topic Okay then it's probably an in Web Security

WSA with Outlook client

ama1510 — Thu, 05 May 2016 17:22:50 GMT

I had an issue after deploying Cisco WSA as a web security gateway with outlook email client, the case as below:

1- Cisco WSA HTTPS proxy is configured with self-signed certificate to intercept the encrypted traffic.

2- Customer email server is hosted extrenally, they access their email through the OWA web interface and through the outlook client.

3- OWA web interfaces working fine with HTTPS.

4- Outlook client is configured with Exchange proxy URL to be able to retrieve their emails, this exchange proxy URL is using HTTPS.

5- Cisco WSA self-signed certificate is deployed in the client machine certificate repository in the trusted root certificate authorities.

6- When trying to access the email using the outlook client, it cannot connect to the exchange server.

what should i do to solve this issue, as from my readings i knew that the outlook client is connecting to the exchange proxy using RPC over HTTP, i do not know exactly what is the issue.

Are the OWA users getting a

Ken Stieers — Thu, 05 May 2016 17:31:38 GMT

Are the OWA users getting a cert error that they just click through?

Outlook doesn't surface that error so they can't click through it. You need to deploy that cert to all machines or have the users install it or deploy a subordinate CA cert from a CA the workstations already trust.

Cisco WSA self signed

ama1510 — Thu, 05 May 2016 17:35:48 GMT

Cisco WSA self signed certificate is already deployed on the trusted root certificates on the users browsers and when access email through OWA web interface there is no problem and nor certificate error happen cause it's exited in the trusted root certificates, the problem appear when using the outlook client and the outlook start to use the defined exchange proxy HTTPS URL.

Okay then it's probably an

Ken Stieers — Thu, 05 May 2016 17:46:00 GMT

Okay then it's probably an authentication issue. If they go to a website with a browser and then open Outlook does it work? Outlook doesn't handle authentication either. Either deploy a CDA or create a new identity for the Outlook user agent and set that identity to not require authentication.

Thanks for your reply, but

ama1510 — Thu, 05 May 2016 18:06:05 GMT

Thanks for your reply, but users access the internet without authentication at all.

Hi. The Outlook client

Andre Neethling — Fri, 06 May 2016 10:10:18 GMT

Hi. The Outlook client (Outlook anywhere/RPC over HTTPS) doesn't behave well with decryption. What I would try to do is put the Exchange URL in a "Do not Decrypt" custom URL category and configure a decryption policy with the action "Pass" so that no Decryption takes place. This should get the Client to work through the WSA.

Thank you Andre, It Works

ama1510 — Tue, 17 May 2016 11:03:30 GMT

Thank you Andre, It Works with me.

Thanks Andre, It Works :)

ama1510 — Tue, 17 May 2016 11:04:53 GMT

Thanks Andre, It Works 🙂

No Probs........... I'm glad

Andre Neethling — Thu, 19 May 2016 04:28:44 GMT

No Probs........... I'm glad you got it to work.