April 3, 2011 by Paul Cunningham 22 Comments TweetOne way to make Exchange Server 2010 Outlook Web App (OWA) available for remote users is to publish it using ISA Server 2006.
This diagram provides an overview of how Outlook Web App is published using ISA Server 2006.
The ISA server needs to be configured with an SSL certificate to accept the secure remote access connections.
For more details see this article on exporting an SSL certificate from Exchange 2010 (note that it refers to importing it for Exchange 2003 but the steps are the same for importing to an ISA Server 2006 firewall running on Windows Server 2003). In the ISA Server Management console right-click the Firewall Policy and choose New -> Exchange Web Client Access Publishing Rule.
Set the Exchange version to Exchange Server 2007 (yes this is correct for Exchange 2010 publishing) and tick the box for Outlook Web Access, then click Next to continue. Configure the public names that this rule should accept connections for and click Next to continue.
A list of valid certificates will appear, which should include the one you imported to the server earlier. Leave the authentication delegation set to Basic Authentication and click Next to continue.
Before you click Finish to create the new rule first click on the Test Rule button to validate the settings you chose. Before applying the changes to the Firewall Policy double-click the new rule to open its properties. Now that the rule has been configured we can test it from outside of the firewall using a web browser.
However after logging in the Exchange Server 2010 Outlook Web App interface will be available to the remote user.
TweetTutorials Exchange 2010, ISA 2006, OWAAbout Paul CunninghamPaul is a Microsoft MVP for Office Servers and Services, specializing in Exchange Server and Office 365, and is the publisher of Exchange Server Pro. Publishing Outlook Web App with ISA 2006 is a quite strait forward and easier because you can test it directly.
I’m not 100% sure about the correct setting for these 3 directories so I wanted to double check with you guys! I guess, the question remains, are these paths (Exchange, Exchweb and public) necessary on a Exchange 2010 environment?
The Mailbox Replication service was unable to determine the set of active mailbox databases on a mailbox server. Next day I had just started all above mentioned services at (exchange server 2 with no Sp1). Can you let me know if there is no problem I can uninstall or remove from control panel (exchange server 2 with no Sp1) exchange server from exchange environment (exchange server 2 with no Sp1 has no mailbox at its databases), and will it not effect to main exchange server 2010 sp1 (HT,CAS, mailbox). I have a issue i have exchange 2007 and isa 2006 everything was working fine suddenly when i try to login through browser to exchange in internal lan i cannot go through where as when i try it i get the login screen and i can login and browse mails. In this article, we begin with a short introduction to Server Publishing Rules and discussed the differences between Web Publishing Rules and Server Publishing Rules. In the first eight installments of this series of articles, we focused on the web publishing feature included in the TMG firewall. A major difference between Web Publishing and Server Publishing is that Web Publishing is more complex. In contrast, Server Publishing is more like reverse NAT, where the connection is terminated at the TMG firewall and the only change to the request is the replacement of the source IP address.
Server Publishing can actually be used instead of Web Publishing for HTTP, HTTPS and FTP connection.
In general if you are publishing web sites, you should use Web Publishing Rules because they afford you a much higher level of application layer inspection and authentication and authorization.
Note that there is nothing to prevent you from getting a higher level of security for your Server Publishing Rules.
Let’s begin our discussion of Server Publishing by taking a look at how you create a simple Server Publishing Rule.
You start creating a new Server Publishing Rule by clicking the Tasks Tab in the Task Pane.
On the Welcome to the New Server Publishing Rule Wizard page, enter a name for the Server Publishing Rule in the Server Publishing Rule Name text box. On the Select Protocol page, shown in Figure 3, you are offered the option to select the protocol you want to publish. Another place where you can see all the available Server Publishing Rule protocols is in the Toolbox tab of the Task Pane, which is shown in Figure 4. On the Network Listener IP Addresses page, you can select which network and which IP addresses you want users to connect to when they make a call to your published server.
You can get more granular regarding which IP address you want the listener to use by clicking the Address button.
On the Completing the New Server Publishing Rule Wizard page, shown in Figure 6, you are provided with a summary of the options you selected for the rule. In this article, we began with a short introduction to Server Publishing Rules and discussed the differences between Web Publishing Rules and Server Publishing Rules. DEBRA LITTLEJOHN SHINDER, MCSE, MVP (Security) is a technology consultant, trainer and writer who has authored a number of books on computer operating systems, networking, and security. Cloud Admin CON is a cost-effective, convenient opportunity for busy System Administrators and IT Managers to stay up to date on the most recent industry trends and vendor solutions and build their network of IT experts and vendors. TechGenix Ltd is an online media company which sets the standard for providing free high quality technical content to IT professionals. A fair few of my working ISA Server and Forefront TMG deployments are used to publish and protect SharePoint environments. I currently work as a Senior Security Consultant for Microsoft Consulting Services (MCS) in the UK.
Forefront TMG Enterprise Edition introduced the concept of a new array called the Standalone Array. In this article, I’ll walk you through enabling forms-based authentication for external and internal Outlook Web App 2010 (OWA 2010) users where Exchange 2010 is published using Forefront TMG 2010. In this part 5 which is the last in this multi-part article, we’ll continue where we left of in part 4. So in order to create the web farm publishing rules, log on to one of the servers in the Forefront TMG 2010 stand-alone array in the primary datacenter, and then launch the Forefront TMG console. On the “Select Services” page, select “Exchange Server 2010” in the drop-down box and then check “Outlook Web Access”. On the “Publishing Type” page, select “Publish a server farm of load balanced Web servers” and click “Next”.
On the “Server Connection Security” page, select “Use SSL to connect to the published Web server or server farm” and click “Next”. On the “Internal Publishing Details” page, type the internal FQDN in the “Internal site name” box and then click “Next”. On the “Welcome to the New Server Farm Wizard” page, enter a meaningful name for the new Exchange Server farm (such as Exchange 2010 CAS Farm). On the “Servers” page, we need to add the Exchange servers that should be part of the Exchange Server Web farm (Figure 9). The Exchange 2010 CAS Farm in the primary datacenter should consist of “EX01” and “EX03” so we’ll add those. On the “Public Name Details” page, make sure “This domain name (type below) is selected in the “Accept requests for” drop-down menu.
Now we need to create a new web listener to be user with the Exchange Web farm publishing rule.
On the “Client Connection Security” page, make sure “Require SSL secured connections with clients” is selected and click “Next”. On the “Web Listener IP Addresses” page, check the extenal network or if you have multiple IP addresses associated with this network, select one of those.
Select the respective certificate and make sure it’s installed on both TMG 2010 servers as shown in the bottom of Figure 22 then click “Select”. On the “Authentication Settings” page, make sure “HTML For Authentication” is sleected and there’s a bullet in “Windows (Active Directory)”. Since we want to enable single sign on for all published Exchange services and web servers using this web listener, check “enable SSO for Web sites published with this Web listener” then enter the domain name in the “SSO domain name” textbox.
Note:The authentication delegation you select here depends on the configuration on the OWA and ECP vdirs on the published Web Site and what authentication method you want to offer to your external OWA and ECP clients.


With the new Web Publishing rule created, open the property page for this new rule and click the “Paths” tab. Now click on the “Test Rule” button to verify that the new Web Publishing rule works as expected. Now repeat the above steps on one of the servers in the Forefront TMG 2010 stand-alone array located in the failover datacenter.
Important:If you’re doing the load balancing using a TMG 2010 web farm publishing rule and your environment is running in Hyper-V, you need to enable MAC Spoofing on the TMG 2010 virtual machines. Henrik Walther is a respected writer with special focus on Microsoft Exchange and Office 365 solutions.
This information-packed event is presented by MSExchange.org and is designed for busy IT Professionals within the global MS Exchange and Office 365 Community, as a convenient and cost-effective opportunity to get the latest information on important Office 365 and Exchange topics from leading experts and vendors. As companies begin relying more on Skype for Business for their communications and application delivery, performance and reliability become paramount.
How hardware load balancing can provide better monitoring and availability of front-end and edge server pools. The new Citrix SD-WAN solution that can ensure quality through unique QoS and path selection technologies for MPLS, DSL and Internet.
How performance for audio and video can be enhanced for virtually deployed desktop Skype clients. This week, we continue our series of articles on TMG firewall basics for all those new TMG administrators I’ve been hearing from, by covering the basic elements of web publishing. To introduce you to the web publishing process, let’s start with publishing a simple HTTP site located behind the TMG firewall.
