<![CDATA[Reverse Proxy RPCoverHttp Exchange 2013]]>Hello Guys, i hope somebody can point me in the right direction.

We have installed Squid3-dev package on a PF 2.1 i386. After some research we bring it to work. And the most Exchange Services working well through squid. But only the RPCoverHttp feature does not working.
We have investigated some logs and found following information:

in the access.log on the pfsense box we can see every time 3 requests that will be answered from exchange wiht http code 401,401,503.

On the exchange server we found following correspondend lines:

2014-03-19T19:33:18.567Z,xxx,RpcHttp,"S:Stage=BeginRequest;S:OutlookSessionId=""{F1FB7F7D-D891-4B8D-9D01-967DF7172FB9} Outlook=15.0.4569.1508 OS=6.2.9200 CPUArchitecture=9"";S:AuthType=Basic;S:HttpVerb=METHOD_OTHER;S:UriQueryString=?efb24183-60c0-4974-8756-a4a688110935@xxx:6001;S:RequestId=1f3bdc04-61fd-4ccb-8e3e-918d4a6afaff;S:AssociationGuid=6d82b035-2989-4d00-a8b6-79d934ea1e5a;S:ClientIp=10.1.1.254"
2014-03-19T19:33:18.567Z,xxx,RpcHttp,"S:Stage=PostAuthorizeRequest;S:UserName=xxx;S:OutlookSessionId=""{F1FB7F7D-D891-4B8D-9D01-967DF7172FB9} Outlook=15.0.4569.1508 OS=6.2.9200 CPUArchitecture=9"";S:AuthType=Basic;S:HttpVerb=METHOD_OTHER;S:UriQueryString=?efb24183-60c0-4974-8756-a4a688110935@xxx:6001;S:RequestId=1f3bdc04-61fd-4ccb-8e3e-918d4a6afaff;S:AssociationGuid=6d82b035-2989-4d00-a8b6-79d934ea1e5a;S:ClientIp=10.1.1.254"
2014-03-19T19:33:18.583Z,xxx,RpcHttp,"S:Stage=EndRequest;S:UserName=xxx;S:OutlookSessionId=""{F1FB7F7D-D891-4B8D-9D01-967DF7172FB9} Outlook=15.0.4569.1508 OS=6.2.9200 CPUArchitecture=9"";S:AuthType=Basic;**S:Status=503 Must use POST;S:HttpVerb=METHOD_OTHER;**S:UriQueryString=?efb24183-60c0-4974-8756-a4a688110935@xxx:6001;S:RequestId=1f3bdc04-61fd-4ccb-8e3e-918d4a6afaff;S:AssociationGuid=6d82b035-2989-4d00-a8b6-79d934ea1e5a;S:ClientIp=10.1.1.254"

For me it looks like that squid sends a unrecognized http-verb, and the rpc-proxy does ignore this request. I found on the internet that the extension_methods configuration key is obsolete in squid 3.2++.

Now is the question how we can bring this to work. Or has somebody experience with such setup?
Please help us to replace a old ISA-Server box.

regards Enrico

]]>https://forum.netgate.com/topic/66889/reverse-proxy-rpcoverhttp-exchange-2013RSS for NodeFri, 16 Oct 2026 20:44:07 GMTWed, 19 Mar 2014 20:50:23 GMT60<![CDATA[Reply to Reverse Proxy RPCoverHttp Exchange 2013 on Thu, 17 Apr 2014 08:31:16 GMT]]>Thanks to keyser, we have try it in our environmet. And HAproxy works for us to.

]]>https://forum.netgate.com/post/455970https://forum.netgate.com/post/455970Thu, 17 Apr 2014 08:31:16 GMT<![CDATA[Reply to Reverse Proxy RPCoverHttp Exchange 2013 on Thu, 10 Apr 2014 21:39:49 GMT]]>Btw. The mentioned setup requires the Exchange server to run SSL and have a certificate that your PFsense trusts (knows the root signer of.
So the default selfsigned certificate in exch. 2013 does not work. You need a proper cert or a selfsignet cert where your have installed the issuers root CA cert on PFsense.

]]>https://forum.netgate.com/post/454387https://forum.netgate.com/post/454387Thu, 10 Apr 2014 21:39:49 GMT<![CDATA[Reply to Reverse Proxy RPCoverHttp Exchange 2013 on Thu, 10 Apr 2014 21:34:53 GMT]]>I have only done a GUI config, and wouldn't know where to find the config file ;D

But basically i enabled HAproxy in setting and then created a Backend entry (backend tab) for my Exchange server. On that backend I just entered the LAN IP of my Exchange server and set it for port 443 and enabled SSL. Make sure "Transparent Client IP" is disabled. Everything else on that page is Default settings.

Then I created a Frontend entry (Frontend TAB - You could call it the listener part of a proxy).
Bind it to the WAN IP interface, and external port 443 and Type HTTP. Select the previously created backend as "backend server pool".

I have attached my ACL's to secure the access to the server so only valid URL path's are forwarded. Note: Two ACL's with the same name becomes a AND ACL where both statements need to be true to work.

The select SSL offloading and select the certificate you want the proxy to use on the listener (The certificate users will be presented with).
Everything else i default settings.

Remember to make an allow rule from the internet to the WAN interface port 443.

Works great for me.

Capture.JPG
Capture.JPG_thumb

]]>https://forum.netgate.com/post/454382https://forum.netgate.com/post/454382Thu, 10 Apr 2014 21:34:53 GMT<![CDATA[Reply to Reverse Proxy RPCoverHttp Exchange 2013 on Thu, 10 Apr 2014 08:49:07 GMT]]>@ keyser: Can you provide any HAproxy example configs to make Exchange 2013 get working?

@ tfjelde: We have deactivated it and problem is the same as discribed.

Best regards

]]>https://forum.netgate.com/post/454145https://forum.netgate.com/post/454145Thu, 10 Apr 2014 08:49:07 GMT<![CDATA[Reply to Reverse Proxy RPCoverHttp Exchange 2013 on Thu, 27 Mar 2014 13:54:26 GMT]]>The squid3-dev 3.3.10 pkg 2.2.1 is working with Exchange 2013 SP1 RPC over http as long as you don't activate the antivirus feature in the package.

for some reason it breaks the logon to exchange !

]]>https://forum.netgate.com/post/451285https://forum.netgate.com/post/451285Thu, 27 Mar 2014 13:54:26 GMT<![CDATA[Reply to Reverse Proxy RPCoverHttp Exchange 2013 on Wed, 26 Mar 2014 17:46:11 GMT]]>Yes, using the HAproxy-devel package which is an excellent http/https reverse proxy I have deploy'd exchange 2013 sp1 without issues.

]]>https://forum.netgate.com/post/451103https://forum.netgate.com/post/451103Wed, 26 Mar 2014 17:46:11 GMT<![CDATA[Reply to Reverse Proxy RPCoverHttp Exchange 2013 on Wed, 26 Mar 2014 07:47:32 GMT]]>No answers.

So i Try another question. Has somebody successfully deployed Outlook- anywehre with pfsense ?

]]>https://forum.netgate.com/post/450982https://forum.netgate.com/post/450982Wed, 26 Mar 2014 07:47:32 GMT