Exchange 2016 Deployment Guide
Exchange 2016 Deployment Guide
VERSION: 4.0 UPDATED: OCTOBER 2016
MS Exchange 2016 Introduction
Copyright Notices Copyright © 2002-2016 KEMP Technologies, Inc.. All rights reserved.. KEMP Technologies and the KEMP Technologies logo are registered trademarks of KEMP Technologies, Inc.. KEMP Technologies, Inc. reserves all ownership rights for the LoadMaster product line including software and documentation. The use of the LoadMaster Exchange appliance is subject to the license agreement. Information in this guide may be modified at any time without prior notice. Microsoft Windows is a registered trademarks of Microsoft Corporation in the United States and other countries. All other trademarks and service marks are the property of their respective owners. Limitations: This document and all of its contents are provided as-is. KEMP Technologies has made efforts to ensure that the information presented herein are correct, but makes no warranty, express or implied, about the accuracy of this information. If any material errors or inaccuracies should occur in this document, KEMP Technologies will, if feasible, furnish appropriate correctional notices which Users will accept as the sole and exclusive remedy at law or in equity. Users of the information in this document acknowledge that KEMP Technologies cannot be held liable for any loss, injury or damage of any kind, present or prospective, including without limitation any direct, special, incidental or consequential damages (including without limitation lost profits and loss of damage to goodwill) whether suffered by recipient or third party or from any action or inaction whether or not negligent, in the compiling or in delivering or communicating or publishing this document. Any Internet Protocol (IP) addresses, phone numbers or other data that may resemble actual contact information used in this document are not intended to be actual addresses, phone numbers or contact information. Any examples, command display output, network topology diagrams, and other figures included in this document are shown for illustrative purposes only. Any use of actual addressing or contact information in illustrative content is unintentional and coincidental. Portions of this software are; copyright (c) 2004-2006 Frank Denis. All rights reserved; copyright (c) 2002 Michael Shalayeff. All rights reserved; copyright (c) 2003 Ryan McBride. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1.
Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer
2.
Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE ABOVE COPYRIGHT HOLDERS ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE ABOVE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. The views and conclusions contained in the software and documentation are those of the authors and should not be interpreted as representing official policies, either expressed or implied, of the above copyright holders.. Portions of the LoadMaster software are copyright (C) 1989, 1991 Free Software Foundation, Inc. -51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA- and KEMP Technologies Inc. is in full compliance of the GNU license requirements, Version 2, June 1991. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
2
MS Exchange 2016 Introduction
Portions of this software are Copyright (C) 1988, Regents of the University of California. All rights reserved. Redistribution and use in source and binary forms are permitted provided that the above copyright notice and this paragraph are duplicated in all such forms and that any documentation, advertising materials, and other materials related to such distribution and use acknowledge that the software was developed by the University of California, Berkeley. The name of the University may not be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Portions of this software are Copyright (C) 1998, Massachusetts Institute of Technology Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. Portions of this software are Copyright (C) 1995-2004, Jean-loup Gailly and Mark Adler This software is provided 'as-is', without any express or implied warranty. In no event will the authors be held liable for any damages arising from the use of this software. Permission is granted to anyone to use this software for any purpose, including commercial applications, and to alter it and redistribute it freely, subject to the following restrictions: 1. The origin of this software must not be misrepresented; you must not claim that you wrote the original software. If you use this software in a product, an acknowledgment in the product documentation would be appreciated but is not required. 2. Altered source versions must be plainly marked as such, and must not be misrepresented as being the original software. 3. This notice may not be removed or altered from any source distribution. Portions of this software are Copyright (C) 2003, Internet Systems Consortium Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies. THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
Used, under license, U.S. Patent Nos. 6,473,802, 6,374,300, 8,392,563, 8,103,770, 7,831,712, 7,606,912, 7,346,695, 7,287,084 and 6,970,933
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
3
MS Exchange 2016 Introduction
Table of Contents 1
2
Introduction .................................................................................................................................... 6 1.1
About This Manual .................................................................................................................. 6
1.2
Prerequisites ........................................................................................................................... 6
Exchange 2016 Overview ................................................................................................................ 7 2.1
Differences Between Exchange 2013 and Exchange 2016 ..................................................... 7
2.2
Understanding Server Load Balancing .................................................................................... 8
2.3
Enable Subnet Originating Requests Globally......................................................................... 8
2.4
100-Continue Handling ........................................................................................................... 9
2.5
Additional L7 Header ............................................................................................................ 10
3
Virtual Service Templates ............................................................................................................. 12
4
Configuring Virtual Services for Exchange 2016 ........................................................................... 13 4.1
HTTPS Virtual Service ............................................................................................................ 13
4.1.1
HTTPS Reencrypted using SubVSs ................................................................................. 16
4.1.2
HTTPS Offloaded Using SubVSs ..................................................................................... 22
4.1.3
HTTPS Re-Encrypt Using ESP and SubVSs ..................................................................... 29
4.1.4
HTTPS Re-Encrypt Using ESP, WAF and SubVSs ............................................................ 37
4.1.5
HTTPS Offloaded Using ESP and SubVSs ....................................................................... 40
4.1.6
HTTPS Offloaded Using ESP, WAF and SubVSs ............................................................. 48
4.2
Office Online Server Virtual Service ...................................................................................... 51
4.3
IMAP Virtual Service ............................................................................................................. 53
4.3.1
IMAP STARTTLS Virtual Service ..................................................................................... 55
4.3.2
IMAPS Virtual Service .................................................................................................... 56
4.3.3
IMAPS Offloaded Virtual Service................................................................................... 57
4.4
POP Virtual Service................................................................................................................ 58
4.4.1
POP with STARTTLS Virtual Service ............................................................................... 60
4.4.2
POPS Virtual Service ...................................................................................................... 61
4.4.3
POPS Offloaded Virtual Service..................................................................................... 62
4.5
SMTP Virtual Service ............................................................................................................. 63
4.5.1
SMTPS Virtual Service ................................................................................................... 65
4.5.2
SMTPS Offloaded Virtual Service .................................................................................. 65
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
4
MS Exchange 2016 Introduction
4.5.3
SMTP with STARTTLS Virtual Service ............................................................................ 67
4.5.4
SMTP with ESP Virtual Service ...................................................................................... 68
4.5.5
Office Online Server Virtual Service .............................................................................. 69
References ............................................................................................................................................ 72 Document History ................................................................................................................................. 73
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
5
MS Exchange 2016 Introduction
1 Introduction The KEMP LoadMaster combines versatility with ease-of-use to speed deployment of the complete portfolio of advanced messaging applications and protocols used by Exchange 2016, including Outlook on the Web, MAPI/HTTP, Outlook Anywhere (OA), Exchange ActiveSync (EAS), Simple Mail Transfer Protocol (SMTP), Post Office Protocol version 3 (POP3), Internet Message Access Protocol version 4 (IMAP4) and Office Online Server (OOS). With built-in SSL acceleration and/or overlay, the LoadMaster offloads a key source of CPU drain to improve the capacity of the Exchange 2016 infrastructure. Layer 7 health checking at the LoadMaster ensures that if one of the Client Access components becomes inaccessible, the load balancer will take that component offline for that server, while automatically re-routing and reconnecting users to other functioning servers. The entire KEMP LoadMaster product family, including the Virtual LoadMaster (VLM) supports Microsoft Exchange 2016.
1.1
About This Manual
This manual addresses how to deploy and configure a LoadMaster appliance with Microsoft Exchange 2016. KEMP’s LoadMaster family of products is available in various models to support networks of different throughput requirements. Information in this manual applies to all LoadMaster models.
1.2
Prerequisites
This guide assumes the reader is a network administrator or a person otherwise familiar with networking and general computer terminology. Set up an Exchange 2016 environment and install the KEMP LoadMaster. LoadMaster documentation is available at http://www.kemptechnologies.com/documentation. At a minimum, you should have:
Installed the Microsoft Servers, Active Directories and followed other Microsoft requirements. Installed the LoadMaster on the same network as the servers. Established access to the LoadMaster Web User Interface (WUI).
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
6
MS Exchange 2016 Exchange 2016 Overview
2 Exchange 2016 Overview Microsoft Exchange Server is a mail server, calendaring software and contact manager. It is a server program that runs on Windows Server and is part of the Microsoft Servers line of products. The improvements made in Exchange 2016 have made it easier to load balance Exchange-related traffic. Exchange 2016 includes the following solutions for switchover and failover redundancy:
2.1
High availability: Exchange 2016 uses Database Availability Groups (DAGs) to keep multiple copies of your mailboxes on different servers synchronized. That way, if a mailbox database fails on one server, users can connect to a synchronized copy of the database on another server. Site resilience: You can deploy two Active Directory sites in separate geographic locations, keep the mailbox data synchronized between the two, and have one of the sites take on the entire load if the other fails. Online mailbox moves: During an online mailbox move, email accounts are still accessible. Users are locked out for a brief period at the end of the process, when the final synchronization occurs. Online mailbox moves can be performed across forests or in the same forest. Shadow redundancy: Shadow redundancy protects the availability and recoverability of messages while they are in transit. With shadow redundancy, the deletion of a message from the transport databases is delayed until the transport server verifies that all the next hops for that message have completed. If any of the next hops fail before reporting successful delivery, the message is resubmitted for delivery to the hop that did not complete.
Differences Between Exchange 2013 and Exchange 2016
Although there are a lot of similarities between Exchange 2013 and Exchange 2016, there are a couple of areas to mention relating to the roles and the Preferred Architecture. The Exchange 2016 Preferred Architecture is to use unbound namespace load balanced across datacenters in a Layer 7 configuration that does not leverage session affinity. An Office Online Server farm is deployed in each datacenter, with each farm having a unique namespace (bound model). The load balancer now manages session affinity. This server allows users to view and modify supported file attachments within Outlook on the Web. New to the server roles with Exchange 2016 is that Client Access role has now been moved to the Mailbox Server. In older versions of Exchange the Client Access role could be deployed on a dedicated server or coexist on the mailbox server. In Exchange 2016 there are just two server roles:
The Mailbox Server combines all prior rolls including Mailbox, Hub Transport, Unified Messaging and Client Access (CAS). The Edge Transport server provides secure inbound/outbound mail flow.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
7
MS Exchange 2016 Exchange 2016 Overview
The CAS still acts as a reverse proxy. The CAS determines which mailbox database their mailbox is located on and provides the request to the back-end mailbox server that hosts the database. The mailbox server then renders the OWA content, not the CAS. Clients no longer interact with Exchange using RPC, it is all done over HTTPS. MAPI over HTTP and Outlook Anywhere are the protocols that Outlook clients use to access their mailbox. In Exchange 2016 MAPI/HTTP is enabled by default. Outlook 2010 with KB2965295 or greater is required with Exchange 2016.
2.2
Understanding Server Load Balancing
Server load balancing is a way to manage which servers receive traffic. Server load balancing provides failover redundancy to ensure users continue to receive service in case of failure. It also enables your deployment to handle more traffic than one server can process while offering a single host name for clients. Server load balancing serves two primary purposes. It reduces the impact of server failures within an Exchange Organization. In addition, server load balancing ensures that the load on the CAS and Transport services are optimally distributed. Two key changes in Exchange 2016 make load balancing a lot simpler:
HTTPS-only access from clients means that there is only one protocol to consider. The HTTP failure states are well known and clients typically respond in a similar way. As OWA is rendered on the same server that is hosting the user’s mailbox database; if a client hits a different CAS there is no performance degradation as the session rendering for that user is already up and running. Since Exchange 2013 Client Access Server role is just an intelligent proxy, it can proxy the mailbox requests to an Exchange 2016 server. This means Exchange 2013 and Exchange 2016 Client Access Services can co-exist in the same KEMP Virtual Service.
There are improvements to forms-based authentication. The authentication cookie is provided to the user after logon and it is encrypted using the CAS’s SSL certificate. This allows a logged in user to resume their session on a different CAS without having to re-authenticate (if servers share the same SSL certificate).
2.3
Enable Subnet Originating Requests Globally
It is best practice to enable the Subnet Originating Requests option globally. In a one-armed setup (where the Virtual Service and Real Servers are on the same network/subnet) Subnet Originating Requests is usually not needed. However, enabling Subnet Originating Requests should not affect the routing in a one-armed setup. In a two-armed setup where the Virtual Service is on network/subnet A, for example, and the Real Servers are on network B - Subnet Originating Requests should be enabled on LoadMasters with firmware version 7.1-16 and above.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
8
MS Exchange 2016 Exchange 2016 Overview
When Subnet Originating Requests is enabled, the LoadMaster will route traffic so that the Real Server will see traffic arriving from the LoadMaster interface that is in that network/subnet. When Subnet Originating Requests is enabled globally, it is automatically enabled on all Virtual Services. If the Subnet Originating Requests option is disabled globally, you can choose whether or not to enable Subnet Originating Requests on a per-Virtual Service basis. To enable Subnet Originating Requests globally, follow the steps below: In the main menu of the LoadMaster WUI, go to System Configuration > Miscellaneous Options > Network Options.
Figure 2-1: Network Options
Tick the Subnet Originating Requests check box.
2.4
100-Continue Handling
To avoid issues with Exchange Web Services, especially in a hybrid configuration, configure 100continue handling to comply with RFC-7231 instead of standard setting of RFC-2616. To resolve this issue, set the 100-Continue Handling setting to RFC-7231 Complaint. In the main menu of the LoadMaster WUI, go to System Configuration > Miscellaneous Options > L7 Configuration.
Figure 2-2: 100-Continue Handling
Select RFC-7231 Complaint under 100-Continue Handling.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
9
MS Exchange 2016 Exchange 2016 Overview
2.5
Additional L7 Header
When using the built-in Mail client on Mac, you may experience connectivity issues. This happens due to how Mail client on Mac handles Persistent-Auth headers from the Exchange server. This behaviour will not be present on Outlook for Mac clients or any Windows Office clients. To resolve this issue, apply the following settings on the KEMP LoadMaster: Globally set Additional L7 Header to None. Follow the steps below: In the main menu of the LoadMaster WUI, go to System Configuration > Miscellaneous Options > L7 Configuration.
Figure 2-3: Additional L7 Header
Select None under Additional L7 Header.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
10
MS Exchange 2016 Exchange 2016 Overview
Client
KEMP LoadMaster
Exchange Mailbox Servers
Figure 2-4: Load Balancing Exchange 2016
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
11
MS Exchange 2016 Virtual Service Templates
3 Virtual Service Templates KEMP have developed templates containing our recommended settings for Exchange 2016. These templates can be installed on the LoadMaster and can be used when creating each of the Virtual Services. Using a template automatically populates the settings in the Virtual Services. This is quicker and easier than manually configuring each Virtual Service. If needed, you can make changes to any of the Virtual Service settings after using the templates. Released templates can be downloaded from the KEMP documentation page: http://www.kemptechnologies.com/documentation/. For more information and steps on how to import and use templates, refer to the Virtual Services and Templates, Feature Description. For steps on how to manually add and configure the Virtual Services, refer to the sections below. The Microsoft Exchange 2016 templates currently available are grouped in three downloadable files as follows:
Exchange 2016 Core Services
This file contains templates for non-SSL offloaded HTTPS, SSL offloaded HTTPS and SMTP Virtual Services. This is the primary set of services needed to balance Exchange 2016. Exchange 2016 ESP Services This file contains individual templates for a HTTPS service with SSL offloading and an SMTP service, both with ESP enabled. These services are only necessary if you want to use ESP functionality. Exchange 2016 ESP and WAF Services This file contains individual templates for a HTTPS services with ESP and the Web Application Firewall (WAF) enabled. These services are only necessary if you want to use ESP and WAF functionality. If you try to install this template on a LoadMaster that does not have a WAF license, an error message will appear. Please contact KEMP in order to upgrade your license, if needed.
Exchange 2016 Additional Services This file contains templates for IMAP, POP and SMTP services, including variants for STARTTLS and SSL secured services.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
12
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
4 Configuring Virtual Services for Exchange 2016 The sections below give instructions on how to configure the various Virtual Services related to Microsoft Exchange. KEMP recommends these settings. They may not be applicable to your specific configuration. For further information and help, please contact our Support team.
4.1
HTTPS Virtual Service
Follow the instructions below to set up a HTTPS Virtual Service: Select the Add New option within the Virtual Services section of the main menu tree.
Figure 4-1: Virtual Service parameters
Enter the IP address of the Virtual Service in the Virtual Address field. Enter 443 in the Port field. Type a name, for example Exchange 2016 HTTPS in the Service Name field. Select tcp in the Protocol drop-down list. Click the Add this Virtual Service button to add the Virtual Service.
Figure 4-2: Basic Properties
Within the Basic Properties section, select the following options: Select HTTP/HTTPS in the Service Type drop-down list. Expand the Standard Options section.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
13
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-3: Standard Options
Within the Standard Options section of the Virtual Services options page, select the following options: a) Ensure the Force L4 check box is clear. When L7 is referred to in KEMP documentation, it is in relation to the actual TCP connection. When Microsoft refer to L7 for Exchange it is in relation to SSL decryption and re-encryption. This is different and what KEMP recommends is not necessarily L7 configuration unless SSL acceleration is enabled. b) c) d) e)
Ensure the Transparency check box is clear. Ensure none is selected from the Persistence Options drop-down list. Ensure round robin is selected from the Scheduling Method drop-down list. Enter 1800 in the Idle Connection Timeout field and click the Set Idle Timeout button. Expand the Advanced Options section.
