RPC over HTTP with GC on different server

[lifegard2]

Hello,

I'm trying to setup RPC over HTTP for my org without a great deal of luck. My situation is different in that I have a single Exchange server that is a member server and the Global Catalog server is located on a different server. I do not see hardly any tutorials from M$ or anywhere on how to setup this configuration.

I've got 443 and 80 on my Watchguard Firebox pointed to the internal IP of my Exchange box.

I think I've done all I am supposed to do, but I am unable to connect to the Exchange server with OL2003. I have an SSL cert installed on the server and installed on the client. OWA over https comes up without any prompts for a certificate, so I am assuming that issue is closed.

My validports reg key is pointed to "ExchangeSvr:593;ExchangeSvr.company.local:593;ExchangeSvr:6001-6002;ExchangeSvr.company.local:6001-6002;GC_Server:6004;GC_Server.company.local:6004;GC_Server:593;GC_Server.company.local:593".

On the GC server I have the "NSPI interface protocol sequences" value set to "ncacn_http:6004" as prescribed.

When I use outlook /rpcdiag, I see it connect via HTTPS to the internal FQDN of my exchange server twice (I am connecting from outside). It shows type "directory" and then "referral" and for status it is always "Connecting".

When I use RPCPING, I get "Response from server received: 401 Client is not authorized to ping RPC proxy Ping failed."

Is there any different f/w configuration I should be setting up since my GC is on a different machine than the Exchange server?

Any ideas?

 

[lifegard2]

Oh, forgot to mention what happens in OL2003 client. Asks for username and password, domain\username works as well as username@company.local. After that, I just get an error that the Exchange Server is unavailable and to retry or work offline.

 

[lifegard2]

Ok, I fixed it. I had to do a few things, but honestly, I'm not sure which one thing did it.

I logged onto my GC server and opened up a browser. From there I installed the SSL certificate that I generated on my Exchange box. I also logged onto my Exchange box and did the same thing (done through IE, Tools>Internet Options>Content>Certificates>Other People>Import).

After I did this, a number of the RPCPING commands in

http://support.microsoft.com/default.aspx?kbid=831051

started to work.

The last thing I did was remove references in my ValidPorts subkey to the GC server and put in a reference to my exchange server as the GC server instead. From what I can read online, it looks like with Exchange 2003 SP2 (maybe at SP1), the need to put in the GC server:6004 entry goes away because Exchange got smart enough to forward the request to the right place.

My ValidPorts subkey now looks like "ExchangeSvr:593;ExchangeSvr.company.local:593;ExchangeSvr:6001-6002;ExchangeSvr.company.local:6001-6002;ExchangeSvr:6004;ExchangeSvr.company.local:6004;ExchangeSvr.company.com:6001-6002;ExchangeSvr.company.com:6004"

After I made this change, voila!

I must say, setting up RPC over HTTP is one HELL of a lot easier on a SBS box where the GC and everything is located on one machine. Geez. . .

Hope this helps someone else.