For each publishing rule, however, it is recommended to
apply more strict HTTP filtering settings to match the type of traffic that will be used. For
Exchange Outlook Web Access and other Exchange Services, see the table published at the
following Microsoft URL:
http://www.microsoft.com/technet/isa/2004/plan/httpfiltering.mspx
Note that while the article was written for ISA 2004, the filtering settings apply to 2006 as
well.
Enabling the Change Password Feature in OWA Through an ISA
Publishing Rule
If publishing OWA using Exchange Server 2003, by default, Exchange does not display the
Change Password button in Outlook Web Access. This option was previously made available
by default in Exchange 2000 OWA, so many administrators may be looking to
provide for this same functionality.
339
12
Securing Exchange Outlook Web Access with ISA Server 2006
TABLE 12.2 Sample ISA Rule for OWA
Rule Tab Settings
General tab Defaults (Enable)
Action tab Defaults (Allow)
From tab Defaults (from anywhere)
To tab Server field=mail.companyabc.com (hosts file points this to OWA server;
make sure virtual server is set to Basic Auth)
Forward original host header (checked)
Requests come from ISA Server
Traffic tab Defaults (128-bit grayed-out)
Public Name
tab
Websites and IP addresses=mail.
Pages:
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561