How to read my Outlook on Pocket PC (from outside the network)?

[lesj1968]

Hi

I am on a network which has Exchange Server 2000. We want to trial the use of mobile devices with Pocket PC so we can access email from outside the network. At the moment we can synchronize our email by connecting directly to the computer. However we want to be able to do this OUTSIDE of the network using IMAP4 (which I believe is the protocol Pocket PC uses).

What settings do I need to imput into the mobile device and what do I need to do on our mail (Exchange) server? We have an ISA 2004 firewall which I have recently configured for Outlook Web Access which all works fine.

The mobile device is called an MPV 500 but I'm not sure this matters - the important thing is it has Pocket PC software on it so should be able to potentially do what we want.

Thank you very much for any help.

Les

 

[tony72000]

Yes, the same external IP address for the server that Exchange is installed on. Is the OWA installed on the same server as well?

You are also correct that only the IP address is used (e.g. 192.168.0.1 etc.)

With regards the SSL connection, have you set up the SSL certificate for each of the vertual servers? (properties, access, secure communication)

Using SSL will change the port for both vitual servers to use 933 for IMAP3 and 995 for POP3.

 

[lesj1968]

Yes I have installed the certificates on each of the servers - not the SMTP as we don't need secure communication on this protocol for outgoing mails. I have ensured all ports (993 for IMAP4 and 995 for POP3). I used the same certificate for each virtual server - the certificate is the same as the one used for the mail server machine. I have also opened listeners on the ISA firewall for all ports involved.

 

[tony72000]

You need to check the address the SSL certificate covers. (Possibly the same address you use for OWA). For example, if you use '

https://owa.yourdomain.com/exchange',

then your certificate will only cover 'owa.yourdomain.com'.

Putting an IP address in your mobile device to access a service that uses this certificate will not work. You may have to change the incoming and outgoing mail servers on your mobile device to 'owa.yourdomain.com', as long as the Exchange server is installed on the same server as the IIS for web access.

 

[lesj1968]

Exchange is on the same server as the IIS for Outlook Web Access. However an outside user would not be able to access Outlook web access by typing in a name such as mail.domain.com into the web browser. Instead the IP has to be entered otherwise it will not work.

By the way the certificates used on all our internal servers are issued by a local CA as opposed to a commercial CA - not sure if this makes a difference though. The "common name" on each certificate on the internal network is the same: "name.domain.com" which is the same as the name of the server where I created the local CA which issues all the certificates. However this name is not what is entered into the web browser to access OWA etc... as mentioned before it is only the external IP address that is entered.

The friendly name of each certificate is different of course, which represents the name the server it is issued to.

If I enter mail.domain.com in the incoming and outgoing mail server fields in the mobile will it still work?

Failing that I will have to make the connection standard, as opposed to secure, which is not something I wanted to do.

 

[tony72000]

When you say "certificates", are you using more than one?

If you type in a web brower address like "

https://192.168.0.1/exchange"

and the certificate is issued to 'mail.domian.com', then the user will see this message "The name on the certificate is invalid or does not match the name of the site".

Email clients need these to match or they will refuse the SSL connection.

Does 'mail.domain.com' revert to your servers external IP address over the internet? If not, you may need to issue another certificate using the IP address as the common name.

 

[lesj1968]

Hi

Yes I am using 3 certificates in total - one for each internal server. Each has the same common name (the name of the local CA). We do get a message coming up on the screen when we try to access OWA saying the certificate does not match the name on the certificate etc - which we expected because we are using the SSL certificates only for company use. I wasn't aware I could put an IP address as the Common Name on the SSL certificates.

When we type the domain name mail.domain.com it does not resolve to the server's external IP address over the internet. We only have it set up as an FQDN for internal DNS. I have tried to contact our web host to see if they can set up an A record to point to the external IP address for mail.domain.com (where "mail" is the name of our Exchange server). However this hasn't been done yet. Will this be vital so we can have something correct to enter in the incoming and outgoing server addresses? I would have assumed the external IP address for our DMZ (i.e the point of entry into our ISA) would be what I enter into the incoming and also outgoing email server addresses - is this correct? I have turned off all SSL authentication to try and get it to work without success.

Thank you again.

 

[tony72000]

It is not vital, but a lot less complicated when giving out these details to users.

Is the external IP address of your server the same as the IP address your users use to get access to OWA? i.e. Multi-homed system with two NIC's and a modem (no router)

 

[lesj1968]

Hi the external NIC IP of our server is different to the public external IP that is used to enter into a browser to bring up OWA (if that's what you mean).

I have checked all ports and removed SSL security but it keeps coming up with the message "cannot download messages to this mobile". So I suspect it could be a possible compatibility problem with the mobile device. However the only solution I have implemented is accessing OWA on the mobile device which seems to work fine - although I'm not sure if you know, but for some reason in the login box it normally asks for network username, password, and domain, I seem to be able to gain access by either typing domain.com OR domain on its own. Why is this?

Thanks again.

 

[Zelandakh]

You see, OWA-PDA would have been so much simpler...it just works.

Or use Exchange 2003 SP2 with push through ActiveSync over GPRS using SSL.