Kerberos authentication from FE to BE

  • From: "ravi" <rrb@xxxxxxxxxxx>
  • To: exchangelist@xxxxxxxxxxxxx
  • Date: Thu, 18 Nov 2004 11:34:05 -0700

In the default exchange 2003 FE/BE configuration, kerberos is used for 
we have our FE in DMZ. we opened UDP/TCP 88 to our domain controllers.
we are seeing some warnings on FE:
Microsoft Exchange Server has detected that NTLM-based authentication  is
presently being used between this server and server 'BE'. NTLM is  still a
secure authentication mechanism and protects users' credentials.  
However, this indicates that there may be a configuration issue preventing
 the use of Kerberos authentication.   If this condition persists, please
verify that server 'BE' is properly  configured to use Kerberos
authentication.  After applying any changes it may be necessary to restart
Internet Information Services on both the front-end and back-end servers.

my question is:
Do we need to open port 88 UDP/TCP from DMZ to Back End server also?

I would greatly appreciate any help,


Other related posts: