This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

AutoDiscover not working behind WAF on 9.510

I have an Exchange 2010 server deployed behind an SG310 9.510. I have Outlook Anywhere and Autodiscover configured. Outlook Anywhere works, while autodiscover does not. Creating a straight port forward for Autodiscover allows it to work. Microsoft Remote Connectivity Analyzer returns the below.

Attempting to resolve the host name autodiscover.domain.com in DNS.

The host name resolved successfully.

Additional Details

Testing TCP port 443 on host autodiscover.domain.com to ensure it's listening and open.

The specified port is either blocked, not listening, or not producing the expected response.

Tell me more about this issue and how to resolve it

	Additional Details
	A network error occurred while communicating with the remote host. Elapsed Time: 21041 ms.

I configured the virtual web server using the default Autodiscover policies in the firewall.

This thread was automatically locked due to age.

Parents

0 DKKDG over 6 years ago

Hi NickT,

do you followed the guide from Sophos to configure your WAF?
https://sophserv.sophos.com/repo_kb/120454/file/Configuring%20UTM%20firewall%20for%20Exchange.pdf

Best Regards
DKKDG
Cancel
Vote Up 0 Vote Down

Cancel
0 NickT over 6 years ago in reply to DKKDG

I have.

I'm using the boxed Exchange Autodiscover firewall profile.

If I use a firewall profile with no protection, I get an SSL error.

The certificate couldn't be validated because SSL negotiation wasn't successful. This could have occurred as a result of a network error or because of a problem with the certificate installation.

Certificate is valid and properly installed.
Cancel
Vote Up 0 Vote Down

Cancel
0 DKKDG over 6 years ago in reply to NickT

Hi NickT,

which certificate did you use?

Look up in the guide.
There stands that you have to use the exchange certificate instead of the firewall.

Best Regards
DKKDG
Cancel
Vote Up 0 Vote Down

Cancel
0 NickT over 6 years ago in reply to DKKDG

I followed the guide to the letter. I'm getting inconsistent results with the remote connectivity analyzer. It either can't connect on port 443 or cannot handshake SSL.

I have two WAN connections for redundancy and load balancing. There are virtual web servers linked to each WAN connection. I have two A records for autodiscover.domain.com, one for each WAN connection.

It's worth noting that OWA works in this configuration.
Cancel
Vote Up 0 Vote Down

Cancel
0 DKKDG over 6 years ago in reply to NickT

Hi NickT,

do you have any other services on the UTM e.g. User Portal or Remote Access that listen on port 443?

If so change the port of the User Portal or Remote Access.

Keep in mind that changing the remote access port need a configuration update on your clients.

Best Regards
DKKDG
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 DKKDG over 6 years ago in reply to NickT

Hi NickT,

do you have any other services on the UTM e.g. User Portal or Remote Access that listen on port 443?

If so change the port of the User Portal or Remote Access.

Keep in mind that changing the remote access port need a configuration update on your clients.

Best Regards
DKKDG
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 NickT over 5 years ago in reply to DKKDG

I do have other services listening on port 443, but they are listening on different public IPs. We have 2 WAN connections, each with a block of 5 static IPs. I'll double check to make sure there are no conflicts.

Interestingly, OWA works behind the WAF.
Cancel
Vote Up 0 Vote Down

Cancel