How i configure ISA SERVER without proxy? (Full Version)

All Forums >> [ISA Server 2004 Firewall] >> Access Policies



Message

tobiastromm -> How i configure ISA SERVER without proxy? (3.Jun.2008 10:31:18 AM)

Hi.
I have an Isa Server 2004 and I need to configure this firewall to allow clients to surf in internet whithout proxy. I have 2 network interfaces:

INTERNET:
IP: 192.168.0.4
Gateway: 192.168.0.1
Máscara: 255.255.255.0

LOCAL NETWORK:

IP: 10.0.0.1
Máscara: 255.0.0.0
Gateway: blank

-x-

Desktops:
IP: 10.x.x.x
Máscara: 255.0.0.0
Gateway: 10.0.0.1

Please I need help [sm=eek.gif][sm=eek.gif][sm=eek.gif]



elmajdal -> RE: How i configure ISA SERVER without proxy? (4.Jun.2008 7:32:30 AM)

Ok you need to set the client as securenet client, that is to point its default gateway to ISA Server Internal NIC.  seems like you already did this, but where is the DNS Entry on the Internal ISA Server machine and on the client ?

do you have an internal DNS Server ?




tobiastromm -> RE: How i configure ISA SERVER without proxy? (4.Jun.2008 12:58:03 PM)

Hi!
Yesterday work... today dosen't work more...
Please...

DNS:

INTERNET:
IP: 192.168.0.4
Gateway: 192.168.0.1
Máscara: 255.255.255.0
Primary DNS: 201.10.120.3
Secondary DNS: 201.10.1.2

LOCAL NETWORK:

IP: 10.0.0.1
Máscara: 255.0.0.0
Gateway: blank
Primary DNS: 10.0.0.1

-x-

Desktops:
IP: 10.x.x.x
Máscara: 255.0.0.0
Gateway: 10.0.0.1
Primary DNS: 10.0.0.1



tobiastromm -> RE: How i configure ISA SERVER without proxy? (4.Jun.2008 1:01:04 PM)

When I ping a external host, for example
ping google.com.br from internal network, he find ip but don't have a answer...



elmajdal -> RE: How i configure ISA SERVER without proxy? (4.Jun.2008 7:25:29 PM)

quote:

ORIGINAL: tobiastromm
INTERNET:
IP: 192.168.0.4
Gateway: 192.168.0.1
Máscara: 255.255.255.0
Primary DNS: 201.10.120.3
Secondary DNS: 201.10.1.2

LOCAL NETWORK:

IP: 10.0.0.1
Máscara: 255.0.0.0
Gateway: blank
Primary DNS: 10.0.0.1



Never put any DNS Entry on the external NIC  ! remove the ISP DNS Entries from the external NIC.

now on the internal NIC, i can see that the same internal of your ISA Server is set in the DNS Entry , is your ISA Server a DNS Server as well ????

Also you will need to read my article here : Internal DNS Forwarding Through ISA Server 2004/2006
 
 



tobiastromm -> RE: How i configure ISA SERVER without proxy? (4.Jun.2008 9:24:22 PM)

OK. I remove the primary and secondary DNS from INTERNET NIC and the system say "the dns list is empty, now your DNS is the local IP because this machine is a DNS Server"...

Then, the two NIC - Local Network and Internet - receive a localhost for DNS = 127.0.0.1????



HePa -> RE: How i configure ISA SERVER without proxy? (5.Jun.2008 2:07:18 AM)

quote:

ORIGINAL: tobiastromm

OK. I remove the primary and secondary DNS from INTERNET NIC and the system say "the dns list is empty, now your DNS is the local IP because this machine is a DNS Server"...

Then, the two NIC - Local Network and Internet - receive a localhost for DNS = 127.0.0.1????


The comment is explaind because of you configuration as Tarek said.

LOCAL NETWORK:
IP: 10.0.0.1
Máscara: 255.0.0.0
Gateway: blank
Primary DNS: 10.0.0.1

Have you installed the ISA server as a DNS server? It's look like you have installed the ISA server as a DNS server, so the other question is why you chosen that kind of configuration?

