Logo
programming4us
programming4us
programming4us
programming4us
Home
programming4us
XP
programming4us
Windows Vista
programming4us
Windows 7
programming4us
Windows Azure
programming4us
Windows Server
programming4us
Windows Phone
 
Windows Server

Exchange Server 2010 : Configuring Transport Servers - Edge Transport Servers

- How To Install Windows Server 2012 On VirtualBox
- How To Bypass Torrent Connection Blocking By Your ISP
- How To Install Actual Facebook App On Kindle Fire
5/14/2011 5:35:22 PM
Edge Transport servers are responsible for transmitting messages to and receiving messages from email servers on the Internet. As the entry point for external messages, Edge Transport servers are responsible for message hygiene, that is, cleaning messages that contain malware and discarding messages that contain unsolicited commercial or phishing-related content. Edge Transport servers store configuration information in an Active Directory Lightweight Directory Services database. A special unidirectional replication process called EdgeSync populates this database. The unidirectional nature of this replication process ensures that Active Directory is not compromised in the event that attackers compromise the Edge Transport server.

1. Edge Transport Role

The Edge Transport role is different from other Exchange server roles in that you can install the role on a computer that is not a member of a domain. Edge Transport servers are designed to be deployed in perimeter networks. Edge Transport servers form a bridge between mail servers on the Internet and Hub Transport servers on the internal network. You can use the Edge Transport server to scan and discard incoming messages if these messages are found to contain malware or have unsolicited commercial or phishing-related content.

Like other Exchange Server 2010 roles, you can deploy the Edge Transport server role on computers running Windows Server 2008 or Windows Server 2008 R2. Prior to deploying the Edge Transport role, you need to install the following operating system features:

  • .NET FrameWork 3.51

  • Remote System Administration Tools for Active Directory Directory Services

  • Active Directory Lightweight Directory Services

Prior to running Exchange setup, you also need to ensure that the server’s fully qualified domain name is set. You can set the fully qualified domain name of the host server by performing the following general steps:

  1. In the Computer Name tab of the System Properties dialog box, click on the Change button.

  2. In the Computer Name/Domain Changes dialog box, click on the More button.

  3. On the DNS Suffix and NetBIOS Computer Name page, enter the DNS suffix of the computer.


2. EdgeSync

EdgeSync is a unidirectional process that replicates transport server configuration information, such as transport rules, from Hub Transport servers on protected networks to Edge Transport servers on perimeter networks. EdgeSync subscriptions mean that Edge Transport servers can be configured centrally rather than having to make a remote desktop connection to the server on the protected network. EdgeSync subscriptions replicate information from the Hub Transport server to the Edge Transport server. This way, should the Edge Transport server become compromised by an attacker, it is not possible for the attacker to replicate information back to the internal network.

Once you configure EdgeSync, you will be unable to perform certain configuration tasks on the Edge Transport server. The following cmdlets are disabled on an Edge Transport server when you configure EdgeSync:

  • Set-SendConnector

  • New-SendConnector

  • Remove-SendConnector

  • New-AcceptedDomain

  • Set-AcceptedDomain

  • Remove-AcceptedDomain

  • New-MessageClassification

  • Set-MessageClassification

  • Remove-MessageClassification

  • New-RemoteDomain

  • Set-RemoteDomain

  • Remove-RemoteDomain

If you want to create an additional send connector after you have configured an edge transport solution, you need to create it within the Exchange organization. The new send connector configuration will then replicate through the EdgeSync process to the Edge Transport server.

When configuring the firewall between the screened subnet and the internal network, you will need to open port 25 between the Hub Transport and Edge Transport servers to allow for the transmission of messages. To allow the EdgeSync process to function, you need to open TCP port 50636 between the Edge Transport server and the Hub Transport servers on the site connected to the perimeter network. This port must be open before you attempt to configure the Edge subscription.

To create an Edge subscription, perform the following general steps:

  1. Ensure that the Hub Transport and Edge Transport servers are able to resolve each other’s DNS names.

  2. On the Edge Transport server, use the EMS to run the New-EdgeSubscription cmdlet.

  3. Transfer the file generated by running the New-EdgeSubscription cmdlet to a Hub Transport server.

  4. On the Hub Transport server, open the EMC and navigate to the Organization Configuration\Hub Transport node. Click on the Edge Subscriptions tab and then click New Edge Subscription in the Actions pane. This will open the New Edge Subscription Wizard.

  5. On the New Edge Subscription Wizard, specify the location of the Edge Subscription file that you copied to the Hub Transport server. Select the Active Directory site to which the Edge Transport server will subscribe. Select the Automatically Create A Send Connect For This Edge Subscription if you want to route messages through the Edge Transport server to the Internet.

