SSL / Outlook Web Access not identified by App-ID

[MarkRosenecker]

I have a customer that is using a PA-5020, and when users try to go to certain Outlook Web Access sites, it won't work for them.  Checking the logs, I can see where the user initiates a connection over port 443 to the destination OWA server, but App-ID identifies it as 'unknown' instead of 'ssl'.  I never see the SSL setup, and the user's connection times out.  The same user on the same machine can go to a different OWA site without difficulty.  He can also get to the problematic OWA site when connected to the Internet via alternate means.  

We are not doing SSL Decrypt on this traffic, and SSL and web-browsing outbound is permitted.  NAT rules are configured correctly (else he wouldn't be able to get to anything, much less a different OWA site).  

Anyone have any thoughts on this?  Why wouldn't OWA over SSL work for individual sites, but work fine for others?

Thanks in advance!

[Raido_Rattameister]

Do you know what version of Exchange is running behind this not working OWA?

[rmonvon]

Hi there...I would suggest doing a packet capture on the OWA traffic and compare the working one against the non-working one.  Check the SSL handshake for client hello and cert exchange to see if it is indeed SSL traffic.

[MarkRosenecker]

All -

Turns out that it was the outside OWA system blocking our requests for connection.  As soon as we routed the user through an alternate gateway, it began working again.  We contacted the system admins of that OWA server, and they were able to permanently fix it on their end.

Thanks for trying to help!