It's preferd that you forward external namerasolution queries to a DNS server outside you corporate network. The internal DNS server should be configured with at forwarder for external queries.




elmajdal -> RE: How i configure ISA SERVER without proxy? (5.Jun.2008 5:23:24 AM)

quote:

ORIGINAL: tobiastromm

OK. I remove the primary and secondary DNS from INTERNET NIC and the system say "the dns list is empty, now your DNS is the local IP because this machine is a DNS Server"...

Then, the two NIC - Local Network and Internet - receive a localhost for DNS = 127.0.0.1????



Hi ,

Installing DNS Services is one of the supported configurations.

Check this : http://technet.microsoft.com/en-us/library/cc302550.aspx

HTH,
Tarek



HePa -> RE: How i configure ISA SERVER without proxy? (5.Jun.2008 8:48:01 AM)

Ok, but as the technet article says it a "caching-only DNS" that's the supported of how to intall a DNS server service on a ISA server(?, right?! There is actually diffrent kind of DNS server solutions, and caching-only DNS is only one of those[image]http://forums.isaserver.org/micons/m11.gif[/image]



tobiastromm -> RE: How i configure ISA SERVER without proxy? (5.Jun.2008 11:06:12 AM)

Please!

I'm lost!

I configure my DNS server again with TechNet article and now i receive:

*** Nao e possivel encontrar o nome de servidor para o endereco 10.0.0.1: Non-existent domain
Servidor padrao:  UnKnown
Address:  10.0.0.1

In clients Microsoft Internet explorer find site IP but don't load site.
[image]http://images.orkut.com/orkut/albums3/ATgAAADN1qDqtWxhgOLM7w0XMLaaIz0JiETRcdNtNnSml3nTZGZdpixRgqb8U0o0VoHcZzTEMadbvCZCLMlPrs1cC4dnAJtU9VBrUdlkt1T9Z07rYN4Ong8_22rJaw.jpg[/image]

And when I ping a external host:
[image]http://images.orkut.com/orkut/albums3/ATgAAAAPHDg3UbgvoBUJticdc5C_vjQsTK0mubcNxRW2YjlztJ01KfJWtLBpYc48a6kssm44BT6WDM-rr343LgdBP8dxAJtU9VAg0WB50kGM1YhWRoJpfju3K-IYpA.jpg[/image]

Never change... Where is the problem?



tobiastromm -> RE: How i configure ISA SERVER without proxy? (5.Jun.2008 11:37:56 AM)

Hey... Can you please conect to my remote desktop to look my configuration? Send a message to my e-mail, and i give for you the server name and login/password.



elmajdal -> RE: How i configure ISA SERVER without proxy? (5.Jun.2008 1:44:10 PM)

quote:

ORIGINAL: HePa

Ok, but as the technet article says it a "caching-only DNS" that's the supported of how to intall a DNS server service on a ISA server(?, right?! There is actually diffrent kind of DNS server solutions, and caching-only DNS is only one of those[image]http://forums.isaserver.org/micons/m11.gif[/image]



Hi Hepa,

Do a search on the net and on this site and you will find multiple articles on how to install DNS Server on ISA Server, also other supported services such as DHCP etc ....

As you have said, there are plenty of scenarios and i'm not going to paste the links for each and every scenario



HePa -> RE: How i configure ISA SERVER without proxy? (6.Jun.2008 12:48:06 PM)

quote:

ORIGINAL: elmajdal

quote:

ORIGINAL: HePa

Ok, but as the technet article says it a "caching-only DNS" that's the supported of how to intall a DNS server service on a ISA server(?, right?! There is actually diffrent kind of DNS server solutions, and caching-only DNS is only one of those[image]http://forums.isaserver.org/micons/m11.gif[/image]



Hi Hepa,

Do a search on the net and on this site and you will find multiple articles on how to install DNS Server on ISA Server, also other supported services such as DHCP etc ....

As you have said, there are plenty of scenarios and i'm not going to paste the links for each and every scenario


I will, my question was just if the only DNS-solution was the "caching-only DNS"...because that I've never heard about anything else. Anyway, I'll search for the articles and going to take a look at those.

So it's supported to install a ISA server as a DHCP server, but is it recomended? As I've understod you should place the DHCP service on an other server within your organisation if you have the possibility...but that's not maby true(?).



elmajdal -> RE: How i configure ISA SERVER without proxy? (6.Jun.2008 12:59:07 PM)

Hi Hepa,

If it was up to me, i would always prefer to leave the ISA Server as it should be and treat it only as a Firewall and nothing else.

