Appendix C: Troubleshooting a Mobile Messaging Solution
6/2/2010
This section provides information about troubleshooting tools and detailed information and specific troubleshooting steps around Microsoft direct push technology so that you can better isolate mobility issues within your network infrastructure.
This section contains information on the following subjects:
- Logging and Troubleshooting Tools
- Issues Related to Direct Push Technology
- Issues with ISA Server 2006
- Certificate Implementation Issues on the Server
- Communication Issues between the Front-end and Back-end Exchange Servers
- Frequently Asked Questions
Logging and Troubleshooting Tools
The following troubleshooting and logging tools should help you track and resolve mobility issues.
Monitoring Mobile Performance on Exchange Server 2003 SP2
To track the performance, availability, and reliability of Exchange ActiveSync and other mobile messaging components, you can use the Exchange Server Management Pack. The Exchange Server Management pack includes rules and script components that validate the availability of communication services, send test e-mails to verify operations, and measure actual delivery times.
With Exchange Server 2003 SP2, the following new rules were added:
- Exchange database sizes limits
- Exchange ActiveSync configuration settings
- Exchange ActiveSync Up-to-Date Notifications performance
- Exchange ActiveSync errors
- Monitor intelligent message filtering performance
- Intelligent message filtering for errors
- Sender ID configuration errors
- Sender ID errors
- Disk read/write performance
- DSAccess settings
- Public folder replication
The Exchange Management Pack Configuration Wizard provides a graphical user interface (GUI) to configure Exchange 2000 and Exchange 2003 Management Packs, including test mailboxes, message tracking, and monitoring services.
You can download the Exchange Management Pack from the Microsoft Web site: https://go.microsoft.com/fwlink/?LinkId=55885.
The Exchange Server Management Pack Guide for MOM 2005 explains how to use the Exchange Management Pack to monitor and maintain messaging resources.
You can download the management pack guide from the Microsoft Web site: https://go.microsoft.com/fwlink/?LinkId=58794.
ISA Server Best Practices Analyzer
To determine the overall health and diagnose common configuration errors, download and run the Microsoft ISA Server Best Practices Analyzer Tool at the Microsoft Download Center at this Microsoft Web site: https://go.microsoft.com/fwlink/?LinkId=108979.
Issues Related to Direct Push Technology
Refer to Understanding the Direct Push Technology in this document for details on how direct push works.
General Direct Push Troubleshooting Tips
In general, there are three troubleshooting steps that an administrator can take to troubleshoot connectivity issues:
- Verify that the operating system on the mobile devices includes MSFP. Windows Mobile 5.0–based devices that have a version number of 148xx.2.x.x or later include the Messaging and Security Feature Pack. To find the operating system version on the device, select Start, choose Settings, and then select About.
- Verify that your mobile operator supports direct push. It is important that your mobile operator perform basic troubleshooting so that you can determine if your mobile operator supports direct push on their cellular data network.
- Provision a mobile device on the mobile operator’s network for Exchange ActiveSync and try to synchronize manually. If this works, then the network supports basic connectivity to the Internet.
- Enable direct push technology on the device by setting the synchronization schedule on the device to As items arrive. Send email to the account with which the device is provisioned, and verify that it is immediately synchronized by the mobile device by means of Exchange ActiveSync. If this step works, wait twenty or so minutes and try again. If it does not work, verify that the mobile operator timeouts are set to thirty minutes.
Path Troubleshooting Direct Push
In many cases, a single firewall or gateway in the network can cause timing issues that impede the direct push path.
- If your users have problems with short battery life, the heartbeat interval may be too short. Contact your mobile operator to have the device heartbeat interval modified.
- If your users' devices are unsynchronized for long periods of time, this may be a result of having the Exchange server session duration shorter than the maximum heartbeat interval. Check with your mobile operator.
- Another possible cause of unsynchronized devices has to do with the firewall settings. The firewall session timeout should be equal to or greater than the idle timeout on your mobile operator's network or the firewall will close the session prematurely.
In all mobile messaging scenarios, you will need to ensure that your firewall configuration is set to work correctly with Exchange ActiveSync and direct push technology. While each network infrastructure varies, the following illustration depicts a typical network infrastructure where the firewall idle session timeouts need to be adjusted to 30 minutes.
.gif)
Using a heartbeat interval of 30 minutes has positive implications for battery life and bandwidth consumption. When direct push sessions are permitted to live longer (such as 30 minutes), there are fewer HTTP round trips, less data sent and received, and less power consumed by the device.
