Forefront TMG 2010 EOL Announcement

Today, Microsoft finally announced the discontinuing of most of it’s ForeFront products, including the retirement of products used in many Exchange deployments, ForeFront Threat Management Gateway (TMG) 2010 and ForeFront Protection for Exchange (FPE).

The products to be discontinued are:

  • ForeFront Threat Management Gateway (TMG), including Forefront TMG Web Protection Services (TMG WPS);
  • ForeFront Protection for Exchange (FPE);
  • ForeFront Protection for SharePoint (FPSP);
  • ForeFront Security for OCS (FSOCS);
  • ForeFront Protection Server Management Console (FPSMC).

This announcement is not a real surprise; rumors TMG would cease to exist circulated for months. Using this official statement companies can start adapting their strategies, when they have not already done so, when using one of the products mentioned. When companies were planning to use them in the (near) future, they need to turn to alternative solutions as well, since the these ForeFront offerings will no longer be available for purchase as of December 1st, 2012!

As it stands, mainstream support for TMG will end on April 14th, 2015; extended support for TMG will end on April 14th, 2020. Forefront Online Protection for Exchange (FOPE) will be rebranded as Exchange Online Protection.

First, the hygiene products. This is clearly a move these shift these layers of protection to “the cloud”, which has clear benefits like filtering incoming messages before they enter the organization which is also nice from a bandwidth perspective. However, that’s no solution for the many customers still requiring an on-premise solution which, for example, does store scanning; these customers are forced to tend to to 3rd parties, like McAfee or Symantec. Note that Exchange 2013 will contain basic anti-malware functionality, but I doubt this will meet any customer’s demands and certainly isn’t a very manageable solution.

Next, there’s the firewall, reverse proxy, load balancing and VPN functionality offered by TMG. Currently, many organizations use TMG to publish Exchange and as like many say and know, Exchange and TMG go very well together. For example, TMG can offer pre-authentication or SSL offloading for your Exchange boxes.These customers need to look into VPN like solutions like ForeFront UAG, which is a totally different concept and less straightforward than implementing a TMG in front of your Exchange boxes, or check for 3rd party solutions, like F5 BIG-IP with the Access Policy Manager add-on. Of course, your revised strategy and eligible solutions depend on your business requirements.

Roadmaps of ForeFront Identity Manager (FIM) and ForeFront Unified Access Gateway (UAG) remain unchanged, so publishing Exchange using UAG remains a future-proof possibility.

10 thoughts on “Forefront TMG 2010 EOL Announcement

  1. Thanks for your thoughts on TMG. I have several customers running TMG only to publish Exchange. One downside with LB line big-ip is that it doesn’t offer pre-auth (I guess?).

    How would UAG role in Win2012 compare to TMG? Does it have service check and “loadbalancer”?


  2. Hi, I guess there is a little typo :
    Currently, many organizations use Exchange to publish Exchange
    Currently, many organizations use TMG to publish Exchange

    And bad luck for Microsoft, I guess many companies will go the way to Apache Reverse Proxy solutions that may offer pre-auth, but definitely offers SSL offloading… We’ll have to find solutions quickly!


  3. Pingback: Microsoft Exchange Conference 2012, a Summary | EighTwOne (821)

  4. Pingback: Forefront TMG SP2 Rollup 3 | EighTwOne (821)

  5. Pingback: Forefront TMG 2010 SP2 Rollup 4 | EighTwOne (821)

  6. Pingback: EHLO! | Forefront TMG 2010 SP2 Rollup 4

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.