Welcome to ISAserver.org

SSL-Tunneling

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2004 General ] >> Web Publishing >> SSL-Tunneling

Page: [1]

Message

<< Older Topic Newer Topic >>

SSL-Tunneling - 9.Feb.2007 8:17:10 AM

philcollins99

Posts: 44
Joined: 27.Sep.2006
Status: offline

Hi there,

I have a problem attempting to configure SSL-Tunneling. Please let me first describe our set up.

Windows2003 with ISA 2004 SP2 Edge Firewall solution.
A single Windows 2003 IIS 6.0 Web site hosting solution (Perimeter Network).
IIS 6 holds our *.domain.com certificates.
We have many web sites which are non SSL and are working
We have one web site using SSL on the same address but we cannot get this working.
We also have OWA on a single Exchange 2003 server on the internal network. We cannot get this working either.

I am trying to achieve a solution whereby ISA 2004 listens for www.domain.com on port 443 and forwards all traffic to an internal address. e.g. 192.168.2.2 and then allows the traffic to flow between the clients and web server. I believe this to be SSL-Tunneling.

I am also attempting to configure OWA on the Exchange server and again I would like to simply forward the traffic to our Exchange server as this server deals with the SSL traffic.

We have tested many solutions to get this working but we cannot get past varying responses. The main examples are:

i) Browser states an error using the word "Principal"
We looked this up and it states that a browser certificate does not match the published web site. We think this is connected with the use of a wildcard on our published certifcates. Apologies for not giving the full browser error message but we can only test out of hours as we need to be back in a 'live' state on our current ISA 2000 configuration. I did not write down the full error message when testing. Whoops!

ii) Failed connection attempt (protocol = SSL-Tunnel)

I'm trying to be as specific as possible here but if you need more information in order to help me, please let me know. I am very very happy to provide it as I really need a solution to these problems.

If I can solve the problem with the SSL web site, I should be able to solve the problem with OWA. I have read much documentation and confered with a colleague but we cannot get the SSL tunnel to work. This really is confusing me.

The final thing that is really causing me a problem is that when ever I set up a listener on SSL, I am prompted for a certificate. I have indeed installed the same certificate (*.domain.com) onto IIS on my ISA server and made it availble through a web listener. When I apply this web listener, this is when we receive the browser error message stating the word 'Principal'. The thing I can't get out of my mind is, why do I need to use a certificate for all SSL web listeners? I would have expected to use a certificate when using bridging but not SSL-Tunneling. This is one of the reasons I cannot get OWA to work.

I have also read (I'm going on a bit now, sorry!), in one of the forum posts, that internal clients may need direct access to the web servers in order to return the web sites. I'm not sure how to configure this and if this is the case, we may have actually stumbled on the solution without knowing.

Please could someone spare the time to possibly address this issue for me? I know I've mentioned quite a lot of stuff here, but believe me, we have been struggling through this for many many hours of the previous days.

Thank you.

Phil.

Post #: 1

Featured Links*

RE: SSL-Tunneling - 9.Feb.2007 10:18:15 AM

philcollins99

Posts: 44
Joined: 27.Sep.2006
Status: offline

Hi there,

I really do need some help with this. Is there anyone out there that could possibly help in anyway at all?

I would really appreciate any assistance that can be given.

Thank you.

Phil.

(in reply to philcollins99)

Post #: 2

RE: SSL-Tunneling - 9.Feb.2007 10:28:11 AM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Phil,

1. check out the ISA help file. There is really very useful stuff in there!

2. check out http://www.microsoft.com/isaserver/techinfo/guides-articles.mspx.
3. do a site search on www.isaserver.org on the key words 'web publishing' or 'owa'. You'll find a bunch of articles.
4. ...

HTH,
Stefaan

(in reply to philcollins99)

Post #: 3

RE: SSL-Tunneling - 9.Feb.2007 10:46:38 AM

philcollins99

Posts: 44
Joined: 27.Sep.2006
Status: offline

Hi Stefan,

Thanks for taking the time to reply. I will check out those articles now but at a brief look at them, I've visited them before and I'm just not getting it. I will check them out again though.

