Hi Mungo23, read this two articles. I think they will help you and answer your questions. http://blogs.technet.com/b/exchange/archive/2009/11/20/3408856.aspx http://blogs.technet.com/b/exchange/archive/2009/12/17/3409102.aspx Hth.Regards Robert Genes

When you created your listener, did you on the Single Sign On Settings page, enter your domain, such as fabrikam.com? This check box and field are very important for migration from Microsoft Exchange Server 2003 and Exchange 2007 to Exchange 2010, because this setting allows Forefront TMG to do the single sign-on (SSO) redirection for Exchange 2003 and Exchange 2007 users when they try to log on to Exchange 2010. This document discusses: "Using Native Exchange SSO Redirection Combined with Forefront TMG Listener SSO", which should apply to your scenario. Greg Taylor, Senior Program Manager, Exchange Server Publishing Exchange Server 2010 with Forefront Unified Access Gateway 2010 and Forefront Threat Management Gateway 2010 http://www.microsoft.com/download/en/details.aspx?id=8946MCTS: Messaging | MCSE: S+M

We are about to migrate from Exchange 2003 to 2010 and I am currently in the process of setting up and testing the publishing rules. I have set the 2003Url property on the CAS server, and the redirection works internally when connecting to the CAS and you are redirected to the 2003 server. Externally we currently have a publishing rule for 2003 and this works fine. (all users are still on the 2003 mailbox at the moment) I have also created a legacy rule that points to 2003 and if you manually go that that address it works correctly. When I create a 2010 publishing rule which points to the 2010 cas server, you can login, however it doesn't redirect to the legacy address and you get a 403 error. How do you correctly configure redirection when you are publishing the site behind TMG?

Don’t know if you went through this thread but its same issue as you facing http://social.technet.microsoft.com/Forums/en-US/exchange2010/thread/57317a09-2ab1-416b-8a72-c66645dff2f8/ Jasjit Singh Dhindsa | ITIL v3 | IASA Foundation Certified | MCITP:Exchange 2010 | Exchange 2007 | MCTS:OCS 2007 | Exchange 2010 | Exchange 2007 | MCSA:Messaging | Security | MCSE:Messaging | Security

Hi Mungo23, I would check where there is A record for legacy.domain.com on the public DNS server. How about to use https://legacy.domain.com/exchange directly to access the mailbox on the exchange 2003 server from outside. some information for you:http://technet.microsoft.com/en-us/library/ee332348.aspx After publishing the exchange 2010 CAS external webservice, how do you change the rule/listener for exchange 2003. As normal, we could let the https://mail.domain.com/owa point to the new exchange 2010 server, and use https://legacy.domain.com/exchange point to the old exchange 2003 external url. Please check it, hope more information, and we can do more research about your issue. Regards! Gavin TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Mungo23, Any update for your issue? Regards! Gavind TechNet Subscriber Support in forum If you have any feedback on our support, please contact tngfb@microsoft.com Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.