Figure 4-4: Advanced Options
Within the Advanced Options section, select the following options: a) Ensure https://%h%s is the value of the Redirection URL in the Add a Port 80 Redirector VS section. b) Click Add HTTP Redirector. This creates a new redirect Virtual Service on port 80 with the same IP address.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
14
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Expand the Real Servers section.
Figure 4-5: Real Servers section
In the Real Servers section, select the following options: a) Ensure HTTPS Protocol is selected as the health-checking option from the Real Server Check Parameters drop-down list. b) Enter 443 in the Checked Port field and click Set Check Port. c) Enter /owa/healthcheck.htm in the URL field and click Set URL. d) Ensure the Use HTTP/1.1 check box in not selected. e) Select GET from the HTTP Method drop-down list.
Figure 4-7: Real Servers section
Click Add New…, and select the following options: a) Enter the Real Server Address for the Exchange Server. b) Enter Port 443. c) Select NAT as Forwarding method. d) Click Add This Real Server. Do this for each Exchange Server in your organization. Make minor changes to the redirect Virtual Service that was added: Click View/Modify Services in the main menu. Click Modify on the Redirect Virtual Service with the blank name which has the same IP address as the Virtual Service that was just created.
Figure 4-8: Basic Properties
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
15
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Enter a recognizable Service Name, for example Exchange 2016 HTTP Redirect and click Set Nickname.
Figure 4-9: Standard Properties
In Standard Options, set the Persistence Mode to None.
4.1.1
HTTPS Reencrypted using SubVSs
Follow the instructions below to set up a HTTPS Virtual Service with SubVSs. 4.1.1.1
Create the Parent Virtual Service
Follow the instructions below to set up the parent HTTPS Virtual Service: Select the Add New option within the Virtual Services section of the main menu tree.
Figure 4-10: Virtual Service Parameters
Enter the IP address of the Virtual Service in the Virtual Address field. Enter 443 in the Port field. Type a name, for example Exchange 2016 HTTPS Reencrypt in the Service Name field. Select tcp in the Protocol drop-down list. Click the Add this Virtual Service button to add the Virtual Service.
Figure 4-11: Basic Properties
Within the Basic Properties section of the Virtual Services options page, select the following options:
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
16
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
a) Select HTTP/HTTPS in the Service Type drop-down list.
Figure 4-6: Standard Options
Within the Standard Options section of the Virtual Services options page, set the fields as outlined below: a) Ensure the Force L4 check box is clear. b) Ensure the Transparency check box is clear. c) Ensure none is selected from the Persistence Options drop-down list. d) Ensure round robin is selected from the Scheduling Method drop-down list. e) Enter 1800 in the Idle Connection Timeout field and click the Set Idle Timeout button. Expand the SSL Properties section.
Figure 4-13: SSL Properties
Within the SSL Properties section, select the Enabled check box and click OK. Select the Reencrypt check box. Select the Certificate to be used for encryption and click > to Assigned Certificates. Click Set Certificate.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
17
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Select BestPractices from the Cipher Set drop-down list. Expand the Advanced Properties section.
Figure 4-14: Advanced Properties
Within the Advanced Properties section, select the following options: a) Ensure https://%h%s is the value of the Redirection URL in the Add a Port 80 Redirector VS section and click Add HTTP Redirector. This creates a redirect Virtual Service on port 80 with the same IP address. 4.1.1.2
Create the SubVSs
Follow the instructions below to set up the SubVSs: In the Real Servers section of the Virtual Services options page, click the Add SubVS button. A message stating that the SubVS is created appears, click OK. The Real Servers section should now be renamed to SubVSs. The following steps deal with creating a SubVS for an Exchange service such as owa. In the SubVSs section of the SubVS options page, click the Modify button next to the SubVS and select the following options:
Figure 4-16: Basic Properties
a) In the SubVS Name field enter a relevant name such as OWA and click Set Nickname. b) In the SubVS Type field, select the HTTP/HTTPS option. Expand the Real Servers section.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
18
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-18: Real Servers
In the Real Servers section make the following selections: a) Enter 443 as the Checked Port and click the Set Check Port button. b) Enter /owa/healthcheck.htm in the URL field and click the Set URL button. c) Ensure the Use HTTP/1.1 check box is not selected. d) Select GET from the HTTP Method drop-down list. When finished editing the SubVS, click Back. Now you can add other SubVSs to this Virtual Service as needed. Configure each SubVS using the settings in the table below. SubVS Name
Healthcheck URL
OWA (as in steps above) Autodiscover ECP EWS ActiveSync OAB Powershell RPC MAPI
/owa/healthcheck.htm /autodiscover/healthcheck.htm /ecp/healthcheck.htm /ews/healthcheck.htm /microsoft-serveractivesync/healthcheck.htm /oab/healthcheck.htm /powershell/healthcheck.htm /rpc/healthcheck.htm /mapi/healthcheck.htm Table 4-1: Health Check URLs
4.1.1.3
Create Content Rules
Content Rules must be created for the Virtual Services to function correctly. To create a Modify URL rule for owa please complete the following steps: Select the Rules & Checking > Content Rules menu option. Click the Create New button.
Figure 4-20: Redirect_Root Content Rule
Enter a relevant name, for example Redirect_Root, in the Rule Name field.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
19
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Select Modify URL from the Rule Type drop-down list. Enter /^\/$/ in the Match String field. Enter /owa in the Modified URL field. Click the Create Rule button. To create a Content Matching rule for owa please complete the following steps: Select the Rules & Checking > Content Rules menu option. Click the Create New button.
Figure 4-7: OWA Content Matching Rule
Enter a relevant name, for example OWA, in the Rule Name field. Select Content Matching from the Rule Type drop-down list. Ensure Regular Expression is selected in the Match Type drop-down list. Enter /^\/owa.*/ in the Match String field. Select the Ignore Case check box. Click Create Rule. Create additional Content Matching rules following steps 1 to 8 above but using the values as described in the following table: Rule Name
Match String
Ignore Case
ActiveSync
/^\/microsoft-server-activesync.*/
yes
Autodiscover
/^\/autodiscover.*/
yes
ECP
/^\/ecp.*/
yes
EWS
/^\/ews.*/
yes
OAB
/^\/oab.*/
yes
PowerShell
/^\/powershell.*/
yes
RPC
/^\/rpc.*/
yes
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
20
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Rule Name
Match String
Ignore Case
Root
/^\/$/
yes
MAPI
/^\/mapi.*/
yes
Authentication Proxy
/^\/lm_auth_proxy*$/
yes
Table 4-2: Content Rules
4.1.1.4
Apply Content Rules
Once all Content Rules have been created, you must add these to the Virtual Services/SubVSs. Select View/Modify Services under Virtual Services. Select Modify next to the Exchange 2016 HTTPS Re-Encrypt Virtual Service.
Figure 4-23: Show Header Rules
In the Advanced Properties section, select Show Header Rules. Select the redirect rule created earlier and select Add. Click Back to return to the Virtual Service settings. Expand the Advanced Properties section.
Figure 4-24: Advanced Properties
In the Advanced Properties section, select Enable under Content Switching.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
21
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-25: SubVS Section
In the SubVS section, select None under Rules for ActiveSync.
Figure 4-26: Add Content Rules
Select the Content Rule for ActiveSync that was created in Section 4.1.1.3 and select Add. Click Back and repeat these steps for all remaining SubVSs.
4.1.2
HTTPS Offloaded Using SubVSs
To set up HTTPS Offloading Using SubVSs, follow the steps in the section below. 4.1.2.1
Create the Parent Virtual Service
Follow the instructions below to set up the parent HTTPS Virtual Service: Select the Add New option within the Virtual Services section of the main menu tree.
Figure 4-27: Virtual Service Parameters
Enter the IP address of the Virtual Service in the Virtual Address field. Enter 443 in the Port field.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
22
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Type a name, for example Exchange 2016 HTTPS Offloaded in the Service Name field. Select tcp in the Protocol drop-down list. Click the Add this Virtual Service button to add the Virtual Service.
Figure 4-28: Virtual Service Parameters
Within the Basic Properties section of the Virtual Services options page, select the following options: a) Select HTTP/HTTPS from the Service Type drop-down list. Expand the Standard Options section.
