AdamB2K4
Posts: 26
Joined: 9.Jan.2004
From: New York
Status: offline
|
quote:
Because sophisticated networks using a split DNS infrastructure. I've written extensively on this topic. I never use illegal TLDs for this reason. Makes life easier for the admins and provides a superior expereince for users. The intent was not to be insulting, but is the result of observing network designs over the last ten years.
Nonetheless it WAS insulting. I've never read your articles on this subject, and to be honest I don't care. I have my own reasons for using a 23 bit mask and a .local domain extension. I've been designing and administering entire network infrastructures from the ground up for 15+ years. I don't need to explain why I use either of them, since they are both irrelevant to the situation. And you shouldn't assume that I am "unsophisticated" based on the little information you know about my network. And I do use a split DNS infrastructure. I don't see how you came to the conclusion that I did not. In fact, to assume that one is unsophisticated in networking based on a subnet mask and a domain name, kind of makes YOU look unsophisticated.
quote:
The ISA Firewall should be configured to use a single DNS server, and that DNS server should be listed on the internal interface. The internal interface should be placed on the top of the list of the interface in the Advanced configuration dialog box in the Network Connections window.
The internal interface on my ISA server is configured to point to my Active Directory DNS server. My ISP is dynamic, and so my external interface must be set for automatically obtain. There is no way to remove the DNS server address from the WAN interface unless I specify a different one. I don't suspect that this has anything to do with why SecureNAT isn't working. If I configure the client as a web proxy client, there is no problems. This same configuration worked on ISA 2000 without any issues.
quote:
A rule allowing outbound DNS from the DNS server to External is required.
I have 2 rules. 1) Allow all access, all protocols, all users, from internal to external. 2) Deny all. This is only to test SecureNAT in my environment. I do not plan on leaving the access rule like this. I say this so you don't assume I am unsophisticated again. As previously noted, when configured as web proxy, the client can access the internet. As a securenat client, it cannot.
quote:
The DNS server must use the ISA Firewall's internal IP address as its default gateway.
It does, as does every other computer and server on the network.
quote:
Use the diagnostics tab on your DNS server to see if it can successfully perform recursive queries. It should fail when you're using forwarders, as you should disable recursion when forwarders are being used.
I am using forwarders, and recursion is disabled, but the DNS server still passes the recursion test. FYI there is no diagnsotic tab in Windows DNS Server management. There is a monitoring tab and this is what I used to perform the test.
quote:
Use nslookup on the DNS server to see if it can resolve Internet host names. If that fails, remove the forwarders and configure the DNS server to use recursion.
The DNS server is able to resolve all internet host names.
quote:
Check the ISA Firewall's log file to see what is happening when the DNS server sends outbound DNS queries.
The firewall log shows the securenat client initiating a connection, but that is it. The client receives a "Page cannot be displayed" error. However, I have verified the client is able to resolve DNS using nslookup on the client. Also pinging any internet address from the client resolves the address correctly. Even after ipconfig flushdns.
Some useful information maybe: When configured as a web proxy client, the session is listed as "securenat" in the monitoring window of ISA 2006.
NEW PROBLEMS: I am also unable to create a user set. I have edited the system policy to allow active directory authentication between ISA server and my AD servers. However, when I attempt to add a user or group to a user set, it fails with an error "RPC Server is Unavailable". What is unusual about this is that the ISA server is able to enumerate a list of users and groups from active directory using the advanced/find buttons. But when I select a user or group, it fails with the RPC error.
I am also seeing Event 1053 in the system log every time I try to do this. The error says that the windows cannot determine the computer or user name.
I would appreciate some constructive suggestions as to what might be causing these issues, rather than an analysis of my networking skills. Is it at all possible that there is a bug in ISA 2006 where securenat does not function properly after installing on top of Windows 2003 Standard R2 SP2?
< Message edited by AdamB2K4 -- 20.May2007 3:08:08 PM >
|
|
My Subscription |
My Forums |
Address Book |
Member List |
Search |
FAQ |
Ticket List |
Log Out
Printable Version
No internet without proxy configuration - 
New Messages
No New Messages
Hot Topic w/ New Messages
Hot Topic w/o New Messages
Locked w/ New Messages
Locked w/o New Messages
Post New Thread