Publishing Exchange coexistance in 2010/2013 in TMG

I already asked this in the TMG forums and didnt really get the answers there, so hoping I get better luck
here, so slightly rephrased:
Environment:
Two Windows 2008 R2, Exchange 2010 SP3 servers, currently holding all mailboxes
Two Windows 2012 R2, Exchange 2013 SP1 servers, setup in progress
Two Windows 2008 R2, TMG 2010, V7.0.9193.540 publishing both Exchange 2010 servers.
Scenario:
I need to allow incoming and outgoing emails through TMG to both Exchange 2010 and 2013 as it will take me weeks, if not months before all mailboxes are in 2013.
Question:
1. How do I need to configure TMG to allow both Exchange 2010 and 2013 simultaneously?
2. Do I just redirect all SMTP to Exchange 2010 mailboxes to Exchanges 2013 in TMG and 2013 just pass on the traffic to 2010 if it doesn't have the mailbox?
Hoping to hear from someone whos actually had 2010/2013 in coexistence with TMG doing the publishing and firewalling for Exchange. Thanks.

These answers assume that all servers are in the same Exchange organization.
1. Exchange 2013 will proxy all Exchange 2010 traffic, so all you should route all traffic through and publish the Exchange 2013 servers rather than trying to publish both. Unfortunately, TMG hasn't been updated with a wizard for Exchange 2013.
I've seen this article that explains how to publish Exchange 2013, but I haven't tried it myself since none of my Exchange 2013 customers have deployed TMG with it. It does come from a source I would trust.
http://blogs.technet.com/b/exchange/archive/2012/11/21/publishing-exchange-server-2013-using-tmg.aspx
2. Generally I don't recommend routing SMTP through TMG as it doesn't offer much value for that, but there's no reason you can't do it. You should not have to worry about the server to which you route SMTP since SMTP mail will find
its way to the correct destination regardless of where you submit it. It is my preference to change your routing so that all mail goes through the Exchange 2013 servers early in the project rather than late.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

Similar Messages

Never ending story: Exchange and Outlook 2010/2013 - Read receipts (reading confirmation) implementation is buggy

OK, I try it again (for the fifth time or so), maybe anywhere in the big microsoft world there is ONE support engineer that is able to recognize a bug and hand it over to the development????
In several cases the read receipt does not contain the sending time of the original message, instead it contains (quite senseless) the time when the receipt itself has been sent.
The only information in the read receipt is the subject of the original mail which may be identical in longer mailthreads to several (dozends of) mails. So in this implementation you are not able to find out to which message a read receipt really relates.
So we cannot prove at all if a single mail in a thread has been read or not. The printout of such a receipt does not have any information that can be used in a meeting or discussion.
Since this situation obviously lasts for several years I'd like to ask
how I can get a working read-receipt-functionality for professional eMail-handling???
It seems that the problem does not lie in the content of the MDN sent by the Exchange server.
If I look into a copy of such a sent MDN with Thunderbird, it tells me for example, that my mail, sent on 15th Juli 2013 14:43:47 (UTC+1) has been read on 15th Juli 2013 14:50:08, which is correct.
But in combination with Outlook I get the same MDN displayed like follows:
Your message at... subject... sent Monday, 15. Juli 2013 14:51:30 (UTC+01:00)... has been read on Monday, 15. Juli 2013 14:51:16 (UTC+01:00) (Text translated from German to English)
So Outlook exchanges the timestamps and falsifies the content of the MDN.
This does only appear in combination with an Exchange server. If I work with a POP3 account and Outlook and send a message to an Exchange 2010 mailbox the correct timestamps are displayed within the returned MDN-message.
All involved systems are set to German (DE-de), the timezone on all systems is UTC+1
Here a small table with my tests
I've used Outlook on all Clients, 2010 and 2013.
Sender: sends initial mail and gets the Reading Confirmation
Receiver: gets the initial mail and sends the MDN
Sender     |     Receiver     |     MDN Display
POP3        |     Exchange   |     correct
Exchange |     Exchange   |     fail (displays wrong "sent"-time)
POP3        |     POP3         |     correct
Exchange |     POP3         |     fail (displays wrong "sent"-time)
It is obvious this cannot be a "feature". This is different behaviour depending on the senders Account type and one of this two scenarios must be a bug.
Could you help me further on this, please?

