Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Using IE on the ISA server

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2000 General] >> Installation >> Using IE on the ISA server Page: [1]
Login
Message << Older Topic   Newer Topic >>
Using IE on the ISA server - 7.Nov.2002 1:34:00 PM   
swoolhead

 

Posts: 14
Joined: 7.Nov.2002
Status: offline
OK, before you disregard this and tell me to RTFM, I know the normal answer is in the FAQ but that's not working for me.

I have 5 ISA servers. 2 are on Static external IP addresses, the other 3 are using DHCP.

On each of these I want to use IE (V6SP1) to browse the web. So I have set the proxy settings to the servers internal IP and port 8080.

Now this works fine on the two machines that use static IP addresses, but the DHCP machines will time out trying to connect to the proxy.

In all cases the clients behind the ISA server can use the web proxy fine.

On the DHCP machine I get the error
---
Cannot find server or DNS Error
Internet Explorer
---
On the ISA server if I fire up a command prompt and telnet to the internal IP on port 8080 I can connect and with the correct commands retreive a web page.

It looks like IE will bind the outgoing port to the external IP address when it attempts to connect to the proxy and the firewall is blocking the connection. It takes a long time to time out, the same as if I pointed the proxy address of a client with a public ip to the ISA servers external IP.

The strange thing is this only happens on ISA machienes that have DHCP on the external IP addresses.

Is there a way to make IE behave?

Stephen.

[ November 07, 2002, 01:45 PM: Message edited by: Stephen Woolhead ]
Post #: 1
RE: Using IE on the ISA server - 7.Nov.2002 8:52:00 PM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Stephen,

have you already tried localhost or 127.0.0.1 instead of the ISA internal interface IP?

HTH,
Stefaan

(in reply to swoolhead)
Post #: 2
RE: Using IE on the ISA server - 7.Nov.2002 9:56:00 PM   
swoolhead

 

Posts: 14
Joined: 7.Nov.2002
Status: offline
Yep, tried that, 127.0.0.1 and localhost neither worked.

Cant see why I can telnet to the port, but IE can't.

As I said, I have 5 ISA servers and it is only the ones running DHCP that have an issue.

Stephen.

(in reply to swoolhead)
Post #: 3
RE: Using IE on the ISA server - 7.Nov.2002 10:11:00 PM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Stephen,

that is indeed weird. Which type of external connection do you have?

HTH,
Stefaan

(in reply to swoolhead)
Post #: 4
RE: Using IE on the ISA server - 8.Nov.2002 12:26:00 AM   
swoolhead

 

Posts: 14
Joined: 7.Nov.2002
Status: offline
The first two machines are fine, the three DHCP have the problem. All are at the same patch level for OS and ISA

External leased line 3c905 nic static IP
Internal 3c905 static ip private win2K network

External ADSL 2Mb Static IP Onboard Intel Pro100
Internal Onboard Intel Pro100 static ip private win2K network

External ADSL 512Kb DHCP 3c905 DHCP
Internal 3c905 static ip private win2K network

External Cable Modem 512Kb DHCP 3c905 DHCP
Internal 3c905 static ip private win2K network

External Cable Modem 512Kb DHCP 3c905 DHCP
Internal 3c905 static ip private win2K network

All internal networks are running AD with their own DNS.

[ November 08, 2002, 12:29 AM: Message edited by: Stephen Woolhead ]

(in reply to swoolhead)
Post #: 5
RE: Using IE on the ISA server - 8.Nov.2002 12:01:00 PM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Stephen,

we must overlook something very stupid. Because it works for internal clients and if you telnet to the web proxy service, it sounds like a pure IE configuration problem. What are the settings in the IE connection tab? Is 'never dial a connection' selected? Also, what is the interface order? For more info about this, check out http://www.isaserver.org/tutorials/Configuring_ISA_Server_Interface_Settings.html .

BTW --- I just checked one of my cable modem configurations with DHCP and it works without any problem.

HTH,
Stefaan

[ November 08, 2002, 12:02 PM: Message edited by: spouseele ]

(in reply to swoolhead)
Post #: 6
RE: Using IE on the ISA server - 8.Nov.2002 2:02:00 PM   
swoolhead

 

Posts: 14
Joined: 7.Nov.2002
Status: offline
Thank you! [Smile]

It now works, I had the adapters bound in the wrong order, external, then internal. Swapped that and it sprang to life.

Strange thing is that if I undo the changes I made to the settings it still works!

Stephen.

(in reply to swoolhead)
Post #: 7
RE: Using IE on the ISA server - 8.Nov.2002 2:36:00 PM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Stephen,

good to hear you got it working and thanks for the follow up! [Smile]

BTW --- the proper adapter order is very important for the DNS resolving and I set them correctly *before* even installing ISA.

Thanks,
Stefaan

(in reply to swoolhead)
Post #: 8
RE: Using IE on the ISA server - 8.Nov.2002 3:01:00 PM   
swoolhead

 

Posts: 14
Joined: 7.Nov.2002
Status: offline
One last thing, I noticed in the article it said to not put any DNS server entries into the external adapter, and to not worry about it because it would work. I assume that meant that requires the internal DNS servers to be able to able to resolve external DNS names?

If the internal server only does internal DNS is it OK to put entries in the external DNS point to external DNS servers?

Thanks

Stephen.

