Publish Exchange 2010 with TMG (Forefront Threat Management Gateway)

Walkthrough on publishing all roles through TMG with AD pre-auth on TMG. (Part 1/4 OWA)

Keep in mind to do it this way you need to have the following

1. At least 2 External IPs listed on the external NIC (in order to have both forms based auth for OWA\ECP and Basic for OA,EWS,EAS
2. A multi-name trusted Certificate with all applicable names (For more information) –This is critical!
3. TGM can authenticate with AD already (either domain joined or authentication configured)

Start By preparing the exchange server

1. Configure Exchange 2010 for basic authentication
   1. Run the following on the CAS server that will be published
      • Set-OwaVirtualDirectory -id <CasServer>\* -BasicAuthentication $true -WindowsAuthentication $true -FormsAuthentication $false
      • set-WebServicesVirtualDirectory -id <CasServer>\* -WindowsAuthentication $true -BasicAuthentication $true
      • set-EcpVirtualdirectory -id <CasServer>\* -BasicAuthentication $true -WindowsAuthentication $true -FormsAuthentication $false
      • set-OabVirtualDirectory -id <CasServer>\* -WindowsAuthentication $true -BasicAuthentication $true
      • set-ActiveSyncVirtualDirectory -id <CasServer>\* -BasicAuthentication $true
2. Copy the 3rd party certificate to the TMG server.
   1. Click Start –> Run –> Type MMC
   2. Click File –> add remove Snap-in –> Certificates –> ADD –> Computer account-> Next –> finish-> ok
   3. Click Personal –> certificates
   4. Right Click on 3rd party certificate and click all tasks –> export
   5. Click Next –> Yes, Export Private Key –> Base-64 –> next –> Browse for file location.
   6. Next-> finish
   7. Copy certificate file to the TMG server
   8. Click Start –> Run –> Type MMC
   9. Click File –> add remove Snap-in –> Certificates –> ADD –> Computer account-> Next –> finish-> ok
   10. Click Personal –> Right Click certificates –> all task –> import –> next –> select file –> next –> next finish
3. Configure OWA Rule on TMG
   1. Open Forefront TMG
   2. Click on
   3. In the Action Pane under Task click 
   4. Give the rule a Name ill name mine “2010 OWA”
   5. 
   6. Next –> Next
   7. 
   8. Internal Site Name should be your CAS server FQDN (needs to be on the cert)
   9. 
   10. The external name is what you use to access OWA (Also needs to be on the cert)
   11. 
   12. Click new to make a new Listener
   13. 
   14. Name it whatever you want, I named Mine FBA because I am going to use it for Forms Based auth for OWA.
   15. 
   16. Select one of the External IPs listed (not all IP addresses or you cant do multiple auth methods)
   17. 
   18. Select the certificate you imported earlier
   19. 
   20. Use Form Authentication
   21. 
   22. You can configure SSO if you have other sites that will use this listener
   23. 
   24. Click –> Next –> Finish –> Select the Listener.
   25. 
   26. 
   27.  
       You CANNOT use “all users” here you need to have authenticated users or another group that requires authentication or your will not get prompted for auth. and get a 500.24 in browser
   28. Finish
   29. Now OWA is published!
4. Now on to EWS\Outlook Anywhere

 

Publish Exchange 2010 with TMG (Forefront Threat Management Gateway) Series:

1. OWA
2. EWS\Outlook anywhere
3. Active sync
4. SMTP