This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UTM Webserver Protection and EWS :(

UTM (9.1) seems to have issues with EWS. So it's having issues with all the Mac's/Macbooks in combination with an Exchange server...

I'm running an Exchange 2013 server and everything works fine, all kind of devices synchronize the way they should, iphone/ipad, android, windows mobile, outlook on Windows (2010 and 2013). Update 31-05-2013 11:04; This was a bit over enthusiastic... The Android phones stops synchronizing all of a sudden as well. Solution; shut down Webserver protection, enable NAT rule, let phone sync, disable NAT rule, enable Webserver protection and it's working again... For the time being...

But that is not an EWS issue so, back to the original message; I believe that these products all use Activesync, but...

The email products used on a Mac are using EWS and that is not functioning with the Webserver Protection.
After configuring the account in Outlook 2011 or Entourage (outlook 2008) I get a message like: "Mail could not be received at this time, the server account returned "Login failure: unknown username or bad password."
And it askes if I want to re-enter the password...

But this is BS, because when I turn off Webserver Protection and use a NAT rule, then the error message doesn't appear and Outlook is working fine... That's why I know it has to be something in the Webserver Protection.

Does anybody know what is going on here and how I can solve this, or is this something that Sophos need to look at?

Thanks!
Regards,
Erwin.

This thread was automatically locked due to age.

0 occadmin over 10 years ago in reply to mlawre08

I have put 9.2 on my box over the weekend but haven't had a chance to test it with EWS yet, hoping to look at it today.

Anyone else tried yet?
Cancel
Vote Up 0 Vote Down

Cancel
0 occadmin over 10 years ago in reply to occadmin

Still not working for me, not convinced I have the reverse authentication working correctly and will raise a support ticket.
Cancel
Vote Up 0 Vote Down

Cancel
0 brassardv over 10 years ago

After 2 days having this problem with lync client i decide to check here and found this threads.
Count me in with the lync client outside access with waf enable, asking for credentials.
sometime it work, sometime not.
I made a NAT and for now it working everytime.
Still waiting for a solutions for Lync 2013 vs WAF.
Cancel
Vote Up 0 Vote Down

Cancel
0 occadmin over 10 years ago in reply to brassardv

Looks like its not going to work: The revers authentication in WAF is limited to BASIC only and it looks like Lync requires NTLM.

They are looking into it further.
Cancel
Vote Up 0 Vote Down

Cancel
0 PeterRL over 10 years ago

Thank you for your update occadmin. I´ve following this thread since i also have some customers asking for WAF to publish lync.
Please let us know what support has to say.
Cancel
Vote Up 0 Vote Down

Cancel
0 Punkt over 10 years ago

Hello,

is there something new?
have the same problem and need a solution.
Cancel
Vote Up 0 Vote Down

Cancel
0 isenberg_01 over 10 years ago in reply to occadmin

Looks like its not going to work: The revers authentication in WAF is limited to BASIC only and it looks like Lync requires NTLM.

Please check if Lync really _requires_ NTLM as my guess is, that the Exchange IIS offers NTLM and Basic which is forwarded by the WAF and as via the WAF only Basic is possible, it then fails. See also https://community.sophos.com/products/unified-threat-management/astaroorg/f/57/t/50106
Cancel
Vote Up 0 Vote Down

Cancel
0 occadmin over 10 years ago in reply to isenberg_01

I saw your post a few weeks ago about wget and I get this response back, so I know its enabled.

HTTP request sent, awaiting response...
  HTTP/1.1 401 Unauthorized
  Server: Microsoft-IIS/7.5
  Set-Cookie: exchangecookie=03a95ccf04934973b82b64b222baa016;
ay-2015 16:48:24 GMT; path=/; HttpOnly
  WWW-Authenticate: NTLM
  WWW-Authenticate: Negotiate
  WWW-Authenticate: Basic
  X-Powered-By: ASP.NET
  Date: Tue, 13 May 2014 16:48:24 GMT
  Connection: keep-alive
  Content-Length: 0
Authorization failed.

Basic is enabled and ready for use.  If I use chrome (which doesn't support NTLM), I get the basic prompt and can authenticate.

No update from support.
Cancel
Vote Up 0 Vote Down

Cancel
0 complexxL9 over 10 years ago

We are looking into Sophos UTM as possible replacement for TMG, would be great to see this resolved..
Cancel
Vote Up 0 Vote Down

Cancel
0 NvA over 10 years ago
Hi,
I'm testing with WAF and Exchange 2013.
Is it possible to separate EWS from WAF?
WAF with OWA, RPC, etc. and EWS as NAT Rule.
Set-WebservicesVirtualDirectory -Internal=ExternalURL ews.domain.de/.../Exchange.asmx
Set-OwaVirtualDirectory -Internal=ExternalURL https://mail.domain.de/
...

Seems to need a separate IP or is Sophos able to split different domains?

Regards Nathan
--
just updated my UTM320 to 9.2
Cancel
Vote Up 0 Vote Down

Cancel