Exchange Server SE - Load Balancer and Application Gateway Considerations

Question

Hello All,

Do we have any special requirements for Exchange Server Subscription Edition in terms of load balancer (using legacy protocols such as IMAP and POP3) and application gateway (web traffic HTTP and HTTPS)? For example, is a WAF strictly required for Exchange Server SE?. it is disabled in our current settings due to latency and performance issues.

Answer 1

Hi @MJ-1983,

Welcome to the Microsoft Q&A platform!

For Exchange Server Subscription Edition (SE), there are some issues to consider with load balancers and application gateways, especially when using legacy protocols such as IMAP and POP3 and handling web traffic (HTTP and HTTPS).

Load Balancer Requirements

1. Make sure your load balancer supports session persistence (also known as sticky sessions) to maintain consistent connections for clients1. This is critical for protocols such as IMAP and POP3 to ensure that clients remain connected to the same backend server during a session.
2. Make sure your load balancer supports the necessary TLS versions. Exchange Server SE requires TLS 1.2 or higher to establish secure connections.

Application Gateway Requirements

1. Application gateways, such as Azure Application Gateway, provide layer 7 load balancing and support features such as TLS termination, cookie-based session affinity, and URL path-based routing. These features can help optimize and secure web traffic to your Exchange Server SE.
2. While WAF is not strictly required, it is highly recommended to protect against common web vulnerabilities and attacks. If you are concerned about latency and performance, you can consider optimizing your WAF settings or explore alternative solutions that balance security and performance.

Recommendations

1. Ensure that necessary network ports are open for communication between the load balancer, application gateway, and Exchange Server SE. This includes ports for Active Directory authentication and mail flow.
2. If the WAF is causing latency, consider adjusting its rules or using a higher-performing WAF solution. Alternatively, you can selectively enable the WAF for critical endpoints while bypassing less sensitive traffic.

---

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang

Answer 2

I dont think anyone can answer that. It wont be released until later this year and there is no official documentation yet..

However the deployment guidance will apparently be the same as 2019:

https://techcommunity.microsoft.com/blog/exchange/upgrading-your-organization-from-current-versions-to-exchange-server-se/4241305