Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

RE: Discussion about article on Publishing OWA using ISA Firewalls

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2004 General ] >> Exchange Publishing >> RE: Discussion about article on Publishing OWA using ISA Firewalls Page: <<   < prev  1 2 [3] 4 5   next >   >>
Login
Message << Older Topic   Newer Topic >>
RE: Discussion about article on Publishing OWA using IS... - 26.Dec.2005 2:49:33 PM   
yba

 

Posts: 12
Joined: 24.May2005
Status: offline 		Hi Tom,
Thank you for the article and the support.
quote:

" the name on the Public tab in the OWA Web Publishing Rule is incorrect"
 
That does not apply in this case.
We have a public domain name (hosted and managed by an IPS) and another internal domain name.  I, now, understand your recommendation of identical internal and external domain names.  But that's a future plan.
We have Exchange 2k3 SP1 on Server 2k3 and ISA 2k4 SP1 on Server 2k3.  Internally, two scenarios:
A - OWA works fine when using the FQDN of the Exchange box.
B - An error that ISA Server has denied access to the specifed URL when using the public name.
For now, I followed the rules in the guide and also modified the HOSTS file (temporarily not using SSL and using Integrated-Windows Authentication instead) but from any external host, the return is the following:
Problem Report
Condition TCP error was detected while attempting to retrieve the URL: 'http://mymailserver.MYCOMPANYNAME.com/exchange'.
Problem Description:  TCP/IP processing failure.
Try RELOADING the page.
This error message means that the target host did not properly respond to HTTP GET request after successfully establishing TCP connection. This may be due to problems like congestion on target host or transmission path.
If this problem persists for extended periods of time, contact your network support team. Please, first make sure that the target is really reachable and not, for example, out of service due to maintenance.
Current GMT Date/Time: Mon, 26 Dec 2005/14:58:53

What is the problem here?
Thanks
Yba

P. S. I forgot to mention that mx records point to our ISA server with a public IP.
Moreover, is there any particular entry in the DNS zone to bind the internal Exchange server IP with to the public name?

< Message edited by yba -- 27.Dec.2005 4:36:37 PM >

(in reply to tshinder)
Post #: 41
RE: Discussion about article on Publishing OWA using IS... - 27.Dec.2005 3:50:24 AM   
christianusaj

 

Posts: 4
Joined: 11.May2005
Status: offline 		Hi, I followed the guide for publishing my OWA with ISA Server 2004 step by step but without any certificates and using standard port 80 for the external web listener. IIS listens on port 81 on the internal interface. With this settings OWA works only from internal network.
When I try to access it from internet I get the login window and after I press on "OK" the browser loads the two frames of OWA 2003, but only the structure, not its contents. In the status bar I can see: "Opening http://128.1.1.100:81/exchange/xxxxxx......" and after a while I get error. That is the address of OWA on internal network. Is obvious that it will never work from internet, but I don't know why is trying to open in this way from internal to external instead of doing the correct routing. I created the hosts file but still get that message.
Thanks for your help

Christian

(in reply to tshinder)
Post #: 42
RE: Discussion about article on Publishing OWA using IS... - 28.Dec.2005 6:57:09 PM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline
quote:

ORIGINAL: yba

Hi Tom,
Thank you for the article and the support.
quote:

" the name on the Public tab in the OWA Web Publishing Rule is incorrect"
 
That does not apply in this case.
We have a public domain name (hosted and managed by an IPS) and another internal domain name.  I, now, understand your recommendation of identical internal and external domain names.  But that's a future plan.
We have Exchange 2k3 SP1 on Server 2k3 and ISA 2k4 SP1 on Server 2k3.  Internally, two scenarios:
A - OWA works fine when using the FQDN of the Exchange box.
B - An error that ISA Server has denied access to the specifed URL when using the public name.
For now, I followed the rules in the guide and also modified the HOSTS file (temporarily not using SSL and using Integrated-Windows Authentication instead) but from any external host, the return is the following:
Problem Report
Condition TCP error was detected while attempting to retrieve the URL: 'http://mymailserver.MYCOMPANYNAME.com/exchange'.
Problem Description:  TCP/IP processing failure.
Try RELOADING the page.
This error message means that the target host did not properly respond to HTTP GET request after successfully establishing TCP connection. This may be due to problems like congestion on target host or transmission path.
If this problem persists for extended periods of time, contact your network support team. Please, first make sure that the target is really reachable and not, for example, out of service due to maintenance.
Current GMT Date/Time: Mon, 26 Dec 2005/14:58:53

What is the problem here?
Thanks
Yba

P. S. I forgot to mention that mx records point to our ISA server with a public IP.
Moreover, is there any particular entry in the DNS zone to bind the internal Exchange server IP with to the public name?


