-
Products
-
SonicPlatform
SonicPlatform is the cybersecurity platform purpose-built for MSPs, making managing complex security environments among multiple tenants easy and streamlined.
Discover More
-
-
Solutions
-
Federal
Protect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn MoreFederalProtect Federal Agencies and Networks with scalable, purpose-built cybersecurity solutions
Learn More - Industries
- Use Cases
-
-
Partners
-
Partner Portal
Access to deal registration, MDF, sales and marketing tools, training and more
Learn MorePartner PortalAccess to deal registration, MDF, sales and marketing tools, training and more
Learn More - SonicWall Partners
- Partner Resources
-
-
Support
-
Support Portal
Find answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn MoreSupport PortalFind answers to your questions by searching across our knowledge base, community, technical documentation and video tutorials
Learn More - Support
- Resources
- Capture Labs
-
- Company
- Contact Us
Outlook client authentication fails for an Offloaded Exchange Portal with autodiscover ON when WAF is enabled
03/26/2020 
18 People found this article helpful
480,775 Views
Description
Authentication fails while trying to provision a new outlook client on a Windows PC or trying to use an already existing one, using an offloaded Exchange Portal with WAF enabled. It will happen in cases where autodiscover is being used.
As per Microsoft KB for autodiscover :
"Autodiscover is the feature that Outlook uses to obtain configuration information for servers to which it connects. Autodiscover is considered the single point of truth for configuration information and must be configured and working correctly for Outlook to be fully functional"
Cause
On the SMA 100 series we use the Virtual Host alias for the autodiscover enablement. The issue is seen if WAF is enabled for the Exchange portal. It should be less likely for anyone to come across this issue if WAF is disabled for the portal or if WAF is not being used at all.
The authentication request seems to be blocked by WAF signature rules 1142 and 1198."Both 1142 and 1198 were designed to detect buffer overflows in the “Authorization” and “WWW-Authenticate” headers. Some old web servers such as IIS and Squid (and even routers) were vulnerable to these types of attacks. So for this case, customer can add exclusion for these signatures or disable them if they do not use any old servers.
Resolution
Edit exclusion (in Web Application Firewall > Signatures > Configure/edit signature settings) for the sigId 1142 and 1198 and add the Exchange offloaded Portal Virtual Host in these exclusions.
Also make sure authentication is set to Basic rather than NTLM on the Exchange server.
ISSUE ID:
212977
Related Articles
- How to Set Timeout for Inactive Tunnel Connections
- Commands for silent installation of NetExtender via CMD line
- Users on Netextender 10.3.0 version failing to connect with the following error message " Cannot get a response from the server "
YES
NO