email proxy using microsoft exchange 2013 & outlook anywhere · since this is a guide of how to...
TRANSCRIPT
Copyright © 2016 iWebGate. All Rights Reserved.
No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of iWebGate as provided by the explicit terms and conditions of our license agreement.
Basic Rights of Use
Thank you for choosing iWebGate. Registration of your product is required during the installation process outlined in this document. Registration of a single product entitles you to begin using the product for the specific purposes of the product. Additional licensing might be required to use additional features. For more information about iWebGate, visit us at http://www.iwebgate.com.
Trademarks
Microsoft, Windows, Windows NT, and Vista are registered trademarks of Microsoft Corporation. Other brand and product names are registered trademarks or trademarks of their respective holders.
Statement of Conditions
To ensure proper operational function and/or reliability of the product is maintained, iWebGate reserves the right to make changes to the product described within this document, via electronic means or otherwise, without notice. iWebGate does not assume any liability that may occur due to the use, or application of, the product described herein.
Table of Contents
Introduction 4
1. Upload Signed Certificate in VSP 5
2. Configure Folder Proxy in VSP 8
3. Adjust Exchange Server Settings 11
4. Adding and Changing DNS Entries 12
5. Change Outlook Anywhere Settings 13
6. Test Outlook Settings 21
4
Introduction This guide is for those with an on premise VSP used to protect their Exchange server with a
proxy before connecting an Outlook client to the Exchange server using Outlook
Anywhere (RPC over HTTP) via the VSP proxy.
For those with an off premise VSP, please reference Securing Connections with Network
LinkUp Guide.
The steps for establishing a folder proxy with an on premise VSP are:
1. Upload Signed Certificate in VSP
2. Configure the Folder Proxy in VSP
3. Adjust Exchange Server Settings
4. Configure DNS Entry
5. Change Outlook Anywhere Settings
6. Test Outlook
Since this is a guide of how to setup a folder proxy for Microsoft Exchange 2013 server
using Outlook Anywhere, additional information on the VSP can be found in its detailed
manuals.
Requirements:
Functioning Microsoft Exchange 2013 server (SP1)
A PFX format file containing a public certificate, intermediate certificate and
primate key for the email domain
Administrator login credentials to the Virtual Segmentation Platform (VSP) and
Exchange server (if not already configured for Outlook Web Access/Outlook
Anywhere)
Administrator access to DNS records
5
1. Upload Signed Certificate in VSP Log into the Virtual Segmentation Platform (VSP) with your administrator credentials.
Click Certificate Manager on the Administration menu of the Virtual Segmentation Platform
(VSP).
Click Upload Signed Certificate in Certificate Manager.
6
Click Choose File to open File Explorer to select the certificate off your device before
clicking Upload.
Make sure to assign
the certificate by
clicking Assign
It is possible to use the same FQDN as your existing public facing
Exchange Client Access Server (CAS). Export existing certificate/key pair
from the CAS, or choose a new FQDN for the proxy before purchasing a
new certificate for it. The certificate/key pair must be in PFX or P12
format.
.
7
Assign this certificate as the new VSP certificate, by checking Assign and click Save.
After assigning the new certificate, you may need to refresh your browser to continue
your session.
8
2. Configure Folder Proxy in VSP While logged into the VSP, click Proxy LP on the sidebar before selecting Reverse Proxy
from the list.
Click Add in Backends.
10
In the main Proxy menu, click Add in Backends.
Name the new proxy and click the Folder Proxy option under the Type section of the new
proxy.
11
Under Folder Mapping, select Exchange Web Services with RPC and ActiveSync from the
drop-down list under Pre-Configured Folder Maps, and click Add.
