Isolating Exchange Server with AMP / OWA still accessible

JuliaMora15110 — Thu, 22 Dec 2022 15:21:52 GMT

Hi there,

We recently isolated an Exchange Server using the AMP Dashboard. However, it appears that the Outlook Web Access (OWA) application that is running from it, was still active and accessible from the internet.

Please clarify if AMP Isolation means all applications and connections to the server should be prevented?

Re: Isolating Exchange Server with AMP / OWA still accessible

ppreenja — Thu, 22 Dec 2022 16:07:09 GMT

Hi Julia,

The endpoint isolation should only allow communication between Windows Connector and Cisco Cloud unless any other communication is explicitly allowed in the "IP isolation allow list".

If the "IP isolation allow list" doesn't have any communication defined to & fro from Outlook then I would request you to please open a TAC case and get the issue further investigated.

Please refer the below Cisco Secure Endpoint user guide for more details:

https://docs.amp.cisco.com/en/SecureEndpoint/Secure%20Endpoint%20User%20Guide.pdf (Pg-122)

Cheers,

Pratham

topic Isolating Exchange Server with AMP / OWA still accessible in Endpoint Security

Isolating Exchange Server with AMP / OWA still accessible

Re: Isolating Exchange Server with AMP / OWA still accessible