Solved

Exchange2010 +Forefront TMG

Posted on 2011-03-15
6
1,170 Views
Last Modified: 2012-05-11
Hi I got a difficult problem to solve. I am trying to get active sync to work with this setup. Internet -> Cisco ASA5510 > Forefront TMG (workgroup, DMZ) -> Back to Cisco ASA5510 -> Lan (Exchange 2010)

Well the problem is that i get a HTTP 500 From Forefront TMG on testexchangeconnectivity. If i try to put https://mail.domain.se/microsoft-server-activesync i reaches the forefront TMG web portal. If i try to enter the username configured for active sync it refuses it. Forefront tmg is configured with active sync mail publishing rule and an weblistner with a unified communications certificate that is ok. (this is of course on the exchange server aswell). i have tried getting LDAP to work from the Forefront to the domaincontrollers on the LAN and Telnet shows that port 389 aswell as clobal catalog port is open from the forefront server. It is however not open from the domain controllers to the forefront computer. It really feels like it is some LDAP problem and i cannot manage to get it right.. but i am unsure. Anyone have any experience with a forefront in a workgroup (DMZ)
0
Comment
Question by:ptopservicedesk
  • 3
  • 2
6 Comments
 
LVL 10

Expert Comment

by:simonlimon
Comment Utility
i assume you have two ASA's Or are you routing the traffic back to the ASA before it hits the LAN?

Can you try checking the traffic with Logs and Reports, logging tab on the TMG console? What happens with the traffic?

Is the rule configured so that the traffic for the published server appears to have come from TMG and not the Client?
0
 

Author Comment

by:ptopservicedesk
Comment Utility
Yes that is correct, I actually have two ASA:s but it is configured in an active/passive setup so i route the traffic back to the first firewall. Anyway i managed to get it to work regarding manul setup in active sync. the problem was simply that it couldn´t resolve authenticated users with LDAP, so i changed it to all users and it worked

However now i am trying to get the activsync autodiscover to work and have published the rule outlook anywhere in the forefront tmg with 4 green dots when i try the rule.  However it fails at the step

ExRCA is attempting to retrieve an XML Autodiscover response from URL https://x.iaf.x/AutoDiscover/AutoDiscover.xml for user testtest.test@x.se.
  ExRCA failed to obtain an Autodiscover XML response.
   Tell me more about this issue and how to resolve it
   Additional Details
  An HTTP 403 error was received because ISA Server denied the specified URL.

I have used the previous weblistner for active sync which is configured to use login expression Domainname/*

I have changed the autodiscover url aswell as the EWS url similar to this
Set-WebServicesVirtualDirectory -Identity "ptopsrv04\EWS (Default Web Site)" -InternalUrl
Set-ClientAccessServer -Identity “ptopsrv04” -AutodiscoverServiceInternalUri

i have matched them to mail.domain.se since everything else has that name and the weblistner is still using a uCC cert where autodiscover is a subname
 
0
 
LVL 10

Accepted Solution

by:
simonlimon earned 500 total points
Comment Utility
For Autodiscovery you also need an Autodiscover DNS public record registered in your DNS. Also modify the publishing rule on the TMG to allow HTTP domain name of Autodiscover.your.domain besides your owa.your.domain and/or activesync.your.domain.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 10

Expert Comment

by:simonlimon
Comment Utility
http://www.isaserver.org/tutorials/Publishing-Exchange-2007-Outlook-Autodiscover-2006-ISA-Firewalls.html

You can try using this tutorial. It is for ISA 2006, but the concept is the same.
0
 
LVL 16

Expert Comment

by:PaciB
Comment Utility
Hi,

To be able to publish an internal HTTPS server (IIS, OWA, ActiveSync, or any other HTTPS server) TMG must be able to reach the internal HTTPS page without any certificate security alert.

The best way to check that is the following :

1) on the TMG server, ensure that your access rules permit the TMG server to dialog in HTTPS with the internal server. If needed, create a temporay access rule that permit this traffic (from "localhost", to "Internal", allow HTTPS for "All User").
2) From the TMG server, launch IE. Ensure that IE is not configure to use a web proxy.
3) In IE type the URL "HTTPS://myinternalserver/Microsoft-Server-ActiveSync", where "myinternalserver" must excatly match the internal server name you used in the "To" tab of the ActiveSync publishing rule in TMG.

IE should ask for credential or may give an error about unknown page, but YOU SHOULD NOT HAVE A CERTIFICATE SECURITY ALERT !

If you have a certificate security alert then you made a typical misconfiguration : the common name (or one of the alertnate names) of the certificate installed on the internal server must exactly the name you use to reach this internal server from the TMG server.
In some situations where you can not modify the certificate name, you can easily workaround this problem by using the "hosts" file on the TMG server. As an example, let's suppose your internal server has IP address 10.1.2.3 and the certificate on it was created for the name "myserver.mycompany.com", in this case you'll add the line "10.1.2.3   myserver.mycompany.com" in the hosts file on TMG so that the name "myserver.mycompany.com" will be resolve to the internal server IP address. Finally, in the publishing rule, in the "To" tab you will type "myserver.mycompany.com" as the internal server name to publish.

Have a good day.

0
 

Author Comment

by:ptopservicedesk
Comment Utility
Thanks guys for the help, the thing that was missing this time was the autodiscover.domain.se in the paths folder of the publishing rule. The only name that was stated there before was activesync so now i do not get anymore ISA Faults. Thanks
0

Featured Post

Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

There are three types of ISA client that can be configured - these can be individual clients or multiples of a client on each PC or server SecureNAT. A SecureNAT client for ISA server is a client machine, work station or server, that has its defa…
In all versions of ISA Server and the current version of FTMG, the default https protocol uses TCP port 443 and 563 only. This cannot be changed within the ISA or FTMG GUI and must be completed from a Windows cmd prompt on the ISA Server itself. …
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now