Could you, or someone else, please answer a couple of questions for me?

Q1) Is it by design that an HTTPS listener MUST have a certificate attached to it?

Q2) Is an HTTPS listener only to be used when bridging SSL?

Q3) Is it correct to state that in order to use SSL Tunneling, I MUST publish the web server via a server publishing rule using HTTPS Server? It seems that this is the case and I'm confused by the distinct lack of opportunity to type in the site URL I am trying to publish.

Thanks again.
(Goes off to read articles

)

(in reply to spouseele)

Post #: 4

RE: SSL-Tunneling - 9.Feb.2007 11:05:13 AM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Phil,

A1: HTTPS is HTTP over SSL/TLS and SSL/TLS requires at least a server certificate. Take note that the FQDN of the site must match the Common Name on the server certificate, otherwise any browser will complain.

A2/A3: with ISA you can do server and web publishing. Normally you only choose server publishing for non-web protocols. However, you can do server publishing for web protocols too. However, by doing that you are loosing all of the nice features like path mapping, link translation, HTTP inspection, etc... Think about server publishing as simple TCP/UDP port forwarding with no content inspection at all.

What's your definition of SSL Tunneling?

BTW --- have a nice read!

HTH,
Stefaan

(in reply to philcollins99)

Post #: 5

RE: SSL-Tunneling - 9.Feb.2007 11:20:39 AM

philcollins99

Posts: 44
Joined: 27.Sep.2006
Status: offline

What's my definition of SSL Tunelling? Now you are asking!!!

I THINK SSL Tunnelling is ...

A client requests a web site on port 443. e.g. http://www.mydomain.com:443 (HTTPS://www.mydomain.com).

The website is available on an internet address (a.b.c.d) and hence DNS converts this into HTTPS://a.b.c.d:443. This is the request that is received by ISA 2004.

ISA 2004 forwards the request onto the web server where www.mydomain.com is hosted. This is still on port 443. The web server replies over SSL to the ISA server which then forwards this back to the original client.

Any communications there in are direct and ISA 2004 merely acts as a forwarder for the traffic. This communication is SSL Tunnelling as ISA 2004 does not inspect the traffic.

Is this correct?

Phil.

(in reply to spouseele)

Post #: 6

RE: SSL-Tunneling - 9.Feb.2007 12:06:20 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Phil,

just what I was expecting!

What you described is a server publishing scenario. That means, ISA just do TCP/UDP port forwarding with no content inspection at all. This does not require a server certificate on ISA server because ISA is not the connection endpoint. However, make sure the internal server is configured as a SecureNAT client or make sure you check the flag Requests appear to come from the ISA Server computer setting in the server publishing rule To tab.

Take note that this is not as secure as Web Publishing where ISA terminates the external connection, pre-authenticate first the user, checks the URL's and content, and than forward the data over a new secure connection to the internal server. I highly recommend you use a Web Publishing rule for publishing securely the OWA site.

HTH,
Stefaan

(in reply to philcollins99)

Post #: 7

RE: SSL-Tunneling - 12.Feb.2007 1:08:12 PM

philcollins99

Posts: 44
Joined: 27.Sep.2006
Status: offline

Hi Stefan,

I really do appreciate the time you have spent in replying and I hope you had a great weekend!

Are you saying that I'm not attempting to SSL-Tunnel and that I have misunderstood what SSL-Tunnelling is all about? It is important that I know this so I can understand what options are open to me and how we can go about setting them up. I actually thought I'd grasped the basic concepts of what I was trying to do here, but I now doubt this. Please would you advise?

I have taken eveything on board about the recommendations to our configurations but at the moment I need to get a solution in place. Once I know how to get this working and I can verfiy it, I can move on and make it more secure.

I am about to set up a test enviroment with a temporary site. Once I have this set up and verified the connection, I will publish the site using SSL if I can source a free certificate. As this will be live throughout the day, I should have no trouble in testing and troubleshooting it. This also means that I won't have to interupt the live environment until I know I have it set up correctly. THE WAY IT SHOULD BE DONE!!!

Thanks again.

