Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 2 subscribers
  • Views 8645 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

AutoDiscover not working behind WAF on 9.510

NickT

I have an Exchange 2010 server deployed behind an SG310 9.510.  I have Outlook Anywhere and Autodiscover configured.  Outlook Anywhere works, while autodiscover does not.  Creating a straight port forward for Autodiscover allows it to work.  Microsoft Remote Connectivity Analyzer returns the below.

Attempting to resolve the host name autodiscover.domain.com in DNS.
  The host name resolved successfully.
 
Additional Details
Testing TCP port 443 on host autodiscover.domain.com to ensure it's listening and open.
  The specified port is either blocked, not listening, or not producing the expected response.
   Tell me more about this issue and how to resolve it
 
  Additional Details
 
A network error occurred while communicating with the remote host.
Elapsed Time: 21041 ms.

I configured the virtual web server using the default Autodiscover policies in the firewall.



This thread was automatically locked due to age.
  • 0 in reply to DKKDG

    I have.

    I'm using the boxed Exchange Autodiscover firewall profile.

    If I use a firewall profile with no protection, I get an SSL error.

    The certificate couldn't be validated because SSL negotiation wasn't successful. This could have occurred as a result of a network error or because of a problem with the certificate installation.

    Certificate is valid and properly installed.

     

  • 0 in reply to NickT

    Hi NickT,

    which certificate did you use?

    Look up in the guide.
    There stands that you have to use the exchange certificate instead of the firewall.

    Best Regards
    DKKDG

  • 0 in reply to DKKDG

    I followed the guide to the letter.  I'm getting inconsistent results with the remote connectivity analyzer.  It either can't connect on port 443 or cannot handshake SSL.

    I have two WAN connections for redundancy and load balancing.  There are virtual web servers linked to each WAN connection.  I have two A records for autodiscover.domain.com, one for each WAN connection.

    It's worth noting that OWA works in this configuration.

  • 0 in reply to NickT

    Hi NickT,

    do you have any other services on the UTM e.g. User Portal or Remote Access that listen on port 443?

    If so change the port of the User Portal or Remote Access.

    Keep in mind that changing the remote access port need a configuration update on your clients.

    Best Regards
    DKKDG

  • 0 in reply to DKKDG

    I do have other services listening on port 443, but they are listening on different public IPs.  We have 2 WAN connections, each with a block of 5 static IPs.  I'll double check to make sure there are no conflicts.

    Interestingly, OWA works behind the WAF.

  • 0

    "Outlook Anywhere works, while autodiscover does not."

    What do you see in the Web Application Firewall log when Autodiscover doesn't work?

    Cheers - Bob
    PS I moved this thread to the Web Server Security forum.

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML