Changing IP Address (Full Version)

All Forums >> [ISA 2006 Publishing] >> Exchange Publishing



Message

teejayuu -> Changing IP Address (30.Jun.2008 5:59:44 AM)

Hi

I currently have OWA working through a Linux/ADSL server into an Exchange 2003 backend server (no frontend).  mail.domain.org.uk - ip88.xxx.xxx.xxx

I can access this by typing https://88.xxx.xxx.xxx/exchange and https://mail.domain.org.uk/exchange

I also have ISA Server 2006 with a leased line - ip address 81.xxx.xxx.xxx.  Before I change mail.domain.org.uk to the new ip address I am wanting to test it through the leased line.  I have installed the mail.domain certificate on the ISA Server and disabled FBA on Exchange.

However if I go to https://81.xxx.xxx.xxx/exchange I get the security warning, but if I click Continue to this wesite (not recommended) I get a
quote:

Error Code: 403 Forbidden. The server denied the specified Uniform Resource Locator (URL).

Have I overlooked something obvious?

I want to use the IP address as a backup way of getting in, should the change of IP address not go smoothly.

Thanks
TJ



teejayuu -> RE: Changing IP Address (30.Jun.2008 6:33:25 AM)

Hi

Have made progress, added the new public IP address to the public name tab and have got rid of the 403 error.  I now have
quote:

Error Code: 500 Internal Server Error. The certificate chain was issued by an authority that is not trusted. (-2146893019)
.

Does the certificate on ISA have to be the same as waht the user enters i.e.  The current certificate is for mail.domain.org.uk, but the user enters http://81.xxx.xxx.xxx/exchange?

TJ



paulo.oliveira -> RE: Changing IP Address (30.Jun.2008 9:01:48 AM)

Hi TJ,

below are the answers.

quote:

Error Code: 500 Internal Server Error. The certificate chain was issued by an authority that is not trusted. (-2146893019)

You have to add the certificate in the local computer store of ISA machine. To do this follow this steps: open the mmc of certificates and choose computer account. Import the certificate with the private key (do not choose the option to mark it as exportable) to Trusted root Certificate Authority.

quote:

Does the certificate on ISA have to be the same as waht the user enters i.e.  The current certificate is for mail.domain.org.uk, but the user enters http://81.xxx.xxx.xxx/exchange?

It must be the same as the Public Name tab.

Regards,
Paulo Oliveira.



teejayuu -> RE: Changing IP Address (30.Jun.2008 9:06:44 AM)

Hi Paulo

Thanks for coming back to me - I have imported certificates for both mail.domain.org.uk and 81.xxx.xxx.xxx and also have both in the Public Name.  Removing one or the other (certificates and in Public Name tab) makes no difference - I still get the same error.

Any other ideas?

TJ



paulo.oliveira -> RE: Changing IP Address (30.Jun.2008 9:18:38 AM)

Hi TJ,

are you using HTTPS bridging?

Regards,
Paulo Oliveira.



teejayuu -> RE: Changing IP Address (30.Jun.2008 9:28:24 AM)

Not that I'm aware of - I've seen the tab but haven't done anything with it.  I'm quite new to ISAServer and using ISAServer 2006 Unleashed as my guide - and of course the good people at isaserver.org
TJ



paulo.oliveira -> RE: Changing IP Address (30.Jun.2008 10:12:10 AM)

Hi TJ,

in the bridging tab check what type of connection is marked for the web server.

Other question, what´s the certificate used for the IIS of your exchange server? Is only allowing https connections?

Regards,
Paulo Oliveira.



teejayuu -> RE: Changing IP Address (30.Jun.2008 10:19:41 AM)

The Bridging tab is ticked for Redirect requests to SSL port 443.

Yes certificate is only used for IIS of Exchange - not sure if it is just for HTTPS.  How would I check?
TJ



paulo.oliveira -> RE: Changing IP Address (30.Jun.2008 10:35:38 AM)

Hi,

quote:

The Bridging tab is ticked for Redirect requests to SSL port 443.

Good! You´re using https bridging. You have to import the certificate that exchange server is using in IIS into the Trusted root Certificate Authority as I posted before.
quote:

Yes certificate is only used for IIS of Exchange - not sure if it is just for HTTPS.  How would I check?

Open the IIS snap-in manager expand your_server_name - expand Default website - right click on Exchange - properties - Security Directory tab - click the edit button and see if the chemark is placed in Require secure channel (SSL). If it is, the only way your users to connect to OWA is via https.

Regards,
Paulo Oliveira.



teejayuu -> RE: Changing IP Address (30.Jun.2008 10:38:52 AM)

Hi Paulo

All that is in place - IIS shows as using SSL on Exchange and the certificate has been imported into ISA.

