Possible to have TMG and VPN side by side?

[nLinked]

We have TMG 2010 on Server 2008 R2. The TMG acts as our proxy server and has a 443 HTTPS listener installed.

 

Is it still possible to use this same server to act as an RDP gateway (I believe this also uses port 443) to we can VPN to it from outside and let this server forward our RDP session to any internal machine? Is this something that is normally done or do we HAVE to have a separate server for VPN RDP purposes?

[MicrosoftTechy]

yes you can if you have external DNS host name for example remote.yourschool.sch.uk and set up a new listener and add this in the domain list

[SYNACK]

Yes, so long as your TMG is setup to use a https listener so that it can crack open the traffic you'll be fine. The TMG can redirect based on folders and RDP gateway so you can redirect to different servers if it needs to, we do the same with OWA and RemoteApp on one SSL connection.

[nLinked]

Thanks both. Currently we have the normal HTTPS listener in TMG (443) which is used for accessing secure internal sites from outside. We have requested a new subdomain from our LA just for vpn purposes.

 

Just to clarify, can we use the same HTTP web listener or do we have to make a new one in TMG? Our LA only allows RDP gateway over 443.

[MicrosoftTechy]

I would create a new HTTPS listener for this. and call it like VPN or somthing with the subdomain name of like vpn.myschool.sch.uk ect so all traffic that comes via port 443 with the hostname vpn.myschool.sch.uk then forward to pc xxx.xxx.xxx.xxx

[pantscat]

Just a quick question - is there any particular reason you're not using TMG as your VPN?

[SYNACK]

Thanks both. Currently we have the normal HTTPS listener in TMG (443) which is used for accessing secure internal sites from outside. We have requested a new subdomain from our LA just for vpn purposes.

 

Just to clarify, can we use the same HTTP web listener or do we have to make a new one in TMG? Our LA only allows RDP gateway over 443.

So long as you are endpointing the SSL tunnel on the TMG so that you can use ruels to split the traffic to different servers based on url folders. We use rules to split off RD Gateway from OWA on different servers here via ISA. TMG was a bit of a horror show for us, five rebuilds later it never worked right and we just went back to ISA.

[nLinked]

I would create a new HTTPS listener for this. and call it like VPN or somthing with the subdomain name of like vpn.myschool.sch.uk ect so all traffic that comes via port 443 with the hostname vpn.myschool.sch.uk then forward to pc xxx.xxx.xxx.xxx

 

Thanks that sounds like exactly what we need. Will give it a go and update.

 

Just a quick question - is there any particular reason you're not using TMG as your VPN?

 

We're on LGfL2 now but previously we had VPN working fine with PPTP and MSCHAP configured on TMG, but LGfL2 won't allow PPTP for security reasons, but they do offer an RDP Gateway. They said we can host our own RDP gateway on our own TMG via 443.

[nLinked]

I would create a new HTTPS listener for this. and call it like VPN or somthing with the subdomain name of like vpn.myschool.sch.uk ect so all traffic that comes via port 443 with the hostname vpn.myschool.sch.uk then forward to pc xxx.xxx.xxx.xxx

 

Quick question, if I try to make a new Access Rule, then the properties for the rule don't show a Listener tab so I can't assign the newly created HTTPS listener to the rule. Would a Web Publishing Rule (which does have the Listener tab) be correct in this case?

 

[pantscat]

We're on LGfL2 now but previously we had VPN working fine with PPTP and MSCHAP configured on TMG, but LGfL2 won't allow PPTP for security reasons, but they do offer an RDP Gateway. They said we can host our own RDP gateway on our own TMG via 443.

 

Change to SSTP type VPN? That's what I'm about to try out here with Forefront... (SSTP uses port 443).

[nLinked]

Change to SSTP type VPN? That's what I'm about to try out here with Forefront... (SSTP uses port 443).

 

That looks interesting. But this article says XP won't work with SSTP. Is that true? So XP home users won't be able to VPN in with SSTP? And in that case I suppose Linux too?

[pantscat]

You're absolutely correct. I'm only allowing "school machines" to VPN in... thus Win7 only.

As far as I know there isn't any SSTP client support for anything other than Win7 (Win8!) and Win 2008.

[nLinked]

You're absolutely correct. I'm only allowing "school machines" to VPN in... thus Win7 only.

As far as I know there isn't any SSTP client support for anything other than Win7 (Win8!) and Win 2008.

 

Thanks, we have all Win7 machines inside which is fine, but what about users connecting from home? Do they also have to be Win7?

[MicrosoftTechy]

new access rule

[nLinked]

new access rule

 

Thanks, but when I try that and go it's properties, there's no Listener tab for me to assign the newly created listener to it. Maybe I'll try one of the others and see how it goes...

 

[pantscat]

Thanks, we have all Win7 machines inside which is fine, but what about users connecting from home? Do they also have to be Win7?

 

Yep indeed.

[MicrosoftTechy]

i can take a look if you want ?

[MicrosoftTechy]

it ask you towards the end to create a new listener ? what server is this going to point to internally

[MicrosoftTechy]

Just use TMG as the RAS / VPN

[nLinked]

it ask you towards the end to create a new listener ? what server is this going to point to internally

 

Towards the end of the Access Rule creation there's nothing about making a new listener so I had to make the listener separately.

 

Settings for listener

Networks: External, Internal

SSL port 443

Certificate: Our wildcard

Auth: None

Forms: None

SSO: None

 

Settings for Access Rule

Applies to: All outbound traffic

From: External

To: Internal

Users: All

No Listener tab to can't assign rule to above listener.

 

All we want really is a way for users at home to be able to RDC into any machine internally. But this has to pass through our proxy server, which is TMG. So we need the TMG server to accept the VPN connection, and let the user choose what machine they want to RDC to, and TMG should then forward that through to the machine. But we have to do it through port 443 because our LA will not allow L2TP or PPTP ports for VPN. We do want to use the same TMG server to handle this. Thanks for your help so far.

[MicrosoftTechy]

Can you not use Remote Desktop Gateway ? or Windows Server | DirectAccess | Remote Access | VPN

[nLinked]

To be honest I find this all very confusing as it's the first time I'll be setting this up. I did come across the RD Gateway server role (which isn't currently installed).

[nLinked]

Can you not use Remote Desktop Gateway ? or Windows Server | DirectAccess | Remote Access | VPN

 

Well, we finally got our TMG rules to work. However, when we connect from home, it RDCs straight into the TMG server itself! Is there a way to forward the incoming username to a specific workstation?