Both the Design and Engineering officers seemed sure that an Edge Transport server would solve all my problems, but I still had questions. Everyone arrived in the conferencing bay right on time with all the information I needed.
The Design officer provided the following matrix of the anti-spam and antivirus features that are available for the Hub Transport and Edge Transport server roles. I discovered that Exchange 2007 agents can implement all the features I want to use.
|
Feature
|
Supported on Edge Transport servers?
|
Supported on Hub Transport servers?
|
|---|
|
Attachment filter The Attachment Filter agent lets you block specific attachment types. The attachment can be stripped but delivery of the e-mail message is allowed, or both the attachment and e-mail message can be silently deleted.
|
Yes
|
No
|
|
Connection filter The Connection Filter agent lets you filter connections based on source IP address or IP address range. Connections from known spam sources can be blocked.
|
Yes
|
Yes
|
|
Content filter The Content Filter agent evaluates the likelihood of e-mail being spam. With an Exchange Enterprise Client Access License (CAL), you get regular content filter updates. These include updated data about phishing Web sites, Microsoft SmartScreen spam heuristics, and other Intelligent Message Filter updates.
|
Yes
|
Yes
|
|
Recipient filtering The Recipient Filter agent lets you accept only e-mail that is sent to valid recipients.
|
Yes, with an Edge Subscription
|
Yes
|
|
Sender filtering The Sender Filter agent lets you block e-mail that is received from specific senders. For example, you can block e-mail from known spam originators.
|
Yes
|
Yes
|
|
Sender ID The Sender ID agent verifies the originating IP address for a received e-mail message against the registered IP addresses for the source domain.
|
Yes
|
Yes
|
|
Safelist aggregation This feature collects data from the anti-spam Safe Recipients Lists or Safe Senders Lists and contact data that Outlook users configure and then makes this data available to the anti-spam agents on the computer that has the Edge Transport server role installed. Safelist aggregation can help reduce the instances of false-positives in anti-spam filtering that is performed by the Edge Transport server. When an Exchange administrator enables and correctly configures safelist aggregation, the Content Filter agent passes safe e-mail messages to the enterprise mailbox without additional processing.
|
Yes
|
Yes
|
|
Address rewriting The Address Rewriting agent lets you mask the identity of an internal domain by rewriting the internal e-mail address to an alternative address.
|
Yes
|
No
|
|
Transport rules Transport rules let you take an action on sent and received e-mail. Different predicates, actions, and exceptions are available on Edge Transport servers than those available on Hub Transport servers. Edge Transport rules provide additional anti-spam and antivirus functionality. Hub Transport rules enable policy enforcement inside the Exchange 2007 organization. For more information, see Overview of Transport Rules.
|
Yes
|
Yes
|
|
Domain Security Domain Security lets you identify trusted domains and negotiate security for e-mail communications with those domains.
|
Yes, with an Edge Subscription
|
No
|
The Design officer also provided me with links to more information about each of these features:
“Okay, it looks like I can use an Edge Transport server to implement the features that I need to meet corporate regulations for communications with Wide World Importers. But how will the Engineering officer accomplish the deployment and provide fault tolerance?” I asked.
“I have that all worked out, Admin,” explained the Engineering officer. “I’ll deploy two Edge Transport servers in the perimeter network. I’ll configure DNS to use a round-robin mechanism to load-balance the inbound connections. That will mean manually creating certificates with the FQDN of both servers to provide domain security, but I have the procedures linked right here: Creating a Certificate or Certificate Request for TLS.”
“Hmm. How will you keep the configuration consistent between the servers? And what about load-balancing and fault tolerance for the outbound connections?” I asked.
“I’ll use cloned configuration to make sure that the servers have a consistent configuration. Then I’ll create an Edge Subscription for both servers. This will let us use all the Edge Transport server's features, including safelist aggregation. That will keep Wide World Importers messages from ever being blocked. The Edge Subscription will also create all the Send connectors we need. Both Edge Transport servers will be listed as source servers for the outbound Send connector, so we’ll get load-balancing and fault tolerance for outbound connections, too.” It sounded as if the Engineering officer had been considering this solution for a while. I found more information about cloned configuration here: Using Edge Transport Server Cloned Configuration.
“I’m still somewhat concerned about how this affects security. I’ll have to justify the expense of the additional hardware,” I said to temper the Engineering officer's enthusiasm.
“Well, Admin," the Engineering officer responded, "By deploying an Edge Transport server, we’ll be able to turn off the anonymous access we enabled on the Receive connector on the Hub Transport server. We’ll have better protection of our internal resources, such as the Active Directory directory service. Spam and viruses will be blocked at the earliest possible point. We’ll have better defenses against external threats, directory harvest attacks, and denial of service attacks at the SMTP layer. By moving anti-spam functionality out to the edge, we’ll also reduce the processing overhead on the internal messaging servers. To make sure that we have a defense-in-depth strategy, I'll continue to perform internal antivirus scanning on the Hub Transport servers. I was planning to add a Hub Transport server to help with the anti-spam load anyway, so the hardware is already available.”
“Wait a minute. How does the Edge Transport server protect Active Directory? How can it perform recipient lookup if it’s not looking them up in Active Directory?” I asked.
“Oh, the Edge Subscription handles that," explained the Engineering officer. "I’ll deploy the Edge Transport servers in a workgroup, and then the Microsoft Exchange EdgeSync service will replicate the recipients to the Edge Transport server as encrypted objects. The Edge Transport server will store the data in the Active Directory Application Mode (ADAM) directory service. Look, I have a link to a resource to help you understand this technology right here: Understanding Edge Subscriptions.”
The Design officer supported the Engineering officer’s statements. “Admin,” the Design officer said. “I concur with the Engineering officer’s plans. It’s the most logical recourse for providing the functionality that headquarters requires.”
“Very well,” I concluded. “Let’s deploy.”