Outlook2003 behind ISA2006 issue

[harvester]

Hi

Does anyone know how to config Outlook2003 behind ISA2006 to access Outlook Live. I've created access rules & allowed IMAP SMTP POP IMAPS SMTPS from my test client pc. I've tried installing the firewall client but access still fails.

 

How does access perform name resolution?

 

Outlook seems to be using https port 443 to access Outlook Live & it is being blocked! I dom't see any IMAP or SMTP protocols being used.

 

can anyone help

[SYNACK]

Outlook is probably using Outlook Anywhere or RPC over HTTPS to tunnel the outlook communications to the Outlook Live server. Outlook does not use POP3 or IMAP when connecting to an Exchange server but rather its own protocol which for internet use is tunneled through HTTPS.

[harvester]

Thanks for the info,

You think Outlook 2003 is trying to tunnel rpc using https to connect to Outlook Live servers. If I extend to default range of https from 443 & 563 (NNTPS) would this open the ISA to all RPC traffic on our windows network?

[harvester]

Had a similar issue with Outlook connecting to Live@edu through ISA2006, I installed Outlook 2007 with does manage eventually to breakthrough the isa after attempting many different connection methods. Our problem is the client authentication is not being passed to the web proxy service at all.

[harvester]

We have the same issue with ISA2006 & Outlook 2007, it eventually connects to live@edu.

 

Does anyone have an answer why the user authentication is not passed to the web proxy filter. I have tried with & without the firewall client installed & the firewall client settings in ISA "connections tab" set outlook.exe dissable to O & also tried setting it to 1 but still not working??

 

Very frustrating!!

[sukh]

Hi

 

Just clarify what are you trying to do?

 

Are you trying to use Outlook 2007 behind ISA2006 to connect to live@edu?

 

Sukh

[harvester]

Hi Sukh

 

Yep, thats it exactly as you put it in your post.

 

Harvester

[sukh]

So the issue is that the user gets prompted for credentials constantly or it's not working at all?

[harvester]

The user gets prompted for live@edu credentials but thats not a big prob for us as the user eventually authenticates with live@edu through HTTP. But this is only after the traffice passing through the ISA has been denied for various transport methods. eg,

 

This is for the 1st attempt to access pod*****.outlook.com:443 with "SSL-Tunnel"

Client Agent MSRPC

Log type: Web Proxy (Forward)

Status: 995 The I/O operation has been aborted because of either a thread exit or an application request .

 

After 4 or 5 attempts using this it tries:

Client Agent MSRPC

Log type: Web Proxy (Forward)

Status: 12209 The ISA Server requires authorization to fulfill the request. Access to the Web Proxy filter is denied.

 

Then:

Client agent: Microsoft Office/12.0 (Windows NT 5.1; Microsoft Office Outlook 12.0.6529; Pro)

Log type: Web Proxy (Forward)

Status: 302 Moved Temporarily

Request: GET http://autodiscover.DomainName/autodiscover/autodiscover.xml

 

And Phew, that is finally successful

(Hope this helps)

[sukh]

Are you using autodiscover for live@edu. Is this how Outlook is configured?

[harvester]

yes outlook is set to get auto configure , & gets the xml file to config outlook. (thats fine) If I set outlook to authenticate, ntlm or kerberos the login box keeps popping up & authentication fails!!!

[harvester]

hi

Just removed ticks from boxes outlook >MS exchange > security settings for "encryption & user Identification"

That has stopped all the extra traffic being generated but, has it stopped the encrypted connection between the Outlook Client & Live@edu mail box??

[sukh]

Hi

 

I've been given a link which I'd like you'd to see.

 

Forefront Threat Management Gateway 2010 Autodiscover issue - Outlook Live Answers

 

Sukh

[harvester]

Thanks Sukh

 

I'm back in school today & had a look at the url & tried the suggestion which did not work?

[sukh]

Are you still getting the authectication prompts? Are the users eventually going through and getting access?

[harvester]

Yes;

users get the authentication prompts once when they launch outlook then after a few mins they connect & can send/receive emails