Executive Summary By allowing remote access to Microsoft Exchange to users who are based outside the safety of the corporate network, an organization enables its employees to take full advantage of the technology their company provides. Remote access lets employees use many devices to communicate with their peers and customers from any place and at any time. Allowing access to corporate resources from any location, perhaps using devices that are not controlled by the organization, presents additional risk to the security of the data and services being accessed. Therefore it's critical to take measures to ensure that the data is being accessed securely, which means implementing technologies such as certificates, firewalls, enforcing pre-authentication, and device or endpoint validation. The key concept to understand is that applying security to any solution is a task that includes identifying the threats, reducing the attack surface area, removing unnecessary access points, and enforcing authentication. The casual attacker will usually give up after a few failed attempts to access a resource. When you publish Exchange, Microsoft offers two software-based options: Microsoft Forefront Threat Management Gateway 2010 (Forefront TMG) and Microsoft Forefront Unified Access Gateway 2010 (Forefront UAG). Both options offer publishing wizards and security features to provide secure access to Exchange when it's accessed from outside the safety of the corporate network. There are other ways to publish Exchange besides using Forefront TMG or Forefront UAG. This technical guide isn’t intended to provide the only information you use for a complex organization or one with special security constraints. Instead, it’s intended only as a walkthrough to help you publish Exchange on both these platforms, using basic configuration options. If you have a large organization, it’s likely that you’ll need additional applications or have to factor in additional security considerations. Such applications and security considerations are beyond the scope of this document. This white paper provides detailed information about publishing Microsoft Exchange Server 2010 using Forefront TMG or Forefront UAG, including how to choose between them for different scenarios, and provides specific steps you can take to configure Forefront TMG and Forefront UAG to publish Exchange 2010 while using certificate based authentication. Note that configuring Outlook Web App (OWA) and Exchange ActiveSync to use certificate based authentication is currently available only when TMG is used at the network perimeter. UAG can only provide certificate based authentication for OWA. Document Reviewers: David Bahat Ross Smith IV
wizard to configure Kerberos Constrained Delegation, so for now just leave the default of 401 request and click Next. On Step 14 – Portal Link, the default settings will create icons in the portal for Outlook Web App access, if a portal is used. Also, if the lower check box is selected, the portal will open Outlook Web app in a new window when it is accessed. Click Next. On Step 15 – Exchange Application Authorization, you can leave the default, which enables all authenticated users to access Exchange. This only means that they can try to access Outlook Web App. Any Outlook Web App policies you created in Exchange still apply, including OWAEnabled set to false. Or, you can restrict who can access Outlook Web App on Forefront UAG by selecting from a list of groups or even restrict access down to the user level by adding individual users to this list. Click Next and then Finish on the final page of the wizard to return to the management console. In the Applications section of the console, highlight the Exchange 2010 OWA application you just created, then click the Edit button to bring up the application properties. Use the scroll arrows to navigate to the Authentication tab Click on the Use Kerberos Constrained Delegation radio button and leave the default Application SPN of http/* - this allows UAG to substitute the name of each server in the farm as necessary when requesting Kerberos service tickets. Click OK to close the properties box and then click the Save icon in the UAG console toolbar to save the configuration. Click the Activate icon to back-up the existing configuration and activate this new configuration. This is a standard way to publish OWA using UAG, and at this stage, if a user were to connect to the external interface of the UAG server they would see the UAG Forms Based Authentication page. In order to configure this trunk to use certificate based authentication we need to make some additional changes.