In other infrastructure scenarios, idle session time out settings may also include any other packet-forwarding networking devices or web appliances between the Exchange 2003 Server and mobile device. To modify the idle session timeout settings for your third party firewall or reverse proxy device, please refer to the hardware manufacturer’s documentation to do so. Additionally, Microsoft has worked with mobile operators to increase the idle connection timeouts on their outgoing firewalls, but the enterprises that are deploying direct push technology will also need to increase those timeouts on their incoming firewalls per the instructions above. In Microsoft’s own deployment, the timeouts on the firewall are set to thirty minutes.
Verify Direct Push Initialization
The Exchange Product team has written an article that explains steps that an administrator can take to help isolate direct push technology issues. For additional information and the full context of this article, see this Microsoft Web site: https://go.microsoft.com/fwlink/?LinkId=67080.
Verify that Exchange ActiveSync is loaded and IP-based AUTD is initialized by checking the application log on the FE for events below. Exchange Activesync gets initialized on the first sync attempt.
Event Type: Information Event Source: Server ActiveSync Event Category: None Event ID: 3002 Date: 3/19/2006 Time: 12:44:08 PM User: N/A Computer: 1B25A Description: Microsoft Exchange ActiveSync has been loaded: Process ID: [3048]. Event Type: Information Event Source: Server ActiveSync Event Category: None Event ID: 3025 Date: 3/19/2006 Time: 12:44:19 PM User: N/A Computer: 1B25A Description: IP-based AUTD has been initialized.Verify that the FE is listening on port 2883.
To check if the server is listening on the AUTD port, you can run "netstat -ano". Here are results before and after IP-based AUTD has initialized.
Before
Proto Local Address Foreign Address State PID
UDP 0.0.0.0:1985 *:* 1928
UDP 0.0.0.0:3456 *:* 3356
After
Proto Local Address Foreign Address State PID
UDP 0.0.0.0:1985 *:* 1928
UDP 0.0.0.0:2883 *:* 3048
UDP 0.0.0.0:3456 *:* 3356
Netstat provides the Process ID which matches the EAS process per the initialization event in the application log.
Another way to check if the server is listening on the AUTD port is to use PortQry (available on Microsoft.com). The following lists the process that is listening on the port:
Process ID: 3048 (w3wp.exe)
PID Port Local IP State Remote IP:Port
3048 TCP 31479 172.29.8.222 ESTABLISHED 172.29.9.107:3268
3048 TCP 31480 172.29.8.222 ESTABLISHED 172.29.9.107:389
3048 UDP 2883 0.0.0.0 *:*
Troubleshooting Direct Push Using Logs
To enable device logging, go to ActiveSync, Menu, Configure Server, Next, Advanced and turn up Event logging to Verbose. The logs will be saved in the Windows\ActiveSync folder. PING commands will be logged in "Ping Exchange Server x.txt" where x =1,2,3. You should see commands similar to the one that follows:
POST Microsoft-Server-ActiveSync?User=administrator&DeviceId=6F24CAD599A5BF1A690246B8C68FAE8D&DeviceType=PocketPC&Cmd=Ping MS-ASProtocolVersion: 2.5
The POST command is also logged in the IIS log on the FE.
The Ctrl log on the device can also be used to troubleshoot direct push technology although the format of this file may change with device updates.
Check the IIS logs on the BE to see if AUTDState.XML is being created or updated. You should see an entry something similar to the one that follows:
PUT /exchange/Administrator@1b1domain.lab/NON_IPM_SUBTREE/Microsoft-Server-ActiveSync/PocketPC/6F24CAD599A5BF1A690246B8C68FAE8D/AutdState.xml
Note
The AUTDState.XML is created on receipt of the 1st PING request and is updated only when the heartbeat or folder list changes. So you may not see this command for every Ping request.
AUTD state information is maintained on the mailbox server in the NON_IPM_SUBTREE of each user's mailbox.
In Internet Explorer, you can Choose File, Open, check the box to "Open as Web Folder" and type the following:
https://server/exchange/user/NON_IPM_SUBTREE/Microsoft-Server-ActiveSync/Autd-State.XML
The following is a sample AUTDState.XML file.
<?xml version="1.0" encoding="utf-8"?>
<AutdState xmlns="Ping:">
<Version>1.0</Version>
<HeartbeatInterval>680</HeartbeatInterval>
<Folders>
<Folder>
<Id>7529a5b36290aa458b9e1fc2d5ff85a6-3aaa2</Id>
<Class>Email</Class>
</Folder>
<Folder>
<Id>7529a5b36290aa458b9e1fc2d5ff85a6-2cfb8</Id>
<Class>Calendar</Class>
</Folder>
</Folders>
</AutdState>
|
Push Mail and GAL Lookup missing when syncing to Exchange 2003 SP2 with a MSFP Device.
