Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Web publishing PART II

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2000 General] >> Installation >> Web publishing PART II Page: [1]
Login
Message << Older Topic   Newer Topic >>
Web publishing PART II - 7.Mar.2001 10:19:00 PM   
jgrabiec

 

Posts: 191
Joined: 24.Jan.2001
From: Farmingdale,NY, USA
Status: offline 		picking up from my last thread... COuldn't get web publishing working. So, I uninstalled ISA, and reinstalled. Still no good.
Finally got it to work by DISABLING packet filtering (which I obviously do not want to do). I thought that by setting up a Web Publishing Rule, that the ISA server would listen for requests on port 80 (on the external interface), and floow the rule. It doesn't look like that is happening.

I'm still trying to find out what's going on. I'll keep everyone posted.

------------------
-=john=-
MCSE,MCP+I,CCNA,CCA

Post #: 1
RE: Web publishing PART II - 7.Mar.2001 10:39:00 PM   
jgrabiec

 

Posts: 191
Joined: 24.Jan.2001
From: Farmingdale,NY, USA
Status: offline 		I've re-enabled packet filtering, and of course my web publishing does not work. I then created a static ip packet filter called WEBIN (allow packet ransmission, predefing HTTP server port 80, default ip addr, external interfaces..), restarted the services, and I still can't get in.

Any ideas anyone?

------------------
-=john=-
MCSE,MCP+I,CCNA,CCA


(in reply to jgrabiec)
Post #: 2
RE: Web publishing PART II - 8.Mar.2001 5:40:00 PM   
clynn

 

Posts: 101
Joined: 8.Feb.2001
From: Farmington Hills, MI
Status: offline 		If you right click, properties of the server in ISA Management, you can check the listeners that eare enabled.

Make sure the web site is accessible from ISA. This should absolve any DNS issues.

The run through the web publishing wizard.

Good Luck
Chris


(in reply to jgrabiec)
Post #: 3
RE: Web publishing PART II - 8.Mar.2001 6:16:00 PM   
jgrabiec

 

Posts: 191
Joined: 24.Jan.2001
From: Farmingdale,NY, USA
Status: offline 		Chris,
thanx for the reply.

The listen is setup on that interface listening on port 80. no other authentication options are check - pretty simple. I tried the web site from the ISA server itself, and I can get on with no problem. However, from the web, I cannot unless I remove the packet filters.

------------------
-=john=-
MCSE,MCP+I,CCNA,CCA


(in reply to jgrabiec)
Post #: 4
RE: Web publishing PART II - 8.Mar.2001 8:10:00 PM   
tshinder

 

Posts: 47668
Joined: 10.Jan.2001
From: Texas
Status: online 		Hi John,

When creating your publishing rules, are you using the FQDN that can be accessed by an external user?

Check out the articles I have on publishing at www.isaserver.org/shinder

The second article is a little jumbled up, but it should be fixed by tomorrow and will include the graphics and fixes to the text.

Thanks!

Tom

------------------
Tom Shinder
http://www.isaserver.org/shinder/


(in reply to jgrabiec)
Post #: 5
RE: Web publishing PART II - 8.Mar.2001 8:24:00 PM   
jgrabiec

 

Posts: 191
Joined: 24.Jan.2001
From: Farmingdale,NY, USA
Status: offline 		Tom,

No, I am not using the FQDN on the web publishing rule. Thiese are the steps that I took:
1. Configured incoming web requests for the server. I configured listeners individually per address, and used the correct interface for the web. I set the TCP port to 80.
2. Created a destination set. NAME: WWW.MYSERVER.COM, Destination: WWW.MYSERVER.COM
3. Created a web oublishing rule. NAME: Webtest (enabled it). DESTINATION: selected dest set: WWW.MYSERVER.COM, ACTION: Redirect the request to this internal web server: 172.X.Y.Z (the private address of the server), the rest are deafults. So... I am not using a FQDN name here.

I even created an IP packet filter to allow HTTP server (port 80) traffic in. If I totally remove IP packet filtering, it works.

Also, I cannot find your second article (the one that is jumbled). Is it available yet?

Thanx again for all your help!

------------------
-=john=-
MCSE,MCP+I,CCNA,CCA


(in reply to jgrabiec)
Post #: 6
RE: Web publishing PART II - 8.Mar.2001 8:26:00 PM   
jgrabiec

 

Posts: 191
Joined: 24.Jan.2001
From: Farmingdale,NY, USA
Status: offline 		Tom, found the second part of the article, sorry... Will read immediately.

------------------
-=john=-
MCSE,MCP+I,CCNA,CCA


(in reply to jgrabiec)
Post #: 7
RE: Web publishing PART II - 8.Mar.2001 8:54:00 PM   
jgrabiec

 

Posts: 191
Joined: 24.Jan.2001
From: Farmingdale,NY, USA
Status: offline 		Tom,
Still no luck. I re-read both of your web publishing docs, and still no luck. Once I remove the IP Packet Filtering, it works like a champ! With it in place, no luck.

The only info I can add to the mix is that this is NOT ISA Enterprise Edition, it is Standard edition (not sure if that matters - it shouldn't).

I'm going to re-check the Internal web server itself. I know it is setup as a SecureMAT client, with the default gateway the ISA server itself. But, you mention in the second article of yours that the DNS configuration must be set. I will double check that.

TIA,

------------------
-=john=-
MCSE,MCP+I,CCNA,CCA


(in reply to jgrabiec)
Post #: 8
RE: Web publishing PART II - 8.Mar.2001 11:09:00 PM   
jgrabiec

 

Posts: 191
Joined: 24.Jan.2001
From: Farmingdale,NY, USA
Status: offline 		I decided to look into the event viewer, and saw that every time I tried access the web (with packet filtering on), i'd get the following error:
MICROSOFT ISA SERVER
PACKET FILTER
Event ID: 15108
ISA Server detected a spoof attack from internet protocol (IP) address 10.1.1.77. A spoof attack occurs when an ip address that is not reachable via the interface on which the packet was received. If loggin for dropped packets is set, you can view details in the packet filter log.

From the packet filter log:
SOURCE IP: 10.1.1.77
DEST IP: 10.1.1.68
PROTOCOL: TCP
PARAM #1: 3428
PARAM #2: 80
FILTER RULE: Spoof
INTERFACE: 10.1.1.68

Please note that the IP addresses have been changed to protect the innocent ( ). Also, my external PC is on the same subnet as the external interface of the ISA server (whcih should not be a problem since they are valid internet addresses).

Any thoughts on this???

------------------
-=john=-
MCSE,MCP+I,CCNA,CCA


(in reply to jgrabiec)
Post #: 9
RE: Web publishing PART II - 9.Mar.2001 9:26:00 AM   
tshinder

 

Posts: 47668
Joined: 10.Jan.2001
From: Texas
Status: online 		Hi John,

It may be a problem with your LAT. Make sure that only the IP addresses on the internal network are included on the LAT. If a host on the external network has an IP address that is included on the LAT, it will be interpreted as a spoof attack.

You might try turning off intrusion detection and see what happens. Also, check from an external network client coming from a remote network. Connect a laptop to an ISP and then try to access the published web site.

HTH,
Tom

------------------
Tom Shinder
http://www.isaserver.org/shinder/


(in reply to jgrabiec)
Post #: 10
RE: Web publishing PART II - 9.Mar.2001 3:16:00 PM   
jgrabiec

 

Posts: 191
Joined: 24.Jan.2001
From: Farmingdale,NY, USA
Status: offline 		Hi Tom,

My LAT consisted of public address, but none from the subnet that I am testing on (some of my clients are still using opublic address internally. Since we route to the via private WAN connections, they are essential private address to my internal LAN). Anyway, I removed them from the LAT, still no luck.

I also tried to connect from my PC at home (totally different subnet) - Still no luck.

I also tried to remove intrusion detection. Guess what - still no luck.

Any other thoughts? This is really driving me nuts!

Tahnx again for all the help.

------------------
-=john=-
MCSE,MCP+I,CCNA,CCA


(in reply to jgrabiec)
Post #: 11
RE: Web publishing PART II - 9.Mar.2001 7:26:00 PM   
jgrabiec

 

Posts: 191
Joined: 24.Jan.2001
From: Farmingdale,NY, USA
Status: offline 		Things are starting to look up. Placed an incident with Microsoft this morning, and have been on the phone all morning with them. Finally got web publishing work with a minor hitch (although i'm not sure how I got it orking yet. I'll rollback my changes to see later and fill you guys in).
The hitch is that I still get the spoof attack messages from a client that is on the same subnet as my external adapter of the ISA server. MS is working on that now, and hopefully i'll have and answer soon.

------------------
-=john=-
MCSE,MCP+I,CCNA,CCA


(in reply to jgrabiec)
Post #: 12
RE: Web publishing PART II - 10.Mar.2001 8:08:00 PM   
tshinder

 

Posts: 47668
Joined: 10.Jan.2001
From: Texas
Status: online 		Hi John,

Thanks! Its interesting that they didn't have an answer to the spoof problem right away. That indicates that it isn't an easy or typical issue. Please let us know what they say! The answer should be very interesting.

Thanks!

Tom

------------------
Tom Shinder
http://www.isaserver.org/shinder/


(in reply to jgrabiec)
Post #: 13
RE: Web publishing PART II - 11.Mar.2001 3:48:00 PM   
jgrabiec

 

Posts: 191
Joined: 24.Jan.2001
From: Farmingdale,NY, USA
Status: offline 		Hi Tom,

Microsoft is still working on the spoof problem. Real interesting problem. I still have to put back the 4 or 5 changes that we made to see which fixed the publishing (the problem was that we tested after each change, and the problem did not fix. So we bounced the server and noticed it was working).

NOw anyone on the planet can access the web I published - unless you are on the same subnet as the external interface!

I'm thinking that the issue may lie in the fact that this machine has two external NICS on that subnet. It doen't make any sense to me, but I'm going to remove one of the NICS and test again.

Hopefully Microsoft will get back to me with an answer. The problem is being escalated internally to see what they can do. The MS tech is actually very knowledgeable - just stumped on the spoof problem - but i'm sure he'll get an answer.

You can feel good also, as the tech had great things to say about you and the entire isaserver.org site.

Keep up the good work - this site is great.

------------------
-=john=-
MCSE,MCP+I,CCNA,CCA


(in reply to jgrabiec)
Post #: 14
RE: Web publishing PART II - 11.Mar.2001 6:39:00 PM   
tshinder

 

Posts: 47668
Joined: 10.Jan.2001
From: Texas
Status: online 		Hi John,

Thanks for getting back to us on this! It'll be really interesting to see what the issue is with the spoof issue when someone on the same network ID as the external interface tries to connect. Definitely looking forward to seeing what they come up with.

And thanks for sharing what MS said! That's really nice. Maybe some of those dudes can post some of their ISA secrets

Tom

------------------
Tom Shinder
http://www.isaserver.org/shinder/


(in reply to jgrabiec)
Post #: 15

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2000 General] >> Installation >> Web publishing PART II Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts