Publishing Exchange Server 2010 with Forefront UAG and TMG

re: Publishing Exchange Server 2010 with Forefront UAG and TMG

RedGrey — Tue, 17 Aug 2010 19:48:23 GMT

Thanks Greg. That was what it was set to already (I meant All Users when I typed "Everyone").

I think my problem is due to the fact that I'm using SSL offload, which I know has issues with EWS. I may need to wait for SP1.

re: Publishing Exchange Server 2010 with Forefront UAG and TMG

Greg Taylor — Fri, 13 Aug 2010 20:06:15 GMT

RedGrey - set the Users tab on the rule to All Users

re: Publishing Exchange Server 2010 with Forefront UAG and TMG

RedGrey — Fri, 13 Aug 2010 02:06:26 GMT

Thanks Greg.

I created this rule, set it to "No Authentication, but users can authenticate directly", and set it to apply to
"Everyone" instead of "Authenticated Users". The web listener is set to FBA, but "always authenticate" is not checked.

It still does not seem to be working. Am I missing something?

re: Publishing Exchange Server 2010 with Forefront UAG and TMG

Greg Taylor — Thu, 12 Aug 2010 20:26:55 GMT

Here's how to do this - place a rule higher up in the processing order, requiring no auth for the following specific urls;

/EWS/exchange.asmx/wssecurity
/autodiscover/autodiscover.svc
/autodiscover/autodiscover.svc/wssecurity

Give that a try.

re: Publishing Exchange Server 2010 with Forefront UAG and TMG

RedGrey — Wed, 11 Aug 2010 23:35:34 GMT

How would this need to be modified to support Calendar Federation? Do you need to publish EWS separately with no authentication at the TMG layer?

re: Publishing Exchange Server 2010 with Forefront UAG and TMG

Greg Taylor — Thu, 29 Jul 2010 00:24:55 GMT

@Henry - There's really very little difference with Exchange 2007, it's only the ECP piece/considerations, and you can therefore ignore them.

@stEFO - glad it's working ok now.

re: Publishing Exchange Server 2010 with Forefront UAG and TMG

henrychansa — Wed, 28 Jul 2010 22:07:39 GMT

Hi Greg,

Great article, good job! I'm deploying TMG2010 for OWA and OA but I have Exchange 2007. It looks to me this paper should apply equally well to 2007 'tho? Are there any particular sections you think don't apply or needs configuring differently for Ex2007?

Thanks!
Henry

re: Publishing Exchange Server 2010 with Forefront UAG and TMG

stEfO — Wed, 28 Jul 2010 18:49:49 GMT

Hi Greg,

I found why it didn't work.
In my lab, End user was connected to UAG through HTTPS and UAG was connected to CAS server through HTTP

Configuration:
In CAS Server
"Require SSL" not checked on default web site

In UAG
Trunk configuration > General
Server certificate: UAG computer default certificate

Application Properties > Web Servers
"HTTP Port" checked with value 80

In this case (End User --HTTPS--> UAG --HTTP--> CAS), automatic redirection to /owa/ does not work after authentication. The end user must modify manually the Url to include /owa/.

I created good certificates and configured a full HTTPS chain from End User to Exchange CAS. In this case, redirection is working fine.

Thx

re: Publishing Exchange Server 2010 with Forefront UAG and TMG

stEfO — Tue, 27 Jul 2010 20:17:53 GMT

I already re-created the trunk and the application.
As it should work, i will check my test environment
thx Greg

re: Publishing Exchange Server 2010 with Forefront UAG and TMG

Greg Taylor — Tue, 27 Jul 2010 18:00:08 GMT

Yes it should, it does for me, I'm not quite sure what is causing yours to fail. Did you try re-creating the trunk, and the application? Is there anything unusual in your setup?