Forum Discussion

Smart_Yuen_1168's avatar
Smart_Yuen_1168
Icon for Nimbostratus rankNimbostratus
Aug 24, 2013

Exchange 2010 ActiveSync error with the latest Exchange iApp template

I configure BIG-IP LTM with the Exchange iApp template f5.microsoft_exchange_2010_2013_cas.v1.2.0. When I tested the ActiveSync connectivity with testexchangeconnectivity.com, I got the following er...
deployment
devops
iApps
microsoft
Smart_Yuen_1168's avatar
Smart_Yuen_1168
Icon for Nimbostratus rankNimbostratus

Thanks for all of your help. AFter tcpdump/ssldump, i found some hints:

 

  1. The FolderSync doesn't work, no matter a real ActiveSync device or testexchangeconnectivity.com
  2. Here's the http flow:

Request 1: (there're other details, but I posted the important msgs only) OPTIONS /Microsoft-Server-ActivSync/ HTTP/1.1\r\n Authorization: Basic XXXXXXXXXXXXXXXXX\r\n

 

Response 1: HTTP/1.1 200 OK\r\n (That means the authorization is correct)

 

Request 2: POST /Microsoft-Server-ActiveSync/?Cmd=FolderSync&User=XXXXXXXX&DeviceId=2006028807&Devicetype=TestActiveSyncConnectivity HTTP/1.1\r\n

 

Response 2: HTTP/1.1 401 Unauthorized\r\n

 

However, it's stranged, becuase 1. The account must be corrected. (I examined the decrypted message and found the a/c and passwords are correct) 2. ActiveSync works fine without passing through the load balancer. There's only ONE member in the virtual server at this moment, but still got this problem 3. Seems the connection is lost so that the Authorization status can't be passed to next request

 

Because there's sensitive information in the tcpdump so I don't want to post all the messages here. If you're F5 support persons, would you mind giving me your F5 email address so I can send the dump to you directly?

 

Thanks a lot!!

 

mikeshimkus_111's avatar
mikeshimkus_111
Historic F5 Account
Sep 03, 2013
So, in the POST to ActiveSync, it looks like the Basic authorization header is not being sent, correct? That header should be sent with every request (it is in my testing). Are you attaching any iRules or doing anything else in the BIG-IP config that might strip this header? You'll need to create a case at https://websupport.f5.com to get your configs/captures to the correct engineers. If you post your case number here, I can have a look at it.