Virtual Server - Outlook > Exchange

[Marcde_J]

Please can someone urgently assis.t

I have upgrade to os 7.4 on my 200E.

Created virtual servers for my internal setups.

The Virtual Server for Microsoft Exchange / Email connectivity (HTTPS) works perfectly on mobile (IOS, Android)
But refuses to work on Outlook ? 

No errors in logs etc. Any ideas?

[BK_Bianko]

Hi,

So your guess is that it is a client side issue or default behavior, is it?

Thank you,

Francesco

[smaruvala]

Hi,

Not sure about that. You can check if the x-user-identity has the correct username or not. I am not sure if this is the behaviour or not. But I would suggest you to check on the exchange server for the reason for sending "UnauthenticatedReqeust" message.

Regards,

Shiva

[Marcde_J]

Hi All

To date no solution whatsoever

[smaruvala]

Hi,

Can you try to disable the support for http2 in the virtual server and test if it works correctly?

config firewall vip

edit <virtual_server_name>

set h2-support disable

next

end

Regards,

Shiva

[MikeLa]

I faced to the same issue, 
 we getting this working on FortiOS 7.4.0 
using set http-supported-max-version http1 instead of set h2-support disable 
And enabling full ssl inspection,
here  is a working config sample :

config firewall vip
    edit "_reverse proxy"
        set type server-load-balance
        set extip X.X.X.119
        set extintf "any"
        set server-type https
        set ldb-method http-host
        set persistence http-cookie
        set extport 443
        config realservers
            edit 1
                set ip X.X.X.55
                set port 443
                set http-host "abc.xyz.eu"
            next
            edit 2
                set ip X.X.X.80
                set port 443
                set http-host "mail.xyz.eu"
            next
            edit 3
                set ip X.X.X.80
                set port 443
                set http-host "autodiscover.xyz.eu"
            next
        end
        set http-supported-max-version http1
        set ssl-mode full
        set ssl-certificate "STAR.xyz.23-23.pfx"
    next
end

Regards,
Mike

[fortimaxusa]

Thinking outside the box here. I am just curious if you must use virtual server-type HTTPS (L7 balancer). Exchange 2016/2019 CAS/Mailbox role does not require session persistence because all sessions are stateless. There is no affinity requirement. Do not use NAT in the firewall policy to retain the source IP in the server logs. Finally, virtual servers support up to 5 health-check monitors of any type including the desirable HTTPS independently of the virtual server-type. You probably already configured them for the Exchange virtual directories... looking for "200 OK" response from healthcheck.htm. Why can you not use virtual server-type TCP (L4 balancer) instead and reduce proxy concerns at the FortiGate?