When I follow this article to disable ECP access from the internet, ECP access then no longer works from the server directly via the internal URL say (https://servername/ecp) what's the deal? This isn't a valid solution. I need to disable ECP access to the public internet but still obviously be able to manage my servers internally, how is this done?

http://technet.microsoft.com/en-us/library/jj218639%28v=exchg.150%29.aspx

I would try doing it in IIS Manager. Find the ECP VDir, and look for the IP Address Restrictions module in the middle pane. Trouble is, I don't think it's installed by default anymore in IIS 7 - you will probably need to add it as a role feature.

Hi  ,

If the external access is specify user, you can disable ECP access for the specify user.

How to Disable ECP access to a specific user<//span>:

http://social.technet.microsoft.com/Forums/en-US/exchange2010/thread/a0ac0860-6b20-4e7e-8d67-ab8a8f79ed12/

I have the same issue. When I disable ECP from the internet, it also blocks my internal access to ECP as well.

This was solved by installing a new Exchange 2013 CAS server for internal use only and all ECP traffic is used from the internal only CAS server.  No access to this server is allowed from the internet, therefore our VPN or VMware View connections use internal only traffic to this server, thus allowing ECP to function safely and securely.

Rick Leib, CISSP