Search the Community

Hello, I have created a web access rule to deny HTTP, HTTPS protocols to internal network from a specific web site defined on a URL Set. This rule is set to a group from Active Directory defined on Users Set. This group owns only one member. When we try to test internet access on client, ISA Server blocks not only the user group we have set in the rule, but all users from Active Directory. What could be the problem? Using Windows Server 2008 as a Domain Controller ISA Server 2006 is runnig on Windows Server 2003 Client machines are using Windows XP SP3 Tests are being implement on a virtual network using VirtualBox.

Hey peeps, I am in the process of setting up OWA for the college, something I have never done before. I managed to setup OWA on the Exchange Server Localhost now I just need to find out how I can access it via the internet. After a lot of googling and talking to some companies that have done this before a quick an easy method is to apparently use a spare External IP address (which I have obtained from my ISP) and NAT that publc IP to my Private IP address. I have an internal and external ISA servers and a Exchange Server. I just don't know where to start really. Do I set up that NAT forward on the ISA server? Exchange is 2007 and Threat Management Gateway 2010 on the ISA. I also have a SSL certificate from my ISP which is setup, so obviously that needs to be applied to the whole login bit, but for now, I just need a push in the right direction. I have also looked at DMZs etc, but quick and easy for now, experimentation later lol Any help would be much appreciated, thanks guys!! /Dan

Afternoon all, hope we are all well!!!!! Right I'm just wanting to knw if anyone has successfully manage to reverse proxy an RM EasyLink server using HTTPS. RM have told me that, I do not need a server certificate on my reverse proxy server, this being ISA 2006. I was led to belive that ISA needed a valid signed certificate bound to the vitrtual IP address of the server to allow SSL access. If it is not a ligitatley signed certificate it could then would not allow access to the server from the public Internet. At the moment I'm just wondering if this has ben done in any way by anybody out there. If you need anymore information, I will be happy to supply. Many thanks in advance.

We are trying to get Exchange 2007 ActiveSync to work externally through ISA 2006 so people can access their info from mobile devices such as iPhones. We've installed it using Verisign SSL certificates and OWA works fine. I can't however get ActiveSync to work. I've tested in on http://www.testexchangeconnectivity.com and get the following results, can anyone help please? Testing Exchange Activesync for host https://mydomain.org.uk/microsoft-server-activesync/ Exchange Activesync test Failed Test Steps Attempting to Resolve the host name mydomain.org.uk in DNS. Host successfully Resolved Additional Details IP(s) returned: xxx.xxx.xxx.xxx Testing TCP Port 443 on host mydomain.org.uk to ensure it is listening/open. The port was opened successfully. Testing SSL Certificate for validity. The certificate passed all validation requirements. Test Steps Validating certificate name Successfully validated the certificate name Additional Details Found hostname mydomain.org.uk in Certificate Subject Common name Validating certificate trust for Windows Mobile Devices Certificate is trusted and all certificates are present in chain Additional Details Certificate is trusted for Windows Mobile 5 and Later platforms. Root = OU=Class 3 Public Primary Certification Authority, O="VeriSign, Inc.", C=US Testing certificate date to ensure validity Date Validation passed. The certificate is not expired. Additional Details Certificate is valid: NotBefore = 6/18/2009 5:00:00 PM, NotAfter = 6/18/2012 4:59:59 PM Testing Http Authentication Methods for URL https://mydomain.org.uk/microsoft-server-activesync/ Http Authentication Methods are correct Additional Details Found all expected authentication methods and no disallowed methods. Methods Found: Basic Attempting an Activesync session with server Errors were encountered while testing the ActiveSync session Test Steps Attempting to send OPTIONS command to server Testing the OPTIONS command failed. See Additional Details for more info Additional Details A Web Exception occured because an HTTP 404 - NotFound response was received from ISA

Hello, I'd like to create a single point of entry to our network from the outside and to be able to publish/set up some kind of routing system to access devices/services within. I'm looking at I suppose an ISA style set up but whether this will do what I'm after I don't know; and I'd like some best practice. Things it needs to allow me to do: 1) Single login (authenticated against AD) through some kind of webpage/applet? 2) Allow RDP to 'any' internal IP or have a list of boxes to choose from. 3) Allow HTTP access to 'any' internal IP or have a list of sites/services to choose from. I guess really a VPN solution might be easier, but I'm just wondering whether there is some means of achieving this? I'm imagining it'd need to create some kind of port redirect if I had say 3 open ports on the firewall it could dynamically ssh tunnel or something? Or would it just be easier to have a box running ISA with Terminal Services web connector to RDP to itself and from there to wherever? Many thanks for your time. Kim.

We run ISA 2006 as an additional layer of filtering to pick up sites our RBC fails to filter (amongst other things). As part of this we regularly monitor the logs to detect common "off task" site accesses - i.e. students accessing proxy websites. We've come across a real vein of proxy websites this morning - loads more than I want to sit and add into the "ban" filter because I've got more pressing things to deal with - but I've noticed they all resolve down to a couple of IP addresses. Is there a way of quickly blocking access to a URL based on the IP address it resolves back to in ISA 2006....? This will enable me to enter in the target IPs quite quickly without having to sit and trawl through a list of websites... Thanks in advance! Jim

Hi All, I need a web browser based VPN solution! Any good ones out there guys ??