3. Adjust Exchange Server Settings This guide uses default identities from a stock-standard installation of Exchange 2013 SP1
on Server 2012. Your identities may be different. To obtain the identity for any of the
commands below, use the Get- form of the Set- command e.g.: Get-OutlookAnywhere
The domain in this example is test.local, the external host name is mail.test.local and the
internal host name is exchange.test.local – change these appropriately. The external
host name is the FQDN of the proxy chosen in Step 2. The internal host name is typically
the Exchange server host name.
On the Exchange server, open Exchange Management Console and configure as
follows:
Set-OutlookAnywhere -Identity "Rpc (Default Web Site)"
-ExternalClientsRequireSsl 1
-ExternalClientAuthenticationMethod basic
-ExternalHostname mail.test.local
Set-OutlookAnywhere -Identity "Rpc (Default Web Site)"
-DefaultAuthenticationMethod basic
Set-OutlookAnywhere -Identity "Rpc (Default Web Site)"
-IISAuthenticationMethods basic
-InternalClientAuthenticationMethod basic
Note existing exchange settings before making any changes.
12
Set-AutodiscoverVirtualDirectory -Identity "Autodiscover (Default Web Site)"
-WSSecurityAuthentication 0
-BasicAuthentication 1
-DigestAuthentication 0
-WindowsAuthentication 0
-OAuthAuthentication 0
Set-OabVirtualDirectory -Identity "OAB (Default Web Site)"
-WindowsAuthentication 0
-BasicAuthentication 1
-ExternalUrl https://mail.test.local/OAB
If Exchange 2013 Service Pack 1 (SP1) or later is installed: Set-MapiVirtualDirectory -Identity "mapi (Default Web Site)"
-InternalURL http://mail.test.local/mapi
-ExternalURL https://mail.test.local/mapi
-IISAuthenticationMethods Basic
If Exchange 2013 Service Pack 1 (SP1) or later is installed: Set-OrganizationConfig -MapiHTTPEnabled 1
4. Configure DNS Entry If choosing to use a new fully qualified domain name (FQDN) for the proxy server, then
you can add it to your DNS and test without danger of disrupting existing Exchange
clients.
If choosing the same FQDN as existing public facing Exchange server for the proxy, you
would need to change the DNS record to point it to the proxy's IP address. However, it is
recommended to first test that the proxy and Exchange server configurations are working
as expected before making a change to the DNS configuration.
To test Outlook on the client PC before changing DNS, put an entry in
C:\Windows\System32\Drivers\etc\hosts on the client PC for the FQDN of the proxy for
testing. Once verified that the configuration is correct, change the DNS and remove the
entry from the hosts file. This allows testing without disruption of existing Exchange clients.
13
5. Change Outlook Anywhere Settings To configure Outlook Anywhere on the client PC, go to Mail Setup to click E-mail
Accounts before clicking New.
Under the E-mail tab, click New to add a new account.
15
Select Microsoft Exchange Server or compatible service and click Next:
Under Server Settings, type the internal host name in the Server field along with the user’s
email address in the User Name field.
16
Click More Settings in the Add Account module.
Click the Connection tab before selecting Connect to Microsoft Exchange using HTTP.
18
1. Set Use this URL to connect to my proxy server for Exchange to the external host
name.
2. Check Only connect to proxy servers that have this principal name in their
certificate and enter msstd:<external host name>.
3. Click the On fast networks, connect using HTTP first, then connect using TCP/IP
option.
4. Using the dropdown menu, select Basic Authentication for the authentication
method needed for proxy server for Exchange before clicking OK.
1
2
3
4
19
After adjusting the Exchange proxy settings, you will automatically return to the Add
Account module; click Check Name.
Enter the user’s email address and password before clicking OK.
20
The server name will be now changed to a long hexadecimal number@your_domain.
Click Next.
Click OK to finish changing outlook settings.
21
The account is now set up to open Outlook and connect to the Exchange server via the
proxy on the VSP. Click Finish.
6. Test Outlook Settings Test that all the features of Outlook work via the proxy. Specifically:
Sending and receiving of mail
Calendar access
Users can be found in the address book
Any additional features