Almost no - the MS-Support here in this website was completely overchallenged to even understand this issue. I've tried several times to address this in this forum with no success. The "supporters" here had only one target - to quickly get this
"complicated" case off their desks.
The Office 365 support was much more competent and able to understand the problem. They escalated this to the development team (which lasted about 3 months, dozends of telephone calls and about 20 hours working time, which I had to donate to Microsoft freely)
and located the Problem in Exchange Server.
The result was that they promised to fix it in Exchange Server 2013, but there will be no Bugfix in Exchange 2010. I am waiting for the fulfilment of this promise since over 6 months.
Microsoft seems not to have any problem to leave their (professional and very expensive) Exchange software in a buggy state.
My conclusion: If Exchange 2010 runs out of maintenance I'll switch to Linux and Zarafa Server. The Zarafa guys are able to understand and fix their bugs and I do not have to donate thousands of Euros in working time only to get them understanding their
own bugs.
PS: You need only to press F1 in Office, especially in Access in the German language variant and you get an impressing lesson how desolate Microsoft is working today. Pressing F1 in Access 97 or XP lets you know, how much better they were some years ago.
An impressive deep fall down to the ground.
Regards, Conny

Exchange 2010/2013 coexistence published in TMG 2010

Environment:
Two Windows 2008 R2, Exchange 2010 SP3 servers, currently holding all mailboxes
Two Windows 2012 R2, Exchange 2013 SP1 servers, setup in progress
Two Windows 2008 R2, TMG 2010, V7.0.9193.540 publishing both Exchange 2010 servers.
Scenario:
I need to continue having Exchange 2010 setup in TMG as is as the mailbox migration to 2013 will take weeks if not months and I have a project requirement to have Exchange Database Availability Group (DAG) functionality for all mailboxes throughout the project,
so 4 servers are an absolute must. So I need to add Exchange 2013 in TMG and not just replace the 2010 setup with the 2013 setup and I cannot run one 2010 and one 2013 server.
Questions:
1. I currently only have 2 public IP addresses available to SMTP, mapped to the external interfaces of TMG, to allow my environment to be able receive emails on 4 Exchange servers (two 2010 and two 2013) I need to have 4 public IP addresses, is that correct?
2. Does anyone have a good general guide/blog for doing this (setting up Exchange 2013 in TMG in a coexistance scenario)?
This is nice, but doesn't really approach it from a coexistance scenario:
http://blogs.technet.com/b/exchange/archive/2012/11/21/publishing-exchange-server-2013-using-tmg.aspx
Thanks!

Hi Trana,
In TMG you can use single IP address to publish multiple Web address and below are the options which you can explore.
Hope your OWA ECP etc are Https
You need a SSL certificate which has all the URL SAN entry of both old and new Exchange server.
Create a listener and select the IP address (Say public IP address 195.219.x.x)
Link the SSL certificate
Public DNS entry
A record , Single IP
195.219.x.x
Point to
Owa1.exchange1.com   - Old Server
195.219.x.x
Point to
ECP1.exchange1.com     - Old Server
195.219.x.x
Point to
ECP2.exchange2.com      - New Server
195.219.x.x
Point to
Owa2.exchange2.com     - New Server
Create a Web publishing rule as below
Old server Exchange 1
Owa1.exchange1.com
ECP1.exchange1.com
One Web publishing Rule with all the URL added on it and link the Rule with the listener we created
Point the Web publishing to Exchange1.com server which is old
New server Exchange 2
Web publishing Rule with all the URL added on it and link the Rule with the listener we created
Point the Web publishing to Exchange2.com server which is New
ECP2.exchange2.com
Owa2.exchange2.com

Publish Exchange 2013 OWA + Active Sync + Outlook Anywhere using TMG 2010

We plan to publish our new Exchange 2013 SP1 servers (3 in DAG) outside corporate network using TMG 2010. I am looking for some guide how to do it in the proper way. What I found is little old and does not take into consideration Exchange 2013
SP1
http://blogs.technet.com/b/exchange/archive/2012/11/21/publishing-exchange-server-2013-using-tmg.aspx
Any advice how to publish Exchange 2013 OWA using form-based authentication and how to use Kerberos Constrained Delegation?

