Η κύρια σύσταση είναι η χρήση των official white paper στα οποία παρουσιάζεται μια βήμα προς βήμα configuration μέθοδος για το publishing του OWA 2007 διαμέσου του ISA Server 2006. Αντιστοίχως για τον TMG 2010 το official white paper μπορείτε να το κατεβάσετε κάνοντας κλικ εδώ.

2.1. Επιλογές Authentication

Όταν υλοποιούμε το publishing του OWA 2007/2010 διαμέσου του ISA Server 2006/TMG 2010 έχουμε δύο επιλογές για την ρύθμιση του FBA (Forms Based Authentication):

·         Επιλογή 1 (Η πιο συνήθης): Απενεργοποιούμε το Forms Base Authentication στο Exchange OWA side και ενεργοποιούμε το FBA στον ISA Server 2006/TMG 2010 Web Listener.

Εικόνα 1– Authentication properties.

·         Επιλογή 2 (Σπάνια Χρησιμοποιείται): Δεν εφαρμόζουμε το authenticate στον ISA Server 2006/TMG 2010 αλλά χρησιμοποιούμε το Forms Based Authentication στον Exchange Server:

Εικόνα 2 – Η δεύτερη επιλογή για το authentication.

2.2. Θέματα τα οποία αφορούν τα Certificates

Όταν υλοποιούμε το publishing του OWA 2007/2010 μπορούμε να χρησιμοποιήσουμε το SAN Certificate στο
Exchange OWA side. Εντούτοις το FQDN name το οποίο ενφανίζεται στο To Tab στον ISA Server 2006TMG 2010 OWA Publishing rule είναι υποχρεωτικό να ταυτίζεται με το first name στο SAN Certificate όπως ακριβώς απεικονίζεται στην εικόνα παρακάτω :

Εικόνα 3 – Λεμπτομέριες του SAN Certificate. 

3. Θέματα Troubleshooting - Τα πιο πιθανά σενάρια (Το κείμενο είναι στην Αγγλική γλώσσα διότι τα θέματα αυτά έχουν συλλεχθεί από διάφορα forums)

3.1.
I can access the OWA page, authenticate using Forms Base but after the
first authentication I receive another page asking for authentication
again.

Make
sure that you have forms base authentication enabled only on ISA Server
or only on the Exchange. Review the session 2.1 for more information.

3.2. After authenticate on the OWA Forms Base Authentication I receive the error: Target principal name is incorrect.

Make sure that of the following:

·         The name on the certificate that is installed on the Exchange Server matches with the name on the To tab for the OWA Publishing Rule on ISA Server. Review session 2.3 for more information.

·         The Exchange Server name (usually the CAS Server) is correct on the To tab on the OWA Publishing Rule on ISA Server.

·         ISA Server 2006 can correctly resolve this FQDN for the correct IP.

3.3. I cannot even access the OWA Page, when I type the address https://mail.contoso.com on IE I receive the error: 403 Access Forbidden.

When you create an OWA 2007 Publishing Rule only the following paths are allowed by default:

Εικόνα 4 – Default paths for OWA 2007.

When you type https://mail.contoso.com
without use /owa or the other paths that are allowed by this rule it is
expected to receive the 403 since ISA Server is restricting the paths
for security purpose.

3.4. I’m typing the address https://mail.contoso.com/owa on Internet Explorer, I can reach the FBA page, authenticate but after that I’m receiving the error: 404 Not Found.

Make sure that the ISA Server 2006 can reach the Exchange Server that it is using on the To tab. Try to validate using the following methods:

·         From
the ISA Server ping the FQDN name of the Exchange Server that is in use
on the OWA Publishing to make sure that is resolving to the correct IP.

·         Telnet
from ISA Server to the FQDN of the Exchange Server and use the port
that appears on the Bridging tab as show below and see if you receive an
answer (telnet exc2007.contoso.msft 443):

Εικόνα 5 – Bridging Tab.

·         If
all tests succeed then enable logging on ISA Server (ISA Console /
Monitoring / Logging) and create a filter where the source is the
External network. Try to reproduce the problem and check if you see the
error below:

Εικόνα 6 – Failed connection attempt to the Exchange Server (error 10060).

The error 10060 showed above means that the connection timed out. Usually this error means:

·         Connectivity issue between ISA Server and the Exchange Server that is being used by this publishing rule.

·         The ISA Server is sending the package by for some reason the Exchange Server is not replying in appropriate manner.

Review the following:

·         There
is any other firewall in between ISA Server and the Exchange Server? If
it does, can we bypass that? If we can’t bypass, make sure that the
ports are allowed in both ways. Use PortQuery to test that from the ISA to the Exchange Server.

·         A netmon trace on the internal NIC of the ISA and on the Exchange Server might show what is happening.

·         The IIS Logs on the OWA also will help to see if the traffic is hitting the OWA Server.

3.5. I’m typing the address https://mail.contoso.com/owa on Internet Explorer, I can reach the FBA page, authenticate but after that I’m receiving the error: 10061 Connection Refused.

The error code 10061 means: A connection was refused by the destination host.
This error means that ISA Server tried to contact the published server
(in this case the Exchange Server) and this server refused the request
for some reason.

This
usually happens because ISA Server tried to contact the published
server on a port that is not allowed on the destination server. Review
the Bridging tab on the OWA Publishing rule to make sure that this port matches with the port that OWA is using on the IIS web site:

Εικόνα 7 – IIS properties matching with the Bridging tab.

If you also use the ISA Server Monitoring Logging you will see the error below:

Εικόνα 8 – Failed connection attempt to the Exchange Server (error 10061).

For more information about the error code see the ISA Server 2006 Logging Fields and Values article. For TMG 2010 the link is here.

3.6.
I can authenticate on the FBA page, I can see my OWA inbox but I’m
unable to create a new message and the buttons on the toolbar doesn’t
work. Everything works fine internally (bypassing the ISA Server).

Don’t
set your mind to think that if works internally and externally doesn’t
then the issue is on the ISA Server. There are some 3^rd Party ISAPI filters (for example the one mentioned on KB 924228
) that could be installed on the Exchange Server (Backend, FrontEnd,
CAS or Mailbox Server) that can cause this behavior when the traffic
crosses the ISA Server. A more in depth investigation will be necessary
to determine the root cause in this situation.

4. Συμπέρασμα

Όπως αντιλαμβάνεστε, η προσπάθεια στο άρθρο αυτό είναι να παρουσιαστούν τα πλέον συνήθη προβλήματα τα οποία μπορούν να προκύψουν όταν υλοποιούμε το OWA publishing διαμέσου του ISA Server 2006/TMG 2010. Εάν παρόλα αυτά, τα προβλήματα συνεχίζονται καλό είναι σε πρώτη φάση να χρησιμοποιήσετε το ISA Server BPA
και TMG 2010 Server PBA αντίστοιχα, και να ελένξουμε σχοαλστικά μήπως υπάρχει κάποια πρόταση για την επίλυση του προβλήματος και εν συνεχεία να ζητήσουμε την βοήθεια του Microsoft ISA/TMG Support.and check if there is any recommendation on that.