Data Path Security Reference

Microsoft Exchange Server 2007 will reach end of support on April 11, 2017. To stay supported, you will need to upgrade. For more information, see Resources to help you upgrade your Office 2007 servers and clients.

Applies to: Exchange Server 2007, Exchange Server 2007 SP1, Exchange Server 2007 SP2, Exchange Server 2007 SP3

This topic provides information about ports, authentication, and encryption for all data paths used by Microsoft Exchange Server 2007. The Notes sections following each table clarify or define non-standard authentication or encryption methods.

Transport Servers

Exchange 2007 includes two server roles that perform message transport functionality: Hub Transport server and Edge Transport server.

The following table provides information about ports, authentication, and encryption for data paths between these transport servers and to and from other Exchange 2007 servers and services.

Transport server data paths

Notes on Transport Servers

All traffic between Hub Transport servers is encrypted by using TLS with self-signed certificates that are installed by default by Exchange 2007 Setup. The traffic between Hub Transport servers is authenticated using Kerberos authentication.

All traffic between Edge Transport servers and Hub Transport servers is authenticated and encrypted. The underlying mechanism for authentication and encryption is mutual TLS. Instead of using X.509 validation, Exchange 2007 uses direct trust to authenticate the certificates. Direct trust means that the presence of the certificate in Active Directory or ADAM validates the certificate. Active Directory is considered a trusted storage mechanism. When direct trust is used, it doesn't matter if the certificate is self-signed or signed by a certification authority. When you subscribe an Edge Transport server to the Exchange organization, the Edge Subscription publishes the Edge Transport server certificate in Active Directory for the Hub Transport servers to validate. The Microsoft Exchange EdgeSync service updates ADAM with the set of Hub Transport server certificates for the Edge Transport server to validate.

By default, traffic between Edge Transport servers in two different organizations is encrypted. Exchange 2007 Setup creates a self-signed certificate and TLS is enabled by default. This allows any sending system to encrypt the inbound SMTP session to Microsoft Exchange. By default, Exchange 2007 also tries TLS for all remote connections.

Authentication methods for traffic between Hub Transport servers and Mailbox servers differ when the Hub Transport server roles and Mailbox server roles are located on the same computer. When mail submission is local, Kerberos authentication is used. When mail submission is remote, NTLM authentication is used.

Exchange 2007 also supports Domain Security. Domain Security refers to the set of functionality in Exchange 2007 and Microsoft Office Outlook 2007 that provides a low-cost alternative to S/MIME or other message-level over-the-Internet, security solutions. The purpose of the Domain Security feature set is to provide administrators a way to manage secured message paths between domains over the Internet. After these secured message paths are configured, messages that have successfully traveled over the secured path from an authenticated sender are displayed to users as "Domain Secured" in the Outlook and Outlook Web Access interface. For more information, see Planning for Domain Security.

Many agents may run on the Hub Transport servers and Edge Transport servers. Generally, the anti-spam agents rely on information that is local to the computer that the agents run on. Therefore, very little communication with remote computers is required. The exception is recipient filtering. This requires calls to either ADAM or Active Directory. It is a best practice to run recipient filtering on the Edge Transport server. In this case, the ADAM directory is on the same computer as the Edge Transport server and no remote communication is required. When recipient filtering has been installed and configured on the Hub Transport server, recipient filtering accesses Active Directory.

The Protocol Analysis agent is used by the Sender Reputation feature in Exchange 2007. This agent also makes various connections to outside proxy servers to determine inbound message paths for suspect connections.

All other anti-spam functionality uses data gathered, stored, and accessed only on the local computer. Frequently, the data, such as safelist aggregation or recipient data for recipient filtering, is pushed to the local ADAM directory by using the Microsoft Exchange EdgeSync service.

Journaling and message classification run on Hub Transport servers and rely on Active Directory data to function.

Mailbox Server

In the context of the Mailbox server role, whether the authentication is NTLM or Kerberos relies on the user or process context that the Exchange Business Logic layer consumer is running under. In this context, the consumer is any application or process that uses the Exchange Business Logic layer. In many of the "Default Authentication" cells in the "Mailbox Server data paths" table in this section, the authentication is listed as "NTLM/Kerberos."

The Exchange Business Logic layer is used to access and communicate with the Exchange store. The Exchange Business Logic layer is also called from the Exchange store to communicate with external applications and processes.

If the Exchange Business Logic layer consumer is running as Local System, the authentication method is always Kerberos from the consumer to the Exchange store. Kerberos is used because the consumer must be authenticated by using the computer account Local System and a two-way authenticated trust must exist.