Phil.
(The frustration is killing me, the progression is very enjoyable)

< Message edited by philcollins99 -- 15.Feb.2007 3:17:03 AM >

(in reply to spouseele)

Post #: 8

RE: SSL-Tunneling - 13.Feb.2007 6:32:14 AM

philcollins99

Posts: 44
Joined: 27.Sep.2006
Status: offline

Hi there,

Is there anyone that can confirm if I have the SSL-Tunelling theory correct please?

Thank you.

Phil.

(in reply to philcollins99)

Post #: 9

RE: SSL-Tunneling - 15.Feb.2007 3:23:50 AM

philcollins99

Posts: 44
Joined: 27.Sep.2006
Status: offline

Hi,

I have actually made some excellent progress with this, now that I have a test scenario!

I have obtained a test certificate from Verisign which does not include a wildcard and is specific to our subdomain. e.g. subdomain.domain.com. I have successfully set up all of the scenarios that I now about. SSL-Tunnelling (No certificate at the ISA 2004 firewall), and each possible SSL-bridging scenario too. This appears to be working fine as expected.

The set up I had included a simple ISA 2004 server with a single external facing network card, no internal network and IIS 6.0 with a single website local to the ISA server. I am just about to move onto having a perimeter network as I have sourced a second server to test with. I will update and advise how progress.

Phil.

(in reply to philcollins99)

Post #: 10

RE: SSL-Tunneling - 17.Feb.2007 5:54:21 AM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Phil,

quote:

ORIGINAL: philcollins99

Hi there,

Is there anyone that can confirm if I have the SSL-Tunelling theory correct please?

Thank you.

Phil.

I thought I've clearly stated that your definition of SSL-Tunneling is the equivalent of a ISA Server publishing rule! Didn't I?

HTH,
Stefaan

(in reply to philcollins99)

Post #: 11

RE: SSL-Tunneling - 17.Feb.2007 5:59:22 AM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Phil,

quote:

I have successfully set up all of the scenarios that I now about. SSL-Tunnelling (No certificate at the ISA 2004 firewall), and each possible SSL-bridging scenario too.

To avoid any confusion, I suggest you use the more common ISA terminology instead. Thus, SSL-Tunneling = Server publishing and SSL-Bridging = Web publishing.

HTH,
Stefaan

(in reply to philcollins99)

Post #: 12

RE: SSL-Tunneling - 17.Feb.2007 6:08:34 PM

philcollins99

Posts: 44
Joined: 27.Sep.2006
Status: offline

Ahhhhhhhhhhh! Oh OK.

Thanks for clearing that up Stefaan.

I've actually logged a call with Microsoft as something odd is going on here and I think it is connected with wildcard certificates. We have no way of proving this 100% and it is very risky changing the certificates on the live environment. The documentation I have read and the testing I have done suggests that changing the wildcard certificate on the web server will solve my problems. I need to know 100% before that it will before I do, as it will cost and there will be disruption to the live environment. Microsoft have given me some steps to take so that they can replicate our environment and help me troubleshoot.

That's the stage I'm at now. I'm confident it will work though. It must!!!

I will obviously post my findings as this is what forums are all about.

Phil.

(in reply to spouseele)

Post #: 13

RE: SSL-Tunneling - 18.Feb.2007 6:02:42 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Phil,

you might check out http://forums.isaserver.org/m_2002017489/mpage_1/tm.htm for a discussion about the use of wildcard certs in ISA 2004.

HTH,
Stefaan

(in reply to philcollins99)

Post #: 14

RE: SSL-Tunneling - 19.Feb.2007 6:33:19 AM

philcollins99

Posts: 44
Joined: 27.Sep.2006
Status: offline

Hi Stefan,

Thank you for this.

This certainly confirms that the SSL-Bridging (Web publishing!

)scenarios we have attempted will NOT work as we are using a wildcard certificate at the web server end. I am still a little concerned that the SSL-Tunnelling (Server publishing!

) scenario we have attempted does not work when I use a server publishing rule. Ultimately this isn't the solution we are aiming for any how as I would like to use an SSL-Bridging solution as previously advised in this discussion.

From the link to the ISA.org discussion above, it appears that the SSL-Tunnelling scenario should work if I've understood this correctly.

