ISA not resolving Hostname (Full Version)

All Forums >> [ISA 2006 Web Proxy] >> Web Proxy Client



Message

jun1or -> ISA not resolving Hostname (10.Apr.2008 6:03:54 AM)

Yesterday i installed and configured ISA Server 2006 Std in a Unihomed mode, i also enabled cache on Raid1.

I am unable to ping number of internal client hostnames on different subnets. I can ping the ip address but not the hostname. I can also ping some hostnames on the same subnet.

I also have configured an ISA test server on a different subnet and that also has random hostname resolving issues.

Any help will be greatly appreciated.

Thanks



cbjohnson -> RE: ISA not resolving Hostname (11.Apr.2008 8:33:40 AM)

Hello, is your ISA box setup as the default gateway on your network? Have you added a persistent route for your subnets on your ISA box?



jun1or -> RE: ISA not resolving Hostname (14.Apr.2008 1:51:46 PM)

quote:

ORIGINAL: cbjohnson

Hello, is your ISA box setup as the default gateway on your network? Have you added a persistent route for your subnets on your ISA box?


I thought because it is running in proxy mode persistent routes dont matter?



cbjohnson -> RE: ISA not resolving Hostname (14.Apr.2008 2:52:49 PM)

I thought so too. However, once I added the routes for my two remote subnets I had full connectivity.



jun1or -> RE: ISA not resolving Hostname (14.Apr.2008 4:52:44 PM)

quote:

ORIGINAL: cbjohnson

I thought so too. However, once I added the routes for my two remote subnets I had full connectivity.


Will give that a try Thanks.




jun1or -> RE: ISA not resolving Hostname (14.Apr.2008 5:38:45 PM)

still unable to ping hostname but can ping the IP address.



jun1or -> RE: ISA not resolving Hostname (15.Apr.2008 4:22:03 AM)

The strange thing is when you ping the hostname with the full domain (ping hostname.domain.local) it pings.



pwindell -> RE: ISA not resolving Hostname (15.Apr.2008 5:33:59 PM)

You need the static routes.
You do not want the ISA to be the Default Gateway of anything.

Name resolution won't happen if the System Policies are not correct. 
Name resolution won't happen dependably if the AD/DNS is not the only DNS Server the ISA uses.



jun1or -> RE: ISA not resolving Hostname (16.Apr.2008 8:47:53 AM)

quote:

ORIGINAL: pwindell

You need the static routes.
You do not want the ISA to be the Default Gateway of anything.

Name resolution won't happen if the System Policies are not correct. 
Name resolution won't happen dependably if the AD/DNS is not the only DNS Server the ISA uses.



Static routes? Is this for all subnets we have in our organisation?
Nothing is configured as our default gateway

System Policy 'Allow ICMP (ping) requests from ISA to selected servers is enabled  from 'Local Host' To 'All Networks'

DNS - Yes we have several DNS servers running on different subnets.

When i monitor the ISA server the logs display 'Denied Connection' and the protocol is 'NetBios Name Service'

When checking event log i am also receving the following errors:


The connectivity verifier "DNS" reported an error when trying to connect to 10.0.0.1
Reason: The request has timed out.
 

The connectivity verifier "AD" reported an error when trying to connect to hostname.domain.local.
Reason: Can't resolve server name.
 
The server has TWO Nics and one is disabled so that i can use this in proxy mode.
 
I have also un-installed ISA and tried several pings to different subnets and all seem to work, it only when i install ISA i am able to ping random hostnames.



pwindell -> RE: ISA not resolving Hostname (16.Apr.2008 10:21:50 AM)

1. Forget Ping. Ping is worthless. The fact that something can't be pinged is meaningless.  If you want to test some type of commincation, then use the same protocol used in the communication.  Want to test http, then use http,...want to test DNS, then use DNS,..want to test Telnet, then use Telnet.

2. Connectivity verifiers are worthless if you create them improperly,...such as using Ping to test something that is not Ping.  Forget the Verifiers.

3. Now, let's start from the beginning
  A.  Uninstall ISA from the Box. Make sure the box uses only the AD/DNS
        and none other (same way with every other machine on the LAN).

  B.  Join the box to the Domian. If it is already joined,..then unjoin it and
       move to a Workgroup,...reboot,...then rejoin it to the Domain.  Now we
       know the Join is a "good" one,...which also proves that the machine is
       handling DNS correctly.  Add or verify the Static Routes to the
       OS's routing table as we mentioned in previous posts.

  C. Install ISA and choose the Single-Nic Cache Server Template

  D. Make sure your Firewall,...whatever that may be,...allows the AD/DNS
      Server to make outbound DNS Queries.  The AD/DNS will not use the
      ISA for this,...DNS does not fall within the "role" of a CERN Compliant
       Web Proxy (like a single-nic ISA) which only does http, https, read-only
       ftp, and gopher.  Make sure that this same Firewall does not allow
      outbound http/https/ftp from the Users or they will be able to bypass the
      ISA by removing the proxy settings from their browser.