Hi,
The blog below describes some scenarios about publishing Exchange. You could have a look the Scenario 2.
Exchange publishing after TMG/UAG
http://dizdarevic.ba/ddamirblog/?p=168
Note: Microsoft provides third-party contact information to help you find technical support. This contact
information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information
Best Regards,
Joyce
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Publishing Exchange 2013 Outlook Web App with Forefront TMG 2010

Hello guys,
I have published Exchange 2013 via TMG 2010 with pre-authentication. Since this is the first time I am doing it- I want to ask experts for the explanations:).
When I configure Active Sync on mobile, I just type the password and it's starts syncing after 20 sec.
When I use browser and trying to login using TMG logon screen, after I enter credentials (if they were not wrong), I get exchange 2013 logon screen ( because my password was checked by DC's).
I have customized TMG tamplate to Exchange 2013 tamplate, but it did not help- I have two logon screens.
Is it possible to configure TMG for showing only one logon screen ( without disabling pre-authentication) ? Does it work this way?
Did I miss something?

Hi,
Please try to enable FBA for external and internal OWA 2010 users by the methods in the blog below.
There are several ways to accomplish this:
Have internal users pointed to the internal interface of the Forefront TMG and utilize the forms-based authentication logon page offered by Forefront TMG.
Deploy Forefront UAG instead of Forefront TMG. Forefront UAG allows you to have FBA enabled on both the Exchange 2010 Client Access Servers and on the Forefront UAG solution itself.
Publish Exchange 2010 to the Internet using Forefront TMG but do not configure pre-authentication. This way the users need to go through the Forefront TMG solution, but will authenticate directly against the Exchange 2010 Client Access servers.
Configure an additional OWA and ECP virtual directory on the Exchange 2010 Client Access Servers.
Reference:http://www.msexchange.org/articles-tutorials/exchange-server-2010/management-administration/enabling-forms-based-authentication-external-internal-owa-2010-users-exchange-2010-published-using-forefront-tmg-2010-part1.html
Then check the blog
- Creating a custom Forefront TMG 2010 OWA FBA logon page
Note:
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
Best Regards,
Joyce
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Publish Exchange 2013 using UAG 2010 Sp4

Hi,
We need to publish Exchange 2013 through UAG 2010. But we are not getting any dedicated link for UAG 2010 to publish Exchange 2013. we have UAG 2010 with SP4.
Is there any Step by step UAG 2010 configuration link to publish Exchange 2013?
Thanks
jitender

Hi Jitender,
Based on my knowledge, publishing Exchange 2013 with UAG 2010 is similar with publishing Exchange 2010.
I find a related Blog and Guid for your reference:
1. Publishing Exchange Server 2010 with Forefront UAG and TMG
http://blogs.technet.com/b/exchange/archive/2010/07/16/publishing-exchange-server-2010-with-forefront-uag-and-tmg.aspx
2. Publishing Exchange Server 2010 with Forefront Unified Access Gateway 2010 and Forefront Threat Management Gateway 2010
http://www.microsoft.com/en-us/download/details.aspx?displaylang=en&id=8946
Please also notice the System requirement of both Exchange 2013 and UAG 2010.
System Requirement
Exchange 2013
http://technet.microsoft.com/en-us/library/aa996719(v=exchg.150).aspx
UAG 2010 SP4
Supported Operating System
Windows Server 2008 R2
Servers running Forefront UAG and SP4 require the following:
• Windows Server 2008 R2 Standard, Windows Server 2008 R2 Enterprise, or Windows Server 2008 R2 DataCenter.
• Microsoft Forefront Threat Management Gateway (TMG) 2010 Service Pack 2
Thanks
Mavis Huang
TechNet Community Support

