Exchange 2010 iApp problems with Mac OSX 10.8 Mail App

Mike,

 

 

I'm seeing what may be something strange in the ssldump. The client makes several autodiscover requests which Exchange answers with a HTTP/401. The first response has a Set-Cookie header:

 

 

Set-Cookie: BIGipServerFC_EX2010_DC1_CAS.app~FC_EX2010_DC1_CAS_ad_pool3=2690390700.20480.0000; path=/

 

 

The next post has a Cookie header:

 

 

Cookie: BIGipServerFC_EX2010_DC1_CAS.app~FC_EX2010_DC1_CAS_ad_pool3=2690390700.20480.0000

 

 

The response to this POST is another HTTP/401.

 

 

Next, the client tries to POST again, this time the POST has an "Authorization" header that appears to contain an NTLM token. Exchange, again, returns a HTTP/401 with a WWW-Authenticate header included in the response this time.

 

 

Now the client does another POST to autodiscover, this time with a different "Authorization" header. Finally, Exchange returns a HTTP/200.

 

 

Now that the autodiscover process is complete, the client POSTs to /ews/exchange.asmx. There is no "Authorization" header present in this request, and Exchange returns another HTTP/401 Unauthorized. This same POST/response/401 cycle happens several times. Occasionally before the Exchange server responds with a HTTP/401, I see this in the capture:

 

 

POST /ews/exchange.asmx HTTP/1.1

 

...

 

...

 

27 13 0.0498 (0.0000) C>SV3.1(632) application_data

 

---------------------------------------------------------------

 

IdOnly---------------------------------------------------------------

 

27 14 0.0501 (0.0003) C>SV3.1(22) Alert

 

level warning

 

value close_notify

 

27 0.0501 (0.0000) C>S TCP FIN

 

27 0.0512 (0.0010) S>C TCP FIN

 

25 13 0.1433 (0.1071) C>SV3.1(22) Alert

 

level warning

 

value close_notify

 

25 0.1433 (0.0000) C>S TCP FIN

 

25 0.1433 (0.0000) S>C TCP FIN

 

26 13 0.0970 (0.0611) C>SV3.1(22) Alert

 

level warning

 

value close_notify

 

26 0.0970 (0.0000) C>S TCP FIN

 

26 0.0971 (0.0000) S>C TCP FIN

 

New TCP connection 28: 172.28.1.234(49220) <-> 172.26.137.125(443)

 

 

 

Then, the SSL session ends and the POST cycle starts again. I don't actually see the 401 in this response. As far as I can tell the POST to /ews/exchange.asmx never succeeds. Exchange either returns a HTTP/401, or I see this weird SV3.1(22) Alert/close_notify snippet. Any idea what this means? It only happens with these MAC clients.

 

 

Thanks!