Firewall question (front-end/back-end)

rjbarlow

Hello ppl,
let me suppose that there are two firewalls between a front-end server ans some back-ends.

Internet

---

FW1

---

F.E.

---

FW2

---

B.E

I ask, when an user wants to connect by means of OWA or RPC over HTTPS, that user needs to be authenticated against a DC for being able to access his mailbox. You know?

I suppose that this authentication is made on behalf of the client by the F.E contacting a DC with the protocol Kerberos v.5, so the Kerberos port (8 must be open only on FW2. I suppose also that the username and password are sent in the HTTP/S format to the F.E. server. Is this right?

Another reason for opening port 88 on FW2 could be that the F.E must authenticate itself when he joins the domain.
Anyway, I am interesting over all in answering the first question.

Can someone strengthen my statements providing some links or by his knowledge?

Thank You.

royal

When you're outside, you use Outlook Anywhere (RCP over HTTP) which talks to the CAS. Both Directory lookups and regular mail lookups will hit the CAS. The CAS has certain authentication settings on its virtual directories in IIS which allow the client to authenticate over the HTTPS tunnel.

You'd only need to open up 88 and those types of ports if you wanted to use direct RPC through the internet which would allow more ports to be open such as port 135 and upper ports since 135 is just an RPC endpoint mapper. But if you were to do this, it'd be only a matter of time before your network was hacked. So you'd definitely use Outlook Anywhere which requires only 443 to be open.