Install Exchange 2016 in your lab (Part 4)

In the third part of our Exchange lab series we:

• Installed Exchange 2016 with the graphical setup
• Installed Exchange 2016 with the command line

In the fourth part of our Exchange lab series we:

• Discuss the importance of a correctly configured namespace
• Configure URLs via Exchange Admin Center (EAC)
• Configure URLs via PowerShell
• Configure Split-DNS

Let’s get started!

Note: For instructions on previous versions of Exchange check the following articles:
Designing a simple namespace for Exchange 2013
Designing a simple namespace for Exchange 2010

What’s in a namespace?

A namespace is critically important.

Not only does namespace govern the availability of services like Outlook Web App, or, ActiveSync, but it also governs items such as the distribution of the Offline Address Book, or, Autodiscover. In addition–beginning with Exchange 2013 and continued with 2016–all client requests are made over HTTPS versus straight TCP/IP. This means Outlook Anywhere now manages Outlook connectivity internally as well as externally.

It is imperative we correctly configure our URLs and apply a certificate containing those URLs. Otherwise, our clients won’t be able to establish the necessary SSL connections. Which will lead to all sorts of problems.

Out of the box, Exchange configures its internal URLs to match its internal hostname. It leaves its external URLs blank. Due to recent restrictions, third-party certificate providers no longer allow internal hostnames on certificates. An example of an internal hostname would be anything that ends .LOCAL or .PRIV. In short, it is any top-level domain that is not routable on the internet.

The challenge? If our internal hostnames cannot be found on our certificate it will give our test users a variety of security warnings. This makes it difficult to use internal hostnames with Exchange.

The simplest solution? Don’t use internal hostnames. Instead, use only external hostnames. We will use the same external hostname for both our internal and external URLs. Our URLs for each service will be as follows:

That solves our certificate problem. But how does that work with DNS?

We do this by way of split-DNS. Split-DNS allows us to use the same URLs internally as we do externally. Split-DNS is a non-authoritative copy of our external DNS hosted internally. This non-authoritative copy uses the internal IPs of our servers (versus the public IPs the authoritative copy is using).

For example, our external DNS provider will resolve webmail.exchangeservergeek.com to 71.72.221.140. Whereas internally our own DNS server would resolve webmail.exchangeservergeek.com to 192.168.10.13, which is the internal IP of EX16-01. Depending on which side of the firewall our test user sits will determine which IP they receive.

The need for split-DNS is to keep our local traffic on the local LAN. Without split-DNS, all local traffic would go out the firewall for name resolution only to try and come back in later with the public IP of Exchange. Not only is this an unnecessary detour for your internal clients–plus the unnecessary consumption of internet bandwidth–but most firewalls will block this kind of behavior deeming it suspicious.

Configure URLs via Exchange Admin Center (EAC)

Whether you plan to put your lab on the internet or not we felt it was still good practice to learn how to configure both external and internal URLs. This may be especially true if you are coming from Exchange 2010 and this is your first exposure to the Exchange Admin Center (EAC). That said, let’s get to it.

First, we need to configure our external URLs.

Log in to the Exchange Admin Center. Select the Servers tab. Select the Virtual Directories tab.

Select the Configure External Access Domain () button.

On the Configure External Access Domain dialog click the Add () button.

On the Select a Server dialog, pick the Exchange 2016 server(s) you wish to configure external URLs on. Then click Add. To remove a server click the [remove] link to the right of its name. Once you have all the required servers click OK.

In our example, we will just be configuring EX16-01 but you can select as many servers as you like.

Enter the domain name you wish to use externally. In our case we want our external users to go to webmail.exchangeservergeek.com. Click Save.

Depending on how many servers you are configuring at once, this may take some time. Once complete click Close.

Now that our external URLs are configured. Let’s configure our internal URLs.

In the Select Server drop-down box, pick the server you wish to modify. Only the virtual directories for that server will be displayed.

Let’s start with the Exchange Control Panel. Double-click to open the ECP (Default Web Site) properties.

Copy the contents of the External URL and paste over the contents of the Internal URL. Click Save.

Repeat for:

• EWS (Default Web Site)
• Microsoft-Server-ActiveSync (Default Web Site)
• MAPI (Default Web Site)
• OAB (Default Web Site)
• OWA (Default Web Site)
• PowerShell (Default Web Site)

We also need to modify the Outlook Anywhere URLs.

Select the Servers sub-tab. Double-click the server you wish to change. Select the Outlook Anywhere tab.

