Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Goal: To implement a mobile device management server (MDM) by Air Watch for authentication and not to allow Mobile devices to pass ActiveSync traffic to the published CAS server using 443 from the internet directly, but at the same time keep OWA & Outlook Anywhere continue using port 443 so we can’t block it from the premier firewall. What this means is that all the devices should connect to the MDM server which will proxy the request to the exchange 2010 ActiveSync.

Result already achieved: All the internet devices connect to the MDM server using port 443, then the MDM server proxies the device’s connection to Exchange Active Sync Server using 443.

Issue: Some of the users know that they can still connect to the CAS server via 443 and access ActiveSync and hence by pass the MDM server. If we remove the sub-URL from the public DNS or block the 443 access from the firewall to the CAS servers then the users will also not be able to use OWA and outlook anywhere.

Question: Do you think creating new website just for the Active Sync service on the 2010 CAS to listen on port 444 but keep the rest of the services on the default website and port 443 and then remove Active Sync working on 443 would work? Our firewall does not do reverse proxy, we know implementing and only publishing OWA through TMG solves this is not an option here.


share|improve this question
Please share more detailed instructions or links to more detailed instructions. How did you perform steps 2, 3, and 4? – user201460 Dec 4 '13 at 18:32
up vote 0 down vote accepted

Answer: Solved, below solution is 100% supported by Microsoft.

1) Make a new website listening on port 444 from IIS Manager SSL enabled Same Cert as Default Web Site Same Listening IP Configure the external URL on ActiveSync as in Default Web Site

2) Assign Exchange Active Sync to use the new website from "Exchange Power Shell" This means Active Sync will now also listen on port 444.

3) Edit the MDM server config file proxy on port 444.

4) Remove Exchange Active Sync to use the Default Web Site from "Exchange Power Shell" This means Active Sync will not listen on port 443 anymore.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.