• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Client cannot connect?

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2000 Firewall] >> Firewall Client >> Client cannot connect? Page: [1]
Login
Message << Older Topic   Newer Topic >>
Client cannot connect? - 8.Sep.2006 8:30:24 PM   
pompeytech

 

Posts: 47
Joined: 8.Sep.2006
Status: offline
Hi all i am new to ISA Server so bare with me ok. First, i am using VMWare to set up a test network and i have installed ISA 2000 on a 2003 Server and installed the Firewall client software on a workstation. I have then created a protocal rule on the ISA, but still my workstation will not connect to the internet. Can anyone help please.
Post #: 1
RE: Client cannot connect? - 8.Sep.2006 8:36:33 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi pompeytech,

if you are new to ISA server I highly recommend you drop ISA 2000 and go with at least ISA 2004 or even better ISA 2006. The point is that ISA 2000 is getting "very old" and ISA 2004/2006 is conceptual quite different than ISA 2000. So, go for ISA 2006 if possible.

Nevertheless, do you have a site&control rule in place to allow the destination and the content?

HTH,
Stefaan

< Message edited by spouseele -- 8.Sep.2006 8:37:45 PM >

(in reply to pompeytech)
Post #: 2
RE: Client cannot connect? - 8.Sep.2006 8:47:09 PM   
pompeytech

 

Posts: 47
Joined: 8.Sep.2006
Status: offline
I would love to ISA 2004 but unfortunately i dont have a copy. As for the site & control rule in place, umm no i dont, could you explain to me please. Thanks for the reply by the way.

(in reply to spouseele)
Post #: 3
RE: Client cannot connect? - 8.Sep.2006 8:55:35 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi pompeytech,

check out http://www.isaserver.org/articles/Getting_Started_with_ISA_Server300.html.

HTH,
Stefaan

(in reply to pompeytech)
Post #: 4
RE: Client cannot connect? - 8.Sep.2006 9:01:21 PM   
pompeytech

 

Posts: 47
Joined: 8.Sep.2006
Status: offline
Many thanks spouseele, by the way if you know of anywhere i can get my hands on ISA2004 please let me know.

(in reply to spouseele)
Post #: 5
RE: Client cannot connect? - 8.Sep.2006 9:09:58 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi pompeytech,

what would you think of http://www.microsoft.com/isaserver/prodinfo/trial-software.mspx?

HTH,
Stefaan

(in reply to pompeytech)
Post #: 6
RE: Client cannot connect? - 8.Sep.2006 11:11:25 PM   
pompeytech

 

Posts: 47
Joined: 8.Sep.2006
Status: offline
Yeah i have looked at this but it`s only for so many days!! The way i study i really need a full copy.

By the way i have sorted out my workstations, they now can connect to the internet, thanks for the link.
My only concern is it takes ages for them to connect!! Any ideas on this??

(in reply to spouseele)
Post #: 7
RE: Client cannot connect? - 9.Sep.2006 10:58:10 AM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi pompeytech,

assuming you have no adapter problems (driver, speed & duplex setting) it is likely a routing and/or name resolving problem. Please post some more info about your exact configuration. To start with, an 'ipconfig /all' and a 'route print' on the ISA and the workstation could be helpfull. Also, are you running an internal DNS server?

HTH,
Stefaan

(in reply to pompeytech)
Post #: 8
RE: Client cannot connect? - 9.Sep.2006 1:37:26 PM   
pompeytech

 

Posts: 47
Joined: 8.Sep.2006
Status: offline
Ok i would like to upload the info you asked for but i dont know how!! I have used the FAQ section that clearly states to tick the box "Click here to upload". Or to insert a bmp image that i have to check the box "Embed picture in post”. BUT i cannot find it anywhere???

(in reply to spouseele)
Post #: 9
RE: Client cannot connect? - 9.Sep.2006 1:53:40 PM   
pompeytech

 

Posts: 47
Joined: 8.Sep.2006
Status: offline
===========================================================================

Thanks for the info Spouseele!! Below are the details you asked for.
 
