Welcome to ISAserver.org
Forums |
Register |
Login |
My Profile |
Inbox |
RSS 
|
My Subscription |
My Forums |
Address Book |
Member List |
Search |
FAQ |
Ticket List |
Log Out
Client cannot connect?
|
Users viewing this topic:
none
|
Logged in as: Guest
|
Login  | |
|
Client cannot connect? - 8.Sep.2006 8:30:24 PM
|
|
|
pompeytech
Posts: 16
Joined: 8.Sep.2006
Status: offline
|
Hi all i am new to ISA Server so bare with me ok. First, i am using VMWare to set up a test network and i have installed ISA 2000 on a 2003 Server and installed the Firewall client software on a workstation. I have then created a protocal rule on the ISA, but still my workstation will not connect to the internet. Can anyone help please.
|
|
|
|
|
RE: Client cannot connect? - 8.Sep.2006 8:36:33 PM
|
|
|
spouseele
Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline
|
Hi pompeytech,
if you are new to ISA server I highly recommend you drop ISA 2000 and go with at least ISA 2004 or even better ISA 2006. The point is that ISA 2000 is getting "very old" and ISA 2004/2006 is conceptual quite different than ISA 2000. So, go for ISA 2006 if possible.
Nevertheless, do you have a site&control rule in place to allow the destination and the content?
HTH,
Stefaan
< Message edited by spouseele -- 8.Sep.2006 8:37:45 PM >
|
|
|
|
|
RE: Client cannot connect? - 8.Sep.2006 8:47:09 PM
|
|
|
pompeytech
Posts: 16
Joined: 8.Sep.2006
Status: offline
|
I would love to ISA 2004 but unfortunately i dont have a copy. As for the site & control rule in place, umm no i dont, could you explain to me please. Thanks for the reply by the way.
|
|
|
|
|
RE: Client cannot connect? - 8.Sep.2006 9:01:21 PM
|
|
|
pompeytech
Posts: 16
Joined: 8.Sep.2006
Status: offline
|
Many thanks spouseele, by the way if you know of anywhere i can get my hands on ISA2004 please let me know.
|
|
|
|
|
RE: Client cannot connect? - 8.Sep.2006 11:11:25 PM
|
|
|
pompeytech
Posts: 16
Joined: 8.Sep.2006
Status: offline
|
Yeah i have looked at this but it`s only for so many days!! The way i study i really need a full copy.
By the way i have sorted out my workstations, they now can connect to the internet, thanks for the link.
My only concern is it takes ages for them to connect!! Any ideas on this??
|
|
|
|
|
RE: Client cannot connect? - 9.Sep.2006 10:58:10 AM
|
|
|
spouseele
Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline
|
Hi pompeytech,
assuming you have no adapter problems (driver, speed & duplex setting) it is likely a routing and/or name resolving problem. Please post some more info about your exact configuration. To start with, an 'ipconfig /all' and a 'route print' on the ISA and the workstation could be helpfull. Also, are you running an internal DNS server?
HTH,
Stefaan
|
|
|
|
|
RE: Client cannot connect? - 9.Sep.2006 1:37:26 PM
|
|
|
pompeytech
Posts: 16
Joined: 8.Sep.2006
Status: offline
|
Ok i would like to upload the info you asked for but i dont know how!! I have used the FAQ section that clearly states to tick the box "Click here to upload". Or to insert a bmp image that i have to check the box "Embed picture in post”. BUT i cannot find it anywhere???
|
|
|
|
|
RE: Client cannot connect? - 9.Sep.2006 1:53:40 PM
|
|
|
pompeytech
Posts: 16
Joined: 8.Sep.2006
Status: offline
|
===========================================================================
Thanks for the info Spouseele!! Below are the details you asked for.