Figure 4-29: Standard Options
Within the Standard Options section of the Virtual Services options page, set the fields as outlined below: a) Ensure the Force L4 check box is clear. b) Ensure the Transparency check box is clear. c) Select none from the Persistence Options drop-down list. d) Select round robin from the Scheduling Method drop-down list. e) Enter 1800 in the Idle Connection Timeout field and click the Set Idle Timeout button. Expand the SSL Properties section.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
23
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-30: SSL Properties
Select the Enabled check box and click OK. Ensure the Reencrypt check box is not selected. Select the Certificate to be used for encryption and click > to Assigned Certificates. Select BestPractices from the Cipher Set drop-down list and Click Set Certificate. Expand the Advanced Properties section.
Figure 4-31: Advanced Properties
Within the Advanced Properties section, select the following options: a) Enter https://%h%s is the value of the Redirection URL in the Add a Port 80 Redirector VS section. Click Add HTTP Redirector. This creates a redirect Virtual Service on port 80 with the same IP address.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
24
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
4.1.2.2
Create the SubVSs
Follow the instructions below to set up the SubVSs: Expand the Real Servers section of the Virtual Services options page and click Add SubVS… Click OK on the message, which appears. The Real Servers section should now be called SubVSs. The following steps deal with creating a SubVS for an Exchange service such as owa. In the SubVSs section of the SubVS options page, click the Modify button next to the SubVS and select the following options:
Figure 4-33: Basic Properties
a) In the SubVS Name field enter a relevant name such as OWA and click Set Nickname. b) In the SubVS Type field, select the HTTP/HTTPS option.
Figure 4-35: Real Servers
In the Real Servers section of the SubVS options page select the following options: a) Enter 80 in the Checked Port field and click Set Check Port. b) Enter /owa/healthcheck.htm in the URL field and click the Set URL button. c) Ensure the Use HTTP/1.1 check box is not selected. d) Select GET from the HTTP Method drop-down list. When finished editing the SubVS, click Back. Now you can add other SubVSs to this Virtual Service as needed. Configure each SubVS using the settings in the following table: SubVS Name
OWA (as in steps above) Autodiscover
Healthcheck URL
/owa/healthcheck.htm /autodiscover/healthcheck.htm
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
25
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
SubVS Name
ECP EWS ActiveSync OAB Powershell RPC MAPI
Healthcheck URL
/ecp/healthcheck.htm /ews/healthcheck.htm /microsoft-server-activesync/healthcheck.htm /oab/healthcheck.htm /powershell/healthcheck.htm /rpc/healthcheck.htm /mapi/healthcheck.htm Table 4-3: Health Check URLs
4.1.2.3
Create Content Rules
Content Rules need to be created for the Virtual Services to function correctly. To create a Modify URL rule for owa please complete the following steps: Select the Rules & Checking > Content Rules menu option. Click the Create New button.
Figure 4-37: Redirect_Root Content Rule
Enter a relevant name, for example Redirect_Root in the Rule Name field. Select Modify URL from the Rule Type drop-down. Enter /^\/$/ in the Match String field. Enter /owa in the Modified URL field. Click the Create Rule button. To create a Content Matching rule for owa please complete the following steps: Select the Rules & Checking > Content Rules menu option. Click the Create New button.
Figure 4-39: OWA Content Matching Rule
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
26
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Enter a relevant name, for example OWA in the Rule Name field. Select Content Matching from the Rule Type drop-down list. Select Regular Expression from the Match Type drop-down list. Enter /^\/owa.*/ in the Match String field. Select the Ignore Case check box. Click Create Rule. Create additional Content Matching rules following steps 1 to 8 above but using the values as described in the table below. Rule Name
Match String
Ignore Case
ActiveSync
/^\/microsoft-server-activesync.*/
yes
Autodiscover
/^\/autodiscover.*/
yes
ECP
/^\/ecp.*/
yes
EWS
/^\/ews.*/
yes
OAB
/^\/oab.*/
yes
PowerShell
/^\/powershell.*/
yes
RPC
/^\/rpc.*/
yes
Root
/^\/$/
yes
MAPI
/^\/mapi.*/
yes
Table 4-4: Content Rules
4.1.2.4
Apply Content Rules
After creating all Content Rules, add them to the Virtual Services/ SubVSs. Select View/Modify Services under Virtual Services. Select Modify next to the Exchange 2016 HTTPS Offloaded Virtual Service. In the Advanced Properties section, select Show Header Rules.
Figure 4 40: Show Header Rules
Select the Redirect Rule created earlier and click Add. Click Back to return to the Virtual Service settings.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
27
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-41: Advanced Properties
In the Advanced Properties section, select Enable beside Content Switching.
Figure 4-42: SubVS Section
In the SubVS section, select None under Rules for ActiveSync.
Figure 4-43: Add Content Rules
Select the Content Rule for ActiveSync created in Section 4.1.1.3 and then click Add. Click Back and repeat these steps for all remaining SubVSs.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
28
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
4.1.3
HTTPS Re-Encrypt Using ESP and SubVSs
To set up HTTPS Offloading Using ESP, follow the steps in the section below. 4.1.3.1
Create the Parent Virtual Service
Follow the instructions below to set up the parent HTTPS Virtual Service: Select the Add New option within the Virtual Services section of the main menu tree.
Figure 4-44: Virtual Service Parameters
Enter the IP address of the Virtual Service in the Virtual Address field. Enter 443 in the Port field. Type a name, for example Exchange 2016 HTTPS Reencrypt with ESP in the Service Name field. Select tcp in the Protocol drop-down list. Click the Add this Virtual Service button to add the Virtual Service.
Figure 4-45: Basic Parameters
Within the Basic Properties section of the Virtual Services options page, select the following options: a) Select HTTP/HTTPS in the Service Type drop-down list.
Figure 4-46: Standard Options
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
29
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Within the Standard Options section of the Virtual Services options page, set the fields as outlined below: a) Ensure the Force L4 check box is clear. b) Ensure the Transparency check box is clear. c) Ensure none is selected from the Persistence Options drop-down list. d) Ensure round robin is selected from the Scheduling Method drop-down list. e) Enter 1800 in the Idle Connection Timeout field and click the Set Idle Timeout button. Expand the SSL Properties section.
Figure 4-47: SSL Properties
Select the Enabled check box. Select the Reencrypt check box. Select BestPractices from the Cipher Set drop-down list. Expand the Advanced Properties section.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
30
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-48: Advanced Properties
Within the Advanced Properties section, select the following options: a) Ensure https://%h%s is the value of the Redirect URL in the Add a Port 80 Redirector VS section. Click Add HTTP Redirector. This creates a redirect Virtual Service on port 80 with the same IP address. 4.1.3.2
Create the SubVSs
Follow the instructions below to set up the SubVSs: In the Real Servers section of the Virtual Services options page, click the Add SubVS button. A message stating that the SubVS has been created appears, click OK. The Real Servers section should now be renamed to SubVSs. The following steps deal with creating a SubVS for an Exchange service such as owa. In the SubVSs section of the SubVS options page, click the Modify button next to the SubVS and select the following options:
Figure 4-50: Basic Properties
a) In the SubVS Name field enter a relevant name such as OWA and click Set Nickname. b) In the SubVS Type field, select the HTTP/HTTPS option. The configuration of SubVS ESP is outlined in Section 4.1.3.3.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
31
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-52: Real Servers
In the Real Servers section of the SubVS options page select the following options: a) Select HTTPS Protocol from the Real Server Check Parameters drop-down list. b) Enter 443 as the Checked Port and click Set Check Port. c) Enter /owa/healthcheck.htm in the URL field and click Set URL. d) Ensure the Use HTTP/1.1 check box is not selected. e) Ensure the GET option is selected from the HTTP Method drop-down list. When finished editing the SubVS, click Back. Now you can add other SubVSs to this Virtual Service as needed. Configure each SubVS using the settings in the table below. SubVS Name
Healthcheck URL
OWA (as in steps above) Autodiscover ECP EWS ActiveSync
/owa/healthcheck.htm /autodiscover/healthcheck.htm /ecp/healthcheck.htm /ews/healthcheck.htm /microsoft-serveractivesync/healthcheck.htm /oab/healthcheck.htm /powershell/healthcheck.htm /rpc/healthcheck.htm /mapi/healthcheck.htm
OAB Powershell RPC MAPI Authentication Proxy
Table 4-5: Health Check URLs
If you are using Kerberos Constrained Delegation (KCD) please ensure you add a Real Server to the Authentication Proxy SubVS. For further information on KCD, refer to the KCD, Feature Description. 4.1.3.3
Enable ESP
To enable ESP follow the steps below:
Figure 4-53: ESP Options
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
32
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
For each of the SubVSs created, ensure that in the ESP section, the Enable ESP check box is selected, and select the following options: a) Select the User Access, Security and Connection check boxes in ESP Logging. b) Select the relevant SSO Domain. For instructions on how to add an SSO domain, refer to the ESP, Feature Description. Enter all of the allowed virtual hosts into the Allowed Virtual Hosts text box, for example mail.example.com, and click the Set Allowed Virtual Hosts button. Configure each SubVS using the settings in the table below: SubVS Name
Allowed Virtual Directories
Autodiscover
/autodiscover*
ECP
/ecp*
EWS
/ews*
ActiveSync
OAB
/microsoftserveractivesync* /oab*
Powershell
/powershell*
RPC
/rpc*
OWA
/owa*
MAPI
/mapi*
Authentication Proxy
/*
Pre-Authorization Excluded Directories Client Auth. mode
Server Auth. mode
Delegate to Server Form Based
None
Delegate to Server Basic Auth.
