RPC over HTTPS status code 64

RPC over HTTPS status code 64 (Full Version)

All Forums >> [ISA Server 2004 General ] >> Exchange Publishing

Message

PVerdieu -> RPC over HTTPS status code 64 (8.Aug.2006 11:42:07 PM)
Hello all, I've been looking at it for the last few hours (searched extensively this site, too) but I can't seem to make RPC over HTTPS work with thru ISA 2004 std. A little history. I have a single Exchange server. I had configured RPC over HTTPS and it worked thru a 3com firewall. The firewall, was dying so I replaced it with an ISA server. Now I can't get an IPSec vpn to work (but that's another story), I can't access my DMZ from the lan (but that's also another story), and finally I can't use RPC over HTTPS anymore. I've transfered the cert from the exchange server to the isaserver, and I can access everything else that's on that server thru HTTPS. Now here's the setup: WAN --- ISA --- Exchange (BE RPC/HTTPS). Let me answer the usual questions: I have created and recreated (oh how so many times) the firewall rule and the listener. the listener is set to use Basic Authentication the rule is set to foward authentication the listener and protocols support only HTTPS yes I have two different nics (one for the wan one for the lan) -- actually the server has 4 but the 2 others are for further use and disabled I have read (http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/exchage2003.mspx) and applied it to no avail I have also read (http://forums.isaserver.org/m.aspx?m=2002012897) -- you can notice the similar subject read this one too (http://forums.isaserver.org/m_2002015827/mpage_1/key_rpc%2chttps/tm.htm#2002015827) I am using an internal CA and the external client trusts the root CA I have ran ISA BPA and it told me that I had strict RPC compliance on that might be a problem so I removed it the firewall is resolving the name on the To tab to the actual IP address of the RPC proxy I have rebooted the firewall OWA and the rest of the webpages on the exchange server work the closet issue on the website is this one (http://forums.isaserver.org/m.aspx?m=2002016920&mpage=1&key=rpc%2chttps) Inside the LAN both /rpc/rpcproxy.dll" target=_blank>http://<netbios>/rpc/rpcproxy.dll and https://<netbios>/rpc/rpcproxy.dll work (blank page) On the ISA server though, https://<netbios>/rpc/rpcproxy.dll works but http://<netbios>/rpc/rpcproxy.dll doesn't, it gives me an Error Code 64: Host not available on the wan side /rpc/rpcproxy.dll" target=_blank>https://<external fqdn>/rpc/rpcproxy.dll also gives me an error code 64 the public name is the same as the certificate (adm.college-st-paul.qc.ca), the "to" tab goes to the mail server The exchange server is also a DC and a GC In the ISA Logs, I get one allowed connection then the rest fail The ISA server is a member of the domain Help? Anyone??

tshinder -> RE: RPC over HTTPS status code 64 (9.Aug.2006 3:42:58 PM)
Hi P, Maybe this would help: http://www.isaserver.org/tutorials/Publishing-Outlook-Web-Access-Outlook-RPCHTTP-ISA-Server-2006-Firewalls-Forms-based-Authentication.html Although based on 2006, the principles remain the same. Tom

PVerdieu -> RE: RPC over HTTPS status code 64 (10.Aug.2006 4:59:26 AM)
Hi Tom, Unfortunately no it didn't help, still getting the "Error Code 64" error. both locally on the ISA server and on remote clients, but not anywhere else on the LAN, so I know it is an ISA problem. HELP (getting mighty frustrated here)

tshinder -> RE: RPC over HTTPS status code 64 (10.Aug.2006 2:24:52 PM)
Hi P, What is the name on the TO tab? What is the name on the public name tab? What is the name of the proxy the client is configured to use? What is the name of the Exchange Server the client is configured to use? Are you delegating basic credentails? Are you authenticating at the ISA firewall? Thanks! Tom

PVerdieu -> RE: RPC over HTTPS status code 64 (10.Aug.2006 4:34:02 PM)
TO Tab: <fqdn> Public Name: <fqdn> Proxy: <fqdn> Exchange Name: <netbios> Delegating: yes authenticating at ISA: NO (tried both) split DNS is used and internally <fqdn> = <netbios> Certificate Common name on <netbios>: <fqdn>

tshinder -> RE: RPC over HTTPS status code 64 (13.Aug.2006 6:33:19 PM)
Hi P, Couple of things seems out of whack or that I don't understand. For a split DNS to work, the same name should resolve differently depending on the location of the user. For external users it resolves to the ISA firewall's external address, for internal users it resolves to the name of the actual host (at least in one scenario, there are ways to make it resolve to the name of the ISA firewall's internal interface Web listener too). You should be authenticating at the ISA firewall and use basic delegation and the ISA firewall should be a domain member (obviously). Make sure the /rpc directory is configured to use basic auth Finally, run the ISA firewall BPA on the ISA firewall to check certificate status. On the client, do you see HTTP connection attempts in the Status dialog box (when you CTRL+right click the Outlook icon in the tray?) Tom

tshinder -> RE: RPC over HTTPS status code 64 (13.Aug.2006 6:34:18 PM)
Also, make sure the Web listener is configured to use only BASIC authentication and listens ONLY for SSL (no HTTP allowed). HTH, Tom