ISA Route Print
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.229.2 192.168.229.16 10
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.0.0 255.255.255.0 192.168.0.12 192.168.0.12 10
192.168.0.12 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.0.255 255.255.255.255 192.168.0.12 192.168.0.12 10
192.168.229.0 255.255.255.0 192.168.229.16 192.168.229.16 10
192.168.229.16 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.229.255 255.255.255.255 192.168.229.16 192.168.229.16 10
224.0.0.0 240.0.0.0 192.168.0.12 192.168.0.12 10
224.0.0.0 240.0.0.0 192.168.229.16 192.168.229.16 10
255.255.255.255 255.255.255.255 192.168.0.12 192.168.0.12 1
255.255.255.255 255.255.255.255 192.168.229.16 192.168.229.16 1
Default Gateway: 192.168.229.2
ISA ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : Jaguar
Primary Dns Suffix . . . . . . . : Contoso.local
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : Contoso.local
Ethernet adapter Local Area Connection 2:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : VMware Accelerated AMD PCNet Adapter
Physical Address. . . . . . . . . : 00-0C-29-B3-83-44
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.229.16
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.229.2
DNS Servers . . . . . . . . . . . : 192.168.229.2
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : VMware Accelerated AMD PCNet Adapter
Physical Address. . . . . . . . . : 00-0C-29-B3-83-3A
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.12
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
C:\Documents and Settings\Administrator.CONTOSO>
Workstation Route Print
C:\Documents and Settings\administrator.CONTOSO>Route Print
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...00 0c 29 24 39 d1 ...... AMD PCNET Family PCI Ethernet Adapter - Packet S
cheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.0.1 192.168.0.51 10
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.0.0 255.255.255.0 192.168.0.51 192.168.0.51 10
192.168.0.51 255.255.255.255 127.0.0.1 127.0.0.1 10
192.168.0.255 255.255.255.255 192.168.0.51 192.168.0.51 10
224.0.0.0 240.0.0.0 192.168.0.51 192.168.0.51 10
255.255.255.255 255.255.255.255 192.168.0.51 192.168.0.51 1
Default Gateway: 192.168.0.1
Workstation ipconfig /all
C:\Documents and Settings\administrator.CONTOSO>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : comp01
Primary Dns Suffix . . . . . . . : Contoso.local
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : Contoso.local
contoso.local
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : contoso.local
Description . . . . . . . . . . . : VMware Accelerated AMD PCNet Adapter
Physical Address. . . . . . . . . : 00-0C-29-24-39-D1
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.0.51
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 192.168.0.1
Lease Obtained. . . . . . . . . . : 08 September 2006 22:21:56
Lease Expires . . . . . . . . . . : 16 September 2006 22:21:56
|
|
|
|
|
RE: Client cannot connect? - 9.Sep.2006 3:34:17 PM
|
|
|
spouseele
Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline
|
Hi pompeytech,
aha... I need some more info:
- what is the content of the LAT (Local Address Table) on ISA?
- what is the host 192.168.229.2 used as default gateway and DNS server on the ISA LAN2 nic?
- what is the host 192.168.0.1 used as default gateway, DNS and DHCP server on the Workstations LAN nic?
- do you have an Active Directory server on the ISA internal LAN?
HTH,
Stefaan
|
|
|
|
|
RE: Client cannot connect? - 9.Sep.2006 4:05:06 PM
|
|
|
pompeytech
Posts: 16
Joined: 8.Sep.2006
Status: offline
|
Hi Spouseele, umm your getting technical now, lol, What do you mean by :
- what is the host 192.168.229.2 used as default gateway and DNS server on the ISA LAN2 nic?
- what is the host 192.168.0.1 used as default gateway, DNS and DHCP server on the Workstations LAN nic?
The Contents od the LAT Table are as follows:
10.0.0.0 10.255.255.255
169.254.0.0 169.254.255.255
172.16.0.0 172.31.255.255
192.168.0.0 192.168.0.255
192.168.0.0 192.168.255.255
Yes i have Active Directory on my DC
|
|
|
|
|
RE: Client cannot connect? - 9.Sep.2006 6:48:09 PM
|
|
|
spouseele
Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline
|
Hi pompeytech,
OK, let's draw a little diagram to help explain how the general network setup should be:
quote:
192.168.0.0/24
vvv
[ PC ] --------- [ ISA ] --------- Internet/External
^^^
192.168.229.0/24
In the above diagram, I assume that the ISA internal interface is a member of the Network ID 192.168.0.0/24 and that the ISA External interface is a member of the Network ID 192.168.229.0/24. So the default gateway on ISA should *only* be set on the ISA external interface and that looks OK in your case. However, the LAT on ISA should *only* contain the Network ID's used on the internal network. In your case I think this is the Network ID 192.168.0.0/24 only and therefore the LAT should only have the single entry 192.168.0.0 - 192.168.0.255.
Question: what type of device is the host 192.168.229.2? It seems to be used as default gateway *and* as DNS server and that is a little bit strange.
Now, on the internal network you said you have a DC. So, may I assume it has the IP address 192.168.0.1 and is used as internal DHCP *and* DNS server?
Question: why is on the internal workstation the default gateway 192.168.0.1 and not the ISA internal interface?
