This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Iphone connection with Exchange over WAF

Hello,

we have a Sophos UTM9 as a firewall in use. On our server in an Exchange 2010, the company is insalliert. I can login with an Iphone on the Exchange and everything works. When I'm mobile with my iphone the connection works with the Exchange over the established connection NAT properly. Now, I do not want to permanently enable the Exchange to the Internet through NAT, but set up the Exchange about WAF. This has also worked as far as possible, OWA works but the iphone can not connect to Exchange Server. A laptop with Outllook also gets no connection to Exchange, but NAT is equipped with everything.

Do you have any idea why the pure exchange service with WAF does not work?

Greeting KarlWe

This thread was automatically locked due to age.

0 BAlfson over 12 years ago

Hi, Karl, and welcome to the User BB!

Have you tried selecting 'Pass Outlook Anywhere' in the Firewall Profile?

When you connect the iPhone via WiFi to the network with Exchange, does everything work?

Is there anything related to this issue in the Firewall, Intrusion Prevention or Web Application Firewall log files?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
- 0 KarlWe over 12 years ago in reply to BAlfson
  
  Hallo Bob,
  
  thanks for your help.
  
  point 1:
  at enable or disable of 'pass Outlook Anywhere' no improvement.
  
  point 2:
  IPhone works in local network (over Wlan) fine.
  When i enable NAT for Port 443, the Iphone works from Internet (3G) fine.
  
  point 3:
  Intrusion Prevention log is emty.
  WAF log:
  2013:07:30-22:11:36 UTM reverseproxy: [Tue Jul 30 22:11:36.001046 2013] [core:notice] [pid 6379:tid 4148008640] AH00094: Command line: '/usr/apache/bin/httpd'
  2013:07:30-22:11:36 UTM reverseproxy: [Tue Jul 30 22:11:36.001148 2013] [mpm_worker:warn] [pid 6379:tid 4148008640] AH00291: long lost child came home! (pid 9548)
  2013:07:30-22:11:36 UTM reverseproxy: [Tue Jul 30 22:11:36.001227 2013] [mpm_worker:warn] [pid 6379:tid 4148008640] AH00291: long lost child came home! (pid 9550)
  2013:07:30-22:12:09 UTM reverseproxy: [Tue Jul 30 22:12:09.729595 2013] [mpm_worker:notice] [pid 6379:tid 4148008640] AH00297: SIGUSR1 received. Doing graceful restart
  2013:07:30-22:12:09 UTM reverseproxy: [Tue Jul 30 22:12:09.832902 2013] [core:warn] [pid 6379:tid 4148008640] AH00111: Config variable ${URLHardening_HTTP_Hostname} is not defined
  2013:07:30-22:12:11 UTM reverseproxy: [Tue Jul 30 22:12:11.001014 2013] [mpm_worker:notice] [pid 6379:tid 4148008640] AH00292: Apache/2.4.4 (Unix) OpenSSL/1.0.1e configured -- resuming normal operations
  2013:07:30-22:12:11 UTM reverseproxy: [Tue Jul 30 22:12:11.001088 2013] [core:notice] [pid 6379:tid 4148008640] AH00094: Command line: '/usr/apache/bin/httpd'
  2013:07:30-22:12:11 UTM reverseproxy: [Tue Jul 30 22:12:11.001206 2013] [mpm_worker:warn] [pid 6379:tid 4148008640] AH00291: long lost child came home! (pid 9727)
  2013:07:30-22:12:11 UTM reverseproxy: [Tue Jul 30 22:12:11.001283 2013] [mpm_worker:warn] [pid 6379:tid 4148008640] AH00291: long lost child came home! (pid 9732)
  2013:07:30-22:25:26 UTM reverseproxy: [Tue Jul 30 22:25:26.799578 2013] [mpm_worker:notice] [pid 6379:tid 4148008640] AH00295: caught SIGTERM, shutting down
  
  Cheers
  Karl
0 BAlfson over 12 years ago

I realize it's not mentioned in How to configure your Webapplication Firewall for OWA and Active Sync support, but I think you need to start with 'pass Outlook Anywhere' enabled. Watch the reverseproxy Live Log to be certain that the change has been made before trying your test.

Also, the guide does't mention enabling HTML-Umschreibung, so try disabling that in the Virtual Server.

Any luck?

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down
- 0 KarlWe over 12 years ago in reply to BAlfson
  
  Hello,
  
  Sorry I'm writing so late again. Meantime had other tasks had to be done the.
  
  solution:
  Thus, Iphones, MS Outlook from outside can access our Exchange 2010 I have the following values activated. This work.
  
  * Under Virtual Server Type: SSL Port: 443, and HTML rewriting and host header is not enabled.
  * Under Real Web Type: SSL Port: 443 HTTP keep-alive enabled.
  * A firewall profile only 'pass Outlook Anywhere', Antivir and 'not scan content block' is activated.
  
  According to the hardening and URL link How to configure your Webapplication Firewall for OWA and Active Sync support no cookie is resignaturing supported on Exchange 2010. Does anyone know if that will still support because someday?
  
  If I enable "cross-site scripting (XSS) Filter" and or "SQL Injection filter" Outlook Anywhere does not work.
  
  If the Exchange Server so ever apart from Antivir protected against attacks?
  
  Greeting Karl
  Cancel
  Vote Up 0 Vote Down