Using a multi-vendor strategy, you might be required to authenticate mobile devices and authorize user access to on-premises Exchange Server mailboxes. This blog post focuses on configuring a Kemp LoadMaster in an internal network segment. The Kemp LoadMaster ESP functionality allows ActiveSync connections for members of a dedicated security group.
This results in the following authentication and authorization endpoints:
- MobileIron access policies
- Kemp LoadMaster ESP security group membership validation
- Exchange Server ActiveSync client access allowance
- Exchange Server mobile device policy
Overview
The following diagram shows a simplified overview of mobile devices connecting to an on-premises Exchange Server. The perimeter and internal network segments are omitted for simplification reasons.
- A MobileIron-managed device connects to MobileIron Sentry, which validates access with MobileIron policies.
- If a MobileIron policy allows access, the device connects to Kemp LoadMaster ESP.
- Kemp LoadMaster ESP configuration validates the security group membership of the authenticating user.
- If the user is a member of the security group, the device connects to Exchange Server.
- Exchange Server authenticates the user and checks if the ActiveSync protocol is enabled and the device complies with Exchange Server MDM configuration.
Kemp LoadMaster Virtual Service
The following screenshots illustrate a working setup for a virtual service load balancing mobile device connections from MobileIron Sentry to Exchange Server. It’s assumed that you’ve already configured the following:
- SSO Domain settings for connecting to a domain controller to authenticate users
SSL Properties
The SSL Traffic is offloaded and re-encrypted as we need to authenticate the user with ESP. Ensure to select a Cipher Set that does not provide any weak or unsecure cipher suites. In this example, I’ve chosen the predefined set BestPractices.
ESP Options
Enable ESP to activate the ESP configuration section. The settings are as follows:
- Client Authentication Mode: Basic Authentication
Be aware that this setting requires that MobileIron users are provisioned using DOMAIN\SamAccountName notation and not the UPN Name. - SSO Domain: An existing SSO Domain configuration for user authentication
- Allowed Virtual Hosts: The FQDN matching the LoadMaster virtual service IP address accessed by MobileIron Sentry to connect to Exchange Server
- Allowed Virtual Directories: Can be limited to /Microsoft-Server-ActiveSync otherwise, leave the default /*
- Permitted Groups: The name of the Active Directory security group containing the allowed users
- Server Authentication Mode: Basic Authentication
Real Servers
In the Real Servers section you add all member servers of your Exchange Server DAG. Ensure to use the HTTPS protocol the health checks and ensure to query the /Microsoft-Server-ActiveSync/healthcheck.htm document.
Using this configuration you’ve added your Kemp LoadMaster as an additional authentication endpoint to secure mobile device access to Exchange Server mailboxes.
Enjoy!