Exchange 2013 with TMG 2010 and Go Daddy

Hi all;
actually I'm new to exchange server 2013 and I need some help:
recently I installed exchange 2013 in our domain with contains TMG 2010
what I need is sending emails out.
currently I can send emails internaly
I have static IP and TMG and registered domain in Go daddy.
could someone help me by steps what to do?
in TMG?
in Exchange administration?
in Go Daddy?what records needed and how?
and should I do any configurations in my DNS?
please I'm stuck in this.
Thanks

Sorry, my fault. Try these links:
http://blogs.technet.com/b/exchange/archive/2012/11/21/publishing-exchange-server-2013-using-tmg.aspx
http://www.isaserver.org/articles-tutorials/configuration-general/publishing-exchange-2013-outlook-web-app-forefront-threat-management-gateway-tmg-2010.html
CRM Advisor

TMG with 2010/2013 Coexistence gives dual prompts (TMG and OWA prompt)

2 X 2010 CAS', Load balanced pool
4X 2013 Mutilrole (will take the place of the 2010's in the load balanced pool)
Currently we use TMG to publish owa externally. From TMG, the traffic goes to a load balancer, and to the 2010 CAS's from there. TMG is doing pre authentication.
However, if I take the 2010 CAS' out of the load balanced pool and enable the 2013 in the load balanced pool, users start getting dual prompts - one at the TMG, and then the 2013 OWA login (no mailboxes on 2013 yet, so have only tested with mailbox still
on 2010).
I have been through both of the following articles - however, basic auth. is not an option on the exchange side, as then internal users get prompted for windows credentials. Has anyone in coexistence been able to get this working without basic auth
(currently use Basic, Windows Auth, and NTLM)?
http://blogs.technet.com/b/exchange/archive/2012/11/21/publishing-exchange-server-2013-using-tmg.aspx
http://www.isaserver.org/articles-tutorials/configuration-general/publishing-exchange-2013-outlook-web-app-forefront-threat-management-gateway-tmg-2010.html
TAG

Hi,
As document mentioned, Forefront TMG cannot perform authentication delegation therefore we need change FBA to basic authentication in Exchange 2013.
However if you don’t want use basic authentication, we can try to disable pre-authentication on the TMG server by new web listener and select the "Do not require SSL secured connections with clients.".
Also, I find an similar thread about your question. For your reference:
https://social.technet.microsoft.com/Forums/office/en-US/a4ef2a73-bfee-4fb2-b3c2-c166c11cada7/tmg-owa-double-login-prompts?forum=Forefrontedgegeneral
Thanks
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact [email protected]
Allen Wang
TechNet Community Support

Namespace for Exchange 2003 == 2010 == 2013 Migration

Hi
Hope someone can help. I am working on an Exchange 2003 to 2010 migration, which will then quickly move onto a 2010 to 2013 migration and need some clarification on the namespaces to use. I am aware that if I do not do this right at the 2003
to 2010 migration, this will cause a headache at the 2010 to 2013 migration.
Some background:
2003 Functional Level Domain - 2 x 2008 DC's
Currently users are on a 2003 exchange cluster with a mix of RPC (internal users) and RPC over HTTP connections (roaming users)
We will be installing Exchange 2010 on a single server, with CAS, HUB and Mailbox roles and no load balancer, as we will be moving quickly to 2013.
We have two Kemp load balancers ready for Exchange 2013.
Exchange 2010 is installed on a single server (exh2010.domain.local) and configured with an CAS array name (exh-cas.domain.local) which is resolvable internally only.
Currently we have multiple smtp namespaces e.g. @company.com, @company2.com.
Our main website etc is www.company.com
Our public facing services are at https://service.mycompany.com
Our 2003 RPC address is https://webmail.mycompany.com
I understand that the 2010 RPC CAS array name should be separated from the Outlook Anywhere (RPC over HTTPS) address so that when 2013 takes over the HTTPS address, the RPC connections are not broken.
Two Questions:
Do we have to use the HTTPS same namespace for 2013 as we do in 2010? Its just I would want to test the Kemp load balancers before making them live (slow careful transition), and giving them a different namespace, e.g.
https://mail.mycompany.com would allow a migration, rather then a cutover.
Can we use the *.mycompany.com address rather then the company.com address, even though we have no SMTP addresses at mycompany.com? Can autodiscover still work?
Thanks in advance for any guidance
Cheers
Steve

