> Source: [sk114515](https://support.checkpoint.com/results/sk/sk114515)

# sk114515 - "Your request can't be completed right now. Please try again later." when trying to open e-mails in OWA 2016 via Mobile Access portal

| Property | Value |
|----------|-------|
| Solution ID | sk114515 |
| Date Created | 2016-11-14 |
| Last Modified | 2021-08-16 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81 (EOS) |
| OS | Gaia |

## Solution

### Introduction

This article describes different scenarios when "***Your request can't be completed right now. Please try again later.*** " error is displayed in OWA 2016 (connected via Mobile Access portal) when trying to open e-mails.  
Each Scenario has its own cause and solution.  
See the Table of Contents below.

**Table of Contents:**

* Scenario 1 - OWA is configured to use Path Translation (PT)
* Scenario 2 - Mobile Access Gateway translates OWA e-mail content
* Related documents

Show the Entire Article

### Scenario 1 - OWA is configured to use Path Translation (PT) {#Scenario 1}

**Symptoms:**

* "`Your request can't be completed right now. Please try again later.`" when trying to open e-mails in OWA 2016 via Mobile Access portal

* Debug of *cvpnd* daemon ("`cvpnd_admin debug`" - refer to [sk104577](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk104577)/[sk99053](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk99053)) shows the following:

  `validReferer: Referrer (https://My.TestDomain.Com/PT/https://x.x.x.x/owa/auth/logon.aspx?`  
  `replaceCurrent=1&url=https%3a%2f%2fMy.TestDomain.Com%2fPT%2fhttps%3a%2f%2fx.x.x.x%2fowa) host ref (My.TestDomain.Com) Base host (My.TestDomain.Com)`  
  `validReferer: Comparing basic host (My.TestDomain.Com) if suffix with referrer host (My.TestDomain.Com)`  
  `Got DENY note from ref check for request (/Portal/GetSetCookies) - send error page`  
  `Cvpn::ApacheLog::webSecurityViolation: reason: Illegal Referrer host`

Show / Hide solution  
**Issue:**

* 02306163

**Solution:**
> This problem was fixed. The fix is included in:
>
> * [Check Point R80.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111841)
>
> On R77.X Mobile Access Gateway, follow these steps:
>
> **Note:** In cluster environment, this procedure must be performed on *all* members of the cluster.
>
> 1. Connect to the command line on the Mobile Access Gateway.
>
> 2. Log in to the Expert mode.
>
> 3. Backup the current *$CVPNDIR/conf/includes/CustomRulesBefore.conf* file:
>
>    **`[Expert@HostName:0]# cp -v $CVPNDIR/conf/includes/CustomRulesBefore.conf{,_ORIGINAL}`**
> 4. Edit the current *$CVPNDIR/conf/includes/CustomRulesBefore.conf* file:
>
>    **`[Expert@HostName:0]# vi $CVPNDIR/conf/includes/CustomRulesBefore.conf`**
> 5. Add the following section (6 lines):
>
>    **` #OWA 2016 - Override OWA's attempt to skip the Referer header.`
>    `#Attempt to send it to internal links only.`
>    ` #'origin' is not enough since the internal URL is used for deciding which cookies to serve.`
>    ` SubstituteCond %{ENV:CvpnResourceType} =OWA`
>    ` SubstituteCond %{ENV:CvpnInternalURL} ^.*/owa/.*$`
>    ` Substitute "s~(<meta\s*name=\"referrer\"\s*content\s*=\s*\"?)(?:never|no-referrer)(\"?\s*/>)~<!--The following meta tag was modified by MAB-->$1origin-when-crossorigin$2~qk" `**
> 6. Save the changes in the file and exit from Vi editor.
>
> 7. Reload the Mobile Access policy:
>
>    Note: This can disconnect the current sessions.
>    **`[Expert@HostName:0]# cvpnd_admin policy hard`**

### Scenario 2 - Mobile Access Gateway translates OWA e-mail content {#Scenario 2}

**Symptoms:**

* "`Your request can't be completed right now. Please try again later.`" when trying to open e-mails in OWA 2016 via Mobile Access portal

* Debug of *cvpnd* daemon and *httpd* daemon (refer to [sk104577](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk104577)/[sk99053](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk99053)) shows the following (in (`$CVPNDIR/log/trace_log/` files):

  `[CPCVPN_RECEIVED_BODY] |<Time Stamp>|`  
  ` ...`  
  ` [{"ErrorInfo":null,"SubscriptionExists":false,"SubscriptionId":"ReminderNotification","SuccessfullyCreated":true},{"ErrorInfo":null,"SubscriptionExists":false,"SubscriptionId":"NewMailNotification","SuccessfullyCreated":true},{"ErrorInfo":"SubscribeToSuiteNotification is only supported through Broker not in OwaMapiNotificationManager.","SubscriptionExists":false,"SubscriptionId":"SuiteNotification","SuccessfullyCreated":false}]`

Show / Hide solution  
**Solution:**
> Configure the Mobile Access Gateway to not translate OWA e-mail content.
>
> **Note:** In cluster environment, this procedure must be performed on *all* members of the cluster.
>
> 1. Connect to the command line on the Mobile Access Gateway.
>
> 2. Log in to the Expert mode.
>
> 3. Backup the current *$CVPNDIR/conf/includes/CustomRulesBefore.conf* file:
>
>    **`[Expert@HostName:0]# cp -v $CVPNDIR/conf/includes/CustomRulesBefore.conf{,_ORIGINAL}`**
> 4. Edit the current *$CVPNDIR/conf/includes/CustomRulesBefore.conf* file:
>
>    **`[Expert@HostName:0]# vi $CVPNDIR/conf/includes/CustomRulesBefore.conf`**
> 5. Add the following section (4 lines):
>
>    **` #OWA 2016 - Skip OWA mail body`
>    ` SubstituteCond %{ENV:CvpnResourceType} =OWA`
>    ` Substitute "s~(\Q\"ResponseMessages\":\E)~$1~qs"`
>    ` Substitute "s~(<meta\s*name=\"referrer\"\s*content\s*=\s*\"?)(?:never|no-referrer)(\"?\s*/>)~<!--The following meta tag was modified by MAB-->$1origin-when-crossorigin$2~qk" `**
> 6. Save the changes in the file and exit from Vi editor.
>
> 7. Reload the Mobile Access policy:
>
>    Note: This can disconnect the current sessions.
>    **`[Expert@HostName:0]# cvpnd_admin policy`**

### Related documents {#Related documents}

* Mobile Access Administration Guide ([R76](http://downloads.checkpoint.com/dc/download.htm?ID=22904), [R77.X](http://downloads.checkpoint.com/dc/download.htm?ID=24851), [R80](http://downloads.checkpoint.com/dc/download.htm?ID=46531), [R80.10](http://downloads.checkpoint.com/dc/download.htm?ID=53103))

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content