We migrated from Exchange 2003 SP2 to Exch 2007 this week and our activesync users are complaining. Every so often they are prompted for credentials when syncing. They can hit cancel or enter the credentials, either way the sync will complete successfully on the next try, for example I get prompted, I hit cancel, and do a manual sync and there is no problem. I can sync successfully for an hour or so and the phone prompts me again!
ISA 2006 and Exchange 2007 (single server with all roles). For example the external IP of my ISA is 10.10.10.14 (behind a PIX) and the IP on my Exchange is 192.168.4.50. SSL is maintained from client to exchange (bridged ssl-ssl).
I see the following in the ISA logs when the device requests credentials: Successful sync is like this: (date) dest192.168.4.50 Allowed (domain\username) (long URL) error information code is 0xf80 Unsuccessful sync is like this: (date) dest10.10.10.14 Denied Connection (anonymous) (long URL) error information code is 0x200
Note that the denied request is for the 10.10.10.14 address in the log rather than the address of the Exchange box! The long URL differs, not always the same. The request is logged as anonymous so I assume that's where the device is prompted for credentials. I wonder if my timeout is too short or something? (SSL client certificate timeout 300 secs, validate credentials every 300 secs).
From: United Kingdom
Are you using a single web listener for all Exchange services?
I had seen similar problems when using a single web listener and allowing FBA to fallback to basic for ActiveSync. We solved the problem by creating two separate web listeners, one for FBA and once for Basic auth. The downside is that this requires 2 IP's and two SSL certs :-(
From: United Kingdom
Think this is sorted now.
I needed to disable the "apply session timeout to non-browser clients" in the advanced form options for the web listener that was shared for OWA and ActiveSync.
If you follow the built-in wizards, this option is disabled by default for any listener that is selected for ActiveSync use - that'll teach me!
Thanks to Jim Harrison for the pointers!
"You don't want the FBA timeout applied to EAS clients. The folks in Exch, WM6 and ISA all agreed that a wide-open 30-minute timeout was good for battery life. If you close that sooner, the client has to re-authenticate."
< Message edited by Jason Jones -- 24.Sep.2007 12:25:38 PM >