Allowing IMAP to cloud CRM with on premise Exchange

Nolster
New here

Allowing IMAP to cloud CRM with on premise Exchange

Hello all,

 

I apologize in advance if this is a simple answer. I probably am over thinking this issue but thought I would ask before a created a mess.

 

We have an on-premise exchange server. This has the Proofpoint email filter server in front of it for inbound and outbound mail filtering/security. We route all email connections through that service for various security reasons.

 

However, we are implementing a cloud-based CRM (Bitrix24 if it matters). It has built in IMAP capabilities. The wrinkle is that Bitrix has a set of virtual mail servers hosted in AWS. Those servers seem to have dynamic IP addresses (probably as new VMs are spun up). This implementation has shown a seemingly unending list of AWS IP addresses attempting to access our Meraki. There is a pool of five MTA records that tie to IP addresses. (example mta-us-001.bitrix24.com) These records expire every 5 minutes.

 

Currently we have a port forwarding rule to the email server setup allowing specific IP addresses on port 993. I would rather not open access to several AWS A IP blocks. There has to be a method to allow inbound connections using the published MTA records. However, my brain is not helping me here. Thanks in advance. 

3 REPLIES 3
PhilipDAth
Kind of a big deal
Kind of a big deal

I'm having difficulty answering your question because I have fundamental concerns about your overall system.

 

The reason why IMAP is disabled (by default) in services like Office 365 is because of weak authentication.  Something like 99% of account compromises occurs through basic authentication via POP3, IMAP and SMTP authentication.

 

And then, there is the use of on-premise exchange.  One of the most compromised platforms out there.

 

 

If I were looking at the big picture, I would say migrate to Office 365; then you can use the built-in secure OUATH2 support built into Bitrix24.
https://helpdesk.bitrix24.com/open/16697760/ 

 

 

I do not believe you will be able to implement a solution to do what you have described that won't result in an account compromise within 6 months.

 

I wish I had something more positive to offer.

Nolster
New here

Migrating to office 365 is not an option due to various applications requiring on premise exchange. We would love to change to 365, but we would need to revise 60%+ of our business processes due to removal of tools. 

PhilipDAth
Kind of a big deal
Kind of a big deal

What about running hybrid mode?  Keep the mailboxes on-premise for those things that need it, and move everything else to Office 365.

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels