Hi,   I was hoping someone could maybe shed some light on a very strange ActiveSync issue via the MAG, running 8.0r6.   I've setup ActiveSync/OWA authorization only rules loads of times, and it works perferctly for "full fat" OWA. The problems arise when I tick the ActiveSync only box. It works for some users, but for most it doesnt work.   On further investigation I find the following...    Working user Request hits VirtualIP address, certificate offered correctly (https://owa1.mycompany.com), User Access logs shows the request, source IP, username and deviceID no problems URL re-written to the correct internal server name (https://exchange-cas.mycompany.internal)   Non-working user Request hits VirtualIP address, certificate offered correctly (https://owa.mycompany.com), User Access logs shows the request, source IP, username and deviceID no problems URL re-written to incorrect internal server name (https://owa2.mycompanycom)   The "incorrect" URL is valid for other users, I dont pretend to understand the intricacies of MSX storage groups, DAGs, etc. there's a lot of failover and redundancy built into the exchange infrastructure. That URL is valid for some users but not the one in question.    Now the weirdest part...    If I configure a profile on another iphone (mine), for the non-working user, it goes through just fine!!!    I cant even fathom how that is possible, we've ruled out all MDM software.   Where is the MAG getting that URL from, it's not in the local config on the device at all, there's definitely no passthrough proxy re-writing rule for it, it's nowhere...    In my experience Auth-only pass-through configs "just work", External URL is ALWAYS rewritten Internal URL.   So perhaps not user specific, but device specific, but how? they both pass through the same rule which should be re-writing the requests as per the authorization only virtual hostname config.   I'm well and truely stumped!   Over to you Juniper community! Any ideas?   Many Thanks   Dave   ... View more