  6. Click New to create the subscription and then click Finish to dismiss the wizard.

You can use the following EMS cmdlets to manage Edge subscriptions:

  • New-EdgeSubscription This cmdlet, when run on an Edge Transport server, allows you to create a subscription file. You can also use this cmdlet on a Hub Transport server to import a subscription file.

  • Get-EdgeSubscription This cmdlet allows you to retrieve information about existing Edge subscriptions.

  • Remove-EdgeSubscription You can use this cmdlet to delete an existing Edge subscription.

  • Start-EdgeSynchronization You can use this cmdlet to force the edge synchronization process.

  • Test-EdgeSynchronization This cmdlet allows you to diagnose the synchronization status of currently subscribed Edge Transport servers.

  • New-EdgeSyncServiceConfig Create a new edge synchronization schedule.

  • Get-EdgeSyncServiceConfig Get the properties of an existing edge synchronization schedule.

  • Set-EdgeSyncServiceConfig Modify the properties of an existing edge synchronization schedule.

If you add additional Hub Transport servers to a site where there is an existing subscription, the new hub transport will not participate in the synchronization process. To allow the new Hub Transport server to participate in the Edge subscription, you must resubscribe each Edge Transport server to the Active Directory site. Removing a Hub Transport server from a subscribed site does not cause problems unless the removed Hub Transport server is the last server in that site. When you deploy a new Edge Transport server on the perimeter network, you must subscribe that Edge Transport server to the Active Directory site, but it is not necessary to resubscribe the existing Edge Transport servers.


3. Clone Edge Transport Server

If you want to configure a second or third Edge Transport server on your organization’s perimeter network, you are likely to want to ensure that each Edge Transport server has the same configuration. Rather than manually attempt to replicate the server’s configuration, you can use special scripts to import and export the server’s configuration.

Cloning the configuration of an Edge Transport server does not replicate EdgeSync subscription settings or server certificates. You will need to create a new EdgeSync subscription for the new Edge Transport server.

The following settings are replicated to the new server when you clone the configuration:

  • Send and receive connectors

  • Accepted domains

  • Remote domains

  • IP allow list

  • IP block list

  • The following anti-spam configuration settings are cloned: content filter configuration, recipient filter configuration, address rewrite entries, and attachment filter entries.

To clone an Edge Transport server, perform the following general steps:

  1. Ensure that you have already installed the Edge Transport server role on the target server.

  2. From the EMS, run ExportEdgeConfig.ps1 on the prepared Edge Transport server. Running this command will create an XML file. Transfer this file across to the target server.

  3. You will need to edit the XML file to include the following information:

    • Data and log file paths

    • Source IP addresses for send connectors

    • Network bindings for each receive connector

  4. After you have edited the XML file, from the EMS run ImportEdgeConfig.ps1 on the target server to verify and apply the configuration.


4. Address Rewriting

In some cases, it is necessary to rewrite email addresses into a more consistent format when they are sent to hosts on the Internet. For example, two organizations may merge into a third organization that has a new name. Users in each original organization may continue to receive email using their original addresses, but address rewriting would allow mail flow to be configured so that all outbound messages would have the sender address associated with them rewritten so that it matched the domain name of the new third organization. For example, Fabrikam and Contoso are merging into a new organization named Adatum. Kim Akers’s email address is kim.akers@contoso.com, and Sam Abolrous’s email address is abolrous.s@fabrikam.com. An address rewriting policy can ensure that both Kim’s and Sam’s email addresses are rewritten so that they appear in the format first initial.surname@adatum.com even though neither address is originally in that format. This would make Kim’s and Sam’s addresses, when rewritten, k.akers@adatum.com and s.abolrous@adatum.com.

Address rewriting on an Edge Transport server requires that address rewriting agents be enabled. To enable the inbound and outbound transport agents, run the following EMS commands:

Enable-TransportAgent -Identity "Address Rewriting Inbound agent"
Enable-TransportAgent -Identity "Address Rewriting Outbound agent"

You can verify that the address rewriting agent is enabled by using the Get-TransportAgent cmdlet and verifying that both the Address Rewriting Inbound Agent and the Address Rewriting Outbound Agent are enabled.

You use the New-AddressRewriteEntry cmdlet to configure address rewrite entries. You can configure address rewrite entries for single addresses, single domains, or multiple domains.

For example, to change the address sam.abolrous@contoso.com to helpdesk@adatum.com, issue the following command:

New-AddressRewriteEntry -name "Sam to Helpdesk" -Internal sam.abolrous@contoso.com
-ExternalAddress helpdesk@adatum.com


To change all email addresses from the tailspintoys.com domain to the wingtiptoys.com domain, issue the following command:

New-AddressRewriteEntry -name "Tailspintoys to Wingtiptoys" -InternalAddress
tailspintoys.com -ExternalAddress wingtiptoys.com


To change all email addresses from Contoso.com subdomains, such as Australia.contoso.com and Fiji.contoso.com, issue the following command:

New-AddressRewriteEntry -Name "All Contoso Subdomains" -InternalAddress *.contoso.com
-ExternalAddress Contoso.com -OutboundOnly $True

Note:

Know under which circumstances it is necessary to resubscribe Edge Transport servers.