I have an issue that I thought I had solved, but it keeps rearing it's ugly head, and any help suggestions would be greatfully recieved. I have MOSS 2007 published through ISA 2006, sharepoint is configured with form based authentication, the web site is set with a session timeout of 35 mins, and ISA is configured with a web listener session timeout of 30 mins, as per ISA instructions. Authentication works perfectly internally and externally for the sharepoint web site, but sessions timeout after 10 mins not the 30 mins I have configured with ISA. The problem that I have with this is that I am also using SIMS Learning Gateway, and staff have to log in from home to fill in the reports and marksheets for profiles online. I am getting complaints that when completing the reports on the web form, staff are asked to log back in, but the form data is lost on re-authentication. this is really anoying for staff who lose 15 mins worth of work. I have tried a content editor web part that rotates through 3 pages on the sharepoint site, in a vain attempt to keep the ISA session alive when on the reports page. however this just displays the isa logon page once the session timeout. Whilst this enables the user to log back on without losing report data, it's not the elegant solution i am looking for. Can anyone help?

Simple question. Can ISA reverse proxy content apache on port 80 internally to https: 443 externally. I have a external IP mapped to ISA server. When i test this externally it works fine and is dropped as the rules are not setup correctly. What i want to happen is this: Client -> Firewall -> ISA -> Apache the content is proxied back to the client. I have a SSL wildcard installed on the ISA and the certificate is showing but i'm struggling big time with the web publishing rule. The external IP will be mapped to a seperate server interally. So https://mydomain.com is really http://mywebserver.mydomain.com and reverse proxied through. Please Help! I'm using ISA 06

We are using the Salamander MyDocuments web part with SharePoint in order to provide access to students' personal folders on a file share. The file share is on a separate server to the SharePoint Web Front End. We have configured Kerberos authentication and MyDocuments works fine internally. We use ISA 2006. Externally we can browse to the SharePoint site and turning on Kerberos Logging and using Wireshark I can see that Kerberos is being used. The MyDocuments web part however does not work externally. Presumably this is something to do with ISA and (triple?) hopping from ISA -> SharePoint Web Server -> File Share server. I am wondering if anyone else out there is using MyDocuments in this configuration and if you successfully have it working using Kerberos? [i have contacted Richard from Salamander and he has been very helpful, but, as he admits, his experience with ISA is limited. So I'm looking to find out if anyone has this working and might be able to share their experience with me].

Hi, Desperate help needed here please!! We have ISA 2006 Standard. Up til now it has been running perfectly... This morning I came in to find that internet access was down, with the following error in the Alerts/Monitoring page of ISA configuration every 10 mins or so: "Routing (Chaining) Failure" Whilst in the Application Log at the same time, the following error appears: Event ID: 14130. The Web Proxy filter detected that the upstream proxy server x is not available. During all this, access to the web is unavailable. Now i know the upstream proxy (our county's firewall) is working, as I have a single machine that connects ok (not via the ISA server). Checked all cabling, and all seems fine. Various searches on the web has not really turned anything useful up. Rebooted server but to no avail. Can anyone help please?!?!

Is any one doing this? We're using a dedicated terminal services server on our curriculum network which is behind an ISA 2006 box. I've set up a publishing rule directing RDP traffic to the remote server, but I'm getting errors when trying to connect. Has anyone else done this? Did you have to do anything fancy? It seemed straightforward enough! Cheers, Andy

Right, after careful consideration and several months of troubleshooting I have decided that Microsoft TMG 2010 is an abortion of of product and MS should have decided to kill the line before releasing it. I have tried it on a 2008 R2 VM, 2008 R2 physical host, 2008 physical host and reset it up a few times. Disables all inspection rules, gave it more RAM, implemented extencive logging rules etc. Stupidly I still can't pin down the problems 100% to the dirty TMG box as there is a switch or two in the way that are dodgey but it seems to be the prolem of TMG. Symptoms, continuously dropping packets and choking out internet connections for single clients for up to 15 minutes despite killing off flood mitigation settings and installing every hotfix avalible. Balmer needs to be hit with his own flying chair, removing features from products and releasing tripe like TMG. If I can finally 100% pin it down to TMG I am going to push MS to refund our Volume liscence of it.

Hi everyone, I'm new to ISA Server 2006 and have been reading the SAMS Guide (Microsoft ISA Server 2006 Unleashed) to learn up on it. I've got my SSL certificate installed and have setup the ISA server in unihomed mode (i.e. only 1 network card). According to my book, in unihomed mode all listeners should point to to the All Networks (and localhost) network so I have configured them thus. Using the Publish a website wizard I've specified a couple of websites to publish. I then test from the ISA server itself and get the following error: Denied Connection HANNAH 22/04/2009 14:57:43 Log type: Web Proxy (Forward) Status: 12202 The ISA Server denied the specified Uniform Resource Locator (URL). Rule: Default rule Source: Local Host (10.49.248.90) Destination: Internal (vle.bartoncourt.org 10.49.160.24:80) Request: GET http://10.49.160.24/ Filter information: Req ID: 0a70a5c1; Compression: client=No, server=No, compress rate=0% decompress rate=0% Protocol: http User: anonymous Additional information Client agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729) Object source: (No source information is available.) Cache info: 0x0 Processing time: 1 ms MIME type: For some reason only the Default Rule is being applied (or at least it's the default rule that's blocking my request). Any advice on why this is the case please? Thanks in advance, jonathan

I created a rule in ISA Server 2004 to allow access to an MSDE instance on a win server 2003. When connecting from the computer that I allowed in the rule, I get the message: An error has occurred while establishing a connection to the server. When connecting to SQL Server 2005, this failure may be caused by the fact that under the default settings SQL Server does not allow remote connections. (provider: SQL Network Interfaces, error: 26 - Error Locating Server/Instance Specified) Does anyone have any suggestions? I have allowed outbound traffic for all users on TCP port 1433 (default Microsoft SQL port) and also allowed access to the port for the named instance. When ISA is not installed, I can access the database from any computer. Please Help!