The following is a reprint of a blog on Microsoft TechNet that explains steps that an administrator can take to help isolate issues around direct push email and GAL Lookup when synching to Exchange 2003. For additional information and the full context of this article, please see the following TechNet blog: https://go.microsoft.com/fwlink/?LinkId=108981.
During deployments you may run into the issue where your server is up and you are syncing without a problem but you aren’t getting the option to sync as items arrive as well as the option to do Lookup Online is missing. This is normally caused by a firewall issue where the Options verb is being blocked.
We see we are not returning the expected response for the OPTIONS command from the following entry on the device logs. Enable Verbose logging on the device from server settings in Advanced in device to see these logs.
|
The HTTP 500 is the response from the server for the OPTIONS command sent by the device.
We normally get this response if URLScan is blocking the verb. So we have to check for URLScan in the server. If URLScan is present, then we can add OPTIONS to the AllowVerb section of URLScan.ini file.
The above symptom is confirmed from the IIS logs as well.
|
Notice the entry Log=V1 in the above log entry.
It indicates that Airsync protocol version 1.0 is being used, whereas with Push functionality Airsync version 2.5 is the latest and to be used.
Ideally we should use Airsync protocol version 2.5 which will be represented as Log=V4.
So permitting the OPTIONS verb in URLScan or whatever software is blocking it should resolve the issue.
|
Based on the list of commands returned by the server as above, the device will decide which version of AirSync protocol to use. Different features like direct push technology or AUTD etc depend on the version of the protocol being used for communication.
Check for URLScan on your Exchange server and check if any other device or software device is blocking OPTIONS command.
URLScan is an add-on tool that can be used by Web site administrators. The administrators can control the actions of URLScan and can restrict the type of HTTP requests that the server processes. URLscan.ini file is the configuration file of this tool and URLscan tool will not function after we rename this file and once we rename it back it will start working again, nothing else will be affected.
For more information see the Microsoft Knowledge Base article, "Using URLScan on IIS" (https://support.microsoft.com/kb/307608/). The purpose of this article is to ensure effective distribution of the Internet Information Services (IIS) security tool URLScan.
After you edit your URLSCAN.ini file a Server reboot is not required just restart the IIS & WWW services.
Issues Related to ISA Server 2006
The following issues have been discovered in early deployment of ISA Server 2006.
Double Authentication Required after Upgrading from ISA Server 2004
After upgrading from ISA Server 2004, when an Exchange publishing rule was defined with forms-based authentication, users are prompted twice for their credentials. In ISA Server 2004, when you create a rule with the New Mail Server Publishing Rule Wizard, authentication delegation is not required, because it is handled by ISA Server itself. When this rule is upgraded to ISA Server 2006, authentication delegation for the rule is set to No delegation.
The solution is to manually configure authentication delegation for the affected rule to Basic Authentication.
Log Off when the User Leaves Site Feature Removed
The Log off when the user leaves site setting has been removed from ISA Server 2006. Users should always use the log off button to properly log off from Outlook Web Access.
Windows Mobile Users Receive Error 401 Unauthorized
When a Windows Mobile user tries to access a published Outlook Web Access or Windows Mobile Access Web site published with the New Exchange Publishing Rule Wizard, the user receives error 401 instead of the Exchange logon forms.
This error appears when the required HTML form directories for Windows Mobile access are missing from the Exchange HTML form set directory
The solution is to manually create the two directories, cHTML and xHTML, in the %programfiles%\Microsoft ISA Server\CookieAuthTemplate\Exchange folder. Then, copy the contents of the %programfiles%\Microsoft ISA Server\CookieAuthTemplate\Exchange\HTML folder to the cHTML and xHTML folders.
Users Receive Access Denied Error Message
When a user attempts to connect to a published Outlook Web Access site and does not add the /exchange suffix to the end of the URL, such as https://mail.contoso.com, instead of receiving the forms-based authentication logon screen, the user receives an "Access denied" error message. This error can be difficult to troubleshoot because ISA Server is behaving as expected.
A workaround is to publish the root of the Exchange front-end server, with an action of Deny, and redirect users to the proper URL, such as https://mail.contoso.com/exchange.
Perform the following procedure to automatically redirect users to the proper Outlook Web Access URL.
To create an Exchange Web client access publishing rule
In the console tree of ISA Server Management, click Firewall Policy:
- For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server_Name, and then click Firewall Policy.