ISA Route Print
 
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
         0.0.0.0          0.0.0.0    192.168.229.2   192.168.229.16     10
       127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
     192.168.0.0    255.255.255.0     192.168.0.12     192.168.0.12     10
    192.168.0.12  255.255.255.255        127.0.0.1        127.0.0.1     10
   192.168.0.255  255.255.255.255     192.168.0.12     192.168.0.12     10
   192.168.229.0    255.255.255.0   192.168.229.16   192.168.229.16     10
  192.168.229.16  255.255.255.255        127.0.0.1        127.0.0.1     10
192.168.229.255  255.255.255.255   192.168.229.16   192.168.229.16     10
       224.0.0.0        240.0.0.0     192.168.0.12     192.168.0.12     10
       224.0.0.0        240.0.0.0   192.168.229.16   192.168.229.16     10
255.255.255.255  255.255.255.255     192.168.0.12     192.168.0.12      1
255.255.255.255  255.255.255.255   192.168.229.16   192.168.229.16      1
Default Gateway:     192.168.229.2

ISA ipconfig /all
 
Windows IP Configuration
  Host Name . . . . . . . . . . . . : Jaguar
  Primary Dns Suffix  . . . . . . . : Contoso.local
  Node Type . . . . . . . . . . . . : Unknown
  IP Routing Enabled. . . . . . . . : No
  WINS Proxy Enabled. . . . . . . . : No
  DNS Suffix Search List. . . . . . : Contoso.local
Ethernet adapter Local Area Connection 2:
  Connection-specific DNS Suffix  . :
  Description . . . . . . . . . . . : VMware Accelerated AMD PCNet Adapter
  Physical Address. . . . . . . . . : 00-0C-29-B3-83-44
  DHCP Enabled. . . . . . . . . . . : No
  IP Address. . . . . . . . . . . . : 192.168.229.16
  Subnet Mask . . . . . . . . . . . : 255.255.255.0
  Default Gateway . . . . . . . . . : 192.168.229.2
  DNS Servers . . . . . . . . . . . : 192.168.229.2
Ethernet adapter Local Area Connection:
  Connection-specific DNS Suffix  . :
  Description . . . . . . . . . . . : VMware Accelerated AMD PCNet Adapter
  Physical Address. . . . . . . . . : 00-0C-29-B3-83-3A
  DHCP Enabled. . . . . . . . . . . : No
  IP Address. . . . . . . . . . . . : 192.168.0.12
  Subnet Mask . . . . . . . . . . . : 255.255.255.0
  Default Gateway . . . . . . . . . :
C:\Documents and Settings\Administrator.CONTOSO>

Workstation Route Print

C:\Documents and Settings\administrator.CONTOSO>Route Print
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 0c 29 24 39 d1 ...... AMD PCNET Family PCI Ethernet Adapter - Packet S
cheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
         0.0.0.0          0.0.0.0      192.168.0.1    192.168.0.51       10
       127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
     192.168.0.0    255.255.255.0     192.168.0.51    192.168.0.51       10
    192.168.0.51  255.255.255.255        127.0.0.1       127.0.0.1       10
   192.168.0.255  255.255.255.255     192.168.0.51    192.168.0.51       10
       224.0.0.0        240.0.0.0     192.168.0.51    192.168.0.51       10
255.255.255.255  255.255.255.255     192.168.0.51    192.168.0.51       1
Default Gateway:       192.168.0.1

