Intelligent Application Gateway (IAG) block OWA

[Tonaco_pt]

Hi all,

The team that manage the IAG send my the following event:

Severity	Warning
Time	09-05-2012 11:08
ID	45
Category	Security
Trunk	atinternet (S)
Description	Request failed, URL rejected by URL Inspection rule. Trunk: atinternet; Secure=1; Application Name: OWA; Application Type: OWA2003SP1; Rule: OWA2003SP1_Rule3; Parameter: cmd; Value: EVSettings; Failure reason: Parameter value failed 'Value' check; Source IP: #,#,#,#; Method: GET; URL: /exchange/user/?cmd=EVSettings.

When this event appears the user can´t forward/reply/delete an owa message, the ask for our help because all the seach indicate an Enterprise vault problem "/?cmd=EVSettings".

My question is:
Why does some users not belonging to an provisioning Group get this event.
Is there any information that would help us configure the IAG to access the enterprise vault with out problem?

I will like to thanks you in advance, I don´t know anything about IAG and this problem migth not have anything to do with EV.

Exchange 2003 SP2/Enterprise Vault 9.0.3

[Nups]

Hi Tonaco.pt,

If I understand the issue correctly you are not able to access the vaulted items from OWA and I believe with outlook the affected users are able to access the items without issues.

Kindly confirm if there were any changes done to the Exhange backend servers(addition/modification of the stores) after running the EV OWA setup on backend severs ?

[TonySterling]

You said these users don't belong to a provisiong group, are they still enabled? 

[Tonaco_pt]

No they are not enable.

[Tonaco_pt]

I did not explain my self correctly, the user are not enable, they don´t belong to any provisioning group, they are not trying to access any vault archive. But they still get that event message

[Andrew_G_]

That is a valid Enterprise Vault request. Have you seen this article?

http://www.symantec.com/business/support/index?page=content&id=TECH53414

[Tonaco_pt]

But why does a Non Vault User, gets this request?

The user in is workstation in the local domain does not have Enterprise Vault (EV) Outlook Web Access (OWA) button.

[Andrew_G_ · Accepted solution]

The OWA extensions are active for every user, that request is to determine whether the user is enabled or not and show (or not) the Enterprise Vault functionality.

Similarly if the non-enabled user logs into Outlook with the add-in installed, they will not see Enterprise Vault functionality, but the add-in is running.

[Tonaco_pt]

If I understand you correct If my Front-end server has the Enterprise Vault OWA Extensions install the request "/exchange/user/?cmd=EVSettings" is always send. I have to authorize the URL in the IAG.

Thank all for your help.