Hi Yba,

I'd need to see the exact configuration of the Web publishing rule, and the IP addressing information on the ISA firewall and Exchange Server.

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to yba)
Post #: 43
RE: Discussion about article on Publishing OWA using IS... - 28.Dec.2005 6:58:03 PM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline
quote:

ORIGINAL: christianusaj

Hi, I followed the guide for publishing my OWA with ISA Server 2004 step by step but without any certificates and using standard port 80 for the external web listener. IIS listens on port 81 on the internal interface. With this settings OWA works only from internal network.
When I try to access it from internet I get the login window and after I press on "OK" the browser loads the two frames of OWA 2003, but only the structure, not its contents. In the status bar I can see: "Opening http://128.1.1.100:81/exchange/xxxxxx......" and after a while I get error. That is the address of OWA on internal network. Is obvious that it will never work from internet, but I don't know why is trying to open in this way from internal to external instead of doing the correct routing. I created the hosts file but still get that message.
Thanks for your help

Christian


Hi Christian,
Exchange on the ISA firewall isn't supported, unless this is an SBS 2003 SP1 configuration.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to christianusaj)
Post #: 44
RE: Discussion about article on Publishing OWA using IS... - 28.Dec.2005 7:52:20 PM   
yba

 

Posts: 12
Joined: 24.May2005
Status: offline 		Dear Tom,
Once again, thank you for your support and thank you for your prompt reply.
It works.  I have not implemented SSL but it works, internally and externally.  Amazingly, to me of course, the only thing that I had to change was the port on the listener and the bridging (no HOSTS modification on ISA box.)  It refused to work on port 80 (the same return as in my previous message.) But, when I used port 81 instead, it worked perfectly.
Now, step two (I pray that there are no sniffers installed on any part of my network) is to enforce security.
If I clearly understood your article, I have two reservations:
1 - We need to modify the HOSTS file on the client machine, which might be a PC in a hotel's business center, and
2 - We must install the same certificate on the client machine (this is why I believe we published the enrolment site), which, again, might be a PC in a hotel's business center.
If that's right, then the only practical way of using secure OWA is from one's own laptop, which will be no hassel making these two preparation steps.
The reason for this debate is to ask you for a short-cut so to enforce security for road warriors with minimal hassel on third party PC's.
Besides, does FBA provide any sort of encryption or I may have to abandon external OWA till security is enforced?
And before I forget, thank you once more.
Regards
Yba

P. S. I have a trial version on Exchange 2k3 SP1. Do you know why only the first three users to use OWA are internally (I have not tried it externally) allowed access?  Everyone else is denied access.

< Message edited by yba -- 28.Dec.2005 8:00:35 PM >

(in reply to tshinder)
Post #: 45
RE: Discussion about article on Publishing OWA using IS... - 29.Dec.2005 5:48:00 AM   
christianusaj

 

Posts: 4
Joined: 11.May2005
Status: offline 		Ok, it's not a good thing to know that I can not publish my owa in the easy way.
But, if I'm using exchange 2003 and isa server 2004 on the same machine, how can I publish OWA??? Is there any way?

Thanks
Christian

(in reply to tshinder)
Post #: 46
RE: Discussion about article on Publishing OWA using IS... - 29.Dec.2005 3:40:38 PM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline
quote:

ORIGINAL: yba

Dear Tom,
Once again, thank you for your support and thank you for your prompt reply.
It works.  I have not implemented SSL but it works, internally and externally.  Amazingly, to me of course, the only thing that I had to change was the port on the listener and the bridging (no HOSTS modification on ISA box.)  It refused to work on port 80 (the same return as in my previous message.) But, when I used port 81 instead, it worked perfectly.
Now, step two (I pray that there are no sniffers installed on any part of my network) is to enforce security.
If I clearly understood your article, I have two reservations:
1 - We need to modify the HOSTS file on the client machine, which might be a PC in a hotel's business center, and
2 - We must install the same certificate on the client machine (this is why I believe we published the enrolment site), which, again, might be a PC in a hotel's business center.
If that's right, then the only practical way of using secure OWA is from one's own laptop, which will be no hassel making these two preparation steps.
The reason for this debate is to ask you for a short-cut so to enforce security for road warriors with minimal hassel on third party PC's.
Besides, does FBA provide any sort of encryption or I may have to abandon external OWA till security is enforced?
And before I forget, thank you once more.
Regards
Yba

P. S. I have a trial version on Exchange 2k3 SP1. Do you know why only the first three users to use OWA are internally (I have not tried it externally) allowed access?  Everyone else is denied access.


Hi YBA,

No, none of this is true. You do not need to manipulate the HOSTS file on the client. Read the article again, you'll see that we use a HOSTS file only because in the lab envirnonment, we have not yet deployed the public DNS entries. You'll see that I state that you need to implement your public DNS entries before the clients can connect.

