Everything else is done through the Exchange tools and, more specifically (if you are working through the GUI Exchange Management Console), under Server Configuration and the CAS role settings, where you'll find the virtual folder settings that allow you to configure important aspects like authentication for Exchange. Here you can make adjustments from an OWA connection that uses forms over to a Windows Integrated connection. The same is true with other out-of-office connection settings.
3. Ensure client access
There are two keys to smooth client access. The first is making sure your DNS settings both internally and externally are configured properly so that people trying to access Exchange through a browser or mobile device (or other method) can do so. The second is ensuring you have certificates that confirm the server is who it says it is. That may seem like a security aspect -- and it is on a deeper level -- but it isn't directly connected to anything the user will note as security.
Essentially, you can use the self-signed certificate that comes with Exchange for some connections (like OWA), but users will then have to accept and trust that cert when they try to connect. It's not the most professional way to deploy the services, so you might look to a PKI internal certificate services setup using an in-house server or through a third-party trusted certificate authority. My personal opinion? The third-party certificate authority approach is easy and cheap (and won't give you headaches setting up a PKI server).
Exchange 2010 has a great new wizard that walks you through the certificate request. By working with a trusted certificate authority vendor like GoDaddy or VeriSign, you can obtain the cert, install it on the server, and provide your users a trusted connection that is verifiable (behind the scenes) by the certificate authority. You can use a wild card certificate (*.domainname.com) or a Subject Alternative Name (SAN) certificate to ensure the different access methods are secure.
4. Validate access
You can validate connectivity easily by setting up the out-of-office solution and testing to see if you have any problems accessing from whatever browser, mobile device, and Outlook/mail client will be used, depending on which out-of-office form you've selected. In most cases, you will have multiple forms selected.