ISSUE: Can't RPC Proxy Outlook Anywhere requests for Exchange 2010 mailbox users via the Exchange 2013 CAS NLB IP.

SYMPTOMS: Externally with TestExchangeConnectivity.com, I get 'RPC Proxy Can't Be Pinged' with 'An HTTP 401 Unauthorized response was received from the remote Unknown server'. Internally, I get password prompts with Outlook 2010.

SETUP:

Exchange 2013 CU1
CAS NLB: exchange.mydomain.com
Get-OutlookAnywhere Details:
InternalHostname: exchange.mydomain.com
ExternalHostname: exchange.mydomain.com
ExternalClientAuthenticationMethod: Negotiate
InternalClientAuthenticationMethod: Ntlm
IISAuthenticationMethods: Basic, Ntlm, Negotiate

Exchange 2010 SP3
CAS NLB: legacy.mydomain.com
CAS Array: legacy.mydomain.com
Get-OutlookAnywhere Details:
ExternalHostname: exchange.mydomain.com
ClientAuthenticationMethod: Ntlm
IISAuthenticationMethods: Basic, Ntlm

ADDITIONAL DETAILS:
- With the above settings, Outlook 2010 configures the 'Exchange Proxy Settings' with exchange.mydomain.com and NTLM authentication, which is what I want. However, Outlook 2010 doesn't seem to be able to proxy through exchange.mydomain.com as I continually get password prompts.
- If I change ExternalHostname on the Exchange 2010 side's OutlookAnywhere to legacy.mydomain.com, then Outlook 2010 uses legacy.mydomain.com for the 'Exchange Proxy Settings' and that works fine. However, I want all Outlook requests to be proxied through the Exchange 2013 CAS servers.
- For users with Exchange 2013 mailboxes, they are able to use exchange.mydomain.com as their 'Exchange Proxy Settings' without any issues. The problem therefore lies with proxying RPC requests FROM 2013 to 2010.
- Here are some pertinent lines from a 2013 CAS server's IIS logs:
 01:37:58 192.168.150.210 RPC_IN_DATA /rpc/rpcproxy.dll legacy.domain.com:6002&RequestId=d01bfb91-6fa7-47bb-a1c6-ba2cda921c3a 443 - 207.46.14.63 MSRPC - 401 2 5 15
2013-06-24 01:37:58 192.168.150.210 RPC_IN_DATA /Rpc/RpcProxy.dll legacy.domain.com:6001&RequestId=cbcd4706-9a34-499e-8b63-8b0e0b58e946 443 - 207.46.14.63 MSRPC - 401 1 2148074254 31
2013-06-24 01:37:58 192.168.150.210 RPC_IN_DATA /rpc/rpcproxy.dll &RequestId=114f4709-d614-4a6a-96e6-b33729d85cf1 443 - 207.46.14.63 MSRPC - 401 2 5 218
2013-06-24 01:37:58 192.168.150.210 RPC_IN_DATA /Rpc/RpcProxy.dll legacy.domain.com:6001&RequestId=5d1390b3-84c8-4402-849f-edefe37da159 443 DOMAIN\testuser 207.46.14.63 MSRPC - 401 0 0 62
2013-06-24 01:37:58 192.168.150.210 RPC_IN_DATA /Rpc/RpcProxy.dll legacy.domain.com:6001&RequestId=73f08b89-b71e-46c0-b3c6-5b9dbbacc5c4 443 - 207.46.14.63 MSRPC - 401 2 5 249

Any thoughts or comments are highly appreciated. Let me know if additional details are needed.

Exchange 2013 CU1
ExternalClientAuthenticationMethod: Negotiate

Hi,
Change ExternalClientAuthenticationMethod to NTLM.
Not sure if that is causing the problem you have, but Negotiate should only be used in a pure Exchange 2013 environment and can cause other problems if configured when running in co-existence with EX07/EX10.

See: http://support.microsoft.com/kb/2834139

Exchange 2013 CU1
ExternalClientAuthenticationMethod: Negotiate

Hi,
Change ExternalClientAuthenticationMethod to NTLM.
Not sure if that is causing the problem you have, but Negotiate should only be used in a pure Exchange 2013 environment and can cause other problems if configured when running in co-existence with EX07/EX10.

See: http://support.microsoft.com/kb/2834139

Are you sure that the Clients got the new setting?
If you didn't recycle the application pools MSExchangeAutodiscoverAppPool in IIS after you made the change, it would be a good thing to do. It usually triggers Outlook to get the new settings faster.

Are you sure that the Clients got the new setting?
If you didn't recycle the application pools MSExchangeAutodiscoverAppPool in IIS after you made the change, it would be a good thing to do. It usually triggers Outlook to get the new settings faster.

Hi,
You shouldn't need to hardcode any Outlookprovider.
(I assume now that you have exchange.mydomain.com both as the common name and the as the first SAN)

I haven't added any ValidPorts since Exchange 2003, so no, that is not an option.