Practice: Configuring Transport Servers

In this set of practice exercises, you will configure a Hub Transport server and an Edge Transport server.

EXERCISE 1 Configure accepted domains

In this practice exercise, you will configure the domains wingtiptoys.com and tailspintoys.com as accepted domains. To complete this exercise, perform the following steps:

  1. Log on to server VAN-EX1 using the Kim Akers user account.

  2. In the EMC, select the Organization Configuration\Hub Transport node. In the Actions pane, click on New Accepted Domain.

  3. In the New Accepted Domain dialog box, enter wingtiptoys.com in the Name and Accepted Domain fields. Select the Authoritative Domain option, as shown in Figure 1, and then click New. Click Finish.

  4. Open the EMS and issue the following command:

    New-AcceptedDomain -Name 'Tailspintoys.com' -DomainName 'Tailspintoys.com'
    -DomainType 'Authoritative'

  5. Use the EMC to verify that both the tailspintoys.com and the wingtiptoys.com domains have been configured as accepted domains in the Exchange organization.

    Figure 1. New Accepted Domain


EXERCISE 2 Configure remote domains

In this exercise, you will configure cohovineyard.com and fabrikam.com as remote domains. To complete this exercise, perform the following steps:

  1. In the EMC, ensure that the Organization Configuration\Hub Transport node is selected.

  2. In the Actions pane, click on New Remote Domain. In the New Remote Domain dialog box, enter fabrikam.com in the Name and Domain Name fields, as shown in Figure 2, and then click New. Click Finish.

    Figure 2. New Remote Domain


  3. In the EMS, issue the following command:

    New-RemoteDomain -Name 'cohovineyard.com' -DomainName 'cohovineyard.com'

  4. Use the Get-RemoteDomain cmdlet to verify the creation of the fabrikam.com and cohovineyard.com remote domains.

EXERCISE 3 Configure email address policies

In this exercise, you will configure an email address policy that so that users who are members of the Wingtip Toys Department are able to receive mail with a wingtiptoys.com email address as well as their adatum.com e-mail address. To complete this exercise, perform the following steps:

  1. From the EMC, select the Organization Configuration\Hub Transport node. In the Actions pane, click on New E-Mail Address Policy.

  2. On the Introduction page of the New E-Mail Address Policy Wizard, enter the name WingTip Toys Policy and then click Next.

  3. On the Conditions page, select Recipient is in a Department. Click on the underlined word specified. In the Specify Department dialog box, type Wingtip Toys, click Add, and then click OK. Click Next.

  4. On the E-Mail Addresses tab, click Add. In the SMTP E-Mail Address dialog box, select Last Name.First Name and then select the Select The Accepted Domain For The E-Mail Address and click Browse. Click on Wingtiptoys.com and then click OK. Verify that the SMTP E-Mail Address dialog box matches what is shown in Figure 3 and then click OK.

    Figure 3. New Email Address Policy


  5. Click Next twice and then click New. Click Finish to close the New E-Mail Address Policy Wizard.

EXERCISE 4 Prepare server for and install the Edge Transport server role

In this exercise, you will prepare a new server to function as an Edge Transport server for your existing Exchange Server 2010 deployment. To complete this exercise, perform the following steps:

  1. Log on to server VAN-DC and create a new DNS record et.adatum.com that maps to the IP address 10.10.0.50. Ensure that when you create the host record, you also create the PTR record in the reverse lookup zone.

  2. Log on to the computer that you have installed Windows Server 2008 R2 on using the Administrator account and the password Pa$$w0rd.

  3. Open an elevated command prompt and issue the following commands:

    Netsh interface ipv4 set address "Local Area Connection" static 10.10.0.50

    Netsh interface ipv4 set dnsservers "Local Area Connection" static 10.10.0.10
    primary

    Netdom renamecomputer %computername% /newname:VAN-ET


  4. Restart the computer and log back on using the Administrator account. Open an elevated PowerShell session and then enter the following commands:

    Import-Module ServerManager

    Add-WindowsFeature NET-FrameWork,RSAT-ADDS,ADLDS -Restart

  5. After the server restarts, log in as Administrator. From the Start menu, right-click on Computer and then click on Properties. Click on Advanced System Settings, click on the Computer Name tab, and then click on Change. Click on the More button. In the DNS Suffix And NetBIOS Computer Name dialog box, shown in Figure 4, enter adatum.com and then click OK. Restart the computer when prompted.

    Figure 4. DNS suffix settings


  6. After the server restarts, log in as Administrator and use Windows Explorer to navigate to the location of the Exchange installation files. Run Setup.exe. If prompted, click Yes in the User Account Control dialog box.

