Folks,
in preparation for SBS2008 (and due to some heavy VPN requirements) I have installed a Cisco ASA 5510. This is great and works just fine. During the installation I removed ISA 2004 and the MS proxy clients from user's machines. DHCP now sets the default gateway to 10.0.0.1 (the internal interface of the 5510) and all is peachy.
BUT, what should I do about activesync?
I have a small public IP range, and I could set up DNS on one of them for OMA/OWA and port forward SSL from that IP to the sbsserver, but how secure would this be? My concern is that without ISA on the sbsserver it would be pretty much naked. Can I use the SSL certificates to prevent unknown devices from connecting to my sbsserver?
alternatively:
I already have a mail DMZ in which I am running a spam filter/mail proxy. I am considering re-enabling the second network card on my sbsserver and reinstalling ISA with the external interface living in the mail DMZ. This would mean that the sbsserver box isn't quite as naked since it is running ISA server and can inspect whatever ssl connections it receives. I have to admit that I am fuzzy on the capabilities of ISA in this area, but since we were OK with ISA before, surely we would be fine with it again?
Could someone advise me on what would be the preferable route? Of course, I've lost the original installation media and SP-1 and MS have sent me a replacement set with ISA2000 on it so that is an added complication :/
Thanks
Miles
|