Set the internal and external URLs to your desired URL. In our case, we made both of these webmail.exchangeservergeek.com. Click Save.

We also need to make a change to one additional namespace; Autodiscover. If you double-clicked on the Autodiscover virtual directory you may have noticed it did not have a place to modify the URLs in the GUI.

Open the Exchange Management Shell and issue the following commands.

Note: Be sure to change EX16-01 on this command to the internal hostname of your Exchange server.

 C:\> Set-ClientAccessServer -Identity EX16-01 –AutoDiscoverServiceInternalUri https://autodiscover.exchangeservergeek.com/Autodiscover/Autodiscover.xml

To confirm this change type the following. You should receive an output similar to that below.

 C:\> Get-ClientAccessServer | fl identity,autodiscoverserviceinternaluri

Identity                       : EX16-01
AutoDiscoverServiceInternalUri : https://autodiscover.exchangeservergeek.com/Autodiscover/Autodiscover.xml

That wraps up our URL configuration. In the next section, we will discuss an alternative way to configure all your URLs–PowerShell.

Configure URLs via PowerShell

You may prefer to configure the URLs with PowerShell. Let’s explore how to do this.

Note: Be sure to change EX16-01 on these examples to the internal hostname of your Exchange server.

To set multiple servers at once you can pipe the Get- verb into its Set- counterpart. The only drawback is this example will reconfigure every OWA URL in your environment.

For example:
Get-OwaVirtualDirectory | Set-OwaVirtualDirectory -ExternalUrl https://webmail.exchangeservergeek.com/owa -InternalUrl https://webmail.exchangeservergeek.com/owa.

To configure both URLs for OWA on a single server:

 C:\> Set-OwaVirtualDirectory -Identity "EX16-01\OWA (Default Web Site)" -ExternalUrl https://webmail.exchangeservergeek.com/owa -InternalUrl https://webmail.exchangeservergeek.com/owa

To confirm this change type the following. You should receive an output similar to that below.

 C:\> Get-OwaVirtualDirectory | Select Server,ExternalURL,InternalURL | fl

Server      : EX16-01
ExternalUrl : https://webmail.exchangeservergeek.com/owa
InternalUrl : https://webmail.exchangeservergeek.com/owa

You would have received a warning that you must also reconfigure the URLs for ECP. Let’s take care of that one next.

 C:\> Set-EcpVirtualDirectory -Identity "EX16-01\ECP (Default Web Site)" -ExternalUrl https://webmail.exchangeservergeek.com/ecp -InternalUrl https://webmail.exchangeservergeek.com/ecp

To confirm this change type the following. You should receive an output similar to that below.

 C:\> Get-EcpVirtualDirectory | Select Server,ExternalURL,InternalURL | fl

Server      : EX16-01
ExternalUrl : https://webmail.exchangeservergeek.com/ecp
InternalUrl : https://webmail.exchangeservergeek.com/ecp

Let’s take care of Exchange Web Services (EWS) next. It really doesn’t matter what order we do these in as long as we get them all done.

 C:\> Set-WebServicesVirtualDirectory -Identity "EX16-01\EWS (Default Web Site)" -ExternalUrl https://webmail.exchangeservergeek.com/EWS/Exchange.asmx -InternalUrl https://webmail.exchangeservergeek.com/EWS/Exchange.asmx

To confirm this change type the following. You should receive an output similar to that below.

 C:\> Get-WebServicesVirtualDirectory | Select Server,ExternalURL,InternalURL | fl

Server      : EX16-01
ExternalUrl : https://webmail.exchangeservergeek.com/EWS/Exchange.asmx
InternalUrl : https://webmail.exchangeservergeek.com/EWS/Exchange.asmx

Next up is the ActiveSync virtual directory.

 C:\> Set-ActiveSyncVirtualDirectory -Identity "EX16-01\Microsoft-Server-ActiveSync (Default Web Site)" -ExternalUrl https://webmail.exchangeservergeek.com/Microsoft-Server-ActiveSync -InternalUrl https://webmail.exchangeservergeek.com/Microsoft-Server-ActiveSync

To confirm this change type the following. You should receive an output similar to that below.

 C:\> Get-ActiveSyncVirtualDirectory | select server,externalurl,internalurl | fl

Server      : EX16-01
ExternalUrl : https://webmail.exchangeservergeek.com/Microsoft-Server-ActiveSync
InternalUrl : https://webmail.exchangeservergeek.com/Microsoft-Server-ActiveSync

Next up is the Offline Address Book (OAB).

