Greetings. More of a theoretical question. In a multi site environment, if I was planning an exchange 2010 upgrade / deployment where I would not want any clients accessing mailboxes from the internet, would I still need to deploy CAS in my internet facing site. Basically remote access is achieved via VPN connection back to our network so all clients are essentially part of our internal network.

What do you mean by CAS in your Internet facing site? AD site, physical location? If clients aren't coming in over the Internet at all, then you will just need the hub transport role to get the inbound email in. However if there are clients in that (AD) site, then a CAS server will be required, even if they aren't coming in over the Internet. In that case you just don't open the ports on the firewall. Simon.Simon Butler, Exchange MVP Blog | Exchange Resources

What do you mean by CAS in your Internet facing site? AD site, physical location? If clients aren't coming in over the Internet at all, then you will just need the hub transport role to get the inbound email in. However if there are clients in that (AD) site, then a CAS server will be required, even if they aren't coming in over the Internet. In that case you just don't open the ports on the firewall. Simon.Simon Butler, Exchange MVP Blog | Exchange Resources

yeah our internet facing site is 1) a separate AD site and 2) a separate physical location (a cage in a remote data centre with no users located on site). You've answered my question, thanks

yeah our internet facing site is 1) a separate AD site and 2) a separate physical location (a cage in a remote data centre with no users located on site). You've answered my question, thanks