Web server protection: How do I use both port 443 and 993 at the same time?

Question

Hello everyone, 
 I have a mail server I would like to place behind the UTM's Web Application Firewall. I need to open ports 443 (ssl) and 993 (ssl over imap) as our mail server uses both ports. I have no problem setting up the real and virtual web servers to use either port 443 or 993, but I am unable to figure out how to use both ports at the same time. Any pointers? 
 
 Thanks! 
 Scott

traxxus · Accepted Answer

Scott SISCO said: Hi,
 Assuming you definitely meant ssl over imap is not possible through the WAF then I assume I could only forward https (port 443) through the WAF and would have to NAT any connections on port 993 to the mail server through the UTM. This would only then give me access to the UTMs standard firewall for port 993, correct? 
 
 Correct. 
 Make an WAF for OWA/https/443 
 Make an dnat for 993/imaps 
 If you use Microsoft Exchange, it is tunneling (schanneling) imaps over the same SSL/TLS ciphers as HTTPS. 
 
 All client-server protocols in Exchange use the Secure Channel (or schannel) as a security support provider, this is at the Windows OS level and is not Exchange specific. Exchange uses IIS for HTTPS, and that in turn uses schannel. For SMTP, IMAP and POP Exchange now has it’s own protocols, but those also use the schannel configuration. This means that your supported protocols and ciphers list from HTTP traffic is also used by SMTP, IMAP and POP. So just disable SSL v1/2/3 on the IIS for Exchange and you're fine. 
 
 Source: 
 The easiest way to secure the Exchange IIS is this tool: 
 I hope this helps you a bit.

Evianne · Answer

Hi, you have to add two real webservers and two virtual webservers, one for port 443 and one for port 993 each. 
 Then, you configure the virtual webserver on port 443 using the real webserver on port 443 and the virtual webserver on port 993 using the real webserver on port 993. 
 Sabine