how to publish owa and anywhere on one ip address and same certificate - UTM 9.3 sg210

With a SAN certificate you are able to use different subdomains and a virtual webserver each.
If you like to use different profiles for the same virtual webserver, you can define one virtual webserver and use different exceptions.
See www.sophos.com/.../120454.aspx

Thank you NvA for your answer i also used this article - How to configure Sophos UTM Web Application Firewall for Microsoft Exchange Services (new!) but still have a error - In Sophos we have two virtual web servers with one public ip address - one for owa and the another for anywhere how can we turn on both virtual servers? we must use one certificate.

I found similar problem in old forum www.astaro.org/275312-post4.html

NvA, I found my error on www.astaro.org/.../53891-utm-9-2-exchange-server-2010-a.html and this two topics (see. below) explained problem

---------------------------- wrote by juve
With Forefront TMG only one SSL certificate is required
With Fortigate only one SSL certificate is required
With Checkpoint only one SSL certificate is required

Why UTM 9.2 require 3 certificates for the same host this is crazy

I must also make 3 DNS A records, modifiy internal and external urls on exchange console to reflect this and reconfigure my iphone fleet

Can I publish my exchange server with only one virtual web server and make a fusion of all firewall profiles o should I sold my product on ebay ?

I think that i'm gonna switch to another brand of firewall

Thanks a lot again for your help
---------------------------- wrote by James@Frasca
I was able to get outlook web access, outlook anywhwere, and active sync all working under a single domain.

Everything needs to be done under 1 virtual server and 1 firewall profile.
The profile just has "pass through outlook anywhere" and "block clients with a bad reputation". I tried a few security checks, but it broke outlook anywhere, even if I turned off the check in the exception rule for RPC.

I made an exception for RPC so it doesn't even check for bad clients, maybe not necessary, haven't confirmed.

The virtual server has
HTTPS & Redirect
Links to exchange profile
Pass Host Header checked
-----------------------------

Hi Sophos2015,

here is a very good howto for the owa/activesync with waf: http://networkguy.de/?p=998
You can also merge the autodiscover and owa/activesync to one WAF Profile.

For me it works fine.

Sophos2015 said:

we must use one certificate.

A SAN (SubjectAltName) certificate is one with more domain names.

I use this (german) tutorial: https://www.frankysweb.de/exchange-2013-sophos-utm-9-3-waf-als-reverse-proxy-fr-outlook-anywhere-owa-activesync-und-autodiscover/

If you don't want to use autodiscover.domain.com (and a second domain name) you should try a DNS srv record for autodiscover. https://support.microsoft.com/kb/940881

_autodiscover._tcp 0 0 443 owa.domain.com will delegate autodiscover to owa.domain.com.

Check with https://testconnectivity.microsoft.com/

Regards Nathan

Hi, NvA could you put link to tutorial again your your link wrong

thanks AndreasRieger I read your howto and I have one question: Do we need create AV exception for OWA rule ? Why we do that?

Hi Sophos2015,
I modified my entry.

why do you want to publish your exchange OWA and OA and Active sync all under one profile? this is not recommended.
but said that, it is possible to combine all of the profiles to single one.