?
Solved

Outlook Web App working on internal network but not from an external network

Posted on 2012-03-29
12
Medium Priority
?
663 Views
Last Modified: 2012-06-21
Hello,

I'm setting up an Exchange 2010 infrastructure, and am in the lucky situation of having four Exchange servers.  My company has a single domain and one site.  Two of the servers are running the Client Access Server and Hub Transport roles, and the other two servers are running the Mailbox roles and a DAG.  I'm using Windows Network Load Balancing on the first two servers and a CAS array.  Connecting to https://mail.domain name/owa works fine internally, but I can't get it to work when connecting from an external network - the OWA login page won't display.  I've checked the firewall settings, and been in touch with the firewall provider who has confirmed that the packets are correctly being forwarded to the CAS array.

Can anyone help?
0
Comment
Question by:vphul
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 8
  • 4
12 Comments
 
LVL 17

Expert Comment

by:WORKS2011
ID: 37781836
check FBA (Form Based Authentication) in exchange, open EMC | Server Configuration | Client Access | Outlook Web Access | Authentication | Logon Format.

Do you have SBS or Server environment, IIS will be different in each. Either way if the above doesn't get the logon screen to show we'll move into IIS.
0
 

Author Comment

by:vphul
ID: 37781954
Hello Works2011,

The authentication for Outlook Web App is set to Use forms-based authentication, and Logon format is domain\username.

The servers are running Windows 2008 R2.
0
 
LVL 17

Expert Comment

by:WORKS2011
ID: 37781971
what error do you get from your browser, is it access denied? Please show screen shot or provide info.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 

Author Comment

by:vphul
ID: 37782212
I get Internet Explorer cannot display the webpage.
0
 
LVL 17

Expert Comment

by:WORKS2011
ID: 37782447
have you got all the updates for IE, cleared cache and tried another computer with IE. Could reset as well. Usually if the problem is with IIS you get an HTTP error, doesn't sound like IIS is kicking back the request sounds more like IE not resolving.

None of the errors show up on this page.
0
 

Author Comment

by:vphul
ID: 37782574
I've tried it on my Android smartphone, and it doesn't work on that either when using different wireless networks. There are no error numbers in IE at all.
0
 

Author Comment

by:vphul
ID: 37782676
I've also tried another laptop, and Google Chrome, and still no luck. :-(
0
 
LVL 17

Expert Comment

by:WORKS2011
ID: 37782745
I had an error like this and the problem was with the firewall, IIS errors are often reported with an access denied / http error meaning the content is passed through to IIS, I'm not confident all the data is getting to IIS. As well without the firewall (internal) it's working fine.
0
 

Author Comment

by:vphul
ID: 37786410
Thanks Works2011 for all your advice.  We have Watchguard firewalls, and I'm going to contact Watchguard again about this matter.
0
 

Author Comment

by:vphul
ID: 37832022
Watchguard advised me to run Wireshark on the CAS array servers.  It seems that https traffic from an external network is reaching them, but not being acknowledged.  Please see screenshots of data captured when accessing https://mail.domainname/owa internally and externally.
External.docx
Internal.docx
0
 

Accepted Solution

by:
vphul earned 0 total points
ID: 37842013
I'm pleased to report that this matter has been resolved.

I am using NLB in unicast mode and discovered that you have to enable IP forwarding on the NLB LAN nic on each server.

IP forwarding should be enabled on each cluster member’s NLB LAN NIC.  By default, Windows 2008/2008 R2 disables IP forwarding, which causes problems with NLB.  IP forwarding enabled allows, from an NLB perspective, requests sent from one NIC to be sent out the other.  IP forwarding can be enabled on your NLB LAN NIC by running

netsh interface ipv4 set interface “NLB LAN” forwarding=enabled

 from a command prompt.

Many thanks to

http://info.kraftkennedy.com/blog/bid/102109/Configuring-NLB-for-Exchange-2010-CAS-Load-Balancing

for the information.
0
 

Author Closing Comment

by:vphul
ID: 37859644
By doing lots of research myself, I found the solution.
0

Featured Post

Get free NFR key for Veeam Availability Suite 9.5

Veeam is happy to provide a free NFR license (1 year, 2 sockets) to all certified IT Pros. The license allows for the non-production use of Veeam Availability Suite v9.5 in your home lab, without any feature limitations. It works for both VMware and Hyper-V environments

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lotus Notes – formerly IBM Notes – is an email client application, while IBM Domino (earlier Lotus Domino) is an email server. The client possesses a set of features that are even more advanced as compared to that of Outlook. Likewise, IBM Domino is…
Find out what you should include to make the best professional email signature for your organization.
In this video we show how to create an Address List in Exchange 2013. We show this process by using the Exchange Admin Center. Log into Exchange Admin Center.: First we need to log into the Exchange Admin Center. Navigate to the Organization >> Ad…
The video tutorial explains the basics of the Exchange server Database Availability groups. The components of this video include: 1. Automatic Failover 2. Failover Clustering 3. Active Manager
Suggested Courses

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question