Outlook 2019 - MAPI over HTTP, EWS oder ActiveSync - logon required

Hello Jürgen,

Could you please check if this solution is applicable to you?

Please refer the relavent community post. 

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/89608/cannot-get-exchange-waf-rules-to-work-for-outlook-anywhere-or-outlook-web-access-owa-outlook-mobile-access-and-autodiscover-work

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/99946/outlook-anywhere-ntlm-authentication

Also,

I would recommend to try to create a seperate WAF rule for each component such as Outlook OWA, ExhnageAutodiscover , Exchange Active Sync and Outlook Anywhere. 

Thanks Adity,

i had some time today to check the new installation of my Windows 10 1809 with Outlook 2019.

The last tests where made with SFOS 17.5.1 and here i had problems with outlook.
Outlook was asking for a second user logon a few seconds after i started the client.

In the last weeks i upgraded our FW to the latest release (SFOS 17.5.3 MR-3) AND out Exchange Server to 2016 CU 12.

Today i don´t get this error anymore, maybe there are some fixes in the last 2 FW firmware release or in Exchange, i don´t know.
Outlook is syncing 1GB mailbox right now. No logon popups.

I have a similar setup with two rules and with path specific routing.

Thanks for you information and your two links.

Kind regards

Jürgen

Hi,

i spend the day with figureing out, why this still has problems.

In my last Post regarding this problem, i said it worked.
I know now, why: I had a Microsoft Direct Access Connection and so the problem didn´t come up.

I had some problems the last days with Outlook 2019 and VPN/Direct Access.
I am going to dump MS Direct Access and i am back with the Problem.

External Outlook 2019 is still asking for logon credential on Windows 10  Enterprise Build 18363

This is my situation.

• SFOS 17.5.12 MR-12
• Windows 10 Enterprise Build 18363
• Exchange 2016 CU 16
• SAN Certificate with mail, autodiscover, owa
• A lot of testing

I used this documentations

• Sophos UTM 9.4 (www.frankysweb.de)
• Sophos XG Exchange 2016 und SFOS 16.05 (www.frankysweb.de)
• Sophos doc pages (https://docs.sophos.com/nsg/sophos-cloudfirewallmanager/Help/en-us/webhelp/onlinehelp/index.html#page/onlinehelp/Exchange%20Outlook%20Anywhere.html)
• several website complaining what will work

What i see

• Outlook / Autodiscover Test, on my external Client need logon credentals entered in the dialog box to function properly.
• Outlook 2019 keeps asking for logon credentials
• Microsoft O365 testconnectivity is ok with Mapi over HTTP
• Microsoft O365 testconnectivity fails at rpc/rpcproxy with error 403. A manual call of the url and with addition logon credential seems fine in IE 11.

The o365 has some reply from my exchange server 2016.

• HTTP 403 vorbidden
• You don´t have permission to access this rescource.

What am i missing here in my setup?

has anyone working this Outlook 2019 / Exchange 2016 on-premise?

I have 2 firewall rules, one for Exchange autodiscover, one for Exchange Webservices 

thanks

Jürgen

I am using Exchange 2016 and Outlook 2019 and I didn't have to configure any rules on the XG. Have you checked to see if maybe you problem is related to tls 1.0/1.1 deprecated? Also your problem might be the IIS forms authentication.

Thanks,

i am installing a Life Lab with an old Domain on Hyper-V

DC, Exchange, Client and XG 18.0.

Here i can test more things than in production.

Thanks,

i am installing a Life Lab with an old Domain on Hyper-V

DC, Exchange, Client and XG 18.0.

Here i can test more things than in production.