Skip to main content
Alimov
Alimov
New Member
September 18, 2014
Question

publishing OWA, ActiveSync, Outlook Anywhere and AutoDiscover.

  • September 18, 2014
  • 16 replies
  • 43367 views

Hello. Where can I find instructions for publishing OWA, ActiveSync, Outlook Anywhere and AutoDiscover. Myself, I was able to reach only certificates. I added on fortigate root certificate and certificate exchange. Next, I need to publish services. How do I do it. My device - fortigate 100d Firmware - v5.2.0, build0589 Exchange 2010 sp3

16 replies

Show previous replies
oliverlag
oliverlag
New Member
May 28, 2015

actually I'm not using any app ctrl or ips or inspection there. 

I should not need it right? (only if I need to inspect traffic for security reason, but I'm not that point yet)

 

 

AndreaSoliva
AndreaSoliva
New Member
May 28, 2015

Hi

 

as I said only if you are doing ssl-offloading meaning offloading encrypted traffic. Only in this way you are able to look into the TCP header and if you use so you can define if in application header ActiveSync and/or SSL/SSLv2 allow all other ones block. In this way you are sure that only related traffic is going to the Exchange and nothing else meaning nobodiy can inject within https something else. This is this what normaly TMG did and can be done on the FGT but needs some performance and of course certificate from Exchange on the FGT and the public cert from Exchange on the device which connects. Actually it is the same as you use for explicit proxy doing man of the middle but the otherway arround.

 

hope this helps

 

have fun

 

Andrea

oliverlag
oliverlag
New Member
May 28, 2015

Yes Andrea, thanks. 

 

I'm exactly doing like that. I do offload with wanopt and ssl certs exchange (import cert etc etc)

 

Thanks

 

AndreaSoliva
AndreaSoliva
New Member
May 28, 2015

Hi

 

I confirm it works which means do following:

 

# execute update-ips

 

After some minutes check if all versions are up to date (min 6.648 for Attack definition):

 

# get system auto-update versions

 

After that go to your existing profile and open it. Add HTTPS.BROWSER to the ActivSync (you will only find this sig if you enable ALL Categories which is not the case by standard. The HTTPS.BROWSER is in the Web.Others which you can not see by default and which is not activated by default). Activate the profile again in corresponding policy and thats it...is working out of the box.

 

kind regards

 

have fun...

 

Andrea

Baboda
Baboda
New Member
July 3, 2015

Hi,

I still have ISA proxy, so it should be replaced, for publishing sharepoint; OWA, ActiveSync and AutoDiscover for exchange 2010. Is Fortigate a full working solution for that ? or better to use FortiWeb ?

 

ps. We also have windows mobile other then IPhone and Android.

 

FGT 5.0.11

oliverlag
oliverlag
New Member
July 6, 2015

hi!

from my experience FGT 5.2 does not redirect links (for example mail.mycompany.com is not redirect to https://mail.mycompany.com/owa ) and the autodiscover did not work with a lot of android / ios devices. (Indeed TMG fixed the autodiscover needs of filling the domain name and mail server name). 

We had to write internally a plugin to fix all this stuff and migrate to FGT

 

cheaman
cheaman
New Member
July 8, 2015

Just put an index.html redirect in the inetpub/wwwroot/ or your CAS server to redirect like this:

 

<?xml version="1.0" encoding="UTF-8"?> <configuration> <system.webServer> <httpRedirect enabled="false" destination="/exchange" exactDestination="false" /> </system.webServer> </configuration>

 

We are using Exchange 2007 so /exchange in the above code might be /owa or /exchweb for your version. This takes care of the forward for you.

 

oliverlag wrote:

hi!

from my experience FGT 5.2 does not redirect links (for example mail.mycompany.com is not redirect to https://mail.mycompany.com/owa ) and the autodiscover did not work with a lot of android / ios devices. (Indeed TMG fixed the autodiscover needs of filling the domain name and mail server name). 

We had to write internally a plugin to fix all this stuff and migrate to FGT

 

Terms & ConditionsAccessibility statement