Thanks
TJ



paulo.oliveira -> RE: Changing IP Address (30.Jun.2008 10:54:05 AM)

Hi

hummmm... you have to keep in mind that when you are using https bridging you have to use two certificates, one for the web listener and the other for the communication between ISA and the exchange server.

All this certificates that you imported into ISA have the private key? I mean, ISA is reconizing as valid certificate? [8|]

Regards,
Paulo Oliveira.



teejayuu -> RE: Changing IP Address (30.Jun.2008 11:00:22 AM)

Hi Paulo

quote:

hummmm... you have to keep in mind that when you are using https bridging you have to use two certificates, one for the web listener and the other for the communication between ISA and the exchange server. 


2 certificates or the same certificate in 2 places?  I only have 1 active certificate -mail.domain.org.uk (88.xxx.xxx.xxx).  I have tried a 2nd that points to our leased line public IP 81.xxx.xxx.xxx as I want to test the route before changing the MX records to this IP

TJ



paulo.oliveira -> RE: Changing IP Address (30.Jun.2008 11:59:11 AM)

Hi TJ,

it depends on your DNS configuration. If you use a split DNS infra-structure, then 1 certificate is fine for you, else, you have to use two, one for internal communication (ISA <--> exchange) and the other for external (Internet <--> ISA web listener).

Regards,
Paulo Oliveira.



teejayuu -> RE: Changing IP Address (1.Jul.2008 2:56:54 AM)

Hi Paulo

Not sure what you mean by split DNS.  If you mean domain.local (internal) domain.org.uk (public) then we don't, we use domain.org.uk internally and publicly.  Internally, if we use OWA, we access via https://server/exchange and externally https://mail.domain.org.uk/exchange.  We have only ever used a mail.domain.org.uk certificate.  This is installed on Exchange server IIS and the web listener.  If I need 2 certificates, what do they need to contain, I use SelfSSL to create my certificates

TJ



paulo.oliveira -> RE: Changing IP Address (1.Jul.2008 4:37:22 PM)

Hi,

split DNS is when your internal DNS domain name is the same of your external DNS. Therefore, you have a split DNS infra-structure. [:D]
If your internal DNS server has an A record named mail pointing to the private ip of your exchange server, then you will be able to connect OWA internally using https://mail.domain.org.uk/exchange. This approach is to make your users life easier, cause they just have to memorize one address instead of two. [;)]

Since, thi case you´re testing using and IP address instead of your real domain name you need to import both certificate to ISA trusted store. Did you already import both certificates to ISA server? I mean, the one used in IIS and the new one that you created for the web listener (from the leased line IP).

Regards,
Paulo Oliveira.



teejayuu -> RE: Changing IP Address (2.Jul.2008 7:10:33 AM)

Ok... I now have an A record named mail that points to the exchange server's private IP and (not that I didn't believe you) it works.  User can access OWA internally by pointing their browers at https://mail.domain.org.uk/exchange[;)]

I have imported the mail.domain.org.uk cert from IIS and into ISA.  I had put it on the Web listener, but from your post I assume that is not correct.
quote:

... and the new one that you created for the web listener (from the leased line IP).
Do you mean I need to create a different cert for the listener?  Would I need to create it on the ISA server?  What would it be called - 81.xxx.xxx.xxx? 

Also would I need to change the weblistener password when I change the MX records to point at the leased line

Thanks
TJ



paulo.oliveira -> RE: Changing IP Address (2.Jul.2008 8:44:31 AM)

Hi TJ,


quote:

Do you mean I need to create a different cert for the listener?

Yes!
quote:

Would I need to create it on the ISA server?  What would it be called - 81.xxx.xxx.xxx?

No, you don´t need to create it on ISA. You can use selfssl as you mentioned before. The name of this certificate is the name of the future published webserver. I mean, the name that you put into the Public Name tab. It must not be the name of original owa (mail.domain.org.uk). [;)]
quote:

Also would I need to change the weblistener password when I change the MX records to point at the leased line

Did not get that. What do you mean? [8|]

Regards,
Paulo Oliveira.



teejayuu -> RE: Changing IP Address (2.Jul.2008 8:54:01 AM)

Hi Paulo
quote:

It must not be the name of original owa (mail.domain.org.uk).

so maybe owa.domain.org.uk or 81.xxx.xxx.xxx?

Thanks
TJ



paulo.oliveira -> RE: Changing IP Address (2.Jul.2008 11:34:30 AM)

Hi TJ,

yes, that´s rigth. But I advice you to use a DNS name. I never tried to create a certificate with an IP address. [8|]

Remember, this will be the certificate for the web listener, but you´ll need to import both certificates in ISA computer trusted store.

Regards,
Paulo Oliveira.



teejayuu -> RE: Changing IP Address (3.Jul.2008 3:23:38 AM)

Thanks Paulo

Will try that.  Am on annual leave for a week now so I will let you know when I get back

TJ



Page: [1] 2   next >   >>