• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Publishing Problem

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2004 General ] >> Web Publishing >> Publishing Problem Page: [1]
Login
Message << Older Topic   Newer Topic >>
Publishing Problem - 3.Nov.2006 8:34:17 AM   
tomers@tomers.co.il

 

Posts: 41
Joined: 1.Nov.2006
Status: offline
Hi everyone.

I'm publishing different web servers with a listner on the external interface.
The problem is that when I try access those websites from other networks, not external, I get a "page not found" error.
When I view the logs I can see that when I'm trying to access the published servers from one of the internal networks, it seems that the publish rule is ignored and I get a "Denied connection" based on the last default rule. I guess that is because the servers are published only on the external network. I don't want to publish the servers on other networks because I want everyone, including all the internal networks, to access those servers via their External IP addresses. I tried to add a regular access rule that will let the internal networks access the "localhost" with http and https. Now I don't get a "denied connection" on the log but I still can't access the websites.

I think the base of this problem is that the listner is only for the external network, but don't forget that I have to access those sites with their external IP addresses even from internal networks, so I can't add listners on the internal IP's,

Any ideas ?
Thank you all.

_____________________________

Tomer Schwaitzer
MCT, MCSA, MCSE, CCNA
Post #: 1
RE: Publishing Problem - 3.Nov.2006 9:31:24 AM   
tim_carter

 

Posts: 27
Joined: 2.Nov.2006
Status: offline
hi

i dont understand why you want to loopback through your isa server? that is not the right way to do this.. you should configure your dns internaly to point to your webserver because this way you will save resources on the isa server..

(in reply to tomers@tomers.co.il)
Post #: 2
RE: Publishing Problem - 3.Nov.2006 9:46:43 AM   
tomers@tomers.co.il

 

Posts: 41
Joined: 1.Nov.2006
Status: offline
Not all my internal networks have access to each other so I can't do it. I nee the ISA to function as Reverse proxy for all website connections.
My DNS environment is very complicated and I can't do it anyway. I have to point all the networks to the same IP address, which is the external IP on the ISA.


_____________________________

Tomer Schwaitzer
MCT, MCSA, MCSE, CCNA

(in reply to tim_carter)
Post #: 3
RE: Publishing Problem - 3.Nov.2006 1:23:53 PM   
tomers@tomers.co.il

 

Posts: 41
Joined: 1.Nov.2006
Status: offline
Throughout checking this issue, I noticed that the problem exists only with SSL. Website using only http works just fine...

If anyone have any suggestions, I'll be happy to here it..

Thanks.

_____________________________

Tomer Schwaitzer
MCT, MCSA, MCSE, CCNA

(in reply to tomers@tomers.co.il)
Post #: 4
RE: Publishing Problem - 3.Nov.2006 6:06:55 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Tomer,

internal clients should access internal resources directly, not the published instance of that resource. If that isn't possible, the only workaround I know of is to publish those internal resources to the different internal interfaces and 'play' with the DNS Netmask Ordering feature on the internal DNS server.

For more info about the DNS Netmask Ordering feature, check out:

HTH,
Stefaan

(in reply to tomers@tomers.co.il)
Post #: 5
RE: Publishing Problem - 4.Nov.2006 8:17:38 AM   
tomers@tomers.co.il

 

Posts: 41
Joined: 1.Nov.2006
Status: offline
been there already... Thanks anyway. I still do not understand why Http works but Https do not.... I really have to figure it out.

_____________________________

Tomer Schwaitzer
MCT, MCSA, MCSE, CCNA

(in reply to spouseele)
Post #: 6
RE: Publishing Problem - 4.Nov.2006 5:53:42 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Tomer,

I suggest you read Jim's ISA 2000 article http://www.isaserver.org/articles/14120_Errors_Discussion_and_Solution.html on this subject. Though ISA 2004/2006 is quite another beast, I believe a lot of the basics still hold true.