If the Exchange Business Logic layer consumer is not running as Local System, the authentication method is NTLM. For example, when an Administrator runs an Exchange Management Shell cmdlet that uses the Exchange Business Logic layer, NTLM is used.

The RPC traffic is always encrypted.

The following table provides information about ports, authentication, and encryption for data paths to and from Mailbox servers

Mailbox server data paths

Notes on Mailbox Servers

For HTTP authentication where "Negotiate" is listed, Kerberos is tried first, and then NTLM.

For intra-node communications, cluster nodes communicate over User Datagram Protocol (UDP) port 3343. Each node in the cluster periodically exchanges sequenced, unicast UDP datagrams with every other node in the cluster. The purpose of this exchange is to determine whether all nodes are running correctly and to monitor the health of network links.

Although WebDav applications or clients can connect to the Mailbox server by using 80/TCP or 443/TCP, in most cases the application or clients connect to the Client Access server. The Client Access server then connects to the Mailbox server over 80/TCP or 443/TCP.

The clustering data path listed in the "Mailbox Server data paths" table in this section uses dynamic RPC (TCP) to communicate cluster status and activity between the different cluster nodes. The cluster service (ClusSvc.exe) also uses UDP/3343 and randomly allocated high TCP ports to communicate between cluster nodes.

Client Access Server

Unless noted, client access technologies, such as Microsoft Office Outlook Web Access, POP3, or IMAP4, are described by the authentication and encryption from the client application to the Client Access server.

The following table provides information about port, authentication, and encryption for data paths between Client Access servers and other servers and clients.

Client Access server data paths

Notes on Client Access Servers

The Client Access server communicates with the Mailbox server by using many ports. With some exceptions, those ports are determined by the remote procedure call (RPC) service and are not fixed. It is possible to specify the range of dynamic ports that are used by the RPC service. For more information about restricting the range of dynamic ports that are used by the RPC service, see Microsoft Knowledge Base article 154596, How to configure RPC dynamic port allocation to work with firewalls.

For HTTP authentication where "Negotiate" is listed, Kerberos is tried first, and then NTLM is tried.

When an Exchange 2007 Client Access server is communicating with a Mailbox server that is running Exchange Server 2003, it is a best practice to use Kerberos and disable NTLM authentication and Basic authentication. Additionally, it is a best practice to configure Outlook Web Access to use forms-based authentication with a trusted certificate. In order for Exchange ActiveSync clients to communicate through the Exchange 2007 Client Access server to the Exchange 2003 back-end server, Windows Integrated Authentication must be enabled on the Microsoft-Server-ActiveSync virtual directory on the Exchange 2003 back-end server. To use Exchange System Manager on a server that is running Exchange 2003 to manage authentication on an Exchange 2003 virtual directory, download and install the hotfix that is referenced in Microsoft Knowledge Base article 937301, Event ID 1036 is logged on an Exchange 2007 server that is running the CAS role when mobile devices connect to the Exchange 2007 server to access mailboxes on an Exchange 2003 back-end server.

Unified Messaging Server

IP gateways only support certificate-based authentication that uses mutual TLS and IP-based authentication for Session Initiation Protocol (SIP)/TCP connections. IP gateways do not support either NTLM or Kerberos authentication. Therefore, when you use IP-based authentication, the connecting IP address or addresses are used to provide authentication mechanism for unencrypted (TCP) connections. When IP-based authentication is used in Unified Messaging, the Unified Messaging server verifies that the IP address is allowed to connect. The IP address is configured on the IP gateway or IP PBX.

The following table provides information about port, authentication, and encryption for data paths between Unified Messaging servers and other servers.

Unified Messaging server data paths

Notes on Unified Messaging Servers

When you create a Unified Messaging (UM) IP gateway object in Active Directory, you must define the IP address of the physical IP gateway or IP PBX (Private Branch eXchange). When you define the IP address on the UM IP gateway object, the IP address is added to a list of valid IP gateways that the Unified Messaging server is allowed to communicate with. When the UM IP gateway is created, it is associated with a UM dial plan. Associating the UM IP gateway with a dial plan allows the Unified Messaging servers that are associated with the dial plan to use IP-based authentication to communicate with the IP gateway. If the UM IP gateway has not been created or it is not configured to use the correct IP address, authentication fails and the Unified Messaging servers do not accept connections from that IP gateway's IP address.

For the original release to manufacturing (RTM) version of Exchange 2007, a Unified Messaging server can either communicate on port 5060/TCP (unsecured) or on port 5061/TCP (secured) but not both.

For more information, see Understanding Unified Messaging VoIP Security and Understanding Protocols, Ports, and Services in Unified Messaging.

For More Information

For more information, see Microsoft Knowledge Base article 179442, How to configure a firewall for domains and trusts.