To start, click on the Firewall Policy node in the left pane of the TMG firewall console, as seen in Figure 1 below.
On the Select Rule Action page, as shown in Figure 4, you can configure the rule to Allow or Deny the connection. On the Publishing Type page, shown in Figure 5, you select one of three scenarios that match your web server environment. On the Server Connection Security page, shown in Figure 6, you must select whether or not the TMG firewall will need to use SSL to connect to the web server. On the Internal Publishing Details page, shown in Figure 7, you are asked to define the name of the server on the intranet. On the Internal Publishing Details page, shown in Figure 8, you can enter a path to limit users to accessing a specific file or folder on the web server.
On the Public Name Details page, shown in Figure 9, enter the name of the web site that the users will access. On the Select Web Listener page, shown in Figure 10, select the web listener that will be used to accept connections from external users to access the web site. On the Client Connection Security page, shown in Figure 12, you must specify whether or not you want external users to use SSL to connect to the TMG firewall. On the Web Listener IP Addresses page, shown in Figure 13, select the network on which you want the TMG firewall to accept connections to the web site. On the Authentication Settings page, shown in Figure 14, select the type of authentication that will be used to connect to the TMG firewall to access the site. On the Single Sign On Settings page, shown in Figure 15, you can configure the web listener to support single sign-on for all sites publishing through this web listener. On the Authentication Delegation page, shown in Figure 18, you configure how the TMG firewall delegates credentials to the published web site. On the User Sets page, shown in Figure 19, select which users or groups are allowed to access the published web site.
We’ll review the settings on the Completing the New Web Publishing Rule Wizard page that’s shown in Figure 20, and then click the Test Rule button. The Test Rule button allows you to see whether the web site is reachable from the TMG firewall. The Configuration Change Description dialog box, shown in Figure 23, appears and you can enter a comment about the change you made in firewall policy.
The configuration is now saved and you can see the results in the Saving Configuration Changes dialog box shown in Figure 24.
I too get similar two auth like Jorge, Is there a simple way other than creating second owa directory ? We had also two exchange servers 2010, main exchange server (exchange server 1) had role (CAS, HT and mailbox) with sp1 and other exchange 2010 (exchange server 2 with no Sp1) who had only mailbox role. Yesterday I had unmounted databases at exchange server (exchange server 2 with no Sp1) and stop the exchange services include exchange AD topology service, www publishing service and Net. At (exchange server 2 with no Sp1) did not initialized the exchange management console because (exchange server 1 ) is installed sp1 of exchange server, but (exchange server 2 with no Sp1) is has no exchange SP1.
Having said that, I do have to admit that there have been times when I just wanted something “to just work” and used a Server Publishing Rule instead of a Web Publishing Rule. In this example, we’ll do an FTP Server Rule and name the rule FTP Server, as shown in Figure 2. If you click the drop down arrow in the Selected Protocol section, you’ll see a number of protocols that were included right out of the box.
After you select the protocol you want to publish, you can change the properties of the protocol. If you select this option, you can change some of the characteristics of the protocol, such as on which port the Server Publishing Rule will listen and to which port it will forward the connection on the published server. Once you understand how the options work, you can then use the Properties, Ports and New options when you are going through the wizard so that you won't have to go back into the Properties of the Server Publishing Rule to modify it after you have finished creating it. Here you can see all the available Server publishing protocols and you can see the details of each of them.
Use this option if you want the Server Publishing Rule to listen on all IP addresses assigned to the NIC for the network. If Network Load Balancing is enabled for this network, the default virtual IP address will be used. If you select this option, you can choose the specific IP addresses on which you want the TMG firewall to accept connections for the Server Publishing Rule. Notice that the Server Publishing Rule Wizard does not provide a Test button like the one you saw for Web Publishing Rules. We observed that Server Publishing Rules are much less sophisticated than Web Publishing Rules and work more like reverse NAT than like proxy connections.
Individual focus sessions are scheduled to run consecutively, allowing you to attend all sessions, or selectively choose only those you wish to attend. My blog aims to provide "notes from the field" in addition to covering general Microsoft Edge concepts, best practice and my view on everything Edge.
