Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations SkipVought on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Exchange 2007 / SBS2008 EAS problem. Cannot authenticate with mobile devices!

Status
Not open for further replies.

pmf71

Technical User
Mar 2, 2003
241
0
0
NL
This is starting to give me a real big headache. Been busy on this for days without success.

I am trying to get some android phones to sync with EAS.

Router ports have been opened, no problem there (i checked this in the logs).
I have configured EAS to work with SSL, no success. Phone whines it cannot connect. (even with router port 443 open).
When i configure it for basic auth, the phone says username or password are incorrect. (Yes i made sure i typed them correctly!)

I have gone so far as to uninstall client access role service from Exchange, and even uninstalled IIS 7.
Then reinstalled IIS 7, and reinstalled Client Access. Ran the script that builds the virtual directories.

But Alas, this gave me no pleasure. Still getting the same errors. Funny enough the IIS7 log for EAS gives either a 200 0 0 30 or 200 0 0 40 at the end of each line concerning my phone. From what i have read, 200 means authentication passed (?!?!)

Besides this i have this weird problem of owa only working from local machines. Whenever i try to access owa from outside the lan, no connection (connection timed out) even though port forwarding is set up in the router correctly. Router logs also shows the port (443) is being opened and forwarded correctly. SSL is turned on for owa in IIS.


Please bring it on. Answers, questions, suggestions, whatever you need i will try to provide, but i hope this will give me a solution soon because my customer has been without activesync for quite a while now.

I may seem a bit noob with exchange, and that is correct. I normally work with kerio connect( :) ) but in this case the customer already had exchange when he became my customer...

Any help, whatsoever, will be greatly appreciated!

Thanks in advance,

Paul.
 
Damn this. I just found the cause. Turns out you have to enable authentication on both SBS web applications website AND the virtual directory.

Leaves me with one more issue:


Accessing OWA from the WAN. This still won't work.
 
What do you see when you go to /owa from the WAN?

Normally everything just works when you run the wizards--typically for things to break you have to start changing settings in IIS, or run a bad update.

Dave Shackelford
ThirdTier.net
TrainSignal.com
 
Sorry for the long wait. Busy busy busy

When i try to access OWA from the WAN through https, i get webpage not available. No errors from other side. In other words the OWA website does not respond at all.

Icould check the access log in IIS, if i knew where to look. Maybe you can help me with that.

I have checked the firewall/NAT settings like 10 times, TCP port 443 has been forwarded correctly.

Hope you can give me suggestion. Thanks in advance.
 
When you try to hit your server with the external address, try NOT using the /OWA at the end. Does it load your firewall login page? If so, turn off external access to your firewall or have it listen on an alternate port (like 444 instead of 443).

Dave Shackelford
ThirdTier.net
TrainSignal.com
 
Nope. If only it were that simple. I am very familiar with (NAT)router configurations, I wouldn't be a professional if i hadn't figured that one out (i have completely shut off access to the router WebUI from WAN, i have an IPSec VPN server configured). Nonetheless, it's a valid suggestion. But alas, the problem lies deeper.

Also without /owa, i get a timeout.
 
When you rebuilt IIS 7, did you rebuild the OWA vdir into the SBS Web Apps web site like they are supposed to be, or did you install the vdirs into the Default Web Site? I'm just thinking that you may be in a weird zone by having reinstalled IIS and the CAS role unless you used the SBS-specific scripts to do it. If you did the former and then ran something like the Connect to Internet wizard, I'm guessing that your IIS bindings or the vdir settings may be off.

Dave Shackelford
ThirdTier.net
TrainSignal.com
 
Nope, rebuilt everything in the SBS web applications website.

The weird thing is that all other parts work fine, it's just the OWA that won't respond when a request is done over the internet. Intranet works fine (e.g. accessing from LAN).
 
The place I'd look next are the IIS vdir properties to see if there are restrictions in place that only allow connections from the local subnet, or something in that vdir auth settings which only allow integrated auth and not anonymous. If you only allowed integrated auth, it might prompt for a password or do nothing, whereas anonymous would just allow the page to load.

Dave Shackelford
ThirdTier.net
TrainSignal.com
 
I will look through all setting again. Done it few times already, but maybe i missed something.

Will report back soon.
 
Did you see anything there? I know there is a place where you can set thing to only allow connections from the local subnet, but I think it would be more likely to be the auth settings causing the issue. Especially since you've already found some misconfigured auth settings on this server.

Dave Shackelford
ThirdTier.net
TrainSignal.com
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top