Sign in
Microsoft.com
 
Forefront Server Security TechCenter
 
 
 
Forefront Server Security TechCenter > Forefront Server Security Forums > Forefront Security for Exchange Server > On which roles of Exchange 2010 do I need to install Forefront Security 2010 for Exchange
Ask a questionAsk a question
Search Forums:
 

AnswerOn which roles of Exchange 2010 do I need to install Forefront Security 2010 for Exchange

  • Tuesday, October 13, 2009 6:36 PMivan mckenzie Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote
    Hi everyone, I have two Edge servers, two hub/client servers (cas-array with NLB) and two mailbox servers.
    Do I have to install Forefront on the six servers?

    Thanks a lot,

    Ivan
     

Answers

  • Tuesday, October 13, 2009 7:08 PMChristian Groebner [MVP]MVPUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Answer
    Sign In to Vote
    1
    Sign In to Vote
    Hi Ivan,

    it depends on how much security you want :-)

    You can install FSE on every server that has the roles Edge, Hub transport or mailbox. If you want a high security design you can scan the emails on the edge server with 4 scan engines and on hub transport with 4 different.

    You should always install FSE on the mailbox servers due to mobile access, eg OWA, Outlook Anywhere, whicht doesn't go over SMTP and so no edge or hub transport can detect the virus.

    Greetings

    Christian
    Christian Groebner MVP Forefront
     

All Replies

  • Tuesday, October 13, 2009 7:08 PMChristian Groebner [MVP]MVPUsers MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     Answer
    Sign In to Vote
    1
    Sign In to Vote
    Hi Ivan,

    it depends on how much security you want :-)

    You can install FSE on every server that has the roles Edge, Hub transport or mailbox. If you want a high security design you can scan the emails on the edge server with 4 scan engines and on hub transport with 4 different.

    You should always install FSE on the mailbox servers due to mobile access, eg OWA, Outlook Anywhere, whicht doesn't go over SMTP and so no edge or hub transport can detect the virus.

    Greetings

    Christian
    Christian Groebner MVP Forefront
     
  • Tuesday, October 13, 2009 7:22 PMivan mckenzie Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote
    Thanks for your quick replay.

    Ivan
     
  • Wednesday, October 14, 2009 8:41 AMAndy S. Day Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote
    Great advice from Christian.
    In addition, bear in mind that FSE is designed to do the majority of internal and outbound mail scanning at the Hub level. If you only install FSE on mailbox servers, you will be putting a high load on those servers, as regards scanning.
    Where FSE is installed on Hub and Mailbox servers, load is taken off the mailbox servers, as most scanning will be done at the Hub level (even for local deliveries). This is therefore my own bare-minimum recommendation. Then add FSE on the Edge servers too, if you have them...but this is the optional part, IMHO.
    Kind Regards, Andy Day | CSS Security, Sr. Support Engineer (Antigen/Forefront Server Security)
     
  • Friday, October 23, 2009 1:00 PMAndrew Schiano Users MedalsUsers MedalsUsers MedalsUsers MedalsUsers Medals
     
    Sign In to Vote
    0
    Sign In to Vote
    Best practice would be to install Forefront on all your Edge, Hub, and MB servers. When installed on the Hub and Edge, most scanning will be done at the transport, keeping the load on your MB server low. But if you want to run On-Demand or Scheduled background scans, you will need Forefront installed on your MB servers as well.