Outlook client authentication fails for an Offloaded Exchange Portal with autodiscover ON when WAF is enabled

03/26/2020 10 8994

DESCRIPTION:

Authentication fails while trying to provision a new outlook client on a Windows PC or trying to use an already existing one, using an offloaded Exchange Portal with WAF enabled. It will happen in cases where autodiscover is being used.

As per Microsoft KB for autodiscover :
"Autodiscover is the feature that Outlook uses to obtain configuration information for servers to which it connects. Autodiscover is considered the single point of truth for configuration information and must be configured and working correctly for Outlook to be fully functional"

CAUSE:

On the SMA 100 series we use the Virtual Host alias for the autodiscover enablement. The issue is seen if WAF is enabled for the Exchange portal. It should be less likely for anyone to come across this issue if WAF is disabled for the portal or if WAF is not being used at all.

The authentication request seems to be blocked by WAF signature rules 1142 and 1198."Both 1142 and 1198 were designed to detect buffer overflows in the “Authorization” and “WWW-Authenticate” headers. Some old web servers such as IIS and Squid (and even routers) were vulnerable to these types of attacks. So for this case, customer can add exclusion for these signatures or disable them if they do not use any old servers.

RESOLUTION:

Edit exclusion (in Web Application Firewall > Signatures > Configure/edit signature settings) for the sigId 1142 and 1198 and add the Exchange offloaded Portal Virtual Host in these exclusions.
Also make sure authentication is set to Basic rather than NTLM on the Exchange server.

ISSUE ID:

212977