timbo343 Posted June 3, 2014 Posted June 3, 2014 Im going to sound really naieve and thick here but i have never had outlook anywhere working on any mobile devices that we own. Ive always told staff to use owa. Anyway, after finding out 9 years down the line i needed a UCC cert ive finally got one with SAN added to it however im still having issues trying to get my devices to talk to the exchange server. Ive got a smoothwall UTM 1000 however im not sure ive got it setup correctly. Is anyone able to advise. Thanks
forkies Posted June 3, 2014 Posted June 3, 2014 The cert needs to have auto discover.domain.com as well (at least that's what I have) Also ports 6002 seem to ring a bell... Maybe google that. Also you need to enable it in exchange... ActiveSync under client access and on each user should be enabled is activesync under the tab called features or something. (Sorry would be more precise if I was looking at my exchange). If the above doesn't help I think I saw a guide when I was setting mine up, will try dig it out. What version of exchange are you running. Also ios6 broke ours so we have had to ban ios6. It kept crashing the info store.
snagrat Posted June 3, 2014 Posted June 3, 2014 Port 6002 is only internal I thought, along with port 6003 and 6004. Only port 443 is needed for Outlook Anywhere from external
timbo343 Posted June 3, 2014 Author Posted June 3, 2014 (edited) The cert has got autodiscover on it. I checked that once i installed it. Not unblocked the 6000 ports yet.. i guess thats done in port fotwarding. Its all enabled in exchange. Ive followed petenetlive guide many a time and also the youtube videos but not getting anywhere Im using exchange 2010 and a smoothwall utm1000 Edited June 3, 2014 by timbo343
timbo343 Posted June 3, 2014 Author Posted June 3, 2014 (edited) Im guessing that the problem is with the smoothwall. Not sure if ive got it setup properly. In port forwarding ive got Protocol = TCP External IP = All Source IP = "my external ip address" Source Port = HTTPS (443) Destination Port = "internal ip address if exchange server" Destination port = HTTPS (443) does that look right? Edited June 3, 2014 by timbo343
glennda Posted June 3, 2014 Posted June 3, 2014 Have you been into exchange server config,client access and enabled outlook anywhere? Smoothwall should have a 443 port forward to exchange and that should be all required on it (unless it is setup as reverse proxy) 1
glennda Posted June 3, 2014 Posted June 3, 2014 Have you run tests from https://testconnectivity.microsoft.com 1
timbo343 Posted June 3, 2014 Author Posted June 3, 2014 Outlook anywhere is enabled. Im thinking it might need a reverse proxy set but might be wrong. As for the test, yep its run and there is an error... Test Steps Attempting to test potential Autodiscover URL https://mydomain.co.uk/AutoDiscover/AutoDiscover.xml Testing of this potential Autodiscover URL failed. Additional Details Elapsed Time: 1651 ms. Test Steps Attempting to resolve the host name mydomain.co.uk in DNS. The host name resolved successfully. Additional Details IP addresses returned: 78.129.xxx.xx - this address is different from the address my mail server is sat on. Elapsed Time: 134 ms. Testing TCP port 443 on host mydomain.co.uk to ensure it's listening and open. The specified port is either blocked, not listening, or not producing the expected response. Tell me more about this issue and how to resolve it Additional Details A network error occurred while communicating with the remote host. Elapsed Time: 1516 ms.
glennda Posted June 3, 2014 Posted June 3, 2014 Ok - that looks like you don't have an autodiscover record public on the internet. What i normally do is have a cname for autodiscover.domain.com pointing to the owaddress.domain.com When you go to https://owaaddress.domain.com/owa do you get your standard OWA login page? 1
timbo343 Posted June 3, 2014 Author Posted June 3, 2014 Yeah, mail.mydomain.co.uk/owa works fine. Just looked at my dns config.. looks like i have autodiscover pointing to my external ip address for mail.myfomain.co.uk but no cname listed for autodiscover.
glennda Posted June 4, 2014 Posted June 4, 2014 Yeah, mail.mydomain.co.uk/owa works fine. Just looked at my dns config.. looks like i have autodiscover pointing to my external ip address for mail.myfomain.co.uk but no cname listed for autodiscover. Ok that should be fine - it doesn't actually matter whether it is a cname or A record (I just use cname as it is only ever 1 to change if IP changes). Essentially do autodiscover.domain.com point to the same as owa.domain.com? I guess activesync works? Are the permissions on all the IIS folders correct? and Authentication types etc? The correct perms are here - Blogs - Exchange Team Blog - Site Home - TechNet Blogs In particular the EWS folder and RPC 1
timbo343 Posted June 4, 2014 Author Posted June 4, 2014 Ive never had activesync working so i wouldn't be able to say. Yep, autodiscover.domain.com and owa.domain.com (in my case, mail.domain.com) both point to the same IP address. Ive had a look at the permissions and there are some differences.. Default Website: I have got Windows Auth added in there as an extra setting Aspnet_client: Windows Auth added in there as an extra setting ECP: Windows Auth added in there as an extra setting Not got SSL ticked EWS: Windows Auth added in there as an extra setting Not got SSL ticked OWA: Windows Auth added in there as an extra setting Not got SSL ticked I think the reason i have got windows Auth added as an extra setting is so that staff dont have to keep logging in to get to their emails. Essentially once they have logged on the machine, they then dont have to authenticate to see their emails however of they were connecting from outside the network they get the username and password box.