  E. Create Access Rules for Users
            Source: Internal
            Destin:  Internal (yes, internal)
            Protocol:  http, https, ftp
            Users: <whatever>

  F.  ISA itself will not be able to browse the Net.  It is by default and is on
        purpose,...intensional

  G. ISA's System Policies will allow only the minimum communication with
       the LAN (the DC) for it to do its job.  It will not be able to run around on
       the Internet or the LAN in the same way as other machines,...it is not
       supposed to.

If it does not work,...particularly concerning the routing and the Static Routes, then you have not correctly described your LAN Topology Design to us.

Here's some additional information (it says ISA2004, but it is still that same)...

The features and limitations of a single-homed ISA Server 2004 computer
http://support.microsoft.com/kb/838364/en-us
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/single_adapter.mspx

Configuring ISA Server 2004 on a Single Adapter Computer
(http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/single_adapter.mspx)





jun1or -> RE: ISA not resolving Hostname (17.Apr.2008 3:46:06 PM)

quote:

ORIGINAL: pwindell

1. Forget Ping. Ping is worthless. The fact that something can't be pinged is meaningless.  If you want to test some type of commincation, then use the same protocol used in the communication.  Want to test http, then use http,...want to test DNS, then use DNS,..want to test Telnet, then use Telnet.

2. Connectivity verifiers are worthless if you create them improperly,...such as using Ping to test something that is not Ping.  Forget the Verifiers.

3. Now, let's start from the beginning
A.  Uninstall ISA from the Box. Make sure the box uses only the AD/DNS
       and none other (same way with every other machine on the LAN).

B.  Join the box to the Domian. If it is already joined,..then unjoin it and
      move to a Workgroup,...reboot,...then rejoin it to the Domain.  Now we
      know the Join is a "good" one,...which also proves that the machine is
      handling DNS correctly.  Add or verify the Static Routes to the
      OS's routing table as we mentioned in previous posts.

C. Install ISA and choose the Single-Nic Cache Server Template

D. Make sure your Firewall,...whatever that may be,...allows the AD/DNS
     Server to make outbound DNS Queries.  The AD/DNS will not use the
     ISA for this,...DNS does not fall within the "role" of a CERN Compliant
       Web Proxy (like a single-nic ISA) which only does http, https, read-only
       ftp, and gopher.  Make sure that this same Firewall does not allow
     outbound http/https/ftp from the Users or they will be able to bypass the
     ISA by removing the proxy settings from their browser.

E. Create Access Rules for Users
           Source: Internal
           Destin:  Internal (yes, internal)
           Protocol:  http, https, ftp
           Users: <whatever>

 F.  ISA itself will not be able to browse the Net.  It is by default and is on
       purpose,...intensional

 G. ISA's System Policies will allow only the minimum communication with
      the LAN (the DC) for it to do its job.  It will not be able to run around on
      the Internet or the LAN in the same way as other machines,...it is not
      supposed to.

If it does not work,...particularly concerning the routing and the Static Routes, then you have not correctly described your LAN Topology Design to us.

Here's some additional information (it says ISA2004, but it is still that same)...

The features and limitations of a single-homed ISA Server 2004 computer
http://support.microsoft.com/kb/838364/en-us
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/single_adapter.mspx

Configuring ISA Server 2004 on a Single Adapter Computer
(http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/single_adapter.mspx)





I really appreciate your help on this, Two other question before I carry out these steps.

1) Do I have to add all the subnets to the routing table before installing (i.e. 192.168.0.0, 192.168.1.0, 10.10.1.0, 10.10.2.0 etc)?

2) What should the default gateway point to? I know you mentioned they should not point to the ISA, should these point to the ISA’s configured gateway (i.e. ISA’s IP 192.168.0.22 Gateway: 192.168.0.254)?


Again Many thanks for your help



pwindell -> RE: ISA not resolving Hostname (17.Apr.2008 4:03:20 PM)

The route Table entries can be done at any time,..but the sooner the better.

ISA in a single nic mode is not a "router" in any way,...it is not the Default Gateway of anything.

Your LAN Router that routes your LAN's subnets (192.168.0.0, 192.168.1.0, 10.10.1.0, 10.10.2.0) will be the Default Gateway of all machines except the ISA which will use the Firewall as it Default Gateway.

Your LAN Router will use the Firewall as its Default Gateway.



jun1or -> RE: ISA not resolving Hostname (17.Apr.2008 5:50:57 PM)

quote:

ORIGINAL: pwindell

The route Table entries can be done at any time,..but the sooner the better.

ISA in a single nic mode is not a "router" in any way,...it is not the Default Gateway of anything.

Your LAN Router that routes your LAN's subnets (192.168.0.0, 192.168.1.0, 10.10.1.0, 10.10.2.0) will be the Default Gateway of all machines except the ISA which will use the Firewall as it Default Gateway.

Your LAN Router will use the Firewall as its Default Gateway.


I think this is where i might have going wrong i have not given ISA the firewall's default gateway but the default gateway of the subnet it was in (i.e. ISA 192.168.0.222 gateway: 192.168.0.254)

Thanks I will follow these and update.



Page: [1]