None
n/a
Basic Auth.
n/a
Delegate to Server Delegate to Server Delegate to Server /owa/*
None
n/a
None
n/a
None
n/a
Delegate to Server Form Based
None
Basic Auth.
Basic Auth.
Basic Auth.
SSO Greeting Message
SSO Image Set
n/a Exchange
Please enter your Exchange credentials.
Exchange
Please enter your Exchange credentials.
n/a Exchange
Please enter your Exchange credentials.
Table 4-6: SubVS Settings for ESP
GUID is unique to each Exchange deployment. To find the correct GUID, run the following command on the Exchange Server: Get-Mailbox -Arbitration | where {$_.PersistedCapabilities -like “OrganizationCapabilityClientExtensions”} | f1 exchangeGUID, primarysmtpaddress
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
33
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
The Logoff String must be set to /owa/logoff.owa in the OWA SubVS. In a customized environment, if the OWA logoff string has been changed, the modified logoff string must be entered in the Logoff String text box. The Error Code in the Authentication Proxy SubVS should be set to 503 Service Unavailable with an Error Message of Endpoint not available. The SSO Greeting Message field accepts HTML code, so the users can insert their own. An image can be entered if desired. The grave accent character ( ` ) is not supported. If this character is entered in the SSO Greeting Message, the character will not display in the output, for example a`b`c becomes abc. 4.1.3.4
Create Content Rules
Create Content Rules so that Virtual Services function correctly. To create a Modify URL rule for owa please complete the following steps: Select the Rules & Checking > Content Rules menu option. Click the Create New button.
Figure 4-54: Redirect_Root Content Rule
Enter a relevant name, for example Redirect_Root in the Rule Name field. Select the Modify URL option in the Rule Type drop-down. Enter /^\/$/ in the Match String field. Enter /owa in the Modified URL field. Click the Create Rule button. To create a Content Matching rule for owa please complete the following steps: Select the Rules & Checking > Content Rules menu option. Click the Create New button.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
34
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-56: OWA Content Matching Rule
Enter a relevant name, for example OWA in the Rule Name field. Ensure the Content Matching option is selected from the Rule Type drop-down list. Ensure the Regular Expression option is selected in the Match Type drop-down list. Enter /^\/owa.*/ in the Match String field. Select the Ignore Case check box. Click the Create Rule button. Create additional Content Matching rules following steps 1 to 8 above but using the values as described in the table below. Rule Name
Match String
Ignore Case
ActiveSync
/^\/microsoft-server-activesync.*/
yes
Autodiscover
/^\/autodiscover.*/
yes
ECP
/^\/ecp.*/
yes
EWS
/^\/ews.*/
yes
OAB
/^\/oab.*/
yes
PowerShell
/^\/powershell.*/
yes
RPC
/^\/rpc.*/
yes
Root
/^\/$/
yes
MAPI
/^\/mapi.*/
yes
Authentication Proxy
/^\/lm_auth_proxy*$/
yes
Table 4-7 Content Rules
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
35
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
4.1.3.5
Apply Content Rules
Once all Content Rules have been created, you must add these to the Virtual Services/ SubVSs. Select View/Modify Services under Virtual Services. Select Modify next to the Exchange 2016 HTTPS Reencrypt with ESP Virtual Service.
Figure 4-57: Show Header Rules
In the Advanced Properties section, click Show Header Rules. Select the Redirect Rule created earlier and click Add. Click Back to return to the Virtual Service settings.
Figure 4-58: Advanced Properties
In the Advanced Properties section, select Enable under Content Switching.
Figure 4-59: SubVS Section
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
36
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
In the SubVS section, select None under Rules for ActiveSync.
Figure 4-60: Add Content Rules
Select the Content Rule for ActiveSync that was created in Section 4.1.3.3 and click Add. Click Back and repeat these steps for all remaining SubVSs.
4.1.4
HTTPS Re-Encrypt Using ESP, WAF and SubVSs
Before configuring the WAF settings, please download and install the latest commercial rulesets. For further information on WAF, please refer to the KEMP Web Application Firewall, Feature Description. Follow the instructions below to set up the parent HTTPS reencrypted Virtual Service with ESP and WAF: In the main menu of the LoadMaster WUI, go to Virtual Services and click Add New.
Figure 4-8: Virtual Service parameters
Enter a valid Virtual Address. Enter 443 as the Port. Enter a Service Name, for example Exchange 2016 HTTPS Reencrypted with ESP and WAF. Click Add this Virtual Service.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
37
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-9: Standard Options
Remove the tick from the Transparency check box. Enter 1800 in the Idle Connection Timeout text box and click Set Idle Timeout. Expand the SSL Properties section.
Figure 4-10: SSL Properties
Tick the Enabled check box. Tick the Reencrypt check box. Select BestPractices as the Cipher Set.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
38
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Expand the Advanced Properties section.
Figure 4-11: Advanced Properties
Click the Add HTTP Redirector button. This creates a redirect Virtual Service on port 80 with the same IP address. Expand the WAF Options section.
Figure 4-12: WAF Options
Tick the Enabled check box. Tick the following rulesets in the Available Rules box: owasp_protocol_violations owasp_protocol_anomalies owasp_bad_robots
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
39
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
owasp_generic_attacks owasp_common_exceptions owa_attacks All rules should be enabled for each of these rulesets. Click Apply.
After setting up the parent Virtual Service, the SubVSs must be added and configured. The steps to add the SubVSs, enable ESP, create the content rules and assign the rules are the same as those in Sections 4.1.3.2, 4.1.3.3, 4.1.3.4 and 4.1.3.5. In the redirect Virtual Service which was created, change the Persistence Mode to None and change the Real Server Check Method to None.
4.1.5
HTTPS Offloaded Using ESP and SubVSs
To set up HTTPS Offloading Using ESP, follow the steps in the section below. 4.1.5.1
Create the Parent Virtual Service
Follow the instructions below to set up the parent HTTPS Virtual Service: Select the Add New option within the Virtual Services section of the main menu tree.
Figure 4-61: Virtual Service Parameters
Enter the IP address of the Virtual Service in the Virtual Address field. Enter 443 in the Port field. Type a name, for example Exchange 2016 HTTPS Offloaded with ESP in the Service Name field. Select tcp in the Protocol drop-down list. Click the Add this Virtual Service button to add the Virtual Service.
Figure 4-62: Basic Properties
Select the following options: a) Select HTTP/HTTPS from the Service Type drop-down list. Expand the Standard Options section.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
40
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-63: Standard Options
Within the Standard Options section, set the fields as outlined below: a) Ensure the Force L4 check box is clear. b) Ensure the Transparency check box is clear. c) Ensure none is selected in the Persistence Options drop-down list. d) Ensure round robin is selected in the Scheduling Method drop-down list. e) Enter 1800 in the Idle Connection Timeout field and click the Set Idle Timeout button. Expand the SSL Properties section.
Figure 4-64: SSL Properties
Select the Enabled check box. Ensure the Reencrypt check box is not selected. Expand the Advanced Properties section.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
41
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-65: Advanced Properties
Select the following options: a) Ensure https://%h%s is the value of the Redirect URL in the Add a Port 80 Redirector VS section. Click Add HTTP Redirector. This creates a redirect Virtual Service on port 80 with the same IP address. 4.1.5.2
Create the SubVSs
Follow the instructions below to set up the SubVSs: In the Real Servers section of the Virtual Services options page, click the Add SubVS button. A message stating that the SubVS has been created appears, click OK. The Real Servers section should now be renamed to SubVSs. The following steps deal with creating a SubVS for an Exchange service such as owa. In the SubVSs section of the SubVS options page, click the Modify button next to the SubVS and select the following options:
Figure 4-67: Basic Properties
a) In the SubVS Name field enter a relevant name such as OWA and click Set Nickname. b) In the SubVS Type field select the HTTP/HTTPS option.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
42
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-68: ESP Options
The configuration of the SubVS ESP settings is outlined in Section 4.1.5.3.
