TMG 2010:Login To OWA Without Domain

Some company would simplified the process of lo gin to Outlook Web App (OWA), for instance redirect from HTTP to HTTPS, which is very convenient for users because  they don't need to remember to key in "S" when they want to access OWA.

Another example is they could log in without domain name (domain\username), especially when one company could have different internal & external domain name, they wouldn't want user to get confused about it so they decided to have only username as the log in name.

The steps above is easy to configure in Exchange CAS server, but if you have a TMG server in place, you will need to configure it in TMG server but not CAS server.

Navigate to C:\Program Files\Microsoft Forefront Threat Management Gateway\Templates\CookieAuthTemplates\Exchange , look for a file name "string" and open it. (Strongly recorded to backup the file before you start modifying it)

Inside the string file locate the _UserName_Text="Domain\user_name:"

remove domain\ and it should look like _UserName_Text="user_name:" 

Save it and reboot TMG server and you should be able to log in without inputting domain now.


Remember to perform the same step if you have an array of TMG servers.

Deploying Lync Mobility With TMG Single NIC Configuration

I finally managed to deploy Lync mobility service today for my company's Lync server ever since Lync mobility was introduced few months back. You can find many useful deployment guide over the internet if you do a search, but what I would like to share is some experience about deploying Lync mobility services with TMG single NIC configuration which I found it is quite rare since most of the guide you found is mostly about having 2 NICs TMG configuration.

In my environment the TMG server is already in use to publish Exchange web services(OWA, Active Sync, Outlook Anywhere) . Since this is a single NIC TMG, you can only create one listener. If you try to create another listener for Lync services,  an error “A web listener specifying the same port and similar IP Addresses already used by the rule “[Your_Exchange_Services_Rule]”. The port and IP addresses specified in a Web Listener cannot overlap with the IP addresses specified web listener already used in a different rule”

To overcome this issue, simply use the same listener with a SAN certificate that contains both Exchange and Lync services FQDN.

For example, my original SAN certificate for Exchange is inclusive of webmail.domain.com , autodiscover.domain.com. I regenerated a new certificate in Exchange server with additional SAN which is required by Lync mobility services - lyncdiscoverinternal.domain.com , lyncdiscover.domain.com and etc.

After that, I went ahead to request new certificate from Lync Front End server with the same SAN (inclusive of Exchange web services FQDN) and we are almost good to go.

In TMG server I removed the original listener, and created a new listener by using the certificate which is newly created (In my case I export the certificate from Exchange server), followed by creating a new publishing rule for Lync discovery. When the rule is created and the moment I clicked "Test Rule" , it is showing a positive passed result and Lync mobility is ready to go live!

This is just an overall concept on how to deploy Lync mobility with TMG single NIC configuration, I hope this will at least provide you with some ideas if you have the same environment as mine.

Forefront TMG With Single NIC Configuration

I'm involved in a large scale Microsoft Exchange deployment project recently. I've proposed  to use TMG server with single NIC configuration to function as reverse proxy for Exchange services.

During the discussion with my customer when we drill down to the TMG configurations, I'm asked why am I proposing TMG server with single NIC(DMZ) instead of 2 NIC(DMZ + Internal).

Well this is a good question and I would like to take this opportunity to explain the benifits of single NIC configurations.

Before that, you may want to take a look into what is the limitation of single NIC configuration here.

Lets talk about typical 2 NIC configuration like below:

The TMG is configured with 2 NICs, 1 connecting to External network and another one connecting to internal network. When the external firewall NAT the 443 traffic(for Exchange services) to TMG, first it will go through from the external network NIC then perform reverse proxy request to Exchange server via internal network NIC. Please note that in this situation the network traffic will bypass the internal firewall when it route back to Exchange server.


Where if you use single NIC configuration, it will look like this:

 When the external firewall NAT the 443 traffic to TMG, the TMG server will perform reverse proxy request (firewall to route the traffic back to Exchange server) to Exchange server with only single NIC, where it will need to go through the firewall this time without bypassing it.


In my humble personal opinion, this is a better configuration since we can utilize the internal firewall's functionality(scan for malware and etc) instead of bypassing it, it would be a waste if we deploy an inetrnal firewall and bypass it right?(and firewall is expensive!)  ;)

Anyway this is still very much depend on the situation, whether the customer's policy would allow you route traffic directly from DMZ to internal.

I hope this would help you to have a better idea on single NIC TMG deployment.