Workstation ipconfig /all
C:\Documents and Settings\administrator.CONTOSO>ipconfig /all
Windows IP Configuration
       Host Name . . . . . . . . . . . . : comp01
       Primary Dns Suffix  . . . . . . . : Contoso.local
       Node Type . . . . . . . . . . . . : Unknown
       IP Routing Enabled. . . . . . . . : No
       WINS Proxy Enabled. . . . . . . . : No
       DNS Suffix Search List. . . . . . : Contoso.local
                                           contoso.local
Ethernet adapter Local Area Connection:
       Connection-specific DNS Suffix  . : contoso.local
       Description . . . . . . . . . . . : VMware Accelerated AMD PCNet Adapter
       Physical Address. . . . . . . . . : 00-0C-29-24-39-D1
       Dhcp Enabled. . . . . . . . . . . : Yes
       Autoconfiguration Enabled . . . . : Yes
       IP Address. . . . . . . . . . . . : 192.168.0.51
       Subnet Mask . . . . . . . . . . . : 255.255.255.0
       Default Gateway . . . . . . . . . : 192.168.0.1
       DHCP Server . . . . . . . . . . . : 192.168.0.1
       DNS Servers . . . . . . . . . . . : 192.168.0.1
       Lease Obtained. . . . . . . . . . : 08 September 2006 22:21:56
       Lease Expires . . . . . . . . . . : 16 September 2006 22:21:56



(in reply to pompeytech)
Post #: 10
RE: Client cannot connect? - 9.Sep.2006 3:34:17 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi pompeytech,

aha... I need some more info:  
- what is the content of the LAT (Local Address Table) on ISA?
- what is the host 192.168.229.2 used as default gateway and DNS server on the ISA LAN2 nic?
- what is the host 192.168.0.1 used as default gateway, DNS and DHCP server on the Workstations LAN nic?
- do you have an Active Directory server on the ISA internal LAN?

HTH,
Stefaan 


(in reply to pompeytech)
Post #: 11
RE: Client cannot connect? - 9.Sep.2006 4:05:06 PM   
pompeytech

 

Posts: 47
Joined: 8.Sep.2006
Status: offline
Hi Spouseele, umm your getting technical now, lol, What do you mean by :
 
- what is the host 192.168.229.2 used as default gateway and DNS server on the ISA LAN2 nic?
- what is the host 192.168.0.1 used as default gateway, DNS and DHCP server on the Workstations LAN nic?

The Contents od the LAT Table are as follows:
10.0.0.0          10.255.255.255
169.254.0.0      169.254.255.255
172.16.0.0        172.31.255.255
192.168.0.0      192.168.0.255
192.168.0.0      192.168.255.255

Yes i have Active Directory on my DC

(in reply to spouseele)
Post #: 12
RE: Client cannot connect? - 9.Sep.2006 6:48:09 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi pompeytech,

OK, let's draw a little diagram to help explain how the general network setup should be:
quote:

    192.168.0.0/24
           vvv
[ PC ] --------- [ ISA ] --------- Internet/External 
                                   ^^^
                           192.168.229.0/24

In the above diagram, I assume that the ISA internal interface is a member of the Network ID 192.168.0.0/24 and that the ISA External interface is a member of the Network ID 192.168.229.0/24. So the default gateway on ISA should *only* be set on the ISA external interface and that looks OK in your case. However, the LAT on ISA should *only* contain the Network ID's used on the internal network. In your case I think this is the Network ID 192.168.0.0/24 only and therefore the LAT should only have the single entry 192.168.0.0 - 192.168.0.255.

Question: what type of device is the host 192.168.229.2? It seems to be used as default gateway *and* as DNS server and that is a little bit strange.
 
Now, on the internal network you said you have a DC. So, may I assume it has the IP address 192.168.0.1 and is used as internal DHCP *and* DNS server?
 
Question: why is on the internal workstation the default gateway 192.168.0.1 and not the ISA internal interface?
 
 
About the optimum DNS configuration:
----------------------------------------

Assuming you have an internal DNS server, do *not* specify any ISP/External DNS server on any adapter of the ISA server. Just the internal DNS server on the internal interface and make sure the internal adapter is listed first in the adapter order as explained in Jim's excellent article http://www.isaserver.org/tutorials/Configuring_ISA_Server_Interface_Settings.html .

Next, perform the following configuration steps:

1) configure the internal DNS server as a SecureNAT client. That means his default gateway should point to the ISA internal interface.

2) enable forwarders on your internal DNS server and specify there your ISP/External DNS servers. Also, make sure you check the "Do not use recursion" box.

3) create on ISA a client address set containing your internal DNS server.

