Using ISA Server 2006 with Exchange ActiveSync
Microsoft Exchange Server 2007 will reach end of support on April 11, 2017. To stay supported, you will need to upgrade. For more information, see Resources to help you upgrade your Office 2007 servers and clients.
Applies to: Exchange Server 2007, Exchange Server 2007 SP1, Exchange Server 2007 SP2, Exchange Server 2007 SP3
We recommend that you use Internet Security and Acceleration (ISA) Server 2006 to enhance the security of all available client access methods in your Microsoft Exchange Server 2007 deployment. When you configure Exchange ActiveSync client access with ISA Server 2006, communications between the Exchange ActiveSync clients and the Exchange server computer pass through an ISA Server computer to add an additional layer of Secure Sockets Layer (SSL) encryption.
Exchange ActiveSync enables information workers to access their Microsoft Exchange messaging data by using a mobile device. For more information about Exchange ActiveSync, see the following topics:
Benefits of Using ISA Server 2006 with Exchange ActiveSync
The following table describes several of the benefits of using ISA Server 2006 to protect client access through Outlook Anywhere to your Exchange deployment.
ISA Server 2006 features for Exchange ActiveSync
| Feature | Description |
|---|---|
Exchange server locations are hidden |
When you publish an application through ISA Server, you are protecting the server from direct external access because the name and IP address of the server cannot be viewed by the user. The user accesses the ISA Server computer. The ISA Server computer then forwards the request to the server according to the conditions of the server publishing rule. |
SSL Bridging and Inspection |
SSL bridging protects against attacks that are hidden in SSL-encrypted connections. For SSL-enabled Web applications, after ISA Server receives the client's request, ISA Server decrypts it, inspects it, and ends the SSL connection with the client computer. The Web publishing rules determine how ISA Server communicates the request for the object to the published Web server. If the secure Web publishing rule is configured to forward the request by using Secure HTTP (HTTPS), ISA Server initiates a new SSL connection with the published server. Because the ISA Server computer is now an SSL client, it requires the published Web server to respond with a server-side certificate. |
ISA Server 2006 Deployment Prerequisites for Exchange ActiveSync
When you deploy ISA Server 2006 to help secure communication from Exchange ActiveSync clients on the Internet to Exchange 2007 computers that have the Client Access server role installed, we recommend that you confirm the following:
Forms based authentication is not configured on the Exchange Client Access server. When ISA Server 2006 is being used to publish Exchange client access, we recommend forms-based authentication be configured only on the ISA Server computer.
A server certificate is installed on the Exchange Client Access server. This certificate can be from an internal certification authority (CA) or a public CA.
SSL is required on all Exchange Client Access virtual directories.
After you confirm these settings, you can configure ISA Server 2006 to provide Exchange ActiveSync access for your clients.
How to Deploy ISA Server 2006 for Exchange ActiveSync
To enable an encrypted channel between the client computer and the ISA Server computer, you first have to install a server certificate on the ISA Server computer. This certificate should be issued by a public certification authority (CA) because it will be accessed by users on the Internet. If a private CA is used, the root certificate from the private CA must be installed on any computer that requires a secure (HTTPS) connection to the ISA Server computer.
For more information about how to install a server certificate on ISA Server 2006, see Publishing Exchange Server 2007 with ISA Server 2006.
After a server certificate is installed on the ISA Server computer, you can run the New Exchange Publishing Rule Wizard. Running the New Exchange Publishing Rule Wizard to provide Exchange ActiveSync access involves the following steps:
Create a server farm (optional) When you have more than one Client Access server within your organization, you can use ISA Server to provide load balancing for these servers. The server farm properties determine the following:
The specific servers included in the farm.
The connectivity verification method that ISA Server will use to verify that the servers are functioning correctly.
Create a Web listener When you create a Web publishing rule, you must specify a Web listener. The Web listener properties determine the following:
The IP addresses and ports on the specified networks that the ISA Server computer uses to listen for Web requests (HTTP or HTTPS).
Which server certificates to use with IP addresses.
The Authentication method to use.
The number of concurrent connections that are allowed.
Single sign-on (SSO) settings.
Create an Exchange Web client access publishing rule When you publish an internal Exchange 2007 Client Access server through ISA Server 2006, you are protecting the Web server from direct external access because the name and IP address of the server cannot be viewed by the user. The user accesses the ISA Server computer. The ISA Server computer then forwards the request to the internal Web server according to the conditions of your Web server publishing rule. An Exchange Web client access publishing rule is a Web publishing rule that contains default settings appropriate to Exchange client access.
For more information about how to use the New Exchange Publishing Rule Wizard, see Microsoft ISA Server 2006.
Important
There is a software update that is required for ISA Server 2006 before you can publish Exchange Server 2007. For more information about that update, see Update for Publishing Microsoft Exchange Server 2007 for Internet Security and Acceleration (ISA) Server 2006.
For More Information
For more information about how to configure ISA Server 2006 for client access, see Configuring ISA Server 2006 for Exchange Client Access.