Help needed creating a DMZ

[pooley]

Ok the story goes .....

 

One of my primary schools wants exchange 2003 installed.

 

They want to use the Diary feature and internal email for staff/children etc.

 

Now the awkward part - my admin and curriculum networks are seperated (by county) - I have asked them if they will open the relevant ports needed for exchange to work across the both networks but they wont.

 

Best they can offer me is port 80 for web based mail, but this doesnt help me with the Diary side.

 

Now another suggestion was a DMZ that both admin and curriculum can access for their email.

 

I have NO idea about DMZ's etc and whats best practice, whats most cost effective option etc. :?

 

So any help is much appreciated.

 

Simon

[ChrisH]

Try something like Smoothwall on an old box.

[pooley]

What abot the hardware setup ? how would you configure it ?

[ChrisH]

Now I have thought about it a smoothwall wouldnt work out of the box for you due to the way it has its 3 interfaces. Some other dedicated linux based distro would do the job though and im sure someone will suggest one .

[webman]

Won't this setup need 4 interfaces? External, Curric, Admin and DMZ?

[ChrisH]

Yes thats what I meant there is only 3 interfaces as standard. He needs another interface like the green.

[spc-rocket]

How about using ISA Server 2004 Standard edition.

 

Can have many interfaces as you like.

 

Ashok.

[webman]

I think IPCop support four interfaces. Red, Orange, Green and Blue. Blue was originally designed for stations accessing the box via a wireless subnet (only to apply different security), but should work in this case.

[ChrisH]

Smothwall has a blue as well but not as standard.

[Geoff]

If you use Shorewall you get up to 127 (hardware limit on x86 based PCs).

 

http://www.shorewall.net/

 

You'll need a Linux box of some description to install it on with a correctly configured kernel (its all covered in the docs).

[Ric_]

When I was installing IPCop last week at home, I noticed the options at install time as mentioned by webman. The coloured networks are only really separated so that you can distinguish between them and you can do the same to pretty much any of them.

 

Alternatively, you could use Outlook Web Access to view personal calendars (although shared calendars would be a problem IIRC). Exchange can be forced to use port 80 for all traffic but I can't remember where the setting is.

[pooley]

...... Exchange can be forced to use port 80 for all traffic but I can't remember where the setting is.

 

That would be usefull.

 

If I used a linux distro and install Shorline as my dmz i would then need another 2k/2k3 server connected to that for exchange ?

 

Sorry for the numpty questions, but the wonders of networking are relativly new to me.

[Geoff]

nope, just the one.