

Why has this seemingly simple support statement become so muddied and confusing over the years? Maybe we didn’t make it blunt enough to start with, but there could be some other compounding points adding to the confusion.

However, you can install a network device if traffic isn’t restricted and all available ports are open between the various Exchange servers and Active Directory.” The installation of a firewall between Exchange servers or between an Exchange 2010 Mailbox or Client Access server and Active Directory isn’t supported. Make sure that all defined ports that are used by Exchange are open in both directions between all source and destination servers. “In addition to having a Client Access server in every Active Directory site that contains a Mailbox server, it’s important to avoid restricting traffic between Exchange servers. A network device may sit in the communication path between the servers, but a rule allowing “ANY/ANY” port and protocol communication must be in place allowing free communication between Exchange servers as well as between Exchange servers and domain controllers.įor Exchange Server 2010 this is already articulated at (v=EXCHG.141).aspx under Client Access Server Connectivity in the Client Access Server section in the following paragraph. Starting with Exchange Server 2007 and current as of Exchange Server 2013, having network devices blocking ports/protocols between Exchange servers within a single organization or between Exchange servers and domain controllers in an organization is not supported.