Figure 4-69: Real Servers
In the Real Servers section of the SubVS options page select the following options: a) Enter 80 as the Checked Port and click Set Check Port. b) Enter /owa/healthcheck.htm in the URL field and click Set URL. c) Ensure the Use HTTP/1.1 check box is not selected. d) Ensure GET is selected from the HTTP Method drop-down list. When finished editing the SubVS, click Back. Now you can add other SubVSs to this Virtual Service as needed. Configure each SubVS using the settings in the table below. SubVS Name
Healthcheck URL
OWA (as in steps above) Autodiscover ECP EWS ActiveSync OAB Powershell RPC MAPI Authentication Proxy
/owa/healthcheck.htm /autodiscover/healthcheck.htm /ecp/healthcheck.htm /ews/healthcheck.htm /microsoft-server-activesync/healthcheck.htm /oab/healthcheck.htm /powershell/healthcheck.htm /rpc/healthcheck.htm /mapi/healthcheck.htm Table 4-8: Health check URLs
If you are using Kerberos Constrained Delegation (KCD) please ensure you add a Real Server to the Authentication Proxy SubVS.. For further information on KCD, refer to the KCD, Feature Description.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
43
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
4.1.5.3
Enable ESP
To enable ESP follow the steps below:
Figure 4-13: Enable ESP
For each of the SubVSs created, ensure that in the ESP section, the Enable ESP check box is selected, and select the following options: a) Select the User Access, Security and Connection check boxes in ESP Logging. b) Select the relevant SSO Domain. For instructions on how to add an SSO domain, refer to the ESP, Feature Description. Enter all of the allowed virtual hosts into the Allowed Virtual Hosts text box, for example mail.example.com, and click the Set Allowed Virtual Hosts button. Configure each SubVS using the settings in the table below. SubVS Name
Allowed Virtual Directories
Autodiscover
/autodiscover*
ECP
/ecp*
EWS
/ews*
ActiveSync
OAB
/microsoftserveractivesync* /oab*
Powershell
/powershell*
RPC
/rpc*
OWA
/owa*
MAPI
/mapi*
Authentication /* Proxy
Pre-Authorization Excluded Directories Client Auth. mode
Delegate to server Form Based Delegate to Server Basic Auth.
Delegate to Server Delegate to Server Delegate to Server /owa/*1 Delegate to Server Form Based
Server Auth. mode
None
SSO Image Set
SSO Greeting Message
n/a
Basic Authentication None
Exchange
Basic Authentication
n/a
None
n/a
None
n/a
None
n/a
Please enter your Exchange credentials.
n/a
Basic Authentication None
Exchange
Basic Authentication
Exchange
Please enter your Exchange credentials.
n/a Please enter your Exchange credentials.
Table 4-9: SubVS Settings for ESP
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
44
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
1
GUID is unique to each Exchange deployment. To find the correct GUID, run the following command on the Exchange Server: Get-Mailbox -Arbitration | where {$_.PersistedCapabilities -like “OrganizationCapabilityClientExtensions”} | f1 exchangeGUID, primarysmtpaddress
The Logoff String must be set to /owa/logoff.owa in the OWA SubVS. In a customized environment, if the OWA logoff string has been changed, the modified logoff string must be entered in the Logoff String text box. The Error Code in the Authentication Proxy SubVS should be set to 503 Service Unavailable with an Error Message of Endpoint not available.
The SSO Greeting Message field accepts HTML code, so the users can insert their own image if desired. The grave accent character ( ` ) is not supported. If this character is entered in the SSO Greeting Message, the character will not display in the output, for example a`b`c becomes abc. 4.1.5.4
Create Content Rules
Create the content rules so the Virtual Services function correctly. To create a Modify URL rule for owa please complete the following steps: In the main menu of the LoadMaster WUI, click Rules & Checking. Click Content Rules. Click the Create New button.
Figure 4-71: Redirect_Root Content Rule
Enter a relevant name, for example Redirect_Root in the Rule Name field. Select the Modify URL option in the Rule Type drop-down. Enter /^\/$/ in the Match String field. Enter /owa in the Modified URL field. Click the Create Rule button. To create a Content Matching rule for owa please complete the following steps: Select the Rules & Checking > Content Rules menu option. Click the Create New button.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
45
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-73: OWA Content Matching Rule
Enter a relevant name, for example OWA in the Rule Name field. Ensure the Content Matching option is selected in the Rule Type drop-down list. Ensure the Regular Expression option is selected in the Match Type drop-down list. Enter /^\/owa.*/ in the Match String field. Select the Ignore Case check box. Click the Create Rule button. Create additional Content Matching rules following steps 1 to 8 above but using the values as described in the following table: Rule Name
Match String
Ignore Case
ActiveSync
/^\/microsoft-server-activesync.*/
yes
Autodiscover
/^\/autodiscover.*/
yes
ECP
/^\/ecp.*/
yes
EWS
/^\/ews.*/
yes
OAB
/^\/oab.*/
yes
PowerShell
/^\/powershell.*/
yes
RPC
/^\/rpc.*/
yes
Root
/^\/$/
yes
MAPI
/^\/mapi.*/
yes
Authentication Proxy
/^\/lm_auth_proxy*$/
yes
Table 4-9 Content Rules
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
46
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
4.1.5.5
Apply Content Rules
Once all Content Rules have been created, you must add these to the Virtual Services/SubVSs: Select View/Modify Services under Virtual Services. Click Modify next to the Exchange 2016 HTTPS Offloaded with ESP Virtual Service.
Figure 4-74: Show Header Rules
In the Advanced Properties section, click Show Header Rules. Select the Redirect Rule created earlier and click Add. Click Back to return to the Virtual Service settings.
Figure 4-75: Advanced Properties
In the Advanced Properties section, select Enable under Content Switching.
Figure 4-76: SubVS Section
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
47
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
In the SubVS section, click None under Rules for ActiveSync.
Figure 4-77: Add Content Rules
Select the Content Rule for ActiveSync that was created in Section 4.1.1.3 and select Add. Click Back and repeat these steps for all remaining SubVSs.
4.1.6
HTTPS Offloaded Using ESP, WAF and SubVSs
Before configuring the Web Application Firewall (WAF) settings, please download and install the latest commercial rulesets. For further information on WAF, please refer to the KEMP Web Application Firewall, Feature Description. Follow the instructions below to set up the parent Exchange 2016 HTTPS Offloaded with ESP and WAF Virtual Service: In the main menu, go to Virtual Services and click Add New.
Figure 4-14: Virtual Service properties
Enter a valid IP address in the Virtual Address text box. Enter 443 as the Port. Enter a Service Name, for example Exchange 2016 HTTPS Offloaded with ESP and WAF. Click Add this Virtual Service.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
48
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-15: Standard Options
Expand the Standard Options section. Enter 1800 into the Idle Connection Timeout text box and click Set Idle Timeout. Expand the SSL Properties section.
Figure 4-16: SSL Properties
Select the Enabled check box. Select BestPractices as the Cipher Set. Expand the Advanced Properties section.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
49
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-17: Advanced Properties
Click the Add HTTP Redirector button. This creates a redirect Virtual Service on port 80 with the same IP address. Expand the WAF Options section.
Figure 4-18: WAF Options
Select the Enabled check box. In the Available Rulesets list, tick the following rules: owasp_protocol_violations owasp_protocol_anomalies owasp_bad_robots owasp_generic_attacks owasp_common_exceptions
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
50
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
owa_attacks All rules should be enabled for each of these rulesets. Click Apply.
After setting up the parent Virtual Service, the SubVSs must be added and configured. The steps to add the SubVSs, enable ESP, create the content rules and assign the rules are the same as those in Sections 4.1.5.2, 4.1.5.3, 4.1.5.4 and 4.1.5.5. In the redirect Virtual Service which was created, change the Persistence Mode to None and change the Real Server Check Method to None.
4.2
Office Online Server Virtual Service
Follow the instructions below to set up an Office Online Server Virtual Service: In the main menu of the LoadMaster WUI, go to Virtual Services and click Add New.
Figure 4-19: Virtual Service parameters
Enter a valid IP address in the Virtual Address text box. Enter 443 as the Port. Enter a Service Name, for example Exchange 2016 Office Online Server. Click Add this Virtual Service. Expand the SSL Properties section.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
51
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-20: SSL Properties
Tick the Enabled check box. Tick the Reencrypt check box. Select BestPractices from the Cipher Set drop-down list. Expand the Standard Options section.
