Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Name Resolution problem with Firewall clients

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2004 Firewall] >> Firewall Client >> Name Resolution problem with Firewall clients Page: [1] 2   next >   >>
Login
Message << Older Topic   Newer Topic >>
Name Resolution problem with Firewall clients - 25.Jul.2004 11:54:00 AM   
cbarneaud

 

Posts: 44
Joined: 10.Mar.2003
From: Sweden
Status: offline 		I'm very closer now to get in production my Back to Back configuration with ISA 2004 but I got some problem with Name Resolution when using Firewall Client.
My Intern ISA server (member server in domain) is configuring with 4 Externals networks (DMZ, Teachers, Students, Admin), all resources (DC, Exchange, Sharepoint, DNS) reside on the Internal network.

When using secure Nat on my studentsÆ network (they get IP address, and DNS address from a DHCP server on Intern ISA server) everything works normally, but cannot get Name Resolution from my DNS server when using Firewall clients.

I use DHCP to automatically detect Firewall client configuration, the detection works but only when I put the ISA Server IP address and name on my client Hosts file, Is this a normal configuration?

Did I miss something?

Thanks
Post #: 1
RE: Name Resolution problem with Firewall clients - 26.Jul.2004 12:03:00 PM   
cbarneaud

 

Posts: 44
Joined: 10.Mar.2003
From: Sweden
Status: offline 		Name resolution seems to work now, but I cannot map network drive that is on the Internal network, I get error messages in Event Viewer like this one:

'Windows cannot obtain the domain controller name for your computer network. (A socket operation was attempted to an unreachable host. ). Group Policy processing aborted.'

How could it be possible if I can resolve my DC IPaddress from my Firewall client?
Everything works perfectly when using Secure Nat client. I would prefer to not use a Wins server.

Is there a special configuration that I have to make on the Firewall Client Application Settings?

Thanks

(in reply to cbarneaud)
Post #: 2
RE: Name Resolution problem with Firewall clients - 26.Jul.2004 2:38:00 PM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi C,

You don't need to use a WINS server, but the Firewall client machine does need access to a DNS server that has knowledge of the Internal network domain and the intradomain communications protocols should be enabled.

HTH,
Tom

(in reply to cbarneaud)
Post #: 3
RE: Name Resolution problem with Firewall clients - 26.Jul.2004 3:39:00 PM   
cbarneaud

 

Posts: 44
Joined: 10.Mar.2003
From: Sweden
Status: offline 		They have access to the Intern DNS on the Domain Controller, I could resolve my Domain controller's IPAddress and DNS name through NSLookup on the Firewall client.

An access rule allow all intradomain communications protocols(DNS,LDAP,Kerberos,CIFS,RPC...)from my Student external Network to Internal Network.)

(in reply to cbarneaud)
Post #: 4
RE: Name Resolution problem with Firewall clients - 27.Jul.2004 2:11:00 AM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi C,

So, with that access rule and name resolution being OK, you still see that error? Are the clients domain members? Are the users successfully logging into the domain? Is group policy applies to the domain member machines on the student network?

Thanks!
Tom

(in reply to cbarneaud)
Post #: 5
RE: Name Resolution problem with Firewall clients - 28.Jul.2004 9:03:00 AM   
cbarneaud

 

Posts: 44
Joined: 10.Mar.2003
From: Sweden
Status: offline 		Yes the clients are domain members (they integrated the domain when they were Secure NAT clients).

Since they became Firewall Clients Group policy could not apply, there is no intradomain communications protocols traffic between the STUDENT network (Intern) and the INTERNAL network (Build-in internal)in the live logging.

I could only see a lot of HTTP traffic between the STUDENT and the INTERNAL network to the LOCALHOST.
I have been working on this problem during 3 days now [Embarrassed] [Embarrassed]

(in reply to cbarneaud)
Post #: 6
RE: Name Resolution problem with Firewall clients - 29.Jul.2004 2:14:00 AM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi C,

So, it sounds like the firewall clients on the student network are not communicating with the DCs on the other network. Do you see any denied connections from the firewall client computers in the log viewer?

IIRC, group policy is applied before the user logs on. If so, you may need to identify the protocols that are being blocked because there is no logged on user and allow those protocols to the IP addresses of the domain members on the student network.

Its an interesting problem and I'll see if I can work out the details.

