Securing OWA in Small Business Server 2008

[WobbleWobble]

I realize that SBS 2008 isn't released yet, but it is available on Technet.

Since SBS 2008 no longer has ISA as part of the package, I'm wondering what is small business supposed to do at reasonable costs? My security hat says it's not a good idea to expose OWA directly to the Internet without a reverse proxy, but setting up a dedicated ISA box is costly. Are there any cheaper solutions to securing OWA?

I do realize that there is Small Business Essentials that does have the Forefront Edge (ISA), but that costs significantly more.

I also believe Microsoft doesn't support putting OWA in a perimeter. But I guess that's a different issue since that would require a separate Exchange and Windows Server license to host that CASE server in a DMZ.

 

[RebateMonger]

Wish I had a good answer. I'm going to miss ISA Server 2004. It was a tremendous bargain in security software as part of SBS 2003 Premium Edition.

Options I've heard discussed include the Netgear VPN Pro series (an inexpensive SOHO router that, at least, reliably works with inbound VPN passthrough), Untangle, and the new Calyptix appliances. I'm migrating my own SBS 2003 Premium Server to SBS 2008 next month and still haven't decided how I'm going to secure my network. I don't have a spare $1000 laying around for this and neither do most small businesses.

 

[WobbleWobble]

I guess I'm going off topic on my own thread...

Since SBS 2008 Std is priced quite a bit higher than SBS 2003 Std, how do you justify to clients that they should get SBS 2008 over 2003? I've only dabbled in each, but where are the actual benefits from client's point of view? Sure SBS 2008 is easier to manage, but that's hard to quantify when small businesses are looking at initial costs.

Exchange 2007 vs 2003? Would be hard for a normal user to really care. The Forefront and OneCare products are only time-limited versions. You don't even get client backup functionality, ala WHS. Windows 2008 versus 2003 from the users point of view? Windows 2003 is pretty solid and does the job.

The only other big pro is that you can do a bare-metal restore with SBS 2008.

I was pretty excited about SBS 2008 being released, but I feel let down. It costs more and doesn't provide much benefit to the user. Lack of ISA just makes it feel like an even worse bundle.

 

[RebateMonger]

Originally posted by: WobbleWobble
Since SBS 2008 Std is priced quite a bit higher than SBS 2003 Std, how do you justify to clients that they should get SBS 2008 over 2003?

It's going to be tough. I was a Beta tester for SBS 2008 and was VERY disappointed to find that MS had dropped the "WHS-like" backups. SBS 2003 was an incredible bargain in both the Standard and Premium Editions, and that bargain, unfortunately, is going away.