About the optimum DNS configuration:
----------------------------------------
Assuming you have an internal DNS server, do *not* specify any ISP/External DNS server on any adapter of the ISA server. Just the internal DNS server on the internal interface and make sure the internal adapter is listed first in the adapter order as explained in Jim's excellent article http://www.isaserver.org/tutorials/Configuring_ISA_Server_Interface_Settings.html .
Next, perform the following configuration steps:
1) configure the internal DNS server as a SecureNAT client. That means his default gateway should point to the ISA internal interface.
2) enable forwarders on your internal DNS server and specify there your ISP/External DNS servers. Also, make sure you check the "Do not use recursion" box.
3) create on ISA a client address set containing your internal DNS server.
4) create on ISA a *separate* protocol rule allowing the protocols DNS Query (UDP port 53 send/receive) *and* DNS Zone Transfer (TCP port 53 outbound) and apply it to the above created client address set.
5) create on ISA a *separate* site&content rule allowing access to any destination or better to a destination set containing your ISP/External DNS servers, and apply it to the above created client address set.
Now, thoroughly test the DNS name resolving with the command nslookup. All should work well. Last but not least, never touch the DNS protocol and site&content rule again. You should now have a very stable DNS infrastructure.
HTH,
Stefaan
|
|
|
|
|
RE: Client cannot connect? - 9.Sep.2006 10:14:19 PM
|
|
|
pompeytech
Posts: 16
Joined: 8.Sep.2006
Status: offline
|
Ok i have followed your advise but i must be missing something as its still very slow.Below is a print of when i ran nslookup on the DC.
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
C:\>nslookup jaguar
DNS request timed out.
timeout was 2 seconds.
*** Can't find server name for address 192.168.0.1: Timed out
Server: UnKnown
Address: 192.168.0.1
Name: jaguar.Contoso.local
Address: 192.168.0.12
|
|
|
|
|
RE: Client cannot connect? - 9.Sep.2006 11:04:02 PM
|
|
|
spouseele
Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline
|
Hi pompeytech,
you seems to have a problem with the configuration of the DNS server itself. Check out if you have a reverse zone so that IP addresses can be translated to FQDN's!
Oh... and please, do NOT autoregister the ISA interfaces in the DNS server (Interface properties -> DNS tab, uncheck the box 'Register this connection's addresses in DNS'). Instead you should define them statically in the DNS server.
HTH,
Stefaan
|
|
|
|
|
RE: Client cannot connect? - 10.Sep.2006 11:10:43 AM
|
|
|
pompeytech
Posts: 16
Joined: 8.Sep.2006
Status: offline
|
do NOT autoregister the ISA interfaces in the DNS server (Interface properties -> DNS tab, uncheck the box 'Register this connection's addresses in DNS').
Yes the check box is unchecked. But what would happen if this box was left ticked.?
you seems to have a problem with the configuration of the DNS server itself. Check out if you have a reverse zone so that IP addresses can be translated to FQDN's!
When a new reverse zone is created do i add the Internal IP address? 192.168.0?
|
|
|
|
|
RE: Client cannot connect? - 10.Sep.2006 2:13:21 PM
|
|
|
spouseele
Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline
|
Hi pompeytech,
quote:
Yes the check box is unchecked. But what would happen if this box was left ticked.?
Whenever ISA server acquire a new IP address (i.e. by enabling VPN client access), you would get a wrong registration for the ISA internal interface which breaks Auto Configuration, Web Proxy and Firewall client access.
quote:
When a new reverse zone is created do i add the Internal IP address? 192.168.0?
Yes, if the internal Network ID is 192.168.0.0/24, the reverse zone is '192.168.0'.
HTH,
Stefaan
|
|
|
|
|
RE: Client cannot connect? - 10.Sep.2006 7:05:04 PM
|
|
|
pompeytech
Posts: 16
Joined: 8.Sep.2006
Status: offline
|
Thanks Spouseele for all your help, seems to be working fine so far, on to learning more!!
|
|
|
|
 New Messages |
 No New Messages |
 Hot Topic w/ New Messages |
 Hot Topic w/o New Messages |
 Locked w/ New Messages |
 Locked w/o New Messages |
|
 Post New Thread
Reply to Message
Post New Poll
Submit Vote
Delete My Own Post
Delete My Own Thread
Rate Posts |
|
Printable Version
Yessssssss It works, Finally figured it out. All i did was change the order of the nics on the ISA so North was first !!!! 