Thanks!
Tom

(in reply to cbarneaud)
Post #: 7
RE: Name Resolution problem with Firewall clients - 29.Jul.2004 11:38:00 AM   
penrose.l@2college.nl

 

Posts: 474
Joined: 29.Jan.2004
From: Netherlands
Status: offline 		Hi ,

did you think of enabling access to port 1745 ( UDP AND TCP )from the clients to the ISA server ?
port 1745 is the port that the firewall clients use to communicate to the ISA server.
We had some issues with that before.
If you want I could send you our XML configs to see which ports you need to setup exactly.

Furthermore , you should make sure you modify your ghost installations <I think [Smile] > to have the new RTM release version of the firewall client , otherwise you get strange errors.

Hope this helps let us know,
Lex Penrose

(in reply to cbarneaud)
Post #: 8
RE: Name Resolution problem with Firewall clients - 29.Jul.2004 2:10:00 PM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi Lex,

When you enable the Firewall client for the student's network interface, it will automatically allow outbound 1745 to that interface.

Is that what you did?

Thanks!
Tom

(in reply to cbarneaud)
Post #: 9
RE: Name Resolution problem with Firewall clients - 29.Jul.2004 2:29:00 PM   
cbarneaud

 

Posts: 44
Joined: 10.Mar.2003
From: Sweden
Status: offline 		Hi,

I don't see any denied connctions from the Firewall client. The only traffic from my Firewall client I can see in the log is on port 1745 to the localhost (allowed).
I tested with an access rule that allow all outbound traffic from the Student Network to the localhost and the Internal Network. I get the same problem.

Tell me if I'm wrong:

the Firewall Client only support UDP and TCP based protocols.
My client domain member need to use ICMP messages to communicate with DC.
the Firewall Client doesn't support ICMP messages.

I tested to configure a default gateway on the Firewall client (Could it be a possible configuration??)
It looks like my Firewall client can communicate with the Internal Network now!
I still see the firewall session in the monitoring console.

I thouhgt that you should never configure a Firewall Client with a gateway!
Could you tell me what is wrong and what is right?

Thanks for help

Chris

(in reply to cbarneaud)
Post #: 10
RE: Name Resolution problem with Firewall clients - 29.Jul.2004 2:33:00 PM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi Chris,

You should never configure the Firewall client as a SecureNAT client too unless you need to do so. [Smile]

There is no conflict between the multiple client types.

Now, the question is what did the SecureNAT client config provide that the Firewall client config did not provide? Do the clients require ping access to the DC?

Thanks!
Tom

(in reply to cbarneaud)
Post #: 11
RE: Name Resolution problem with Firewall clients - 29.Jul.2004 3:12:00 PM   
cbarneaud

 

Posts: 44
Joined: 10.Mar.2003
From: Sweden
Status: offline 		It sounds like you need PING to allow the DC to apply Group policy on Clients.
I made my client a SecureNAT again. If I block PING between the STUDENT network and the Internal Network no GP could applied on the client, I get this event:

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1054
Date: 2004-07-27
Time: 16:27:19
User: NT AUTHORITY\SYSTEM
Computer: FS999
Description:
Windows cannot obtain the domain controller name for your computer network. (A socket operation was attempted to an unreachable host. ). Group Policy processing aborted.

(in reply to cbarneaud)
Post #: 12
RE: Name Resolution problem with Firewall clients - 29.Jul.2004 3:16:00 PM   
cbarneaud

 

Posts: 44
Joined: 10.Mar.2003
From: Sweden
Status: offline 		Sorry this event:
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1054
Date: 2004-07-29
Time: 15:00:45
User: NT AUTHORITY\SYSTEM
Computer: FS999
Description:
Windows cannot obtain the domain controller name for your computer network. (An unexpected network error occurred. ). Group Policy processing aborted.

(in reply to cbarneaud)
Post #: 13
RE: Name Resolution problem with Firewall clients - 29.Jul.2004 9:27:00 PM   
cbarneaud

 

Posts: 44
Joined: 10.Mar.2003
From: Sweden
Status: offline 		From Microsoft Documentation:
Because Group Policy works with fully qualified domain names, you must have DNS running in your forest in order to correctly process Group Policy; you cannot use NETBIOS only. Also, because client or destination computers must be able to contact your networkÆs domain controllers, do not turn off the ICMP protocol. If destination computers cannot ping the domain controllers, Group Policy processing will fail.

(in reply to cbarneaud)
Post #: 14
RE: Name Resolution problem with Firewall clients - 30.Jul.2004 2:00:00 AM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi C,

Bingo! Great work. But I thought I saw an article that said there was a method to turn off the ping requirement on the DCs. I think I saw this when researching the FE Exchange Server in the DMZ scneario.

