of the firewall. Then you will forward that traffic, port 25, to your private network through the firewall to your exchange servers ip address.

If you configure your firewall to point to an SMTP server in your DMZ then all you need to to is configure your Exchange server, SMTP Connection, to accept traffic from the IP address of the DMZ server.

Again the only thing Exchange does require is Active Directory. You can install it on any member server. It sounds like maybe you could save some cash by purchasing Microsoft Small Business Server. That basically installs everything, AD, DNS, ISA, Exchange, to one server.
Doug.

[John O'Neill_6]

Hi,

Thanks for the Info, I'm worried about MS Exchange being hacked though, even though we've got a Watchguard firewall in place, there are so many hacks out there for Exchange...

I'll put Exchange onto it's own server and make that server a backup AD controller in case we loose the AD server for some reason.



-John

[David Holbrook · Accepted solution]

John,

To set up Exchange you will need an account that is a member of the Domain Admins, Enterprise Admins and Schema Admins groups.

I recommend you create this as a new account just for this purpose, do not use your existing Domain Admins account. The Exchange Administrator is unique, and is the account which sets up the Exchange server and has some very unique and explicit admin privilages in the Exchange system. This account can then be used to delegate the Exchange admin functions to other accounts. Once it is set up, be sure to grant at least one other account the full admn privilages. This account can be another new account and you should immediately record the password and name of this and the original Exchnage administrator accounts, and then lock them up in a safe for safekeeping.

...... IMPORTANT .......

Be sure you set this second full admin account up as soon as the Exchange is finished installing. It is your lifesaver if something happens to the original admin account and Exchange refuses to acknowledge the original account once the installation is done.
................
Before you start, there are things that need to be done to prepare for the install.

You will need to define the Organization name, and IT CAN NOT BE CHANGED LATER, so be right the first time!

The Exchnage server needs a drive for itself with over 2 GB of space (be smart, give yourself at least 10 GB, databases grow and need to have maintenance done on them over time). You will need at least 500 MB on the system drive also. I would NOT set up the system drive on less than 6-8 GB, as you will run out of space on this drive as MS keeps adding patches to the OS software and to the Exchange software, so give yourself breathing room! Rember, RAM needs swapspace on the system drive, so 512 MB of RAM will eat up a GB of the system drive space all by itself!

The system memory needs to be at least 256 MB, but I would recommend you put in at least 512 MB, and the page file needs to be at least twice the size of the RAM. Use a PIII or better CPU(s), at least 300 MHZ or faster.

While the Exchange server can be installed on Server or Advanced Server (or a Data Center Server), and it needs to have IIS 5.0 and Network News Transfer Protocol (NNTP) AND at least the OS SP1 installed before the Exchange server is installed (for Win200 as the host). What ever the OS version, I recommend you get the OS server software fully up to all patches and fixes before installing the Exchange server.

Since Exchange needs the Active Directory, it is a good idea to have it run on a DC with AD, as it greatly speeds up the operation. The computer MUST be a member of the Domain in any event to do the install, and I am not even sure you are currently running a domain configuration. In any event the Domain must be set up first.

You need to install the first Exchnage server into the Domain where the schema master resides, and by default this is the first Win 2k DC installed in the forest, and only one DC in the forest can be the schema Master. You will need to run the DomainPrep command (from the Exchange CD) to set up the Domain to accept the Exchange installation. THIS PERMENENTLY CHANGES THE AD, so PLAN AHEAD! The server you run this command on becomes your domain Recipient Update Server.

I can only stress again, that while the installation can be simple, if you make mistakes in your planning, you can wind up destroying the AD database which can force a rebuild of your entire Domain, so BE CAREFUL. Get the Microsoft Manuals such as the Implementation and Administration books, and READ UP on the installation to understand what you are going to do BEFORE you work on the real Domain. An Idea---you can take the new server, make it into a new Domain all by itself, and practice installing the Exchange to see what happens to the Active Directory, etc. I do not know if Exchange 2003 has the same copy protection MS has adopted for XP, but I woould suspect it does. If so, DO NOT register it in this configuration, as you will need to wipe this system and reinstall it into your Domain once you are done practicing. It is a lot of work, but it will pay off big time since you have no experience in setting this up, and mistakes are very, very costly later. This is NOT, I repeat, NOT a simple little installation where you put in the cd and run setup. DO YOUR HOMEWORK FIRST!

Good Luck, I HTH,

David

[Doug Wogan]

Sounds like you've got a good plan John. I wouldn't worry about Exchange being hacked as much as you need to worry about virus's. They seem more geared toward how the Outlook client works. Definetly purchase a virus scan program specifically for Exchange. You might want to install it on your Exchange server before you put any mail in the d-base. I assume you'r going to import users .pst files into their mailbox's. Also there are some pretty good anti-spam filters out there you can put on your smtp server to help filter out crap. Your users will love that!