Exchange 2010 - Virtual Directory Internal & External URL's with Wildcard Cert

Question

Hi Guys
I am trying to determine if my Exchange 2010 server Virtual Directory URL's are setup according to best practice. I'm sure anyone with good Exchange experience will instantly be able to tell me if my Virtual Directory DNS is correct or could cause issues.
Scenario:
Hosted Exchange 2010 SP1. Multiple client mail domains hosted
2x CA, 2x HT, 2x MB, 2x DC
Wildcard *.example.co.za certificate being used on CA servers
AD domain is he.example.za.net
CA Server naming example: ca1.he.example.za.net, ca2.he.example.za.net
he.example.net DNS is done by DC servers
External name used by clients: outlook.example.co.za (For Outlook setup and OWA access)
outlook.example.co.za has two A records pointing to the CA IP's
PROBLEM/CONCERN:
We have a random OWA log out issue that we believe might be due to ambiguous DNS names being used.
If I change the Virtual Directories External URL to be the FQDN of the server, we get a Certificate Error in clients (due to the .co.za Wildcard). The external URL clients use
must be on .co.za.
So are the Virtual Directory URL's causing the CA servers to loose track of who is authenticated in where (leading to OWA disconnection)? Is it fine to load balance the CA servers with the DNS the way we are doing currently? Any other issues you see?
Current Virtual Directory settings:
Note that they are identical on CA1 and CA2
[PS] C:>Get-OabVirtualDirectory -server ca2 |fl *url
InternalUrl : https://outlook.example.co.za/OAB
ExternalUrl : https://outlook.example.co.za/OAB
[PS] C:>Get-WebServicesVirtualDirectory -Server ca2 |fl *url
InternalNLBBypassUrl : https://ca2.he.example.za.net/ews/exchange.asmx
InternalUrl          : https://outlook.example.co.za/ews/Exchange.asmx
ExternalUrl          : https://outlook.example.co.za/ews/Exchange.asmx
[PS] C:>Get-ActiveSyncVirtualDirectory -Server ca2 |fl  *url
MobileClientCertificateAuthorityURL :
InternalUrl                         : https://outlook.example.co.za/Microsoft-Server-ActiveSync
ExternalUrl                         : https://outlook.example.co.za/Microsoft-Server-ActiveSync
[PS] C:>Get-EcpVirtualDirectory -Server ca2 |fl  *url
InternalUrl : https://ca2.he.example.za.net/ecp
ExternalUrl : https://outlook.example.co.za/ecp
[PS] C:>Get-OwaVirtualDirectory -Server ca2 |fl  *url
Url             : {}
Exchange2003Url :
FailbackUrl     :
InternalUrl     : https://ca2.he.example.za.net/owa
ExternalUrl     : https://outlook.example.co.za/owa
[PS] C:>Get-AutodiscoverVirtualDirectory |fl *url, server
InternalUrl :
ExternalUrl :
Server      : CA1
InternalUrl : https://outlook.example.co.za/
ExternalUrl : https://outlook.example.co.za/
Server      : CA2
REALLY APPRECIATE SOME EXPERT ADVISE. Thanks.

Answer 1

Hi Kane,
Why did not you use cas array to load balance client connectivity?
If you create a CAS array, you can assign an virtual IP (VIP) for the CAS array FQDN (e.g CASarray.example.za.net), and then point all the Virtual Directories internal URL to CAS array fqdn;
For external, you can point outlook.example.co.za to VIP which had been assigned to CAS array.
I recommend you refer to the following article to understand CAS array:
http://technet.microsoft.com/en-us/library/ee332317(v=exchg.141).aspx#CASarray
http://blogs.technet.com/b/ucedsg/archive/2009/12/06/how-to-setup-an-exchange-2010-cas-array-to-load-balance-mapi.aspx
http://blogs.technet.com/b/exchange/archive/2012/03/23/demystifying-the-cas-array-object-part-1.aspx
Best regards,
Niko Cheng
TechNet Community Support