  7. On the splash screen, click on Step 3: Choose Exchange Language Option. Click on the Install Only Languages From The DVD option. Click on Step 4: Install Microsoft Exchange. On the Introduction screen, click Next.

  8. On the License Agreement screen, select I Accept The Terms In The License Agreement and then click Next.

  9. On the Error Reporting screen, verify that No is selected and then click Next.

  10. On the Installation Type screen, click Custom Exchange Server Installation and then click Next.

  11. On the Server Role Selection screen, shown in Figure 5, click on the Edge Transport Role and then click Next.

    Figure 5. Edge Transport Role selection


  12. Ensure that I Don’t Wish To Join The Program At This Time is selected on the Customer Experience Improvement Program page and then click Next.

  13. After the readiness checks complete, click Install.

  14. After the install completes, de-select the Finalize Installation Using Exchange Management Console option and then restart the server.

EXERCISE 5 Configure and perform Edge Transport server synchronization

In this exercise, you will configure the Edge Transport server that you installed in Exercise 4 to perform an edge synchronization. To complete this exercise, perform the following steps:

  1. If you have not already done so, log on to server VAN-ET with the Administrator account.

  2. From the EMS, issue the following command:

    New-EdgeSubscription -FileName "C:\VAN-ET.xml"

  3. When prompted, press Y.

  4. Click Start. In the search box, type \\van-ex1\c$ and then press Enter.

  5. Copy c:\VAN-ET.xml to the \\VAN-EX1\c$ directory.

  6. Log on to server VAN-EX1 using the Kim Akers user account.

  7. Click on the Organization Configuration\Hub Transport node and then click on New Edge Subscription. This will bring up the New Edge Subscription dialog box.

  8. Click Browse next to Active Directory Site, select Default First Site Name, and then click OK. Click Browse next to Subscription File, navigate to C:\VAN-ET.xml, and click Open. Verify that the New Edge Subscription dialog box matches what is shown in Figure 6 and then click New.

    Figure 6. New Edge Subscription


  9. Click Finish to close the New Edge Subscription Wizard.

  10. From the EMS, issue the Get-EdgeSubscription command. Verify that VAN-ET is returned as a subscription.

Other -----------------
- BizTalk 2010 Recipes : EDI Solutions - Configuring an EDI Envelope
- BizTalk 2010 Recipes : EDI Solutions - Creating and Configuring a Trading Partner
- SharePoint 2010 PerformancePoint Services : Working with the Monitoring API - Setting Up Your Development Environment
- SharePoint 2010 PerformancePoint Services : Installing SharePoint on a Client Operating System
- Exchange Server 2010 : Configuring Transport Servers - Hub Transport Servers (part 2)
- Exchange Server 2010 : Configuring Transport Servers - Hub Transport Servers (part 1)
- BizTalk 2010 Recipes : EDI Solutions - Defining Complex Mappings in External XSLT
- BizTalk 2010 Recipes : EDI Solutions - Creating an EDI Map
- BizTalk 2010 Recipes : EDI Solutions - Adding an EDI Schema to a Project
- Exchange Server 2010 : Setting Up Message Routing (part 4) - Configuring Foreign Connectors for Compliance & Using TLS and MTLS
 
 
Top 10
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Finding containers and lists in Visio (part 2) - Wireframes,Legends
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Finding containers and lists in Visio (part 1) - Swimlanes
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Formatting and sizing lists
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Adding shapes to lists
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Sizing containers
- Microsoft Access 2010 : Control Properties and Why to Use Them (part 3) - The Other Properties of a Control
- Microsoft Access 2010 : Control Properties and Why to Use Them (part 2) - The Data Properties of a Control
- Microsoft Access 2010 : Control Properties and Why to Use Them (part 1) - The Format Properties of a Control
- Microsoft Access 2010 : Form Properties and Why Should You Use Them - Working with the Properties Window
- Microsoft Visio 2013 : Using the Organization Chart Wizard with new data
- First look: Apple Watch

- 3 Tips for Maintaining Your Cell Phone Battery (part 1)

- 3 Tips for Maintaining Your Cell Phone Battery (part 2)
programming4us programming4us
Popular tags
Microsoft Access Microsoft Excel Microsoft OneNote Microsoft PowerPoint Microsoft Project Microsoft Visio Microsoft Word Active Directory Biztalk Exchange Server Microsoft LynC Server Microsoft Dynamic Sharepoint Sql Server Windows Server 2008 Windows Server 2012 Windows 7 Windows 8 windows Phone 7 windows Phone 8
programming4us programming4us
 
programming4us
Natural Miscarriage
programming4us
Windows Vista
programming4us
Windows 7
programming4us
Windows Azure
programming4us
Windows Server
programming4us
Game Trailer