Search the Community

Hi, we're in the process of switching from a Sophos box to Forefront for website restrictions etc. The thing I like about the Sophos box is that you can submit a request to have the site unblocked there and then, it sends the URL and username. I cannot figure out how to get this kind of feature with Forefront, have anyone else done it? Thanks.

Hello there. What I'm going to try and explain now may be very vague, but I just want to see if anyone else has had the same issue as me, so here goes! We have a Server 2008 Standard server. Installed on the server is Forefront TMG. I have configured a web chain out to a proxy the entire site uses provided by our local council. I have added all the rules into the firewall that we need as a school, and the net connection works exactly how I would expect it to. The issue I have, is that when any changes are made to any aspect of networking on the server, I get a BSOD telling me that fweng.sys is the problem (I don't have dump log to hand, but I can get it if anyone thinks they might be onto something.) The server can run in a stable fashion if the following is done: Disconnect internal and external interfaces from server Turn on server and leave to boot into Windows Log on and leave to settle reconnect network cables one at a time Check that internal shares can be reached Check that external websites can be reached Log off Once it's up and running, it serves the whole site perfectly until you try to make any changes to it. I can log onto the server and use it in any fashion I wish. So long as I don't try to make any changes in Forefront or adjust any network settings, I can be sure it won't "fall over" again. Obviously this is no good for us, as we are unable to do anything to this server in it's current state. We have disabled the internal network card, and have added an HP Broadcomm adapter in it's place. All drivers have been updated and we have attempted to run Windows update. When Windows update is run, we get a BSOD and the same error message about fweng.sys (which I believe is the Firewall Engine). We have NOT updated the firmware on the network cards, but we will be doing so over half term. Basically, I was wondering if anyone has come across an issue like this. Idea's and suggestions are very welcome.

Hi all, In an earlier post I asked how it was possible to setup web monitoring in Forefront TMG 2010. With this we have decided that at least in principal that TMG is the best option for our school. However I’m having a hard time with the Licencing…. We would need access to the URL Filtering feature and filter lists and I’m trying to figure out is this an additional cost for us? We already pay out Schools Agreement and get with that Forefront TMG Enterprise so does this cover the URL lists or do we need the extra CAL mentioned on the Microsoft website? Thanks, James

I'm trying to deploy Forefront from Server 2008 to Windows 7 clients using the MOM 2005 Administrator Console. I've added port exceptions (tcp and udp) 1270, 135 and 445, on the server and client, but always get an error: If I turn off the client firewall, it installs fine. The most detailed page addressing this problem (on winserverkb.com) suggested adding the program exception: but this didn't help either. Has anyone encountered this and know what ports to open/programs to allow?

When trying to access Exchange web mail from external, after logging in I get the following error reported in the browser: Error Code: 500 Internal Server Error. The certificate chain was issued by an authority that is not trusted. (-2146893019) Running TMG Management Console tests on the OWA firewall policy also indicate similar: Destination Server Certificate Error 0x80090325 - The certificate chain was issued by a certificate authority that was not trusted. Following the link reported in the test and actioning to generate a certificate and deploy reported in no errors, however I cannot see the certificate in the AD Certificate server store, nor any mention of certificates in any of the GPO's that I have looked at - the implication is that the certificate is deployed by GPO. The instructions that I followed were from here: Generating the https certificate Deploying the certificate Forefront TMG is running in a domain environment so I opted for automatic deployment as is recommended. We have an enterprise root CA. The note mentions up to 8 hours for the certificate to propagate, but I have done a GPUPDATE on each machine and also waited a significant number of hours, possibly more than 8, with reboots in between. So it looks like its not working rather than simply taking time to deploy. Any suggestions of debugging this error?

Good Morning, Our teachers have started using new documents as apart of the curriculum. These are opened securely through LockLizard but we're having a hard time getting this to work. We keep receiving the message in the screenshot above. We have exempted the process as specified through Forefront. We have also stopped any scans running on the install directory and still struggling to get this to work. Has anyone else had similar issues?

Hi, Right what I am trying to achieve sounds simple..full VPN access with a windows 7 client into my network. Currently I utilise the VPN supplied by the Grid, which gives me full access to my school's grid allocated 10.105.0.0 subnet. That would all be fine, if my internal network actually used that subnet. How I have my school's network set up is that everything is in a private address range 10.100.0.0 and all clients that require internet access go via a Forfront TMG firewall/proxy (obviously this has two network cards, one in each network). The 10.105.0.0 network contains only the outside NIC of the TMG server and a switch. How I get around the problem now is to simply allow RDP through a specific port on the TMG from authenticated users with an IP in my VPN range. This works fine in most cases, but I have specific need for full VPN. I have no idea how I can actually achieve a scenario where from the client end, I would connect to the Grid's VPN solution and just have full access to my internal network, no messing around. Any ideas?