Thanks!
Tom

(in reply to cbarneaud)
Post #: 15
RE: Name Resolution problem with Firewall clients - 30.Jul.2004 10:29:00 AM   
cbarneaud

 

Posts: 44
Joined: 10.Mar.2003
From: Sweden
Status: offline 		Hi Tom,

I will try to find this article, If you find again this article please tell me.
The question now is could I implement user- or group- based access control with both my clients configured as SecureNat and Firewall clients?

If no, well all my Network Design is falling down!. User and group based access control was an important feature to control Students Internet Access, and I really like the possibility to have all my resource in a different segment. I should start thinking to move one DC on the Student Network (something I really don't like).

Thanks

Chris

(in reply to cbarneaud)
Post #: 16
RE: Name Resolution problem with Firewall clients - 30.Jul.2004 12:07:00 PM   
penrose.l@2college.nl

 

Posts: 474
Joined: 29.Jan.2004
From: Netherlands
Status: offline 		Hi ,

We use the same design as you do Chris , and we have given the clients a default gateway. It works like a charm. The clients do everything they need to do as secureNAT clients ( basic AD connectivity etc.. ) and when we want to restrict something we restrict the usergroups and the firewall client takes over for only that connection. Works really good and very fast.

We have setup the following :

4 networks : EDU / ADM / INT(ernet) / RES(ource)
The clients are only on Edu and adm and are configured as follows :

EDU clietn:

ip : 10.1.100.1
mask : 255.255.0.0
dns : 172.16.3.1 (res)
dns2: 172.16.3.2 (res)
default gateway : 10.1.1.253

The ISA does the rest [Smile]
btw : if you set the default gateway you need to make a rule to allow 1745 UDP and TCP BETWEEN the edu and adm networks AND the ISA server.

Hope this helps. Don't worry your design is not falling down.

Kind regards,
Lex P.

(in reply to cbarneaud)
Post #: 17
RE: Name Resolution problem with Firewall clients - 30.Jul.2004 2:36:00 PM   
cbarneaud

 

Posts: 44
Joined: 10.Mar.2003
From: Sweden
Status: offline 		Hi Lex,

[Smile] [Smile] Thanks.
My clients are now both SecureNAT and Firewall clients and Web proxy clients.
I made a Firewall chaining between the downstream ISA server and the upstream ISA server.
I created a Web proxy chaining to make the downstream ISA server a Web proxy client of the upstream ISA Server.
All necessary access rules were created on both ISA servers.

My clients ca now access the Internet but I could not see the client user name in the the log, just an anonymous HTTP request!

Did I forget something?

Thanks

Chris

(in reply to cbarneaud)
Post #: 18
RE: Name Resolution problem with Firewall clients - 30.Jul.2004 3:46:00 PM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline
quote:
Originally posted by cbarneaud:
Hi Tom,

I will try to find this article, If you find again this article please tell me.
The question now is could I implement user- or group- based access control with both my clients configured as SecureNat and Firewall clients?

If no, well all my Network Design is falling down!. User and group based access control was an important feature to control Students Internet Access, and I really like the possibility to have all my resource in a different segment. I should start thinking to move one DC on the Student Network (something I really don't like).

Thanks

Chris
Hi Chris,

You can still do user/group based access control. You can create a rule that allows PING to the address range of your SecureNAT clients, but require authentication for the other protocols using the Firewall client.

HTH,
Tom

(in reply to cbarneaud)
Post #: 19
RE: Name Resolution problem with Firewall clients - 30.Jul.2004 3:47:00 PM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline
quote:
Originally posted by cbarneaud:
Hi Lex,

[Smile] [Smile] Thanks.
My clients are now both SecureNAT and Firewall clients and Web proxy clients.
I made a Firewall chaining between the downstream ISA server and the upstream ISA server.
I created a Web proxy chaining to make the downstream ISA server a Web proxy client of the upstream ISA Server.
All necessary access rules were created on both ISA servers.

My clients ca now access the Internet but I could not see the client user name in the the log, just an anonymous HTTP request!

Did I forget something?

Thanks

Chris
Hi Chris,

Are you not seeing the user name on the downstream or upstream ISA firewall?

Thanks!
Tom

(in reply to cbarneaud)
Post #: 20

Page:   [1] 2   next >   >> << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2004 Firewall] >> Firewall Client >> Name Resolution problem with Firewall clients Page: [1] 2   next >   >>
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts