Welcome to ISAserver.org

Websphere and ISA 2004

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2004 Firewall] >> DMZ >> Websphere and ISA 2004

Page: [1]

Message

<< Older Topic Newer Topic >>

Websphere and ISA 2004 - 16.Dec.2005 9:52:05 AM

danat

Posts: 2
Joined: 16.Dec.2005
Status: offline

Hi.
We have recently been asked to accomodate a Web server in the DMZ area (we have a front hardware firewall and the ISA completes the back-to-back firewall configuration as an internal firewall, the web server sits virtually between them). There is a Websphere cluster on the internal LAN that is supposed to feed some of the secure and normal web content to the web server (ports 9080 and 9444). I did use the isatpre tool to extend the ssl tunnel range and defined a rule accordingly but, unfortunately, some of the content (the normal web traffic content) is denied, as the logs show. Although I have defined a port range and a relevant rule to allow port 9080 traffic from the LAN to the DMZ area, it is being stopped. Help! I have even attempted to create a rule that allows all traffic between the websphere cluster and the web server solely, yet port 9080 traffic is still blocked.
Any advice will be absolutely invaluable.
Thanking you,
Dana

Post #: 1

Featured Links*

RE: Websphere and ISA 2004 - 25.Dec.2005 7:23:23 PM

tshinder

Posts: 47669
Joined: 10.Jan.2001
From: Texas
Status: online

Hi Dana,

Can you give a complete description of the protocol used?

1. Where is the client?
2. Where is the server?
3. What device initiates the connection?
4. What device answers the connection call?
5. What is the route relationship between the caller and the answering device?

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to danat)

Post #: 2

RE: Websphere and ISA 2004 - 27.Dec.2005 10:27:31 AM

danat

Posts: 2
Joined: 16.Dec.2005
Status: offline

Hello and thank you for taking the time to read and answer my post.
The protocols used between the Web server and the Websphere cluster that feeds the web content are http (on port 9080 and SSL (HTTPS) on port 9444.
1. The clients are currently only on the internal LAN. Name resolution is working correctly. Some of the web content (the "skeleton" web site that is stored on the web server) is retrieved OK. I have identified that the traffic is being blocked post-client-request and initial web server reply, between the web server and the websphere cluster. To expand that, the handshake is initiated and politely closed between the 2 server-based parties, yet no content is displayed.
2. The web server is in the DMZ, between the Sonicwall and the ISA and is going to be published on the Internet for secure access shortly. The Websphere cluster is located on the LAN.
3. Whether the client is on the LAN or I am attempting to access the page from the web server, I am getting the same result. Client web browsers are triggering the request, then the web server makes a request to the Websphere cluster for content, which, in its turn, queries an AS400 DB2 database located on another (iseries) server.
4. Ultimately, the Websphere cluster is responsible for site content return. As you can see, there are a few server systems that are involved in the answering process (webspere cluster, iseries server - which communicates solely with the websphere cluster via ODBC)
5. The relationship between the DMZ and LAN is route, not NAT.
Finally, I have not been able to identify any other traffic but on ports 9080 and 9444. Although the rule at the top now allows all traffic between the web server and the websphere cluster, the ISA traffic monitoring tool displays traffic as both being allowed via that rule and traffic (unknown on the same above-mentioned ports) being denied according to no rule (?)
I am suspecting that this behaviour may not be caused by a single problem (i.e. solely ISA-related).
Thanking you in advance for your help,
Dana

(in reply to tshinder)

Post #: 3

RE: Websphere and ISA 2004 - 31.Dec.2005 7:00:38 PM

tshinder

Posts: 47669
Joined: 10.Jan.2001
From: Texas
Status: online

Hi Dana,

Yes, I think you're right, this seems to be a multifactorial problem.

One thing I immediately identify is that you need to extend your tunnel port range for SSL, since the ISA firewall will support only 443 out of the box.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to danat)

Post #: 4