WAF: Common configurations for securing OWA, ActiveSync and Outlook Anywhere to access Exchange mailbox

03/26/2020 12 10569

DESCRIPTION:

This article describes common configurations for the WAF to effectively secure Exchange applications, such as OWA, ActiveSync and Outlook Anywhere. This article especially focuses on the configuration for successful support for Outlook Anywhere.

TIP:  Please test Exchange Server settings with https://testconnectivity.microsoft.com/ before deploying or switching DNS to make sure all Exchange Settings are good.

CAUSE:

While OWA and ActiveSync requires no additional set up, Outlook Anywhere for Exchange 2010 needs RPC over HTTP, which was not supported by WAF 2.2.0.0-12waf and earlier.

RESOLUTION:

Here's a table with the supportability of Exchange version, Outlook version and its protocol (this data is fetched from Microsoft Technet site):

Moreover, we can check the value of Protocol in Outlook Connection Status to check current*

NOTE:  Exchange 2010 specifically needs upgrade to WAF 2.2.0.1-16waf as it requires RPC over HTTP protocol support for Outlook Anywhere. WAF does not need any special support for other Exchange versions.

Configuration on WAF:

1. Navigate to Application Delivery and click on Offload Web App.
2. A wizard will open. Select Single or Multiple (if you have multiple servers and would like to configure Load balancing on WAF), and enable "This is an Exchange Application which will be accessed by OWA, ActiveSync or Outlook Anywhere" . Click NEXT.
3. Configure as follows:

• Backend Server to protect: [IP / Name of your backend Exchange server]
• DNS to publish for Web App: Users will be accessing Exchange / OWA/ ActiveSync using this domain name.
• Virtual IP for Web App: This is optional. If not configured, this web App will be listening on X0 IP of WAF. If you would like to use a specific IP, you can configure it here.
• SSL certificate: Select the applicable certificate. It is recommended to use a valid signed certificate.
• Web App Name: Type the application name.

   4. Click NEXT. The Security screen appears. Select "Enable Web Security" checkbox to enable the core security features of Web Application firewall.

   5. Click NEXT. The final screen with a message appears, Click FINISH. Now, you can edit the web App to make advanced configuration changes as below:

 Authentication Controls and Anonymous Session tracking is disabled by default for Exchange portals.

Exchange Server configuration:

External Hostname should be same as Web App Name configured in WAF.

Client authentication method: Basic authentication

It is recommended to enable SSL offloading and set Authentication method to Basic authentication.

NOTE: NTLM is an insecure authentication protocol and is not supported by SonicWall WAF.

Refer: https://social.technet.microsoft.com/wiki/contents/articles/1267.how-to-configure-ssl-offloading-in-exchange-2010.aspx

 IIS configuration:

Outlook Anywhere configuration:

If autodiscover is configured well, the Outlook settings will be configured properly by autodiscover. If not, user will need to configure it manually.

Use this URL to connect to my proxy server for Exchange: should be same as Web App Name and the name configured on Exchange Server.