topic Re: Reverse proxy for Exchange ActiveSync in General Topics

Reverse proxy for Exchange ActiveSync

karsayor — Thu, 11 Apr 2024 12:30:31 GMT

We have a Palto Alto cluster and I want to use them as reverse proxy for our Exchange inbound trafic. We activated decryption for this trafic and we want to allow only ActiveSync trafic / application.

It did not work with only allow ActiveSync application, we also had to create another rule to allow web-browsing to URL */microsoft-server-activesync because it does not detect all trafic as activesync, even though it's decrypted.

In attached picture the log of a part of the trafic when I sync my iphone with the native mail application.

Anyone already done this ? Why doesn't it detect correctly the trafic as ActiveSync ?

Re: Reverse proxy for Exchange ActiveSync

kiwi — Tue, 16 Apr 2024 13:02:21 GMT

Hi @karsayor ,

Looking at applipedia info for activesync, web-browsing should be implicitly allowed and no explicit configuration should be required.

That said, applications for which the firewall cannot determine dependent applications on time will require that you explicitly allow the dependent applications when defining your policies.

Source:

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/app-id/applications-with-implicit-support

Kind regards,

-Kim.

Re: Reverse proxy for Exchange ActiveSync

karsayor — Tue, 16 Apr 2024 13:14:28 GMT

Hello ! Thanks for the reply !

But in case I have to specify web-browsing explicitely, it will allow all trafic to the HTTPS port including OWA / ECP /.. , which I do not want to open. I only want to allow activesync . Is there a way to do this ?