This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

WAF and ActiveSync with iPhone

Hi,

this week I've tried to remove our NAT rule that allows us to use Outlook WebAccess and ActiveSync with our iPhones from outside our office and repace it with the new Web Application Firewall. After a bit of tweaking, I managed to get Outlook WebAccess to work perfectly.
But I couldn't manage to get ActiveSync with the iPhones to work. I had to acceppt the new certificate, but it wasn't able to fetch any new eMails. And since then, its batteries were draining really fast and it got quite warm.

I had to put the NAT rule back for now, but is there a solution for this? Or does ActiveSync just not work with WAF?

This thread was automatically locked due to age.

0 BAlfson over 15 years ago

Hi, lonex, and welcome to the User BB!

I don't know the answer to this, but maybe there's a workaround. Since the real concern is protecting Outlook Web Access, you could create a Network definiton for the public range used by the iPhone and use that as the source in the DNAT instead of "Any" or "Internet." Since DNATs are considered before proxies, you shouldn't need an exception in WAF.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 lonex over 15 years ago in reply to BAlfson

Hi Bob,

thanks for the tip, that's something to consider.

Cheers
Timo
Cancel
Vote Up 0 Vote Down

Cancel
0 lonex over 15 years ago in reply to lonex

... although I just realized, that our iPhone users also use their iPhones in their home WLAN, which has dynamic IPs from different providers... so that kind of eliminates this idea. [:(]
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 15 years ago

Was there anything in the WAF/IPS/Packet Filter logs?

Another workaround would be to put an Additional Address on the External interface so you can DNAT ActiveSync traffic. In your situation, we normally give a hostname like mail.company.com and add an A record to DNS like outlook.company.com pointing to an additional address on the External interface. If it's going to be a problem to use ActiveSync with WAF, I suppose we'll start adding another record for activesync.company.com.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 lonex over 15 years ago

I found out that I'm not the only one:
https://community.sophos.com/products/unified-threat-management/astaroorg/f/54/t/39936
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 15 years ago

Isn't that a different issue?

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 warper over 15 years ago in reply to BAlfson

I have iphone working with activesync through WAP. It has worked very well. I have one question though for you. Are you using self signed certs or are you using provider certs. The certs for activesync server and the WAP must be perfect or the astaro will not pass them properly and self signed I was never able to get working.
Cancel
Vote Up 0 Vote Down

Cancel
0 efgh292 over 15 years ago

Bin as language designer LV handbags that half the children nfl youth jerseys dead felt criminal, Yang LV handbags discount Ming-Ling low around it comfort high quality LV replica handbags slack, so unpleasant, said:" You custom nfl jerseys also hump the Blue Broom foreclose any money! ".
Cancel
Vote Up 0 Vote Down

Cancel