exchange server via activeSync

Hi Antonio Rouqueiro.,

Could you please provide protection policy detail, reverse-proxy logs, and source public IP address via PM for further investigation.

Thanks,

I just want to say I upgraded from 17.5 MR12 to 18.1 this weekend and have almost the same issue. In our case any larger email randomly works through Active Sync.  Anything with a attachment above about 1Mb never works, between 500k - 1mb it sometimes works, and below 500k it usually works.  Just says cannot send.  Both Android and Apple devices.

Switching Protection from "Exchange General" to "None" fixes the issue but that's not the answer.

Little more info from our testing.  In the "Exchange General" protection rule I disabled the "Common Threat Filter" and ActiveSync/OMA started working.  So it's something in there.

- Is there any update on this issue?  

Hi AllanD 

Apologies for the delayed response! 

I have reviewed the logs you have provided via PM, and it appears that logs do not have the error that you originally posted on this community thread. 

If you could replicate this issue and provide the logs with the source IP address, that would help further investigate your matter.

I replied to you via PM as well. 

Thanks,

Sorry, I think that was the other poster that initially had this problem as I did not provide you any log files.  Please let me know how I would go about doing so and I will.

Hi AllanD 

Please follow KBA Sophos XG Firewall: Where to find log files? and provide reverseproxy.log and public source IP address. 

Thanks,

PM'd you the logs.  Looks like something in the "Exchange General" protection policy, under the Common Threats filter is blocking based on size.  Which is odd since there isn't and size limits in there.  But sure enough turning off the common threats filter lets the attachments work just fine.

Have there been any fixes for this issue? I'm having the same problem.

Hi Terry Roth 

This issue was resolved by finding ModSecurity rule id(980130, 949110, and 920470) from the logs and adding them to the skip filter rules. 

Thanks,