I wonder what Microsoft will come up with?

Thanks Stefaan, you are being most helpful.

Phil.

(in reply to spouseele)

Post #: 15

RE: SSL-Tunneling - 19.Feb.2007 2:02:04 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Phil,

1. a server publishing rule should work in any case because no certs are involved at the ISA level.

2. the limitation of the wildcard certs are removed in ISA 2006 (http://www.isaserver.org/pages/newsletters/december2006.asp).

HTH,
Stefaan

(in reply to philcollins99)

Post #: 16

RE: SSL-Tunneling - 26.Feb.2007 11:52:04 AM

philcollins99

Posts: 44
Joined: 27.Sep.2006
Status: offline

Hi again,

On Friday evening we managed to get secure server publishing working on our ISA 2004 firewall (SSL Tunnel). We did this by adding host entries on our web server, creating a new server publishing rule for a repeated number of times (I've lost count how many) and adding a knowledge base article update to the (http://support.microsoft.com/kb/916106/).

There was a large pause after applying the update and a lot of clicking around before we tried the repeated rule. When we attempted a browser connection, it suddenly worked. I actually think the knowldege base update was the miraculous solution as we tried everything else on many separate occasions.

This is working now but not using secure web publishing. I know this will not work from the documents I have read as we are using wild card certificates. I am very surprised that Microsoft haven't told me this yet but maybe they will soon.

The next stage of this ever so frustrating story is to configure ISA so that OWA allows connections. This NEEDS to use bridging but it will mean that the wildcard certficate at the ISA 2004 end needs to utilised as the secure part of the bridge. The accepted traffic should then be forwarded to our e-mail server but not over SSL (We do not have a certificate on this server). We are going to troubleshoot this at 17:00 (UK time) this evening. Let's hope that microsoft can give me a magic solution this evening and that we can also get a definitive answer from them on the secure web publishing we are trying to achieve.

I hope this update is helpful for felow posters.

Phil.

(in reply to spouseele)

Post #: 17

RE: SSL-Tunneling - 28.Feb.2007 3:34:37 AM

philcollins99

Posts: 44
Joined: 27.Sep.2006
Status: offline

The latest update in the saga is as follows:

On Monday evening our aim was to configure OWA. When we made our ISA 2004 server live and took our ISA 2000 server offline (Disabled and re-enabled the network cards), we found that the secure server publishing rule was no longer working.

The only changes we had made since taking the server offline were pertaining to rules to allow OWA.

Microsoft support in the US have now taken this call due to time zone restrictions.

We have now deleted the secure server publishing rule and any rules that were similar even though they were disabled. We have also removed a disabled network rule as it wasn't being used.

I raised some questions to the Microsoft support person with regard to ISA 2006. He advised that Microsoft recommend this as a solution over ISA 2004. I guess this isn't a suprising answer in itself. I've asked for permission to upgrade to ISA 2006 immediately once we have a solution with ISA 2004. This way we will avoid any similar headaches that we have observed recently.

I will update when we finally get this working.

Phil.

(in reply to spouseele)

Post #: 18

RE: SSL-Tunneling - 5.Mar.2007 11:58:51 AM

philcollins99

Posts: 44
Joined: 27.Sep.2006
Status: offline

Hi Stefan,

I'm sure you will be very very pleased to hear that we managed to get our ISA 2004 server working. In fact we are live now!!!

The final step in the saga was quite a strange one to be honest as my testing had been successful with pretty much an exact replica of the live set up. The only thing that was very obviously different was the certificates having valid CA's in the live set up (The certificates in the testing environment were self certified).

Anyway the final steps were to clear out the host file entries on the ISA server and on the web servers and the magical piece of troubleshooting was to UNIINSTALL IIS. I am still not 100% convinced that this was 100% necessary but these things combined solved the problems I had been experiencing. I also cleared the cache on my servers (ipconfig /flushdns).

Thank you for all of your help Stefan and I really have learned so much from this post.

Phil.

(in reply to philcollins99)

Post #: 19

RE: SSL-Tunneling - 5.Mar.2007 3:32:14 PM