Securing Exchange Outlook Web Access with ISA Server 2006

As previously mentioned, OWA is one of the most commonly secured services that ISA servers protect. This stems from the critical need to provide remote email services while at the same time securing that access. The success of ISA deployments in this fashion gives tribute to the tight integration Microsoft built between its ISA product and Exchange product.

An ISA server used to secure an OWA implementation can be deployed in multiple scenarios, such as an edge firewall, an inline firewall, or a dedicated reverse-proxy server. In all these scenarios, ISA secures OWA traffic by “pretending” to be the OWA server itself, scanning the traffic that is destined for OWA for exploits, and then repackaging that traffic and sending it on, such as what is illustrated in Figure 12.12.