Exchange2010 +Forefront TMG

Hi I got a difficult problem to solve. I am trying to get active sync to work with this setup. Internet -> Cisco ASA5510 > Forefront TMG (workgroup, DMZ) -> Back to Cisco ASA5510 -> Lan (Exchange 2010)

Well the problem is that i get a HTTP 500 From Forefront TMG on testexchangeconnectivity. If i try to put https://mail.domain.se/microsoft-server-activesync i reaches the forefront TMG web portal. If i try to enter the username configured for active sync it refuses it. Forefront tmg is configured with active sync mail publishing rule and an weblistner with a unified communications certificate that is ok. (this is of course on the exchange server aswell). i have tried getting LDAP to work from the Forefront to the domaincontrollers on the LAN and Telnet shows that port 389 aswell as clobal catalog port is open from the forefront server. It is however not open from the domain controllers to the forefront computer. It really feels like it is some LDAP problem and i cannot manage to get it right.. but i am unsure. Anyone have any experience with a forefront in a workgroup (DMZ)
ptopservicedeskAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
simonlimonConnect With a Mentor Commented:
For Autodiscovery you also need an Autodiscover DNS public record registered in your DNS. Also modify the publishing rule on the TMG to allow HTTP domain name of Autodiscover.your.domain besides your owa.your.domain and/or activesync.your.domain.
0
 
simonlimonCommented:
i assume you have two ASA's Or are you routing the traffic back to the ASA before it hits the LAN?

Can you try checking the traffic with Logs and Reports, logging tab on the TMG console? What happens with the traffic?

Is the rule configured so that the traffic for the published server appears to have come from TMG and not the Client?
0
 
ptopservicedeskAuthor Commented:
Yes that is correct, I actually have two ASA:s but it is configured in an active/passive setup so i route the traffic back to the first firewall. Anyway i managed to get it to work regarding manul setup in active sync. the problem was simply that it couldn´t resolve authenticated users with LDAP, so i changed it to all users and it worked

However now i am trying to get the activsync autodiscover to work and have published the rule outlook anywhere in the forefront tmg with 4 green dots when i try the rule.  However it fails at the step

ExRCA is attempting to retrieve an XML Autodiscover response from URL https://x.iaf.x/AutoDiscover/AutoDiscover.xml for user testtest.test@x.se.
  ExRCA failed to obtain an Autodiscover XML response.
   Tell me more about this issue and how to resolve it
   Additional Details
  An HTTP 403 error was received because ISA Server denied the specified URL.

I have used the previous weblistner for active sync which is configured to use login expression Domainname/*

I have changed the autodiscover url aswell as the EWS url similar to this
Set-WebServicesVirtualDirectory -Identity "ptopsrv04\EWS (Default Web Site)" -InternalUrl
Set-ClientAccessServer -Identity “ptopsrv04” -AutodiscoverServiceInternalUri

i have matched them to mail.domain.se since everything else has that name and the weblistner is still using a uCC cert where autodiscover is a subname
 
0
[Webinar] Kill tickets & tabs using PowerShell

Are you tired of cycling through the same browser tabs everyday to close the same repetitive tickets? In this webinar JumpCloud will show how you can leverage RESTful APIs to build your own PowerShell modules to kill tickets & tabs using the PowerShell command Invoke-RestMethod.

 
simonlimonCommented:
http://www.isaserver.org/tutorials/Publishing-Exchange-2007-Outlook-Autodiscover-2006-ISA-Firewalls.html

You can try using this tutorial. It is for ISA 2006, but the concept is the same.
0
 
Bruno PACIIT ConsultantCommented:
Hi,

To be able to publish an internal HTTPS server (IIS, OWA, ActiveSync, or any other HTTPS server) TMG must be able to reach the internal HTTPS page without any certificate security alert.

The best way to check that is the following :

1) on the TMG server, ensure that your access rules permit the TMG server to dialog in HTTPS with the internal server. If needed, create a temporay access rule that permit this traffic (from "localhost", to "Internal", allow HTTPS for "All User").
2) From the TMG server, launch IE. Ensure that IE is not configure to use a web proxy.
3) In IE type the URL "HTTPS://myinternalserver/Microsoft-Server-ActiveSync", where "myinternalserver" must excatly match the internal server name you used in the "To" tab of the ActiveSync publishing rule in TMG.

IE should ask for credential or may give an error about unknown page, but YOU SHOULD NOT HAVE A CERTIFICATE SECURITY ALERT !

If you have a certificate security alert then you made a typical misconfiguration : the common name (or one of the alertnate names) of the certificate installed on the internal server must exactly the name you use to reach this internal server from the TMG server.
In some situations where you can not modify the certificate name, you can easily workaround this problem by using the "hosts" file on the TMG server. As an example, let's suppose your internal server has IP address 10.1.2.3 and the certificate on it was created for the name "myserver.mycompany.com", in this case you'll add the line "10.1.2.3   myserver.mycompany.com" in the hosts file on TMG so that the name "myserver.mycompany.com" will be resolve to the internal server IP address. Finally, in the publishing rule, in the "To" tab you will type "myserver.mycompany.com" as the internal server name to publish.

Have a good day.

0
 
ptopservicedeskAuthor Commented:
Thanks guys for the help, the thing that was missing this time was the autodiscover.domain.se in the paths folder of the publishing rule. The only name that was stated there before was activesync so now i do not get anymore ISA Faults. Thanks
0
All Courses

From novice to tech pro — start learning today.