Exchange, Firewalls, and Support… Oh, my!

Hello Brian,

thanks for this great post!

I'd have two more detailled questions for which I don't find a specific answer in your post, it would be great if you could answer these:

First: Is the "ANY to ANY between Exchange and DC" rule sufficient if implemented for all DCs of the AD site where the Exchange server is assigned to, or does it need this rule to all DCs of his AD domain, regardless of the site? What about a root domain in a forest, or DC's with forest-wide FSMO roles in another domain as the Exchange Server - Exchange 2003 also wanted some ports open to these?

Second: Is the "ANY to ANY between Exchange server" needed for all Exchange servers between all AD sites? I do understand that it is needed between all Exchange servers in one AD site, and between all CAS-Servers (regardless of site) and between all HUB-Servers (regardless of site). But are connections between Mailbox role servers in different sites (and different DAGs) really needed? Which communication happens there? And between CAS Servers or HUB Servers of one site and Mailbox role servers of another site (when the CAS is not in an CAS array responsible for the Mailbox server, and the HUB is not configured to serve the databases of the Mailbox server)?

Thanks for a short answer for these questions (or pointing me to where I missed the answers)

(sorry if I sent this two times, but the browser lost connection when sending it the first time and I'm not sure now if it is sent)