The external FQDN of the EV server should be used when setting up the 'alias'

[macomsupport]

Hi All,

I am very annoyed because I have spent a fair amount of time installing and configuring EV 8 in a exchange 2007 environment. It all works fine inside the firewall but its a different story outside the corporate network, all the clients use outlook anywhere and all require all functions including offline vault.... I have since realized that if I had named the EV server alias an FQDN the whole job would of been much much more straight forward. We don't use ISA and I have implemented split DNS for outlook anywhere as it just seems wrong to use one name for internal resources and another for external the process for the users should be seamless.

Now I have seen this http://seer.entsupport.symantec.com/docs/316191.htm

quote "The external FQDN of the EV server should be used when setting up the 'alias' for the Enterprise Vault Server.  This way when the default web app URL is formed, it will be resolvable from outside the organization (provided it is published appropriately at the firewall)."

I am pretty sure I followed the installation guide very closely and never saw this advise.

So my question is can the EV server Alias be renamed to reflected a external FQDN?

TIA
Steve

[Rob_Wilcox1]

I don't think you can rename it.  Some people have tried altering the entry in the ComputerEntry Table in the directory database, I think the column is ComputerAlternateName.  Great care should be taken if you go that route, as it's not really something I'd recommend - but it has worked for some people if I recall correctly.

In addition the whole Outlook Anywhere area is something that we are working on, to make it better with EV and Exchange 2007.  In the future it is possibly going to be "similiar" to the Exchange 2003 world where there is a proxy-type setup that can be used, and then the name spaces can be completely different, and will work.  It's not confirmed yet when this will be done though unfortunately.

Dare I say it.. you can use a hosts file in the meantime ..  yeucky though that is, many people have used it.

[macomsupport]

Hi Rob

Thanks for your comments, I don't see how the host file can work because it will be pointing to an external ip which will probably cause the connection to fail when the user returns to the LAN.

What will the affect be if I re-run the getting started wizard? will it allow me to give it a External FQDN?

I'm very disappointed that the product isn't fully functional.

TIA
Steve

[Rob_Wilcox1]

A hosts file does and has worked for many situations, but you're right some companies don't allow you to hit their own servers by an external IP address.. I guess that really depends on the configuration of your firewall.

Not sure about re-running GSW.

In the documentation it does say that you should use "direct" if using RPC/HTTP (aka Outlook Anywhere) :

The installing guide points you to the Setting Up Exchange Server archiving guide, which on page 119 says you have to use "direct"...

My opinion is that it's not very clear, or very good.. and doesn't explain what will and won't work, or how to configure it in a "real world" environment..  this are the reasons that we are changing this area.

Hope that helps,

[macomsupport]

Hi Rob

I have tried the host file it didn't work, outside of the network OWA reports 

Network Error (dns_unresolved_hostname)

Your requested host "archive.******.local" could not be resolved by DNS.

For assistance, contact your network support team.

even though ping  resolved correctly

and within outlook anywhere I get directory unavailable 404 error

I also tried the ComputerAlternateName but this caused the EV services to Fail.

:-(

Steve

[Rob_Wilcox1]

Hmm, I'm not sure I follow you exactly, but let me try to give an example, because I'm not sure we're on the same page....

My EV server is called :

evserver.internal.local

For Outlook Anywhere my  EV client will try to contact evserver.internal.local which when I'm outside the firewall isn't going to work.  So I have to :-

a) Add a hosts entry to the client machine :

10.14.55.123  evserver.internal.local

Where 10.14.55.123 is the IP address of my firewall.

b) Add a firewall rule which will take requests for things like http://evserver.internal.local/enterprisevault/clienttest.gif, and redirect them to my EV server.

Make sense?

[macomsupport]

Hi Rob

Thanks for sticking around for me :) yes it makes sense I have used host files for similar reasons before and the above is the method that I used in this trial, but all i get is the DNS error above.

The other problem is configuring the firewall to redirect requests from inside the LAN I not blessed with an ISA server we have a cisco pix to configure here and the only rule I've added is external ip allow to nat internal EV ip for http

Regards
Steve

[Rob_Wilcox1]

If you like, you could PM me the name you're using, and I'll try it remotely (to see if I can get DNS to work etc).  What I can't figure out from the post you made is whether the issue is with the domain name, or the server name?  It might be that you need to add an entry to your external DNS records for the name of your EV server.

[macomsupport]

Hi All

Quick update, don't take any notice of quote "The external FQDN of the EV server should be used when setting up the 'alias' for the Enterprise Vault Server.  This way when the default web app URL is formed, it will be resolvable from outside the organization (provided it is published appropriately at the firewall)."from this tech note http://seer.entsupport.symantec.com/docs/316191.htm because it is not possible to use the external FQDN of the EV server when setting up the 'Alias' for Enterprise vault server (new Install). I wasted my time starting over to do this even more annoyed now.

any ideas when this will be fixed I have it all working apart from Offline Cache using https over Rpc outlook anywhere, and no we are not prepared to use host files in any case this doesn't work when the user comes inside the network. It seems crazy to me that the software can be released with this flaw, offline cache wont update when your outside of the network??? isn't that the most likely place your going to be working offline.

When I say I have it working... it does until I apply a SSL cert to the EV IIS sites. then the opening up an email from OWA doesn't work tells me the the item is not currently available, I'm beginning to wish I had never purchased this product.

Regards
Steve

[Rob_Wilcox1]

@Steve
There are a number of things that you can do to get this working.  Some of them depend on your version of EV, and some depend on your version of Exchange.  You are also interlinking two related usage scenarios, OWA and RPC/HTTP.

For the OWA SSL issue.

When you put the SSL certificate on the EV IIS site, did you change the site settings to HTTPS ?

For the RPC / HTTP issue

I assume from what you've written that you are using Exchange 2007?  If that is correct, the logic in the client is that it will try your default web app URL first of all, if that fails (which it most likely will in the outside world, because the DNS namespaces are going to be different) then it will try the proxy URL only if you have configured the policy to "Use proxy" (rather than direct).  Unfortunately though Vault Cache doesn't share the same logic as the majority of the rest of the client, and only "goes direct".

Until the issue is properly addressed in a future release the current workaround is to use a hosts file, which can work.  You say it won't work from inside the network, why is that?  Do you not allow client machines to connect to internal servers using an external address?

The best thing to do is to raise a support case, for this very issue (RPC / HTTP), and ensure it is a high severity and priority, this will help drive the future-fix to be released sooner, rather than later.  I've already walked through the solution which our development team have proposed, and it will work, but unfortunately at the moment there is no timescales on when the solution will be delivered (but the more customers that "demand" this, the sooner it will be - if that makes sense).

For the OWA issue, if you can answer the above we might be address that here.

Hope that helps,

[macomsupport]

HI Rob

Thanks for the response, I will raise the off line cache issue with support, regarding the OWA SSL issue can you explain what you mean by "did you change the site settings to SSL"

or with you can point me towards a tech note on the subject that would be great

Regards
Steve

[Rob_Wilcox1]

In the VAC, right click on your EV site, and go to properties.  Do you have HTTP or HTTPS listed there, after you added/modified the certificate on the folder in IIS.

Hope that helps,

[macomsupport]

Hi Rob

Yes this was what I was missing, Thanks

Steve

[MichelZ]

Steve

Unfortunately, EV is a very complex product to install.
We always recommend that an EV partner does the planning & installation.

The amazing thing with EV is, that once it's installed & configured, it's very easy to use and maintain.

The Exchange 2007 OWA/RPC thing is very disappointing, this is true.
It was perfect in Exchange 2003 with the Proxy thingy.
However, Microsoft rewrote a large part of OWA, which forced Symantec to "start over" with the EV/OWA integration. That's why they had to "start" with such a complicated publishing integration. But as Rob said, they are aware of this limitation and are working on a better integration.


Cheers
Michel

[macomsupport]

Hi Michel

I couldn't agree more it is taken so much of my time to get a working solution, and I'm still not their yet almost but not quite.....it seems that securing the EV site with a certificate has created a new problem, I think I have the answer but any comments would be great. the problem is that after applying the certificate to the EV iis website the vault cache does not work even within the network, I get the connected to the enterprise vault followed by download failed within the logs on the client it all runs to plan until this section;

17/09/2009 16:25:46.907[1308]: CONTENT:BUILD: Completed INITIAL Job filename '2009_01_03_0001.db' state '7'
17/09/2009 16:25:46.907[1308]: CONTENT:BUILD: Stopping download state '7'

Is this possibly because the certificate that I've used has a common name of archive.domain.com and not archive.domain.local ? would Unified communication certificate including the local name solve this?

remember this did work before the SSL,  we accept the limitation of the cache that it doesn't work outside of the network without VPN or Host file but I have explained this already to the users and this has been accepted (until a Fix is released) only to find I have broken it internally. :(

I also noticed that the logs on the clients always seem to be 1 hour behind, such as above the actual time was 17:25:46 why is this?

Thanks In Advanced
Steve

[MichelZ · Accepted solution]

Steve

I don't know if EV really checks the certificate, but it's possible that this is the problem.
UC certificate with a SAN name would probably solve this, yes.
However, you should try this out first before requesting a paid certificate and just finding out that it doesn't work.

Create your own SAN certificate with your own CA (which is trusted on the client).

Cheers

[macomsupport]

Hi Michel

the above problem was resolved after issuing the certificate, but now out of the blue the off line cache sync fails this time with a new error?
11/10/2009 22:41:47.252[3544]: CONTENT:BUILD: Completed INITIAL Job filename '2009_04_06_0002.db' state '7'
11/10/2009 22:41:47.253[3544]: CONTENT: RETRY logic started reason '302'
11/10/2009 22:41:53.152[2884]: Exchange connection state: 8

Regards
Steve