In various posts I have read that you should *not* use the firewall client on smtp servers, but instead use securenat.
Can someone please explain to me why?
My config: * w2k DC server, internal DNS * w2k DC server, exchange 2k, internal dns * w2k ISA server, 128k ISDN dialup
Note: when I use my ISP's DNS server in the forwarders list of my internal dns, I get errors that the forwarder is not a recursive dns. To sent mail I configured a smarthost in exch2000
Uh well... Thats kind of reversing my question ;-)
I don't know why. Normally I use the fwc only for auth issues, but since the mail server has a static IP its not an issue, so I could use securenat as well.
But I would still like to know what is wrong by using it on a smtp server
in general you don't install the Firewall client on a server because to use server and web publishing rules, the published server should be configured as SecureNAT client, not a Firewall client.
Generally, I think the problem is that the Exchange server (if it has the firewall client installed) doesn't respond the way a published server should. The server publishing rules therefore aren't applied when the internal server replies to external requests and they end up getting dropped by ISA.
As an example, think of what happens when an external SMTP server tries to connect to your internal exchange server to deliver a message. On the incoming side, ISA uses the publishing rule, and establishes a session. When the Exchange server responds, the request gets intercepted by the firewall client and is directed to ISA as if it was a normal client. When that happens, the response by Exchange doesn't match up to the internal request from the external server, and ISA drops your internal server's request.
Now, I've not seen anything that explicitly states this, so if anyone has any better info, I'd be interested in it, too.
Posts: 22
Joined: 9.Nov.2002
From: Bellevue, WA
Status: offline
Stefaan,
I totally see what you're saying. You clarified the mechanism for me! The general process is what I thought it was, I just didn't know what the firewall client did differently than SNAT.
|
My Subscription |
My Forums |
Address Book |
Member List |
Search |
FAQ |
Ticket List |
Log Out
Printable Version
All Forums >> [ISA Server 2000 Firewall] >> Firewall Client >> Why no FWClient on SMTP server? 
Why no FWClient on SMTP server? - 
RE: Why no FWClient on SMTP server? - 
RE: Why no FWClient on SMTP server? - ![[Smile]](/image/smiles/smile.gif)
RE: Why no FWClient on SMTP server? - 
New Messages
No New Messages
Hot Topic w/ New Messages
Hot Topic w/o New Messages
Locked w/ New Messages
Locked w/o New Messages
Post New Thread