I have a Forefront TMG 2010 acting as a reverse proxy:
- I can force HTTP*S* between internet clients and TMG.
- I can force HTTP*S* between TMG and my web servers.
From a security point of view, it is a best practice (correct me if I'm wrong) to force HTTPS between internet clients and TMG. This would allow the reverse proxy to decrypt the traffic and analyse it for attacks. Is this correct?
But what about the traffic in between TMG and the web servers? Would you force it to be HTTPS? If yes, what are the security benefits of doing so?