Proxy Settings and the Microsoft Federation Gateway

I am a bit more than paranoid when it comes to protecting my Exchange and Lync servers from all of those evil people out on the Internet. I like my servers to be protected from all of those annoying script kiddies along with those that are much better at hacking than the typical script kiddie.

No OWA for me. After all, if OWA is published, it can be attacked with lots of improper connection attempts. If Outlook Anywhere, also known as RPC over HTTPs, is available, the servers can be attacked. It is bad enough that the Exchange environment has to listen for port 25 connections. Lots of nasty viruses are transmitted over port 25. Smile

If I could, I would wrap my servers in sterile plastic and rubber. Safe computing is vital, or you could catch something very bad and spread it around.

Anyway, the point of this post is that I had the need to access the Microsoft Federation Gateway (MFG) to share free/busy information with another company. Imagine me getting that bad feeling of having to expose my servers to that dirty, filthy, bad Internet.

My first take was that I was going to have to work with all of the firewall guys and have them open up the ports to the MFG. I have to say this really scared me as it required:

  1. Opening everything needed for OWA access from the Internet
  2. Limiting the access to just the servers for the MFG.

Option 1 is much scarier than Option 2. Option 2, though is scary enough. Per Microsoft’s documentation, you need to open the following from all of the Client Access servers in the environment to the MFG IP ranges and URLs:

207.46.150.128/25
207.46.164.0/24
*.microsoftonline-p.com
*.live.com
*.microsoftonline.com
*.microsoftonlinesupport.net

In case you didn’t notice the *.live.com entry, let me point it out. I about spit up lunch when I saw it. Opening Exchange up to everything at live.com was enough to make me choke and spit and make me ill over all.

OK, that all said, I was on a call with a MFG specialist and he said, “Damn, Russ, you are paranoid. Why don’t you just use a Proxy server in your company to make the connections and then you won’t have to screw around with the firewall rules needed.” Hmmm, proxy server? I like that much more, and it seemed like a much better solution. So, I asked the question, “OK, I know how to set the browser and other applications to use the proxy server, but that requires inputting the settings in the interface, but I am not aware of any method for inputting the settings so that the Client Access server can leverage the proxy server.”

Aha, the key! I learned something new in that I was unaware that it was possible. A simple PowerShell command, and all was well.

get-exchangeserver | where {$_.serverrole -ilike ‘*clientaccess*’} | Set-ExchangeServer -InternetWebProxy http://ProxyServerName:Port#

I am sorry it took me so long to get to the point, but I just had to share the pain and anguish that I experienced and then share the easy solution.

Advertisements
This entry was posted in Uncategorized. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s