1. No, but you can. Exchange 2013 will proxy all services for Exchange 2010, so if you set up everything right, you should be able to simply swing the name from Exchange 2010 to 2013.
2. Your web services can be published with any domain as long as the hostname is in the certificate. Only Autodiscover needs to match the e-mail domain(s). So in your example, you could publish OWA, ECP, ActiveSync, Web Services and OAB
at owa.mycompany.com. You would need autodiscover.company.com, autodiscover.company2.com, etc., but if you don't have e-mail addresses with mycompany.com, you don't need autodiscover.mycompany.com. If all users have a company.com e-mail address,
the you only need autodiscover.company.com as long as users know to enter that e-mail address when configuring profiles on PCs or devices. If you're going to have to have Autodiscover for multiple domains, then you might consider using an SRV record
instead because it can greatly simplify your certificate requirements.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

Exchange 2010/2013 coexistence: OWA proxy not working properly ":-( Something went wrong"

Hi
Exchange 2010 users are NOT able to connect to their mailboxes when they go through exchange 2013 OWA address. We get a message that says following ---> "Something went wrong"
Following is our URL. The address is pointing to 2013 CAS loadbalancer VIP. Outlook anywhere is working fine. What is going on?
Important: All my exchange 2010 / 2013 URIs are the same as suggested by Microsoft (Owa, ecp, activesync, ews, autodiscover): --> mail.domain.com/XXX

Hello Rawa,
Can you log on Exchange 2010 OWA using its localhost address?
Please make sure the intenralurl value is set to Exchange 2010’s local host name and set the Externalurl to Null.
http://technet.microsoft.com/en-us/library/bb310763(v=exchg.141).aspx
Thanks,
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Simon Wu
TechNet Community Support

Maximum number of user mailboxes supported by single Exchange Database in 2007 / 2010 & 2013 ?

What is the Maximum number of user mailboxes supported by single Exchange Database in 2007 / 2010 & 2013 ?
Aditya Mediratta

Agree with Keith, there is no MB # limit, however there are practical concerns such as DB size and how that effects recoverability as well as performance. In terms of extremes we had one major educational customer that had 35K Mailboxes in
a single database so you can utilize a ridiculous # of mailboxes in a DB if desired. IMO you are better off to keep the # of mailboxes to a reasonable level, i.e. no more than 250-500 mailboxes per DB
Search, Recover, & Extract Mailboxes, Folders, & Email Items from Offline Exchange Mailbox and Public Folder EDB's and Live Exchange Servers or Import/Migrate direct from Offline EDB to Any Production Exchange Server, even cross version i.e. 2003 -->
2007 --> 2010 --> 2013 with Lucid8's
DigiScope

Configuring Message Clasifications Exchange 2010 - Outlook 2007/2010/2013

Hi
I created Message Classification as described in:
http://technet.microsoft.com/en-us/library/bb123498(v=exchg.141).aspx
New-MessageClassification ....
New MessageClassification is visible in OWA.
I stared deploy Message Classifications for Outlook 2007 using this
http://technet.microsoft.com/en-us/library/aa998271(v=exchg.141).aspx
Of course there is small bug: "AdminClassificationPath"="c:\\Classifications.xml" but is should be
"AdminClassificationPath"="c:\Classifications.xml"
After set up it doesn't work. The same for Outlook 2010 and 2013?
Does anybody deploy Message Classifications for Outlook 2007 or 2010 or 2013 with success?
I use Exchange 2010 SP3 with all RU and Outlook 2007, 2010, 2013 with all updates.
Kind Regards Tomasz