Figure 4-21: Standard Options
Remove the tick from the Transparency check box. Select Super HTTP and Source IP as the Persistence Mode. Select 30 Minutes as the Persistence Timeout.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
52
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Select least connection as the Scheduling Method. Enter 1800 as the Idle Connection Timeout and click Set Idle Timeout. Expand the Real Servers section.
Figure 4-22: Real Servers section
Enter /hosting/discovery as the URL and click Set URL. Tick the Use HTTP/1.1 check box. Select GET as the HTTP Method.
4.3
IMAP Virtual Service
Follow the instructions below to set up an IMAP Virtual Service: Select the Add New option within the Virtual Services section of the main menu tree.
Figure 4-78: Virtual Service parameters
Enter the IP address of the Virtual Service in the Virtual Address field. Enter 143 in the Port field. Type a name, for example Exchange 2016 IMAP in the Service Name field. Select tcp in the Protocol drop-down list. Click the Add this Virtual Service button to add the Virtual Service.
Figure 4-79: Basic Properties
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
53
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Within the Basic Properties section of the Virtual Services options page, select the following options: a) Select Generic in the Service Type drop-down list.
Figure 4-80: Standard Options
Within the Standard Options section of the Virtual Services options page, select the following options: a) Ensure the Force L4 check box is clear. b) Ensure the Transparency check box is clear. c) Ensure IMAP4 is selected in Server Initiating Protocols drop-down list. d) Ensure none is selected in the Persistence Options drop-down list. e) Ensure round robin is selected in the Scheduling Method drop-down list. f) Enter 3600 in the Idle Connection Timeout text box and click Set Idle Timeout.
Figure 4-81: SSL Properties
Within the SSL Properties section, ensure that the SSL Acceleration check box is not selected.
Figure 4-82: Advanced Properties
Do not change any of the options within the Advanced Options section.
Figure 4-83: Real Servers section
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
54
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Within the Real Servers section of the Virtual Services options page, select the following options: a) Ensure Mailbox (IMAP) Protocol has been selected as the health-checking option. b) Enter 143 in the Checked Port field and click on the Set Check Port button.
4.3.1
IMAP STARTTLS Virtual Service
To configure the IMAP STARTTLS Virtual Service, follow the steps below: Select the Add New option within the Virtual Services section of the main menu tree.
Figure 4-84: Virtual Service Parameters
Enter a Virtual Address. Enter 143 as the Port. Enter a recognizable Service Name, for example Exchange 2016 IMAP with STARTTLS.
Figure 4-85: Basic Properties
Within the Basic Properties section of the Virtual Services options page, select the following options: a) Select STARTTLS protocols in the Service Type drop-down list.
Figure 4-86: Standard Options
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
55
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Within the Standard Options section of the Virtual Services options page, select the following options: a) Remove the tick from the Transparency check box. b) Ensure IMAP is selected in the STARTTLS mode drop-down list. c) Enter 3600 in the Idle Connection Timeout field and click Set Idle Timeout.
Figure 4-87: Real Servers section
In the Real Servers section, enter 143 in the Checked Port text box and click the Set Check Port button.
4.3.2
IMAPS Virtual Service
To configure the IMAPS Virtual Service, follow the steps below: Select the Add New option within the Virtual Services section of the main menu tree.
Figure 4-88: Virtual Service Parameters
Enter the IP address in the Virtual Address text box. Enter 993 in the Port field. Enter a recognizable Service Name, for example Exchange 2016 IMAPS. Click Add this Virtual Service.
Figure 4-89: Standard Options
Within the Standard Options section of the Virtual Services options page: a) Remove the tick from the Transparency check box. b) Select IMAP4 in the Server Initiating Protocols drop-down list.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
56
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
c) Enter 3600 in the Idle Connection Timeout field and click Set Idle Timeout.
Figure 4-90: Real Servers section
Within the Real Servers section of the Virtual Services options page, select the following options: a) Ensure TCP Connection Only is selected as the health-checking option. b) Enter 993 in the Checked Port field and click the Set Check Port button.
4.3.3
IMAPS Offloaded Virtual Service
To configure the IMAPS Offloaded, follow the steps below: Select the Add New option within the Virtual Services section of the main menu tree.
Figure 4-91: Virtual Service parameters
Enter the IP address of the Virtual Service in the Virtual Address field. Enter 993 in the Port field. Enter a recognizable Service Name, for example Exchange 2016 IMAPS Offloaded.
Figure 4-92: Standard Options
Within the Standard Options section of the Virtual Services options page, set the following options: a) Remove the tick from the Transparency check box. b) Select IMAP4 in the Server Initiating Protocols drop-down list. c) Enter 3600 in the Idle Connection Timeout field and click the Set Idle Timeout button.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
57
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-93: SSL Properties
In the SSL Properties section, select the SSL Acceleration - Enabled check box. Click OK.
Figure 4-94: SSL Properties
In the Real Servers section of the Virtual Services options page, select the following options: a) Ensure Mailbox (IMAP) Protocol is selected as the health-checking option. b) Enter 143 in the Checked Port text box and click Set Check Port.
4.4
POP Virtual Service
Follow the instructions below to set up a POP Virtual Service: Select the Add New option within the Virtual Services section of the main menu tree.
Figure 4-95: Virtual Service Parameters
Enter the IP address of the Virtual Service in the Virtual Address field. Enter 110 in the Port field. Type a name, for example Exchange 2016 POP in the Service Name field.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
58
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Select tcp in the Protocol drop-down list. Click the Add this Virtual Service button to add the Virtual Service.
Figure 4-96: Basic Properties
Within the Basic Properties section of the Virtual Services options page, select the following options: a) Select Generic in the Service Type drop-down list.
Figure 4-97: Standard Options
Within the Standard Options section of the Virtual Services options page, select the following options: a) Ensure the Force L4 check box is clear. b) Ensure the Transparency check box is clear. c) Ensure POP3 is selected in Server Initiating Protocols drop-down list. d) Ensure none is selected in the Persistence Options drop-down list. e) Ensure round robin is selected in the Scheduling Method drop-down list. f) Enter 3600 in the Idle Connection Timeout field and click Set Idle Timeout.
Figure 4-99: Real Servers section
Within the Real Servers section of the Virtual Services options page, select the following options: a) Ensure Mailbox (POP3) Protocol has been selected as the health-checking option. b) Enter 110 in the Checked Port field and click the Set Check Port button.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
59
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
4.4.1
POP with STARTTLS Virtual Service
To configure a POP Virtual Service with STARTTLS, follow the steps below: Select the Add New option within the Virtual Services section of the main menu tree.
Figure 4-100: Virtual Service Parameters
Enter a valid IP address in the Virtual Address text box. Enter 110 as the Port. Enter a recognizable Service Name, for example Exchange 2016 POP with STARTTLS. Click Add this Virtual Service.
Figure 4-101: Basic Properties
Within the Basic Properties section of the Virtual Services options page, select the following options: a) Select STARTTLS protocols in the Service Type drop-down list.
Figure 4-102: Standard Options
Within the Standard Options section of the Virtual Services options page, select the following options: a) Remove the tick from the Transparency check box. b) Enter 3600 in the Idle Connection Timeout text box and click Set Idle Timeout.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
60
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-103: Real Servers section
In the Real Servers section, make the following selections: a) Select Mailbox (POP3) Protocol from the Real Server Check Parameters drop-down list. b) Enter 110 in the Checked Port text box and click the Set Check Port button.
4.4.2
POPS Virtual Service
To configure a POPS VS, follow the steps below: Select the Add New option within the Virtual Services section of the main menu tree.
Figure 4-104: Virtual Service Parameters
Enter a valid IP address in the Virtual Address text box. Enter 995 in the Port field. Enter a recognizable Service Name, for example Exchange 2016 POPS.
Figure 4-105: Standard Options
In the Standard Options section: a) Remove the tick from the Transparency check box. b) Select POP3 in the Server Initiating Protocols drop-down list. c) Enter 3600 in the Idle Connection Timeout text box and click Set Idle Timeout.
Figure 4-106: Real Servers section
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
61
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Within the Real Servers section of the Virtual Services options page, enter 995 in the Checked Port field and click the Set Check Port button.
4.4.3
POPS Offloaded Virtual Service
To configure a POPS Offloaded Virtual Service, follow the steps below: Select the Add New option within the Virtual Services section of the main menu tree.
Figure 4-107: Virtual Service Parameters
Enter a valid IP address in the Virtual Address text box. Enter 995 in the Port field. Enter a recognizable Service Name, for example Exchange 2016 POPS Offloaded. Click Add this Virtual Service.