This position involves providing design, architectural and technical consulting to Microsoft's customers and partners. In addition, I described the Forefront TMG 2010 solution deployed in this specific lab environment. We’ll create the Forefront TMG 2010 web publishing rules required to make OWA and ECP accessible from an external network. If the TMG servers are not domain-joined, you should select “LDAP (Active Directory).Click “Next”. We should be presented with the OWA 2010 FBA Logon page and we will also be able to see that this is the FBA page from Forefront TMG 2010 as it will say “Connected to Microsoft Exchange Secured by Microsoft Forefront Threat Management Gateway” unlike the OWA 2010 FBA logon page on an Exchange 2010 CAS server which just says “Connected to Microsoft Exchange”.
Web publishing is the term we use for reverse proxy to web sites so that external users can access web sites located behind the TMG firewall. In this example, we want to publish a single web server that is located behind the TMG firewall, so we’ll select the Publishing a single Web site or load balancer option and click Next. In this scenario, we will not require SSL between the TMG firewall and the web server, so we’ll select the Use non-secured connections to connect the published Web server or server farm option. In this example, however, we want to allow access to the entire site, so we’ll not enter a path. In our example, there are no web listeners set up yet, so there are none to choose from in the drop-down box. Here we’ll enter a name for the web listener in the Web listener name text box (we are using the name HTTP Listener) and then click Next. In this example, we want to publish a simple HTTP site, so we’ll select the Do not require SSL secured connection with clients and click Next.
In most cases, when you publish a web site to external users, you will select the default External Network to accept the incoming connections.


This type of authentication is often referred to as “pre-authentication” since the user actually authenticates with the TMG firewall before authenticating with the web server.
Here we’ll review the settings on the Completing the New Web Listener Wizard page and click Finish. The new web listener now appears on the Select Web Listener page that’s shown in Figure 17, and you can see some of the details of the Web Listener. This means the user will only need to authenticate once with the TMG firewall instead of having to enter credentials to authenticate with the TMG firewall and then enter them again to authenticate to the published web server.
In order to enable this option, you have to require that the users authenticate so that they can be identified. As you can see in Figure 21 below, when you click the Test Rule button TMG will try to connect to the web server using an HTTP connection and it also does a PathPing to the web server.
The TMG firewall stores this information so that you can use this as a part of your change management system, to help with troubleshooting in the future. Note that it says that existing client connections will be reevaluated according to the new policy.
In contrast, the other way you can make internal servers available to others through TMG is by using the Server Publishing feature. When a user connects to a web site using Web Publishing, the connection is terminated at the TMG firewall and then the TMG firewall may perform some actions on that request.
For example, you cannot perform pre-authentication on incoming connections when you use Server Publishing. However, there are scenarios where you might want to publish on an IP address that is not on, or is in addition to, the External Network. If you have multiple IP addresses assigned to that NIC, then all the IP addresses can accept connections for the protocol you select and each of them will forward the connection to the published server.
Therefore, if you want to test the rule, you’ll need to find a client that can connect to the published server after you have created the rule and saved the configuration to the firewall.
However, we also saw that the TMG firewall will perform a certain level of application layer inspection or at least basic protocol validation if there is a filter associated with the server publishing protocol.
Microsoft Edge currently includes the Forefront Threat Management Gateway 2010 (TMG), Forefront Unified Access Gateway 2010 (UAG), Windows DirectAccess and Forefront UAG DirectAccess; legacy ISA Server information is covered in my 'Me, Myself and ISA' blog. In the context menu select “New” > “Exchange Web Client Publishing Rule” as shown in Figure 1.
Note that there are actually two ways you can make web sites available to external users: web publishing and server publishing. In the future, we’ll go through some more complex examples, in which you can use SSL and authentication.
In the Web publishing rule name text box, for this example we’ll enter the name HTTP Web Server and then click Next. The Deny option is used for special use cases; you more typically are going to create web publishing rules that allow connections to a web site behind the TMG firewall. You also have the option here to enable the Use a computer name or IP address to connect to the published server checkbox and then enter another name or IP address of the server. To do this, select the This domain name (type below) option from the Accept requests for drop down list. If you have multiple IP addresses bound to the external interface, you can click the Select IP Addresses button and then select the specific IP address that you want to accept the connections; in most cases you’ll want to do this instead of accepting connections on all the IP addresses that might be configured on the external interface of the TMG firewall. In this example, we will not require authentication so we’ll select the No Authentication option and click Next.
