Exchange Classic Hybrid Network ports and protocols.

shockoQA 126 Reputation points
2020-09-21T13:44:31.823+00:00

I have been looking at the networking requirements for Exchange classic Hybrid to Office 365. It's not clear to me:

  • What each port (443,80,25,587) is required for ?

Specifically what is being sent out of our organization over port 80 for example? We presented the documentation from Microsoft to our security teams and they laughed at the lack of detail! :|

The documentation is not explicit on the network flows.

Microsoft Exchange Hybrid Management
Microsoft Exchange Hybrid Management
Microsoft Exchange: Microsoft messaging and collaboration software.Hybrid Management: Organizing, handling, directing or controlling hybrid deployments.
1,981 questions

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Andy David - MVP 144.4K Reputation points MVP
    2020-09-21T14:43:17.817+00:00

    You wouldnt open port 80 :)

    Where do you see that requirement for Hybrid?

    https://video2.skills-academy.com/en-us/exchange/hybrid-deployment-prerequisites

    All you need is 25 and 443.

    1 person found this answer helpful.
  2. Joyce Shen - MSFT 16,646 Reputation points
    2020-09-22T02:54:25.683+00:00

    Hi @DarraghOShaughnessy-6524 , between Office 365 and your on-prem Exchange server, you need to have port 443 and port 25 available.

    You can have port 25 go directly to the internal Exchange server or you can go through an Edge server which helps you limit the inbound traffic to only the Office 365 IP address ranges list in this official document: Office 365 URLs and IP address ranges

    As for port 443, your system needs to be reverse proxied to Office 365 so that the hybrid connection can be fully established. Office 365 needs a web services connection to your internal systems so that it can create move requests.

    All outbound communication is on either port 25 or port 443. Port 80 is not used between your on-prem Exchange server and Office 365.

    If an Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
     
     

  3. shockoQA 126 Reputation points
    2020-09-22T12:01:16.13+00:00

    An update guys and thanks all who have responded:

    So a Microsoft Field Engineer came back to me and indicated

    "TCP port 80 egress is needed for auto-discovery from on premise Exchange to EOP. Regardless, when the client (outlook) talks to on-premise exchange and needs to discover a mailbox/calendar the Exchange server will use port 80 for auto-discovery."

    I asked was this port 80 from client to EOL directly and he indicated that it was actually the Exchange Backend connection to EOL that needs this. I'm confused as I can't find anything to back this up.