F5/ISA/Exchange

We are working on the same implementation. IMO you would have to put the CAS servers in the DMZ (unless you want to allow inbound INET access to your back-end network) and from our Windows guys, MS states that putting the CAS boxes in the DMZ will not work and is not advised. If you look at this PDF http://download.microsoft.com/download/b/2/0/b20ed7c4-4c29-4e8c-8bce-02f3a7bc0071/ExchangePoster.pdf you will see that the CAS servers have access from the INET and appear to be on the Inside of the network. We are planning on using ISA, behind the LTM with SSL off-loading and load balancing (2 ISA servers) and then put 2 CAS servers behind another VIP for the ISA servers to talk to. At this time, we do not plan on using HTTPS between the ISA and CAS. I am still looking and researching for any and all available methods.

 

-L