BTW --- I've learned in the 30 years I'm in the IT business that the art is to know the limitations of any product you deploy and accept them as it. In any case don't use the product for what it is not specifically designed for unless you are willing to hurt yourself!

HTH,
Stefaan

< Message edited by spouseele -- 4.Nov.2006 5:54:49 PM >

(in reply to tomers@tomers.co.il)
Post #: 7
RE: Publishing Problem - 5.Nov.2006 10:24:10 AM   
tomers@tomers.co.il

 

Posts: 41
Joined: 1.Nov.2006
Status: offline
Not enough for me my friend.  If something don't work I want to know why. 
If there is no clear reason, we have to find it...
If HTTP works, why SSL don't ?
I'll keep searching and let you know.

Thanks for the answers.


_____________________________

Tomer Schwaitzer
MCT, MCSA, MCSE, CCNA

(in reply to spouseele)
Post #: 8
RE: Publishing Problem - 5.Nov.2006 10:35:19 AM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Tomer,

quote:

If something don't work I want to know why.

If you really want to know why, I suggest you call Microsoft PSS or try to contact Jim Harrison [Jim.Harrison@microsoft.com] of the Microsoft Security Platform Group (ISA).

HTH,
Stefaan


(in reply to tomers@tomers.co.il)
Post #: 9
RE: Publishing Problem - 5.Nov.2006 10:37:20 AM   
tomers@tomers.co.il

 

Posts: 41
Joined: 1.Nov.2006
Status: offline
I will do it.  Thank you.

_____________________________

Tomer Schwaitzer
MCT, MCSA, MCSE, CCNA

(in reply to spouseele)
Post #: 10
RE: Publishing Problem - 5.Nov.2006 10:40:00 AM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Tomer,

OK, but keep us informed...

Thanks,
Stefaan

(in reply to tomers@tomers.co.il)
Post #: 11
RE: Publishing Problem - 5.Nov.2006 12:56:02 PM   
Jim Harrison

 

Posts: 271
Joined: 5.May2001
From: Redmond, WA
Status: offline
He did, too.

ISA laws of web proxy client traffic:
- Web proxy clients connect to an upstream HTTP site via bridging
- Web proxy clients connect to an upstream HTTPS site via tunneling

ISA bridging allows this because each connection (client to ISA, ISA to itself, ISA to upstream server) represents a different socket.
Tunneling fails because ISA effectively becomes a port-translating NAT device.
When ISA tries to create a tunnel to itself (the publishing listener), it has to change from bridging to NAT and this is where the connection fails.

Basically, you have two choices; both of whch require that you take control of your DNS:
1. build your split DNS and allow the web proxy clients co connect directly to the internal servers.
2. create DNS records that resolve to the ISA internal interface and build a web publishing rule that bridges back to the internal servers

Personally, option #1 is the best.


_____________________________

Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
My ISAServer.org Stuff
My Site

(in reply to tomers@tomers.co.il)
Post #: 12
RE: Publishing Problem - 5.Nov.2006 1:58:36 PM   
tomers@tomers.co.il

 

Posts: 41
Joined: 1.Nov.2006
Status: offline
Hi Jim.

Thank you for the fast reply.  At least I have a reason now...
Do ISA 2006 supports this feature ?  If not, isn't it an issue that have to be fixed ?

Thanks again,

_____________________________

Tomer Schwaitzer
MCT, MCSA, MCSE, CCNA

(in reply to Jim Harrison)
Post #: 13
RE: Publishing Problem - 6.Nov.2006 2:30:15 PM   
spouseele

 

Posts: 12830
Joined: 1.Jun.2001
From: Belgium
Status: offline
Hi Tomer,

so... basically the same limitations as with ISA 2000. As far as ISA 2006 is concerned, that's more an R2 release of ISA 2004. Therefore no change in that behavior, I think.

HTH,
Stefaan

(in reply to tomers@tomers.co.il)
Post #: 14

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2004 General ] >> Web Publishing >> Publishing Problem Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts