Setting up Exchange ActiveSync

[HMCTech]

Does anyone have any helpfull guides on how to set ActiveSync up from scratch. So that mobile users may connect to the server through ISA using their mobile phones that have this feature.

[SYNACK]

Really easy with ISA once you have the underpinnings setup, more of a hassle with 2007 though but once your exchange side is setup its pretty much just adding a certificate and following a wizard.

 

Publishing Exchange 2007 OWA, Exchange ActiveSync and RPC/HTTP using the 2006 ISA Firewall (Part 1) (2007)

How to Publish Microsoft Exchange Active Sync (EAS) with ISA Server 2006 (Part 1) (2003)

[HMCTech]

Thanks for those links but they seem to be a bit confusing for me. We publish OWA already over the internet, would I have to add a new certificate for ActiveSync? I am not sure how it should be set up in Exchange first, then IIS & finally ISA.

[SYNACK]

If exchange already works with SSL (https) in your current setup you will probably only need to rerun the publish exchange wizzard in ISA 2004/2006 and select the appropriate checkboxes to allow Activesync, it may have been enabled by default previously anyway. If you have ISA 2000 then you'll need to dust off some history books or see you licensing provider for an upgrade

[HMCTech]

We dont use SSL for OWA, and I have set up another publishing rule for activesync on ISA2006. But still not working, I cant seem to get my head around why.

 

I will go through what I have done hopefully someone can point out a fault

 

Set up a DNS record for mobile.myschool.net

gone into isa set up a publishing rule for exchange 2007, set up non SSL security, internal site name is our exchange server, accept request for mobile.myschool.net then chosen external as the listener and allowed all users.

 

In exchange I go into the activesync tab and on internal URL I changed it from HTTPS to http://HTTP://exchangeserver/Microsoft-Server-ActiveSync

[HMCTech]

nevermind, in trying to get remote access to my isa server from home I restarted the ISA server and now it works.

 

Alex

[armadillo]

Hi guys, I am having the same problem when I try to get the iphone to synch with exchange 2007 to get emails externally. OWA works fine from PCs but not the iphone or a blackberry. We're running ISA 2000 and exchange 2007. Blackberry used to work fine with exchange 2003 but since the upgrade to exchange 2007 it stopped and can't get iphone to work correctly. I am having to forward users’ email instead of connecting the mobiles to mail accounts.

 

I was told that ISA 2000 doesn't fully support Exchange 2007 that's where the problem lies, is it true?

 

I hope you can help with this- Your help is appreciated.

 

Thanks

[HMCTech]

Are you using SSL? If you not remember to configure an Iphone how it should be but the option to turn of SSL is only available once you have saved all the settings.

[armadillo]

Are you using SSL? If you not remember to configure an Iphone how it should be but the option to turn of SSL is only available once you have saved all the settings.

 

Hi, thanks for you reply- yes I have tried disabling ssl but it still didn't work.

[glennda]

Hiya,

 

i have set up the rule for active sync on my isa server, but this is behind out LEA's firewall, does any one know what ports need to be opened to it? or does it use the normal 80/443?

[somabc]

I thought Activesync required SSL?

[glennda]

I thought Activesync required SSL?

 

im not sure, we have outlook web access running over http and the only other port open on our lea's firewall is 443, but i am unsure if that will work, just thought i would ask as i cant test atm as i broke my phone and my boss has walked off with his!

[somabc]

In Exchange 2003 SSL was required for Activesync and I'm sure it's the same in 2007.

[glennda]

In Exchange 2003 SSL was required for Activesync and I'm sure it's the same in 2007.

 

i just checked out exchange box (which works fine internally with activesync) and ssl enabled is set to false, so it might work on port 80. will have to wait untill the boss reappears!

[glennda]

its working over both, just via 443 you need to accept the cert error from our exchange server.

 

Toby

[somabc]

I would look at getting rid of the Cert Error by using the correct Root CA

[glennda]

I would look at getting rid of the Cert Error by using the correct Root CA

 

its only us techies that use the activesync, we would like to buy the cert but there no money!

[HMCTech]

I managed to get it working with iPhones (not tried any others) without SSL

[EduTech]

Also, Remember that with Exchange 2007 a UCC SSL Certificate is required not just a normal cert this is for using ActiveSync, RPC over HTTPS etc

 

I am currently awaiting another IP from our LEA (should be with me sometime this week) so that i can get this setup properly for us, have to use another IP as our current IP has the wildcard on it.

 

When the LEA charge you £710 per IP... it makes things rather difficult

 

James.

[glennda]

Also, Remember that with Exchange 2007 a UCC SSL Certificate is required not just a normal cert this is for using ActiveSync, RPC over HTTPS etc

 

I am currently awaiting another IP from our LEA (should be with me sometime this week) so that i can get this setup properly for us, have to use another IP as our current IP has the wildcard on it.

 

When the LEA charge you £710 per IP... it makes things rather difficult

 

James.

 

£710 per ip, ours just seem to do what we ask them for stuff like that, until u need ports opening on a firewall and they spend forever doing it!!

[EduTech]

£710 per ip, ours just seem to do what we ask them for stuff like that, until u need ports opening on a firewall and they spend forever doing it!!

 

Nope, According to the people that do this for the LEA "Broadband Sandwell" that is the cost and there is nothing we can do about it.. which is a shame as it's a bugger! £230 per year for security maintainence.

 

Basically from what i understand, it is because our LEA choose to use a 3rd Party Company such as themselves who have a centrally managed service from Synetrix and that is what the cost is for the changes to be done by Synetrix and therefore those costs are brought down to the client (us).

 

According to him other LEA's dont charge there schools as they have IT Teams at the LEA and they deal with it that was centrally and dont then pass the costs down to the schools each time they need an IP... which i find rather confussing as my bosses brother who works in a school in Walsall, who dont have a very big IT Team at LEA Level and he gets as many IP's as he basically wants (obviously dont take the mick).

 

So! just have to deal with it..

 

-- note, that £230 security fee per Annum is Per IP Address and as we will now have 3 IP's that is a total of £690 per year we have to pay just for some security checks to get done -- though all of the NAT'd IP's will go to exactly the same LAN Card on our TMG Server.. but again the answer to that is someone could come in after us and change TMG Setup to use mutiple NIC's... -- crazy!

 

James.

Edited February 22, 2010 by EduTech

[glennda]

ours is done by an external company (atomwide) recently i have asked 4 3 sub domains to be set up, which obviously involes 3 seperate addresses and that involes 3 seperate addresses which are NAT into our internal address to the lea. but they havn't charged us a penny for it. but like i say, when you ask for port 443 open aswell as port 80 then they seem to take forever to decide that its okay!!

[ZeroHour]

For exchange 2003 you do not need to have an ssl cert for activesync etc to work. ISA 2004 does need a certificate as will 2006 for any website that is published that requires authentication. For mobile activesync to work on WM based devices you generally need to ensure you have purchased a ssl cert thats based on one of the original mobile root ca providers. We purchase our certs from Geotrust and they are the QuickSSL Premuim as it has been signed by a mobile root ca. iPhones should not have this problem though as I *think* you can opt to ignore a cert error from an invalid ca (aka self signed)

 

Alex do not ever use any auth based service without ssl. Buy a geotrust cert for the web address and install it in isa. Search google for quickssl premium and you can find resellers that will sell the cert for cheap.

[SYNACK]

Running Activesync without SSL is a bad idea as domain passwords and emails will be sent in clear text.

 

For WM devices you don't need a commercial cert as you can easily add a internal domain CA to the the trusted list on the phone so that there is no error. This is how we have all of our gear setup as it means even the smart ones need to come to IT to get devices setup which allows us to do them right.

[HMCTech]

If anyone has got ActivSync working on Exchange 2010 with iPhones please let me know.