Hi,
How do you know this is an old reoccurring message? Based on the content or time?
Since the MailboxAutoReplyConfiguration is correct, I suspect the issue can occur by certain client machine. At this stage, I suggest you disable OOF and re-enable
OOF on the problematic machine. If the issue persists, please refer to the following article to clean the problematic client’s Outlook rules. (run Outlook.exe /cleanrules in Run console.)
http://www.tech-recipes.com/rx/2161/outlook_2007_clean_up_command_line_switches/
Thanks.
Novak Wu
TechNet Subscriber Support in forum
If you have any feedback on our support, please contact
[email protected]
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Applying CU4 for Exchange 2013 SP1 in a mixed 2010 / 2013 Environment

We're planning to apply Exchange 2013 SP1 CU in our mixed 2010 / 2013 environment. We'd also like to apply Exchange 2010 SP3 Rollup 5 as well. Are there any gotchas or best practices on what update to apply first?
Orange County District Attorney

We are planning to update our 2013 from CU5 to CU8
and 2010 SP3 to Rollup 9
I cant find any official documentation from MS concerning the upgrade path. Example.
Exchange 2013 first, then 2010. Like the above post outline.
I see 2010 being upgraded first thus bring version numbers closer together, reducing incompatibilities.
Do you still feel this is the appropriate install procedure?
Have you done this?
Djoe

Outlook 2010/2013 not able to connect to Exchange 2013

Hi, I'm the midst of co-exist between Exchange 2010/2013. I have issues where none of internal users that migrated to Exchange 2013 not able to connect via Outlook 2010/2013. OWA is running fine without issue. Using MCA, the issue due to port is blocked
but I have verified that firewall on Exchange 2013 server is turn off all.
    1. Exchange 2010/2013 cert is using public CA cert.
    2. Both outlook anywhere external URL for Exchange2010/2013 is set to outlook.domain.com. internal pointing to server.domain.com. while autodiscover is set to autodiscover.domain.com.
   3. user mailbox in exchange 2010 do not have any issue
while if I try to logon, the error look like below:
Cannot open your default e-mail forlders. You must connect to microsoft exchange with the current profile before you can synchronuze your folder with your outlook data file (.ost).
what else should I check ?
many thanks.

Hello,
What server does “outlook.domain.com” and “autodiscover.domain.com” point to, Exchange 2013 FE or 2010 CAS?
You can also do a Outlook Test Email AutoConfiguration by the following steps:
a. While Outlook is running, click the CTRL key and then right-click the Outlook icon in the system tray and then select “Test Email Autoconfiguration”.
b. Confirm that your email address is in the address field, uncheck “Use Guessmart” and “secure Guessmart authentication” boxes. Then click the “Test” button.
Thanks,
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Simon Wu
TechNet Community Support

Connection Office365 Exchange - Outlook 2010/2013 (Desktop)

I have an Office365 account with Exchange function, connected with my personal domain. This works perfect for almost a year now, but since a few days, Outlook (desktop) can't connect to my ExchangeMail/Office365 anymore. Some details:
I can reach my mail via the Web App
My iPhone receives my email; no problems here
The password has not been changed
I've tried to connect with Outlook2010 on Windows7 and with Outlook2013 on Windows8; both can't connect
Profile removed and re-added: no result
As during creating/editing the profile in the ConfigurationScreen/Email, as in Outlook (2010 & 2013) itself, the login window pops up and can't connect (and because of that, Outlook automatically close).
In short: what is the problem here and -more important- how can I fix this?
Many Thanks,
Ewoud
PS: Apologies if this question has been asked in the wrong forum.

Hi,
Please check the problematic users' Outlook settings by the following steps:
1. Click File > Account Settings > Account Settings > Change > More settings.
2. In Security tab, make sure "Encrypt data between Microsoft Outlook and Microsoft Exchange" option is checked, "Always prompt for logon credentials" is unchecked.
3. Change the logon network security to Negotiate Authentication, and Apply > OK to set it.
Restart Outlook to have a try. If the issue persists, please
re-create Outlook profile to check whether the issue persists.
Regards,
Winnie Liang
TechNet Community Support
Thank you for the response.
I did as you suggested and the problem persists

Publishing Exchange coexistance in 2010/2013 in TMG

Similar Messages

Maybe you are looking for