glennda Posted June 4, 2014 Posted June 4, 2014 Locally within the Network users shouldn't need to auth anyway it will take the settings from the folder. What happens if you go in a web browser externally (or internally) https://autodiscover.domain.com/autodiscover/autodiscover.xml That should internally show you XMl externally prompt for username/password then show you the xml 1
timbo343 Posted June 4, 2014 Author Posted June 4, 2014 (edited) I can get to https://autodiscover.domain.com/.... Internally it doesnt ask for a username or password, however, when i put the domain admin username and password from outside the network in i get Error code 600 which ive just looked up and that means it is working correctly. Edited June 4, 2014 by timbo343
timbo343 Posted June 4, 2014 Author Posted June 4, 2014 (edited) Just going back to the test analyzer tool... Attempting to test potential Autodiscover URL https://domain.co.uk/AutoDiscover/AutoDiscover.xml Testing of this potential Autodiscover URL failed. Additional Details Elapsed Time: 1592 ms. Test Steps Attempting to resolve the host name mydomain.co.uk in DNS. The host name resolved successfully. Additional Details IP addresses returned: 78.129.xxx.xx Elapsed Time: 194 ms. Testing TCP port 443 on host domain.co.uk to ensure it's listening and open. The specified port is either blocked, not listening, or not producing the expected response. Tell me more about this issue and how to resolve it Additional Details A network error occurred while communicating with the remote host. Elapsed Time: 1397 ms. Am i right in thinking that it is trying to look for port 443 on the 78.129.xxx.xx IP address? If that is the case then the listed IP address for domain.co.uk is our website, not the group of IP addresses where our mail.domain.co.uk resolves to. The IP address our mail server is on is 212.159.159.xx. Shouldnt this test analyzer be looking at autodiscover.domain.co.uk? I know that https://domain.co.uk/autodiscover/autodiscover.xml doesnt exist. Edited June 4, 2014 by timbo343
glennda Posted June 4, 2014 Posted June 4, 2014 Just going back to the test analyzer tool... . Am i right in thinking that it is trying to look for port 443 on the 78.129.xxx.xx IP address? If that is the case then the listed IP address for domain.co.uk is our website, not the group of IP addresses where our mail.domain.co.uk resolves to. The IP address our mail server is on is 212.159.159.xx. Shouldnt this test analyzer be looking at autodiscover.domain.co.uk? There is two ways for it to do autodiscover - via domain.com/autodiscover/autodiscover.xml or via autodiscover.domain.com It almost sounds like it cannot locate autodiscover.domain.com from the internet (although you say this does). Try running the connectivity tool now you have changed the IIS permissions.
timbo343 Posted June 4, 2014 Author Posted June 4, 2014 (edited) I have run the connectivity tool since changing the IIS permissions but to no avail. It is still displaying the same problem. Edited June 4, 2014 by timbo343
glennda Posted June 4, 2014 Posted June 4, 2014 I think the problem is to do with the auth on the IIS default website as when you go to https://mail.domain.com/owa it should take you to the forms based auth login but it cannot due to the default website requiring the auth. It should take you to the page attached rather than prompt with a username/password box. I would set the permissions on all the folders as they are specified in the above link
glennda Posted June 4, 2014 Posted June 4, 2014 Right that looks like the autodiscover is working - you can ignore the "Attempting to test potential Autodiscover URL https://domain.co.uk/AutoDiscover/AutoDiscover.xml Testing of this potential Autodiscover URL failed" and should be working. Run the test again for Outlook Anywhere
timbo343 Posted June 4, 2014 Author Posted June 4, 2014 Ok, after setting all the permissions and changing the login to forms based (so i get the form at login) things still aren't working and the test analyzer tool is giving the exact same information.
glennda Posted June 4, 2014 Posted June 4, 2014 But what does the outlook anywhere test show? There is a seperate test.
timbo343 Posted June 4, 2014 Author Posted June 4, 2014 Oh balls... i selected the wrong one. Will re run it a little later on and report back. Thanks glennda.
timbo343 Posted June 4, 2014 Author Posted June 4, 2014 A little bit of progress I have run the outlook anywhere (RPC over HTTP) and got the results... same password on the zip as before. I have just setup outlook to talk to my exchange at home and it seems to work. Had to authenticate a few times but otherwise its happy. Everytime i open up outlook i need to input my test username and password but i guess that is standard. Now, ive tried to setup my phone to sync emails, however this fails to connect.RPC-HTTPConnect.zip
glennda Posted June 4, 2014 Posted June 4, 2014 A little bit of progress I have run the outlook anywhere (RPC over HTTP) and got the results... same password on the zip as before. I have just setup outlook to talk to my exchange at home and it seems to work. Had to authenticate a few times but otherwise its happy. Everytime i open up outlook i need to input my test username and password but i guess that is standard. Now, ive tried to setup my phone to sync emails, however this fails to connect. Ok - the auth doesn't surprise me (on a domain joined laptop it shouldn't happen), is that autodiscover doesn't work? what happens if you manually put in the server address?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now