Not sure what you mean with "hardcoding the settings into Outlook or the online tool ".

Regarding IISAuthenticationMethods...I have removed that, but also seen when it still has been enabled and it has worked.

I remember another thread, where the poster also had problems with password prompts. It was solved by enable/disable Outlook Anywhere on the legacy server. You might want to give that a try.

Does the clients with mailboxes on Exchange 2013 also have problems to connect?

Hi,
You shouldn't need to hardcode any Outlookprovider.
(I assume now that you have exchange.mydomain.com both as the common name and the as the first SAN)

I haven't added any ValidPorts since Exchange 2003, so no, that is not an option.

Not sure what you mean with "hardcoding the settings into Outlook or the online tool ".

Regarding IISAuthenticationMethods...I have removed that, but also seen when it still has been enabled and it has worked.

I remember another thread, where the poster also had problems with password prompts. It was solved by enable/disable Outlook Anywhere on the legacy server. You might want to give that a try.

Does the clients with mailboxes on Exchange 2013 also have problems to connect?

- By hardcoding I mean, explicitly setting the RPC Proxy server. For instance, with the online tool, I will select "Outlook Anywhere (RPC over HTTP)" then on the next page, I choose "Manually specify server settings". Though this still fails as with Autodiscover, to me it demonstrates that Autodiscover (and the XML response that Autodiscover returns) is not a problem. Does that make sense?

- By hardcoding I mean, explicitly setting the RPC Proxy server. For instance, with the online tool, I will select "Outlook Anywhere (RPC over HTTP)" then on the next page, I choose "Manually specify server settings". Though this still fails as with Autodiscover, to me it demonstrates that Autodiscover (and the XML response that Autodiscover returns) is not a problem. Does that make sense?

I didn't get that you were talking about ExrCA (exrca.com) :)

Disable/Enable Outlook Anywhere on EX10, might seems unnecessary but it worked for the other poster. I will see if I can find that post.

Btw..you do have changed Autodiscover.domain.com to point to your Exchange 2013 Serv

Ok, I disabled/enabled OutlookAnywhere with no difference in results. If it helps, when running "Test-OutlookConnectivity -Protocol HTTP" from the 2010 EMS and having the 2010 OutlookAnywhere set to exchange.mydomain.com, I was getting:

RunspaceId                  : 08fb1b71-1d81-4820-85f5-249e685723a8
ServiceEndpoint             : legacy.mydomain.com
Id                          : GetReferral
ClientAccessServer          : EXCA01.domain.internal
Scenario                    : RFRI::GetReferral.
ScenarioDescription         :
PerformanceCounterName      : RFR: Get referral latency
Result                      : Failure
Error                       :
UserName                    : domain.internal\extest_66a4736126034
StartTime                   : 6/24/2013 6:56:02 PM
Latency                     : 00:00:02.7337975
EventType                   : Failure
LatencyInMillisecondsString : 2733.80
Identity                    :
IsValid                     : True

Does that have any significance? When I change OutlookAnywhere for 2010 back to legacy.mydomain.com, it works fine.

Your Settings should look like the below

Exchange 2013 CU1
CAS NLB: legacy.mydomain.com - Get These CAS boxes in the Same NLB as 2010use different NLB's"
Get-OutlookAnywhere Details:
InternalHostname: exchange.mydomain.com
ExternalHostname: exchange.mydomain.com
ExternalClientAuthenticationMethod: Basic
InternalClientAuthenticationMethod: Ntlm
IISAuthenticationMethods: Basic, Ntlm, Negotiate

Exchange 2010 SP3
CAS NLB: legacy.mydomain.com
CAS Array: legacy.mydomain.com - Dosent Matter
Get-OutlookAnywhere Details:
ExternalHostname: exchange.mydomain.com

ExternalClientAuthenticationMethod: Basic
InternalClientAuthenticationMethod: Ntlm

ClientAuthenticationMethod: Ntlm
IISAuthenticationMethods: Basic, Ntlm

----Mark as answer if this helps.

Your Settings should look like the below

Exchange 2013 CU1
CAS NLB: legacy.mydomain.com - Get These CAS boxes in the Same NLB as 2010use different NLB's"
Get-OutlookAnywhere Details:
InternalHostname: exchange.mydomain.com
ExternalHostname: exchange.mydomain.com
ExternalClientAuthenticationMethod: Basic
InternalClientAuthenticationMethod: Ntlm
IISAuthenticationMethods: Basic, Ntlm, Negotiate

Exchange 2010 SP3
CAS NLB: legacy.mydomain.com
CAS Array: legacy.mydomain.com - Dosent Matter
Get-OutlookAnywhere Details:
ExternalHostname: exchange.mydomain.com

ExternalClientAuthenticationMethod: Basic
InternalClientAuthenticationMethod: Ntlm

ClientAuthenticationMethod: Ntlm
IISAuthenticationMethods: Basic, Ntlm

----Mark as answer if this helps.