(in reply to swoolhead)
Post #: 9
RE: Using IE on the ISA server - 8.Nov.2002 4:29:00 PM   
spouseele

 

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Stephen,

if you have an internal DNS server, there is no reason whatsever to not use it also to lookup external names. Keep in mind that ISA can do DNS resolving on behalf of the web proxy and firewall client, but not for SecureNAT clients. So, I find it much better to always configure the internal DNS server with forwarders.

To allow the internal DNS server outbound access for DNS resolving:
1) configure the internal DNS server as SecureNAT client.
2) allow the internal DNS server access to the protocols DNS Query (UDP port 53 send receive) *and* DNS Zone Transfer (TCP port 53 outbound).
3) make sure the internal DNS server has access to the forwarders in a site&content rule.

Now, if you like to put the external DNS servers on ISA too, it's best to place all DNS resolver IPs in the internal ISA NIC only. Check out http://www.isaserver.org/tutorials/DNS_for_ISA_Server.html for more info.

HTH,
Stefaan

(in reply to swoolhead)
Post #: 10
RE: Using IE on the ISA server - 8.Nov.2002 5:06:00 PM   
swoolhead

 

Posts: 14
Joined: 7.Nov.2002
Status: offline
Humm, intreasting read. I will do as it suggests for the systems on static IP address, just a bit concerened about the DHCP clients, and getting out of date if I manually type the values into the DNS server.

That reminds me, is there a way to keep a server publishing rule current with the IP address of the extarnal NIC while using DHCP?

Thanks

Stephen

(in reply to swoolhead)
Post #: 11
RE: Using IE on the ISA server - 8.Nov.2002 8:22:00 PM   
tshinder

 

Posts: 47659
Joined: 10.Jan.2001
From: Texas
Status: offline
Hi Stephen,

check this out:

FIX: Server Publish May Fail on Dial-up Links
The information in this article applies to:
Microsoft Internet Security and Acceleration Server versions 2000, 2000 SP1

SYMPTOMS
If you use ISA Server to server publish on a dial-up adapter link (such as an analog modem, ISDN, or ADSL), the server publish operation may fail. This problem may occur although you use a fixed IP address on the dial-up interface.

When you run netstat -an from a command prompt on the computer running ISA Server, you see that ISA Server is not listening on the published port on behalf of the published service. Because of this, no connections can be made to the server published service.

Typically, this problem occurs on a slow link such as an analog modem connection. However, it may occur when you use any type of dial-up adapter.

To get the server publishing rule to work, you must turn off and then turn on the server publishing rule, or you must stop and then restart the Firewall Service.
CAUSE
ISA Server receives IP address change notifications from the operating system (OS) when the dial-up link is brought online. Sometimes, ISA Server may receive notifications before the IP address on the dial-up adapter is bound to the interface. This causes ISA Server to reject the dial-up interface as a valid interface for server publishing.

Additionally, ISA Server will miss the next notification (a few milliseconds later) from the OS when a valid IP address is bound to the dial-up adapter. Because ISA Server does not receive this second notification, it does not server publish on the dial-up interface. ISA Server can server publish on the dial-up interface again when it receives a new notification.
RESOLUTION
IMPORTANT: You must install ISA Server Service Pack 1 (SP1) before you install the following hotfix.

For additional information about how to obtain the latest ISA Server service pack, click the article number below to view the article in the Microsoft Knowledge Base:
Q313139 How to Obtain the Latest Internet Security and Acceleration Server
A supported fix is now available from Microsoft, but it is only intended to correct the problem that is described in this article. Apply it only to computers that are experiencing this specific problem. This fix may receive additional testing. Therefore, if you are not severely affected by this problem, Microsoft recommends that you wait for the next that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information about support costs, visit the following Microsoft Web site:
http://support.microsoft.com/default.aspx?scid=fh;EN-US;CNTACTMS
NOTE: In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The typical support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

To install the fix, run the self-extracting file. You do not have to restart the computer running ISA Server. If the computer is part of an ISA Server array, you do not have to shut down the whole array; you can still install this fix on a one-by-one basis.

The English version of this fix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
Date Time Version Size File name
----------------------------------------------------------
3-Oct-2002 22:50 3.0.1200.179 176,912 Mspadmin.exe
3-Oct-2002 22:49 3.0.1200.179 388,368 W3proxy.exe
3-Oct-2002 22:50 3.0.1200.179 297,232 Wspsrv.exe
3-Oct-2002 22:50 3.0.1200.179 99,600 Msphlpr.dll
This fix also applies to the French, German, Spanish, and Japanese versions of ISA Server.

STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.
MORE INFORMATION
Note that although you have installed this hotfix, the Application Event Log may record informational events similar to the following:
Type: Information
Source: Microsoft Firewall
Event ID: 14161
Description:
Server publishing rule [My SMTP Publishing Rule] that maps
10.10.10.10 TCP to 192.168.10.10 for protocol [SMTP Server]
was applied successfully.
This rule previously failed, but now completed successfully.
This event occurs because the first notification that ISA Server receives from the OS, before the valid IP address on the dial-up adapter is bound to the interface, fails. The event does not affect ISA Server. When ISA Server receives the second notification, a few milliseconds later, it can server publish successfully.
First Published: Apr 12 2002 5:39AM
Keywords: kbnokeyword kbbug

=============
HTH,
Tom

(in reply to swoolhead)
Post #: 12

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2000 General] >> Installation >> Using IE on the ISA server Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts