transitioning Exchange2003 to 2007

[manick]

Hi all,

 

I am halfway through transitioning Exchange 2003 to 2007, and need a little help with regard to the OWA part! we shall say that the 2003 box is called Exch and the new 2007 box is called Exch1. At present Exch has a fixed IP and Exch1 is using DHCP. When I decommission Exch the new box (Exch1) will take on the IP of Exch.

 

The mailboxes that i haven't moved all work fine through outlook and OWA, the mailboxes I have moved work fine with Outlook but OWA is causing me a few problems. The internal URL works but with a certificate error (I shall concentrate on that later), but i am a little confused with regard to the external URL.

 

Obviously at present the external URL isn't working, but what do I need to do in order for it to work?

 

Is it a case of let SWGFL know the name of the new box or will DNS sort out this problem when the IP address is reassigned? This side of helping run a network isn't my forte and all and any help will be much appreciated.

 

regards

 

Manick

[SYNACK]

The hole in the firewall for your email server will almost definitely have been mapped to an ip address rather than a hostname so your exchange box should become accessible from the outside the moment its ip is changed to take over from the old one.

[manick]

I thought that was the case, just wanted it confirming, many thanks for your reply. Right, now I'll crack on with the certificate issue!!!!!

 

Manick

[manick]

OK,

 

I sorted the certificate problem (by turning off SSL!), internally, no problems with OWA and outlook, however, external connections are getting the:

 

'403 -forbidden: access is denied, You do not have permission to view this directory or page using the credentials that you supplied.'

 

error. This page appears instantly as soon as I click on the email link, there is no prompting for a username or password. Obviously I've not got something enabled authentication wise, I can only assume that it is something to do with the IIS server website configuration. Any ideas which setting I need to be changing anyone?

 

Many thanks

 

Manick

[FN-GM]

have you enabled form based authentication? if you haven't i would consider it.

 

Z

[TheScarfedOne]

Which College in Devon are you? We did the migration about 6mnths ago and happy to provide any help :-)

[manick]

Where abouts? on the OWA part of IIS or on the Exchange management console in the client access part (already enabled)?

 

BTW thanks for the help!

[manick]

I'm in Plymouth Stuart!

[FN-GM]

Where abouts? on the OWA part of IIS or on the Exchange management console in the client access part (already enabled)?

 

BTW thanks for the help!

 

When you go to OWA in IE do you get to a login screen similar to this one - https://exchange.sandi.net/CookieAuth.dll?GetLogon?url=%2Femail&reason=0

 

or do you just get a box up prompting for a username and password?

 

edit:

 

do you see this? http://www.apsu.edu/computer/images/EXINFO1.jpg

Edited August 21, 2008 by FN-Greatermanchester

[manick]

Internally I get the login box as in your link (the default Exchange login), trying to access from external I get the error message straight of the bat, no prompts for login.

 

Manick

[FN-GM]

so you dont get a box like this?

 

http://www.unmelted.com/images/password.jpg

 

If you go into IIS, right click default website, go to the security tab then the first edit button on that tab. is allow anonymous access ticked? if no tick that.

 

Z

[manick]

Hi Z,

 

Thanks for this, I am using IIS 7 so the setup is slightly different. Authentication is already set to anonymous access, I have also just set authorisation rules to authentication, I'll give it 5 minutes to filter through and try that, assuming I'm in the right place!

[FN-GM]

Hi Z,

 

Thanks for this, I am using IIS 7 so the setup is slightly different. Authentication is already set to anonymous access, I have also just set authorisation rules to authentication, I'll give it 5 minutes to filter through and try that, assuming I'm in the right place!

 

ah didn't think then, what is the external address for your OWA?

 

If it doesn't work send some screen shots of your security settings in IIS.

[manick]

Hi,

 

I 'm now at the stage where I get the OWA login page, I obviously have to have SSL enabled (previously I'd disabled it to clear the certificate error, probably a schoolboy error, but IIS isn't my thing) in order for it to work, so now I'm back to the issue of the certificate error and also I can't login with my credentials!!, I'm getting there a step at a time.

 

Thanks for your help last night Z.

 

Cheers

 

Manick

Edited August 22, 2008 by manick

[mac_shinobi]

can't you create or use another static ip and make sure that the firewall(s) if any are not blocking it on the relevant ports and get your ISP to allow it external access on those 2 key ports ?

 

also found this - not sure if this is any help or not but thought it was worth while posting :

 

Publishing Exchange 2007 OWA, Exchange ActiveSync and RPC/HTTP using the 2006 ISA Firewall (Part 1)

 

FYI - there are parts 1 ( the first page ) all the way through to part 7 - which you will see when you go to the page.

[manick]

Hi Gecko,

 

The IP I am using was off the old box and was working fine, I have just started getting the external web access working now by the looks of it. The books and all the web sites said this was easy!!!

 

So now it just looks like the certificate issue and outgoing mail isn't working (I've just discovered).

 

I shall look at that link anyway.

 

Thanks

 

Manick

[manick]

OK I was wrong it's gone belly up. Internally users can connect, externally they can't!! Has anyone else got OWA set up on Exchange 2007 using IIS7, if so can you tell me what settings you have in IIS in terms of authentication please!! I'm not using SSL.

 

Many thanks for any help!!

 

manick

[FN-GM]

Please can you send some screen shots of your security settings in IIS, might be just something one of use can spot.

 

What message do you get when you try and connect?

 

Z

[manick]

OK, here goes, rather than screen shots here are the authentication settings that have been enabled.

 

Default web site -Anonymous

EWS - all disabled

Exadmin - all disabled

Exchange - basic and windows auth

exchweb - Anonymous

OWA - Basic

Public - Basic and Windows auth

 

SSL is switched off. In authorisation rules all are set to anonymous.

 

Anything wrong with that?

 

Many thanks

 

Manick

Edited August 26, 2008 by manick

[GlennT]

Hi Manick!

We have just completed the Exchange 2007 transition and had the exact same problem!

Are you using ISA? If so, you should check that the authentication on the OWA rule in ISA matches the authentication type for OWA on your Exchange server. By the looks of things, if you check the ISA rule to make sure basic authentication is in there, you should be ok.

Good luck!

[manick]

Thanks Glenn, However I've started to uninstall and reinstall IIS and CAS and start again.

[GlennT]

OK buddy, good luck!

[manick]

OK, I'm so close i can smell it now!!!!

 

uninstalled and reinstalled CA and IIS, NEARLY everything is working now!! OWA is the only issue I have at the moment, internally no problems at all, externally, it comes up with the login screen, i enter my details, but it comes up with a "The webpage cannot be found" page. Any pointers anyone???

 

Cheers

 

Manick

[manick]

CRACKED IT!!!! it was the auth folder of owa in IIS, it needed authenticated users to have read/write access. Surely this should have worked straight out of the box!!

 

many thanks for everybody who has tried to point me in the right direction!!!

 

regards

 

Manick