PVerdieu -> RE: RPC over HTTPS status code 64 (14.Aug.2006 9:17:43 PM)
Web Listener is configured to use only BASIC authentication and listens ONLY for SSL Split DNS is configured correctly (external points to external address, internal points to exchange server) ISA server is domain member authenticating at the ISA firewall and using basic delegation ONLY the /rpc directory is configured to use basic auth and ONLY basic auth The only thing on ISA BPA is that a policy blocks FTP uploads outlook /rpcdiag or ctrl right click on icon show (translated from french): (First line) Server Name: --- Type: repertoire Connection: --- State: connecting (second line) Server Name: <netbios> Type: reference Connection: https State: connecting

PVerdieu -> RE: RPC over HTTPS status code 64 (18.Aug.2006 2:15:57 PM)
Help? anybody?

tshinder -> RE: RPC over HTTPS status code 64 (18.Aug.2006 2:48:43 PM)
Hi P, What is the IP address of the Exchange Server? What IP address is reported when you ping the Exchange Server from the ISA firewall? Thanks! Tom

PVerdieu -> RE: RPC over HTTPS status code 64 (18.Aug.2006 3:41:29 PM)
IP address is: <IP> and is the correct one pinged from the ISA server

tshinder -> RE: RPC over HTTPS status code 64 (21.Aug.2006 4:51:50 PM)
Hi P, Is that on the same network ID as the internal interface of the ISA firewall? Thanks! Tom

gja -> RE: RPC over HTTPS status code 64 (21.Aug.2006 5:23:24 PM)
Hello, I know about some problems with RPC over HTTPS. We opened a call at microsoft and the first thing they said; "make sure you are using SP1 for w2k3 and sp1 for exchange". Are you using sp1? good luck

PVerdieu -> RE: RPC over HTTPS status code 64 (21.Aug.2006 9:06:17 PM)
Hi GJA, Thanks for the info, but I am already running SP1 everywhere (I'm a big proponent of keeping everything patched up as much as possible). Glad to know I'm not alone in this though ;) Tom, Yes the ip address of the internal interface is in the same network as the mail server.

Treolorn -> RE: RPC over HTTPS status code 64 (29.Aug.2006 9:37:04 AM)
I have this trouble to :( i can't do anythink :( Windows 2003 SE SP1 ISA Server EE SP2 Exchange 2003 SP2 if i use https://<my internal mail server name>/rpc/rpcproxy.dll, after autorization i have blank page if i use https://<my external mail server name/rpc/rpcproxy.dll, after autorization i have error code 64 my OWA on external name - is working fine on https. ISA BPA reporting this: "SSL connection failure with published server (name mismatch)." My internal web server have a certificate "mailserver.domain.local", my exteral domain name (is a ISA Server) - mail.domain.com. My sertificate ISA Server name is mail.domain.com. How i can fix this? i'm fix error with "name mismatch", but i have steel Error Code 64 :(

tshinder -> RE: RPC over HTTPS status code 64 (29.Aug.2006 3:37:24 PM)
ACCKCCKCK!!!! Not the dreaded .local !! I'm outtua here! [8D] Tom

PVerdieu -> RE: RPC over HTTPS status code 64 (29.Aug.2006 4:47:57 PM)
Hi Treolorn, On your ISA server, if you do a https://<my internal mail server name>/rpc/rpcproxy.dll, what does it give you? I get an error code 64 whereas on the rest of the lan it works OK.

Treolorn -> RE: RPC over HTTPS status code 64 (30.Aug.2006 7:16:57 AM)
don't worry T, i'm writed in end of my post what i fix this. I'm change all names (TO in rule and certificate) to "mail.domain.com", and test my OWA. OWA is working fine, but 64 error is steel present. Please, read to end.. P, on my ISA Server i got blank page. And if i use my external address from ISA - its OK - blank page. But i edited "hosts" file, to resolve mail.domain.com to internal IP of mail server. i get error 64 only if i use external address from LAN or from Internet.

Treolorn -> RE: RPC over HTTPS status code 64 (1.Sep.2006 2:23:44 PM)
P, do you have install user certificate for ISA Firewall service? to all, how i can test my certificate authentication between WEB and ISA servers?

PVerdieu -> RE: RPC over HTTPS status code 64 (1.Sep.2006 3:18:02 PM)
Treolorn, Yes I have installed the certificate, OWA works with another rule. I don't know how to test the certificate authentication between the web and Isa server though, but I would try to publish a simple website if I were you.

Page: [1] 2 3 next > >>