Looking at the logs, it's redirecting to autodiscover URL even though I'm not attempting to go there.
2014:12:14-00:00:57 UTM reverseproxy: [Sun Dec 14 00:00:57.466382 2014] [url_hardening:error] [pid 6181:tid 2813307760] [client 10.27.90.158:38613] Hostname in HTTP request (domain.com) does not match the server name (autodiscover.domain.com) 2014:12:14-00:00:57 UTM reverseproxy: id="0299" srcip="10.27.90.158" localip="174.56.87.184" size="229" user="-" host="10.27.90.158" method="OPTIONS" statuscode="403" reason="-" extra="-" exceptions="-" time="4338" url="/Microsoft-Server-ActiveSync" server="autodiscover.domain.com" referer="-" cookie="-" set-cookie="-" 2014:12:14-00:00:57 UTM reverseproxy: [Sun Dec 14 00:00:57.538509 2014] [url_hardening:error] [pid 6181:tid 2804915056] [client 10.27.90.158:58635] Hostname in HTTP request (domain.com) does not match the server name (autodiscover.domain.com) 2014:12:14-00:00:57 UTM reverseproxy: id="0299" srcip="10.27.90.158" localip="174.56.87.184" size="229" user="-" host="10.27.90.158" method="OPTIONS" statuscode="403" reason="-" extra="-" exceptions="-" time="3050" url="/Microsoft-Server-ActiveSync" server="autodiscover.domain.com" referer="-" cookie="-" set-cookie="-" 2014:12:14-00:00:57 UTM reverseproxy: [Sun Dec 14 00:00:57.609804 2014] [url_hardening:error] [pid 6181:tid 3023125360] [client 10.27.90.158:53593] Hostname in HTTP request (domain.com) does not match the server name (autodiscover.domain.com)
I'm new to this (Kind of). Fixing to go back to port forwarding it.
Thanks for doing a great job writing this [:)] - I have tested it out, just tried to fetch mail from my phone, but I get an error and the WAF logs shows this:
I think i found out, you have this under exceptions:
Title: exception for OWA
Skip: Static URL Hardening
Virtual Webserver: “Exchange Autodiscover”
for paths:
/ecp/*
/ECP/*
/ews/*
/EWS/*
/Microsoft-Server-ActiveSync*
/oab/*
/OAB/*
/owa/*
/OWA/*
Advanced: Never change HTML during Static URL Hardening or Form Hardening
Even though you use OTP, it would give good sence to leave out the /ecp /ECP from the WAF, I still cannot see why people want they Exchange Control Panel Exposed to the Web where people can delete and modify AD user accounts [[:)]] - That design by Microsoft still seems odd to me [[:)]]
