When integrating iPhones with Exchange Server 2010, the authentication process might succeed while email functionality fails. This typically occurs when:

• The Exchange ActiveSync service is running but not properly configured
• Firewall rules are incomplete despite ports 25 (SMTP) and 993 (IMAPS) being open
• SSL certificate requirements aren't met for secure communication

Exchange Server 2010 requires these essential components for iPhone connectivity:

// Minimum required Exchange Web Services configuration
Set-WebServicesVirtualDirectory -Identity "EWS*" -ExternalUrl https://mail.domain.com/EWS/Exchange.asmx
Set-ActiveSyncVirtualDirectory -Identity "Microsoft-Server-ActiveSync*" -ExternalUrl https://mail.domain.com/Microsoft-Server-ActiveSync

While Exchange 2010 might allow account validation without SSL, full functionality requires:

• A valid SSL certificate from a trusted CA (not self-signed)
• Proper certificate binding in IIS
• Matching certificate names (SAN certificates recommended)

Additional ports needed for full Exchange 2010 functionality:

// PowerShell command to verify required ports
Get-NetFirewallRule | Where-Object {$_.DisplayName -like "*Exchange*"} | Select-Object DisplayName,Enabled

Essential ports beyond 25 and 993:

• 443 (HTTPS for ActiveSync and OWA)
• 80 (HTTP redirection)
• 135 (RPC endpoint mapper)

When Exchange resides in a DMZ, ensure:

// Example network flow for DMZ deployment
Client → Firewall (NAT) → DMZ Exchange Server → Firewall (NAT) → Internal Network

Critical checks:

• Autodiscover service must resolve correctly
• All required internal network resources must be accessible
• Firewall rules must allow bidirectional communication

Use these Exchange PowerShell cmdlets for troubleshooting:

Test-ActiveSyncConnectivity -ClientAccessServer YourServer -MailboxCredential (Get-Credential)
Test-OutlookWebServices -Identity user@domain.com | Format-List

Before testing iPhone connectivity:

1. Verify SSL certificate installation and binding
2. Confirm all required ports are open and forwarding correctly
3. Test internal connectivity before external access
4. Validate Autodiscover functionality

---

When attempting to connect iPhones to our Exchange Server 2010 infrastructure, we're observing a peculiar behavior where:

• Account validation succeeds (proving authentication works)
• Ports 25 (SMTP) and 993 (IMAPS) are correctly forwarded
• OWA access functions externally
• Firewall logs show "allowed" traffic
• ActiveSync is confirmed running on Exchange

Exchange 2010's ActiveSync requires SSL encryption for mobile device communication. While account validation might pass without SSL, actual mail flow will fail. Here's why:

// Exchange 2010's default ActiveSync virtual directory configuration
Get-ActiveSyncVirtualDirectory | fl Server,InternalURL,ExternalURL,ClientCertAuth
/*
Server          : EXCH01
InternalURL     : https://mail.contoso.com/Microsoft-Server-ActiveSync
ExternalURL     : https://mail.contoso.com/Microsoft-Server-ActiveSync
ClientCertAuth  : Ignore
*/

Three approaches to resolve this:

# 1. Purchase a commercial SSL cert (recommended for production)
New-ExchangeCertificate -GenerateRequest -SubjectName "c=US, o=Contoso, cn=mail.contoso.com" -DomainName mail.contoso.com, autodiscover.contoso.com -PrivateKeyExportable $true -Path C:\certreq.txt

# 2. Use self-signed cert (temporary/testing only)
$cert = New-ExchangeCertificate -Services "IIS,SMTP" -SubjectName "cn=EXCH01.contoso.local" 
Enable-ExchangeCertificate -Thumbprint $cert.Thumbprint -Services "IIS,SMTP"

# 3. Set certificate authentication (if using internal PKI)
Set-ActiveSyncVirtualDirectory -Identity "EXCH01\Microsoft-Server-ActiveSync (Default Web Site)" -ClientCertAuth "Accept"

Beyond the basic ports, ensure these are open:

# Required ports for Exchange ActiveSync
$activeSyncPorts = @{
    "HTTP" = 80
    "HTTPS" = 443
    "SMTP" = 25
    "IMAP4_SSL" = 993
    "Autodiscover" = 443
}

When Exchange sits in a DMZ, verify:

• Internal DNS resolution works bidirectionally
• Firewall rules allow traffic from DMZ to internal domain controllers
• Service principal names (SPNs) are properly registered

# Check SPN registration
setspn -L EXCH01
/*
Registered ServicePrincipalNames for CN=EXCH01,OU=Exchange Servers,DC=contoso,DC=local:
        http/EXCH01
        http/EXCH01.contoso.local
        exchangeMDB/EXCH01.contoso.local
*/

Test connectivity using PowerShell:

Test-ActiveSyncConnectivity -ClientAccessServer EXCH01 -MailboxCredential (Get-Credential) -TimeoutSeconds 30

# Expected successful output:
/*
ClientAccessServer  : EXCH01.contoso.local
Scenario           : Options
Result             : Success
Latency            : 00:00:00.1560000
Error              :
*/

On the iOS device, verify:

1. Server address uses FQDN (mail.contoso.com, not IP)
2. Domain field is populated (even if blank in OWA)
3. SSL toggle is enabled
4. Authentication method matches Exchange configuration