There are few supported cases and services that can be installed on ISA Server, but its always the fault of the administrator who should not increase the attack surface on his Firewall. users tend to create an open rule such as follows:

Allow > ALL Protocols> From Internal & LocalHost > To Internal & LocalHost > ALL Users which is a NO NO NO !!!



As for the DHCP Article,Check the article here :Configuring the ISA Server Computer as a DHCP Server



before i forget, one of the debatable issue, is installing IIS on ISA Server, well the new TMG will install IIS , as it needs it for SQL Service Reporting, although TMG will install IIS for specific purposes, user should not abuse it and start using it as a Web Server and start to publish website on the Firewall itself.

Here is the blog entry  : http://blogs.isaserver.org/shinder/2008/05/12/tmg-runs-iis-7-is-this-a-security-issue/



HePa -> RE: How i configure ISA SERVER without proxy? (6.Jun.2008 2:01:28 PM)

Hi Tarek,

Exactlly, installing "unecesarry" service on a ISA server increses the attack surface...so I'm also against solutions like those. I actually were about to add that to my comment, and explain why I think it's not a fancy solution. My personal comment is that allways separate services from each other if there posibility and don't install them onto the same server. I hate when I see a DC installed with a SQL database for example (which I've seen several times)...so therefore I'm by nature agains all those solutions with installing multiple services onto a server (which increases the attack surface) and can adventure the server performance, configuration, security etc.

TMG can be installed on a Windows Server 2008 server as I've heard so there is actually some benefits with that. The attack surface is smaller because of the number of installed services and started services by default after the server has been installd. IIS in Windows Server 2008 is hardend and is modulary built, in about 40 modules, and each one which you need on your server needs to be installed...but I understand that there has been a discussion about IIS installed on a Firewall, it don't sound good in my ears anyway if it's running on W2k8 or W2k3.



tobiastromm -> RE: How i configure ISA SERVER without proxy? (6.Jun.2008 5:54:38 PM)

Boys, please... don't fight.

My network is very small. My server is a file server, dhcp server, proxy server, dns server, antivirus server, etc. All services run on this server...

Back to my ploblem... Is not a DNS problem!!! I think i find the problem, something conflict with OfficeScan Personal Firewall. I'am testing and post a result...



elmajdal -> RE: How i configure ISA SERVER without proxy? (7.Jun.2008 2:16:10 AM)

We are not fighting ! These are Web Boards [:D] and its the place to discuss, illustrate, argue and stuff like this .

quote:

My network is very small. My server is a file server, dhcp server, proxy server, dns server, antivirus server, etc. All services run on this server...


So are you creating the rule
quote:

Allow > ALL Protocols> From Internal & LocalHost > To Internal & LocalHost > ALL Users which is a NO NO NO !!!
You are putting all your eggs in one basket, so watch out !

quote:

Back to my ploblem... Is not a DNS problem!!! I think i find the problem, something conflict with OfficeScan Personal Firewall. I'am testing and post a result...  


Keep us updated, thanks



HePa -> RE: How i configure ISA SERVER without proxy? (7.Jun.2008 6:43:00 AM)

I hope you found the problem and as said before, we are not fighting, we are having a discussion. It's interesting to exchange experiance and thoughts of how to do and what to do. As I've learnd during my carrier it's not allways the best configuration just because of the configuration is supported. In some cases, if you have a small network, it may be the only solution to place the most of the services on a handfull number of servers...but thats not a solution that I like but as I said, sometimes there isn't no other solution.

Anyway, I hope the problems is solved for you.



tobiastromm -> RE: How i configure ISA SERVER without proxy? (7.Jun.2008 4:55:35 PM)

Boys, thank you.
My problem is over.
I stop and disable the service OfficeScan Personal Firewall on the server and the problem over. The same service work perfectly on desktops, but not on the server.

Thank you!



elmajdal -> RE: How i configure ISA SERVER without proxy? (7.Jun.2008 5:38:31 PM)

Great , glad that you sorted it out and thanks for the follow up.

By the way, why are installing a firewall on a firewall ?

If it is an Antivirus app, is there any option to disable the firewall part ?



Page: [1] 2   next >   >>