Safeguard Exchange for Mobile-Device Access

How much of a problem this is for your network depends on how you've configured SSL. If you enable SSL from the Internet to the front-end server, you can disable SSL on the back-end server's Exchange virtual directory, and OMA and Exchange ActiveSync will work. After all, the crucial path is really from the client to your front-end server. However, if you want to force the use of SSL on the back end, too, you need a workaround to enable Exchange ActiveSync and OMA to work properly. The exact steps required vary somewhat depending on what you're trying to do:

• If you want OMA only and you want to use FBA but not SSL, don't do anything.
• If you want OMA to work with SSL enabled on the Exchange virtual directory, create an alternate virtual directory by using either Exchange System Manager (ESM) or the Microsoft Management Console (MMC) IIS Manager snap-in.
• If you want to use Exchange ActiveSync and enable either SSL or FBA on the Exchange virtual directory, use the IIS Manager snap-in to create an alternate virtual directory. Creating virtual servers from within ESM copies the "use FBA" flag from the existing server. Then, you can point OMA to the alternate virtual directory also. The Microsoft article "Cannot Access Exchange Server 2003 by Using Outlook Mobile Access When the Exchange Virtual Directory Requires SSL or Uses Forms-Based Authentication" (http://support.microsoft.com/?kbid=817379) describes the specific steps to do this.

If you have to create a new virtual directory, you must configure Exchange ActiveSync and OMA to use that new directory instead of the default by setting the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MasSync\Parameters\ExchangeVDir registry subkey (of data type REG_SZ) to the name of the new virtual directory. You should also add an IP address restriction in Microsoft IIS so that outside computers can't connect. Allow connections only from 127.0.0.1 (the loopback address for the local client), and you should be in good shape. . . .