Since we’re not requiring authentication in this example, single sign-on is not applicable, so we’ll move on and click Next. In this example, we’re not requiring authentication so there’s no reason to delegate any credentials, thus we’ll select the No delegation, and client cannot authenticate directly option and click Next.
Since we’re not requiring authentication in this example, we’ll use the default group, which is All Users.
As you can see in the figure, the TMG firewall was able to connect to the web server and the PathPing was successful. Using this dialog box, you can also export the configuration of the firewall so that you can restore the configuration to where it was before you made this change. This is new with the TMG firewall – with the ISA firewall the firewall policy only applied to new connections.
At the end of rule creation, we used the test button to determine whether the web site was reachable.
When I had stopped these services I got warning at our main exchange server (exchange server 1 with sp1) (Microsoft exchange mailbox replication and still getting warning until I had started services at (exchange server 2 with no Sp1).
Server publishing enables you to publish any protocol using the built in protocols or you can use protocols that you can create yourself.
When the TMG firewall has finished doing whatever it needs to do with the request, it recreates the request, which actually represents a new request, and sends that to the published web server. However, there are a few built-in Server Publishing protocols that will do some protocol inspection to make sure that the connection request isn’t corrupt or that someone isn’t trying to do something to compromise your server.
However, sooner or later I get around to fixing the configuration and publishing the services correctly by using a Web Publishing Rule. However, things have changed a bit with the TMG firewall, and it is different from the way the default IP address was defined by the ISA firewall. After this discussion, we then ran through the Server Publishing Rule Wizard and created a simple Server Publishing Rule for the FTP to protocol.
Lastly, I talked about why it usually is a better idea to publish the Exchange 2010 servers rather than the load balancers via Forefront TMG 2010. Web publishing enables the TMG firewall to act as a reverse proxy, while server publishing makes the web server available through reverse NAT. This allows the TMG firewall to locate the server if it’s using a different name than the one you enter in the Internal site name text box. After selecting that option, enter the name that users will use to access the site in the Public name text box. In this example, we only have one IP address on the external interface, but we’ll select that specific IP address just in case we add more IP addresses to the external interface in the future.
In the context of the TMG firewall, “all users” doesn’t mean all authenticated users; it actually means “anonymous users” – so when you allow “all users” access, you are actually allowing users who do not authenticate to access the site. In the next article in this series, we’ll create an SSL web site that requires authentication. However because they face the internet directly (over a not very stable network link), we want to reduce the attack surface and do load balancing using an ISA server in front. You can publish simple protocols (those that require a single port to imitate the connection) or complex protocols that require that multiple ports and for which callback are required, such as the RPC protocol.
However, some people actually prefer to use Server Publishing over Web Publishing for SSL sites because it is much more simple in some SSL publishing scenarios (such as Microsoft Exchange) than Web Publishing. However, there are some that are dedicated to some security functions related to the protocol.
In that case, you would include the Internal Network (or some internal network) as a network that would be listening for connections that would be subsequently forwarded to the published server in the DMZ segment.
For more information on how the TMG firewall defines the default IP address, check out this link.
In the next article in this series, we’ll take a look at the details of the Server Publishing Rule and look at some of the options that are available to you, by which you can customize the protocol and some other characteristics of how the Server Publishing Rule works.
Web publishing is the preferred method, because with it, you can take advantage of pre-authentication and many other features that aren’t available with reverse NAT.
This will expose you to some of the more advanced options that are available to you when creating web publishing rules. As it is not possible to easily modify the path statements added by the SharePoint Publishing Wizard, I believe the issue will need to be fixed by Microsoft within the wizard code in order to correct the paths, or logic, and remove the undesired results provided above.
For now, I hope this blog article at least puts your mind at rest if you have experienced the problem first hand and then assumed you had done something wrong.



Publishing your website on google drive
Funny vampire quizzes




Comments to «Web publishing rule test results back»

  1. QARTAL_SAHIN writes:
    Buddies because the alcohol even though color's bearing upon attraction is a topic worthy.
  2. Ella115 writes:
    York Instances and books initial volume of ACM (Attraction Manage Monthly) for free and weight, regardless.


2015 Make video presentation adobe premiere pro | Powered by WordPress