- For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array_Name, and then click Firewall Policy.
On the Tasks tab, click Publish Web Sites. Use the wizard to create the rule as outlined in the following table.
| Page | Field or property | Setting |
|---|---|---|
Welcome |
Web publishing rule name |
Type a name for the rule, such as Exchange Redirect. |
Select Rule Action |
Action to take when rule conditions are met |
Select Deny. |
Publishing Type |
Select if this rule will publish a single Web site or external load balancer, a Web server farm, or multiple Web sites |
Select Publish a single Web site or load balancer. |
Server Connection Security |
Choose the type of connections ISA Server will establish with the published Web server or server farm |
Select Use SSL to connect to the published Web server or server farm. .gif) Note:
A server certificate must be installed on the published Exchange front-end servers, and the root CA certificate must be installed on the ISA Server computer.
|
Internal Publishing Details |
Internal site name |
Type the internal FQDN of the Exchange front-end server. For example: exchfe.corp.contoso.com. Important:
The internal site name must match the name of the server certificate that is installed on the internal Exchange front-end server.
Note:
If you cannot properly resolve the internal site name, you can select Use a computer name or IP address to connect to the published server, and then type the required IP address or name that is resolvable by the ISA Server computer.
|
Internal Publishing Details |
Path (optional) |
Type / in the Path box. |
Public Name Details |
Accept requests for Public name |
This domain name (type below) Type the domain name that you want ISA Server to accept connections for. For example, type mail.contoso.com. |
Select Web Listener |
Web listener |
Select the Web listener you created previously, such as Exchange FBA. |
Authentication Delegation |
Select the method used by ISA Server to authenticate to the published Web server |
Select Basic authentication. |
User Sets |
This rule applies to requests from the following user sets |
Select the user set approved to access this rule. This should be the same user set that you used in the Exchange publishing rule. |
Completing the New Web Publishing Rule Wizard |
Completing the New Web Publishing Rule Wizard |
Finish to complete the wizard. |
Certificate Implementation Issues on the Server
For information about troubleshooting Certificate implementation on Server, see "Certificate Revocation and Status Checking" on the Microsoft TechNet Web site.
https://www.microsoft.com/technet/prodtechnol/winxppro/support/tshtcrl.mspx
Communication Issues between the Front-end and Back-end Exchange Servers
For information about front-end and back-end communication issues, see the Microsoft Support Webcast, "Troubleshooting Microsoft Exchange Server 2003 ActiveSync Issues."
Frequently Asked Questions
The Exchange Product team has written an article that explains steps that an administrator can take to help isolate direct push technology issues. For more information about the deployment of direct push technology, see the Exchange Server blog article "Direct push is just a heartbeat away" at https://go.microsoft.com/fwlink/?LinkId=67080.
- Does direct push technology work for folders other than inbox?
Yes, direct push is available for mail folders, Contacts, Calendar and Tasks. The list of folders for direct push is the same as the list of folders that have been configured for sync. - What devices support direct push technology?
Windows Mobile 5 devices require the Messaging and Security Feature Pack(MSFP) for direct push. MSFP is included with AKU2.2. So any Windows Mobile 5 device that has AKU2.2 supports direct push. The AirSync protocol has been licensed to several companies such as Palm, Motorola, Nokia, Symbian, Dataviz and SonyEricsson. Please contact the licensees to see if direct push capable devices are available. - Is direct push supported over Wi-Fi?
No. direct push requires a cellular data connection. It is not supported over Wi-Fi or Desktop Passthrough (when the device is cradled).
Due to hardware limitations, Wi-Fi cannot go into standby mode and receive notifications. So in order to support direct push over Wi-Fi, the Wi-Fi connection would have to be kept alive which in turn would drain the battery very rapidly. - Does direct push technology work with SecurID?
RSA has an update to their agent to allow it to work with direct push technology. RSA Authentication Agent 5.3 for Web for IIS enables you to use Exchange ActiveSync without having to reauthenticate every time ActiveSync is invoked. For more details, please read this and contact RSA. - Does direct push have an impact on server performance?
A typical FE services several thousand connections from clients using OWA, OMA, EAS, and RPC/HTTP clients. Based on the testing done by Microsoft IT, the additional connections opened by direct push did not require the deployment of any additional FE or BE servers. It also did not require an upgrade of hardware on existing servers.
For more information please refer to the whitepaper titled "Microsoft IT Scalability Experience with Windows Mobile 2003 and Exchange Server 2003 Mobile Messaging" available at
https://www.microsoft.com/windowsmobile/business/strategy/scalability.mspx