4) create on ISA a *separate* protocol rule allowing the protocols DNS Query (UDP port 53 send/receive) *and* DNS Zone Transfer (TCP port 53 outbound) and apply it to the above created client address set.

5) create on ISA a *separate* site&content rule allowing access to any destination or better to a destination set containing your ISP/External DNS servers, and apply it to the above created client address set.

Now, thoroughly test the DNS name resolving with the command nslookup. All should work well. Last but not least, never touch the DNS protocol and site&content rule again. You should now have a very stable DNS infrastructure.

HTH,
Stefaan

(in reply to pompeytech)
Post #: 13
RE: Client cannot connect? - 9.Sep.2006 10:14:19 PM   
pompeytech

 

Posts: 47
Joined: 8.Sep.2006
Status: offline
Ok i have followed your advise but i must be missing something as its still very slow.Below is a print of when i ran nslookup on the DC.
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
C:\>nslookup jaguar
DNS request timed out.
   timeout was 2 seconds.
*** Can't find server name for address 192.168.0.1: Timed out
Server:  UnKnown
Address:  192.168.0.1
Name:    jaguar.Contoso.local
Address:  192.168.0.12

(in reply to spouseele)
Post #: 14
RE: Client cannot connect? - 9.Sep.2006 11:04:02 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi pompeytech,

you seems to have a problem with the configuration of the DNS server itself. Check out if you have a reverse zone so that IP addresses can be translated to FQDN's!

Oh... and please, do NOT autoregister the ISA interfaces in the DNS server (Interface properties -> DNS tab, uncheck the box 'Register this connection's addresses in DNS'). Instead you should define them statically in the DNS server.

HTH,
Stefaan

(in reply to pompeytech)
Post #: 15
RE: Client cannot connect? - 9.Sep.2006 11:12:35 PM   
pompeytech

 

Posts: 47
Joined: 8.Sep.2006
Status: offline
 Yessssssss It works, Finally figured it out. All i did was change the order of the nics on the ISA so North was first !!!!

Many Thanks Souseele. Top Guy!!

Now i can finally turn to the next page in the book and get stuck again!!!

(in reply to pompeytech)
Post #: 16
RE: Client cannot connect? - 10.Sep.2006 10:13:49 AM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi pompeytech,

quote:

All i did was change the order of the nics on the ISA so North was first !!!!

I hope you did the other suggested configuration changes too...

HTH,
Stefaan

(in reply to pompeytech)
Post #: 17
RE: Client cannot connect? - 10.Sep.2006 11:10:43 AM   
pompeytech

 

Posts: 47
Joined: 8.Sep.2006
Status: offline
 

do NOT autoregister the ISA interfaces in the DNS server (Interface properties -> DNS tab, uncheck the box 'Register this connection's addresses in DNS').

Yes the check box is unchecked. But what would happen if this box was left ticked.?

you seems to have a problem with the configuration of the DNS server itself. Check out if you have a reverse zone so that IP addresses can be translated to FQDN's!

When a new reverse zone is created do i add the Internal IP address? 192.168.0?


(in reply to spouseele)
Post #: 18
RE: Client cannot connect? - 10.Sep.2006 2:13:21 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi pompeytech,

quote:

Yes the check box is unchecked. But what would happen if this box was left ticked.?

Whenever ISA server acquire a new IP address (i.e. by enabling VPN client access), you would get a wrong registration for the ISA internal interface which breaks Auto Configuration, Web Proxy and Firewall client access.

quote:

When a new reverse zone is created do i add the Internal IP address? 192.168.0?

Yes, if the internal Network ID is 192.168.0.0/24, the reverse zone is '192.168.0'.  

HTH,
Stefaan

(in reply to pompeytech)
Post #: 19
RE: Client cannot connect? - 10.Sep.2006 7:05:04 PM   
pompeytech

 

Posts: 47
Joined: 8.Sep.2006
Status: offline
Thanks Spouseele for all your help, seems to be working fine so far, on to learning more!!

(in reply to spouseele)
Post #: 20

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2000 Firewall] >> Firewall Client >> Client cannot connect? Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts