SSL/MSSTD settings Outlook anywhere

Question

All,
just want to raise a question, as I noticed a strange behaviour.
I have Exchange 2013 with Outlook Anywhare configured in this way:
So external and internal hostname is the same, SSL required only from external.
Internal connection works just fine and Outlook doesn't set the flag and the MSSTD setting for SSL.
Externally, If I setup from scratch, it's working as well, and the msstd is flagged and setup.
Problems begin when I migrate mailboxes from an Exchange 2010 in coexistance, which will be decomissioned in the future. After migration, user's Outlook (connected from external AND not domain-joined) was properly reconfigured BUT for the msstd setting
which was missing.
As result the Outlook connection was totally flickering, up and down every now and then plus keep "connecting" for the directory service.
Setting up the msstd setting manually, everything is fine.
Now, we know that in EX2013 the Autodiscovery behaviour has changed:
http://support.microsoft.com/kb/2754898/en-us
Practically, it will try always the internal first host name first, regardless where you're connecting from.
I was wondering if: since the hostname is the same for both internal and external, would this lead autodiscovery in misinterpret the configuration (InternalClientRequireSSL is set to $False) and left the configuration unflagged in Outlook?
And, if so, why on migrated mailboxes only ?
Any suggestion, answer and comment will be hughly appreciated!
Thanks!

Answer 1

In the Autodiscover.xml that is returned to the client, there is
two EXHTTP sections with settings. Outlook will try the first block (internalSettings) and in your case it will be successfull since you are using the same name for both internal- and externalhostname. So with that, SSL will not be required.
Example: 
<Type>EXHTTP</Type>
        <Server>mail.domain.com</Server>
        <SSL>Off</SSL>
        <AuthPackage>Ntlm</AuthPackage>
   <Type>EXHTTP</Type>
        <Server>mail.domain.com</Server>
        <SSL>On</SSL>
        <AuthPackage>Ntlm</AuthPackage>
Personally, I always configure the same name for both internal- and externalhostname, use the authentication method NTLM AND
InternalClientsRequireSSL=True.
Not a good idea to disable Outlook Anywhere on Exchange 2010 when running in co-existence.
Can you also confirm that autodiscover is pointing to your Exchange 2013 Server?
Martina Miskovic
Hi Martina,
thanks for the clear answer! I had kind-of the same idea, wodering if Exchange could possibly mess up using the same name - sort of bug.
I'll try to set for both internal and external to require SSL.
I'm not clear, however, how set the authentication. NTLM only? NTLM + Basic + Negotiate? And same auth method for both int and ext? Ultimately, how would you setup the IISAuthenticationMethods?
Ah! What whoud you mean by: "confirm that autodiscover is pointing to your Exchange 2013 Server?"
Thanks in advance!
Ale.