Exchange 2016 OWA login works but email, calendar will not open

Question

Env details-

Exchange 2016 CU15 running on Server 2012r2, is patches are recently installed

Owa URL is behind netscaler and load balanced between 4 exchange servers

Note- internally everything works normally

Problem- some users complained they cannot open owa emails from external . After collecting more details, it turns out owa login works and users can see the emails but when you click on one, reading pane shows Loading and it is stuck on it. At same time, you also cannot open calendar or owa options like display settings or other menus. I was also able to replicate this issue. Tried multiple browsers, all latest releases, same thing

Now if the same user open https://webemail.domain.com/owa from a mobile device (iPhone), and get to the mobile ver. of the owa website, everything works. User agent string will identify itself as mobile device and mobile view is shown.. all good. Then if you request desktop site on the same browser, back to above issue

In short for owa, mobile view works but not the full premium view. It just shows loading screen in the reading pane when any email is selected but never load the email body

Interestingly I decided to gave IE11 a shot and it seems to work fine.. odd for sure and then I changed to light mode. Now all other browsers work also, but in light mode only

I did not see anything in the event logs that might be related

Has anyone seen this before, help is appreciated..

TY

Answer 1

issue is resolved..

Turns out it was the front end optimization on the netscaler that caused it. NS were updated in July with new firmware and perhaps it has more aggressive optimization or new browsers have code that do not play well with it. Client had fe optimization enabled before so both combination of new firmware and browser updates likely contributed.

It make more sense now why mobile site and owa light mode worked all this time as traffic sent between client browser and server is significantly less compared to normal mode so not much http traffic to optimize anyway

we didn’t have to test with single server in the lb pool, that was next in line🙂

All browsers now work, no issue

Thanks for all your suggestions

NS

Answer 2

The ECP and OWA virtual directories must be configured the same in the load balancer. Whenever someone says the options menu is not loading, that's the first thing I would check. Verify the netscaler is set the same for both virtual dirs as far as affinity, or servers they are balancing etc...

Answer 3

Ok, I was thinking of three other possibilities. Two being server-based

1. Firewall/Reverse Proxy. Any changes there that would affect the ECP virtual directory? Anything blocked or not published?
2. How about the ECP virtual directories themselves? Are the URLs valid and accessible? And do they match what is set on the OWA virtual directories?

Get-ECPVirtualDirectory | Format-List Name,InternalURL,ExternalURL
Get-OWAVirtualDirectory | Format-List Name,InternalURL,ExternalURL

3. How about authetication? Check to make that the auth on those ECP and OWA dirs match.
   Get-EcpVirtualDirectory | fl auth
   Get-OWAVirtualDirectory | fl auth

Answer 4

No firewall changes

Ecp vd and owa vd, url and auth setting is same

Looking from browser dev tools- network tab, I noticed something that when Firefox or chrome or edge send requests, one particular GET request — Microsoft.owa.lightning.mouse.css returns no data. whatever this thing is must be important as on ie11. , this GET request does work and return big pay pad of 408Bytes, lot is information is returned including exchange server names

That GET request header is https://webemail.donain.com/owa/prem/15.1.1913.7/resources/styles/0/microsoft.owa.lightning.mouse.css

Answer 5

interesting. So anything else that may be interfering?
Anti-virus on the server etc...

otherwise, I would keep that Citrix ticket open.

Question: When you test internal access how are you testing? Through the load balancer or direct to the server? If not direct, try that against each one and see if the issue surfaces?

P.S. You should be at least at CU16, but I dont think that is the issue here.