 C:\> Set-OabVirtualDirectory -Identity "EX16-01\OAB (Default Web Site)" -ExternalUrl https://webmail.exchangeservergeek.com/OAB -InternalUrl https://webmail.exchangeservergeek.com/OAB

To confirm this change type the following. You should receive an output similar to that below.

 C:\> Get-OabVirtualDirectory | Select Server,ExternalURL,InternalURL | fl

Server      : EX16-01
ExternalUrl : https://webmail.exchangeservergeek.com/OAB
InternalUrl : https://webmail.exchangeservergeek.com/OAB

Next up is the MAPI virtual directory.

 C:\> Set-MapiVirtualDirectory -Identity "EX16-01\mapi (Default Web Site)" -ExternalUrl https://webmail.exchangeservergeek.com/mapi -InternalUrl https://webmail.exchangeservergeek.com/mapi

To confirm this change type the following. You should receive an output similar to that below.

 C:\> Get-MapiVirtualDirectory | Select Server,ExternalURL,InternalURL | fl

Server : EX16-01
ExternalUrl : https://webmail.exchangeservergeek.com/mapi
InternalUrl : https://webmail.exchangeservergeek.com/mapi

Next up is Autodiscover.

 C:\> Set-ClientAccessServer -Identity EX16-01 –AutoDiscoverServiceInternalUri https://autodiscover.exchangeservergeek.com/Autodiscover/Autodiscover.xml

To confirm this change type the following. You should receive an output similar to that below.

 C:\> Get-ClientAccessServer | fl identity,autodiscoverserviceinternaluri

Identity                       : EX16-01
AutoDiscoverServiceInternalUri : https://autodiscover.exchangeservergeek.com/Autodiscover/Autodiscover.xml

Finally, let’s configure Outlook Anywhere.

 C:\> Set-OutlookAnywhere -Identity "EX16-01\RPC (Default Web Site)" -ExternalHostname webmail.exchangeservergeek.com -InternalHostname webmail.exchangeservergeek.com -ExternalClientsRequireSsl $true -InternalClientsRequireSsl $true -DefaultAuthenticationMethod NTLM

To confirm this change type the following. You should receive an output similar to that below.

 C:\> Get-OutlookAnywhere | Select Server,ExternalHostname,Internalhostname | fl

Server           : EX16-01
ExternalHostname : webmail.exchangeservergeek.com
InternalHostname : webmail.exchangeservergeek.com

Now that we are all done with URLs we need to implement split DNS. We address that in the next section.

Note: Rather than configuring these one at a time you may also be interested in scripting. Exchange MVP Paul Cunningham has a great set of scripts for setting URLs in bulk. I highly recommend them.

Configure Split DNS

Alright, let’s get our split DNS configured next. Our internal DNS servers will hold a non-authoritative copy of our external namespace. In short, with the exception of a few minor tweaks to our Exchange records, we are cloning everything in our external DNS to an internal DNS server. This will only be used by our internal users.

On your DNS server open DNS Manager. Right-click on Forward Lookup Zone and select New Zone… from the context menu.

Click Next.

Keep the default settings. Click Next.

Keep the default settings. Click Next.

In the Zone Name field enter your external domain name (in our example exchangeservergeek.com).

We will manually create all the records in this zone so select Do not allow dynamic updates. Click Next.

Click Finish.

Expand Forward Lookup Zones. In the left pane, right-click on exchangeservergeek.com zone and select New Host (A or AAAA) from the context menu.

In the Name field, type the first name on your certificate. In the IP address field, type the internal IP of your Exchange server. In our example, it is 192.168.10.13. Click Add Host.

Note: If you are using Kemp’s free virtual load balancer in your lab, you would enter that IP instead.

Repeat these steps for all other names on your certificate.

Referring to our namespace table at the start of this lesson our end result will be this. Your lab may look similar.

We are all set. At this point use ping to verify responses from all the host records you just created. Also, make sure you can get Outlook Web App and Autodiscover internally with a web browser. For example, point your web browser to https://webmail.exchangeservergeek.com/owa. You will see still a certificate error but you should reach the login page and be able to log in.

Note: You will need to repeat the previous steps for any additional resources you have in your external zone. For example, if your website is www.exchangeservergeek.com, you will need to create a www A record and point it to the public IP address of your hosting provider. We have an example of this in the screenshot above.

Next Steps

In part five of our series, we process and complete a certificate request for our lab. We also assign services to our new certificate.