Figure 4-108: Standard Options
Within the Standard Options section of the Virtual Services options page: a) Remove the tick from the Transparency check box. b) Select POP3 in the Server Initiating Protocols drop-down list. c) Enter 3600 in the Idle Connection Timeout text box and click Set Idle Timeout.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
62
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-109: SSL Properties
Within the SSL Properties section, select the SSL Acceleration - Enabled check box. Click OK.
Figure 4-110: Real Servers section
Within the Real Servers section: a) Select Mailbox (POP3) Protocol from the Real Server Check Parameters dropdown list. b) Enter 110 in the Checked Port text box and click Set Check Port.
4.5
SMTP Virtual Service
Follow the instructions below to set up an SMTP Virtual Service: Select the Add New option within the Virtual Services section of the main menu tree.
Figure 4-111: Virtual Service parameters
Enter the IP address of the Virtual Service in the Virtual Address field. Enter 25 in the Port field. Type a name, for example Exchange 2016 SMTP in the Service Name field. Select tcp in the Protocol drop-down list.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
63
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Click the Add this Virtual Service button to add the Virtual Service.
Figure 4-112: Basic Properties
Within the Basic Properties section of the Virtual Services options page, select the following options: a) Select Generic from the Service Type drop-down list
Figure 4-113: Standard Options
Within the Standard Options section of the Virtual Services options page, select the following options: a) Ensure the Force L4 check box is clear. b) Ensure the Transparency check box is clear. c) Ensure SMTP is selected in Server Initiating Protocols drop-down list. d) Select Source IP Address as the Persistence Mode. e) Set the Timeout value to 1 Hour. f) Ensure round robin is selected in the Scheduling Method drop-down list. g) Enter to 120 in the Idle Connection Timeout text box and click Set Idle Timeout.
Figure 4-117: Real Servers section
Within the Real Servers section of the Virtual Services options page, select the following options: a) Ensure Mailbox (SMTP) Protocol is selected as the health-checking option. b) Enter 25 in the Checked Port field and click the Set Check Port button.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
64
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
4.5.1
SMTPS Virtual Service
To configure an SMTPS Virtual Service, follow the steps below: In the main menu of the LoadMaster WUI, select Virtual Services and Add New.
Figure 4-118: Virtual Service Parameters
Enter a valid IP address in the Virtual Address text box. Enter 587 as the Port. Enter a recognizable Service Name, for example Exchange 2016 SMTPS. Click Add this Virtual Service.
Figure 4-119: Standard Options
Within the Standard Options section, set the fields as follows: a) Remove the tick from the Transparency check box. b) Select SMTP from the Server Initiating Protocols drop-down list. c) Set the Persistence Mode to Source IP Address. d) Set the Timeout value to 1 Hour. e) Enter 120 in the Idle Connection Timeout text box and click Set Idle Timeout.
Figure 4-120: Real Servers section
In the Real Servers section, enter 587 and click Set Check Port.
4.5.2
SMTPS Offloaded Virtual Service
To configure a SMTPS Offloaded Virtual Service, follow the steps below: In the main menu of the LoadMaster WUI, select Virtual Services and Add New. Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
65
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-121: Virtual Service Parameters
Enter a valid IP address in the Virtual Address text box. Enter 587 in the Port field. Enter a recognizable Service Name, for example Exchange 2016 SMTPS Offloaded. Click Add this Virtual Service. Within the SSL Properties section, select Enabled. Click OK.
Figure 4-122: Standard Options
Within the Standard Options section of the Virtual Services options page, select the following options: a) Remove the tick from the Transparency check box. b) Select SMTP in the Server Initiating Protocols drop-down list. c) Select Source IP Address as the Persistence Mode. d) Select 1 Hour as the Timeout value. e) Enter 120 in the Idle Connection Timeout field and click Set Idle Timeout.
Figure 4-123: Real Server Options
Within the Real Servers section of the Virtual Services options page: a) Select Mail (SMTP) Protocol as the health-checking option. b) Enter 25 in the Checked Port text box and click Set Check Port.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
66
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
4.5.3
SMTP with STARTTLS Virtual Service
To configure a SMTP Virtual Service with STARTTLS, follow the steps below: In the main menu of the LoadMaster WUI, select Virtual Services and Add New.
Figure 4-124: Virtual Service Parameters
Enter a valid IP address in the Virtual Address text box. Enter 25 as the Port. Enter a recognizable Service Name, for example Exchange 2016 SMTP with STARTTLS. Click Add this Virtual Service.
Figure 125: Basic Properties
Within the Basic Properties section of the Virtual Services options page: a) Select STARTTLS protocols in the Service Type drop-down list.
Figure 4-126: Standard Options
Within the Standard Options section of the Virtual Services options page: a) Remove the tick from the Transparency check box. b) Ensure SMTP (STARTTLS if requested) is selected in the STARTTLS mode dropdown list. c) Set the Persistence Mode to Source IP Address. d) Set the Timeout value to 1 Hour.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
67
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
e) Enter 120 in the Idle Connection Timeout text box and click Set Idle Timeout.
Figure 4-127: Real Servers
In the Real Servers section: a) Enter 25 in the Checked Port text box and click Set Check Port.
4.5.4
SMTP with ESP Virtual Service
To configure a SMTP VS with ESP, follow the steps below: In the main menu of the LoadMaster WUI, select Virtual Services and Add New.
Figure 4-128: Virtual Service parameters
Enter a valid IP address in the Virtual Address text box. Enter 25 as the Port. Enter a recognizable Service Name, for example Exchange 2016 SMTP with ESP. Click Add this Virtual Service.
Figure 4-129: Standard Options
Within the Standard Options section, set the fields as follows: a) Remove the tick from the Transparency check box. b) Ensure SMTP is selected in the Server Initiating Protocols drop-down list. c) Set the Persistence Mode to Source IP Address. d) Set the Timeout value to 1 Hour. e) Enter 120 in the Idle Connection Timeout text box and click Set Idle Timeout.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
68
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-130: ESP Options
Within the ESP Options section, select the following options: a) Ensure the Enable ESP check box is selected. b) Ensure the Connection Logging check box is selected. c) Enter the all the permitted domains allowed to be received by this service and click the Set Permitted Domains button. (Multiple permitted domains can be entered using a space-separated list)
Figure 4-131: Real Servers section
Within the Real Servers section, set the fields as follows: a) Select Mail (SMTP) Protocol from the Real Server Check Parameters drop-down list. b) Enter 25 in the Checked Port text box and click Set Check Port.
4.5.5
Office Online Server Virtual Service
To configure a Virtual Service for Office Online Servers, follow the steps below: Click the Add New button.
Figure 4-132: Add New VS screen
Enter a Virtual Address. Enter 443 in the Port field. Enter a recognisable Service Name, for example Office Online Server. Ensure TCP is set as the Protocol. Click Add This Virtual Service.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
69
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-134: SSL Properties section
Expand the SSL Properties section and select the following options: a) Select the Enabled check box. b) Select the Reencrypt check box.
Figure 4-133: Standard Options section
Expand the Standard Options section and select the following options: a) Select Super HTTP and Source IP as the Persistence Mode. b) Select 30 Minutes as the Persistence Timeout. c) Select least connection as the Scheduling Method. d) Enter 1800 in the Idle Connection Timeout field and click Set Idle Timeout.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
70
MS Exchange 2016 Configuring Virtual Services for Exchange 2016
Figure 4-135: Real Servers Section
Expand the Real Servers section and select the following options: a) Select HTTPS Protocol in the drop-down menu. b) Enter /hosting/discovery in the URL field and click Set URL. c) Select the Use HTTP/1.1 check box. d) Select GET as the HTTP Method.
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
71
MS Exchange 2016 References
References Unless otherwise specified, the documents below can be found at http://www.kemptechnologies.com/documentation Web User Interface (WUI), Configuration Guide Virtual Services and Templates, Feature Description ESP, Feature Description Microsoft Exchange 2010, Deployment Guide Microsoft Exchange 2013, Deployment Guide Exchange Team Blog post on Load Balancing in Exchange 2016 http://blogs.technet.com/b/exchange/archive/2015/10/08/load-balancing-inexchange-2016.aspx KCD, Feature Description KEMP Web Application Firewall, Feature Description
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
72
MS Exchange 2016 Document History
Document History Date
Change
Reason for Change
Ver.
Resp.
Feb 2016
Initial draft
First draft of document
1.0
KG
Mar 2016
Minor updates
Enhancements made
2.0
LB
July 2016
Release updates
Updates for 7.1.35
3.0
LB
Oct 2016
Release updates
Updates for 7.2.36
4.0
POC
Copyright © 2002 - 2016 KEMP Technologies, Inc. All Rights Reserved.
73
