Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 1 subscriber
  • Views 6611 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WAF on v9.3 for Exchange 2013 on single server/IP/FQDN/certificate?

MrOlrich
Hello all,

Is it at all possible to set up WAF on v9.3 for Exchange 2013 OWA, Outlook Anywhere and ActiveSync on the same URL, on one server, a single IP address, and with the same certificate (with only one server name in it)?

I have tried to follow Sophos' official 9.2 pdf guide, as well as https://www.winsec.nl/2013/10/11/publishing-exchange-utm-web-application-firewall/ (taking note of the exceptions in step 5), but I still can't enable the OA virtual webserver.

"The virtual web server domain name 'External (Address):443:mail.domain.com' is already in use by the domain list attribute of the virtual webserver object 'Exchange Services'."

In https://community.sophos.com/products/unified-threat-management/astaroorg/f/81/t/65746 one Sabine says that "one domain name can only be used once on the same interface and on the same port number. Otherwise the WAF can not distinguish which virtual webserver to use. That is the background of your error message." That seems logical enough, of course, but I was of the impression that with a clever combination of virtual servers, exceptions and site path routings this is indeed possible.

Is it? Or if not, what is needed? Multiple public IPs? Different URLs? An expensive certificate with several server names in it?

Thanks in advance.

SG 115, v9.309-3, Exchange 2013 CU7.

Regards,
Mr Olrich


This thread was automatically locked due to age.
Parents
  • 0
    If you have only a single server, you don't need to add a site-path route.  It sounds like all you need is different Exceptions for OWA, Outlook Anywhere and ActiveSync after having configured a single Filter and Virtual Server.  Instead of that extract, refer to the complete document on the KnowledgeBase: How to configure the UTM firewall for Microsoft Exchange connectivity.  Any luck with that?

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Reply
  • 0
    If you have only a single server, you don't need to add a site-path route.  It sounds like all you need is different Exceptions for OWA, Outlook Anywhere and ActiveSync after having configured a single Filter and Virtual Server.  Instead of that extract, refer to the complete document on the KnowledgeBase: How to configure the UTM firewall for Microsoft Exchange connectivity.  Any luck with that?

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Children
No Data
Unfiltered HTML