Client Access

The Client Access Server (CAS) is installed by default.  Plan to have a Client Access server in each site that has an Exchange 2010 mailbox server.  Your main clients will probably be desktop machines running Microsoft Outlook.  Other client types include POP3, IMAP4, Exchange ActiveSync, Web, and Outlook Anywhere. 

In terms of transition, CAS replaces those front-end servers from Exchange 2003 days.  As expected, CAS also supports OWA (Outlook Web Access) clients.

The Client Access Server also supports Autodiscover.  For those who require internet access, then configure an firewall server to manage the transition across the firewall from internet to internal network. 

Placing Your CAS Server

If your Client Access Server is accessible from the Internet, you need to take precautions.  The crucial decision is whether to locate CAS on the internal network or the perimeter network.  If the decision is close, I would locate the Client Access Server(s) on the internal network.

You must install the CAS role on a member server that has access to a Global Catalog server.  Also remember that the CAS must be able to contact the Mailbox servers inside your Exchange organization.  A ratio of 1 CAS : 4 Mailbox servers works well.  In the case of Exchange organizations with fewer than 500 mailboxes, you could combine CAS with other Exchange roles like the Hub Transport.

Once installed, I would call for the Security Configuration Wizard and listen to its suggestions to lock down ports and disable services that your particular Client Access server deployment does not require.   Only allow access through the external and internal firewall for the essential protocols.

The SolarWinds Exchange Monitor

Here is a free tool to monitor your Exchange Server.  Download and install the utility, then inspect your mail queues, monitor the Exchange server's memory, confirm there is enough disk space and check the CPU utilization. This is the real deal - there is no catch.  SolarWinds provides this fully-functioning product for free, as part of their commitment to supporting the network management community.

Hub Transport (Bridgehead)

The hub transport role replaces the old routing connectors.  Smaller organizations would probably add this role to the Mailbox Server or possibly the Client Access server.  The key point is that even for large organizations, the Hub Server manages the delivery of all internal Exchange 2010 email.  At its heart, the Hub Server has a categorizer, which analyzes each email and delivers it to the appropriate mailbox.

Hub Servers also have a Journaling Agent.  You have the technical ability to save a copy of all email, how much, or how little use you make of this facility is best discussed with your company lawyers.