Also, you do not install a server certificate on the clients. You need to install the CA certificate on the clients, which is standard practice for any PKI deployment. If you don't want to do this, you can install a commercial Web site certificate on the ISA firewall instead of creating your own, however, its pretty simple to allow users to get the CA certificate. You can use autoenrollment too, on your managed machines.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to yba)
Post #: 47
RE: Discussion about article on Publishing OWA using IS... - 29.Dec.2005 10:16:01 PM   
yba

 

Posts: 12
Joined: 24.May2005
Status: offline 		Hi Tom,
Relative to certificates, what happens when I logon to my email account at hotmail, for instance.  As you know, the request is redirected to SSL connection without my intervention.  Can you explain the process please in perspective of establishing an SSL transmission channel with any new client machine.
The reason why I'm asking this is that, after all, installing a CA is not an easy job. And, having the external client machine access my OWA site without any hassel, so far, does not seem as easy as pubilshing the OWA itself (please let me know if you have written any article on certificates issuance.)
Or, easiest of all, is it enough to use any other authentication means, apart from FBA, which uses encryption?
Thanks
Yba
P. S. I still need to know if FBA provides encryption.  Or, if you heppen to know, please advise of where can I find more about FBA.

< Message edited by yba -- 29.Dec.2005 10:18:28 PM >

(in reply to tshinder)
Post #: 48
RE: Discussion about article on Publishing OWA using IS... - 31.Dec.2005 5:56:19 PM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi YBA,

The Hotmail log on process is quite different, as they redirect you to an SSL site for the passport.net log on, then send you back to an unencrypted site for the email access.

This works becuase MS has included their CA certificate in all Windows OS machine certificate stores, so you don't need to add it. If you buy a commercial certificate from Verisign, then you want need to install their CA certificate, because its already installed. But that costs a lot of dough and you don't need it if you're doing this just for your own company.

Installing a CA is pretty easy -- just run the install from Add/Remove Programs. There is tons of guidence on this site on how to do it. I can setup an enterprise CA and get autoenrollment working in less than ten mintues, and I don't have to do anything fancy.

FBA does NOT use encryption. Its not even encoded. If you run a sniffer, you'll see the client sends credentials in free text, very easy to read and you don't even have to worry about decoding it, like with basic (not that that is hard, either). The ISA firewall then converts the free text credentials into Basic credentials when it forwards the credentails to the published Web site.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to yba)
Post #: 49
RE: Discussion about article on Publishing OWA using IS... - 31.Dec.2005 6:53:21 PM   
yba

 

Posts: 12
Joined: 24.May2005
Status: offline 		Hi Tom,
I have one more little inquiry please, can you continue this superb work you are doing in these MBs?
I'm grateful.
Regards
Yba

(in reply to tshinder)
Post #: 50
RE: Discussion about article on Publishing OWA using IS... - 1.Jan.2006 4:36:56 PM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi YBA,

Ha! You bet :)

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to yba)
Post #: 51
RE: Discussion about article on Publishing OWA using IS... - 1.Jan.2006 5:33:51 PM   
yba

 

Posts: 12
Joined: 24.May2005
Status: offline 		Hi Tom,
Happy new year.
I've downloaded some articles from the site on certificates.
Can you please elaborate on what exactly happens when I type my OWA site in any external browser and then key in my credientials.
Will it ask me (while sitting at the external machine) to allow the download of a certificate from my at-the-other-end ISA server and whether I want to always trust content from my www.myisaserver.com?
Thanks
Yba

(in reply to tshinder)
Post #: 52
RE: Discussion about article on Publishing OWA using IS... - 2.Jan.2006 3:26:44 PM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi Yba,

If the client machine doesn't have the CA certificate of the CA that issued the Web site certificate bound to the Web listener in on the ISA firewall, then the user will see a dialog box indicating that his computer does not trust the site and would they like to continue. I don't believe they will be able to install this CA certificate in the correct place at this point -- they will need to install it either through the Web enrollment site, or via autoenrollment, if the clients are domain members.

The key here is to install the CA's certificate in the client machine's Trusted Root Certification Authorities machine certificate store. Not the user store or the service store, but local computer/machine store.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to yba)
Post #: 53
RE: Discussion about article on Publishing OWA using IS... - 3.Jan.2006 5:18:20 PM   
yba

 

Posts: 12
Joined: 24.May2005
Status: offline 		Hi Tom,
If I got the whole picture, then it is practically annoying to use SSL from a non-domain member PC.
If so, is there a unique folder path that I can give my remote users (with no laptops or persnal PCs) so to allow the installation of the CA certificate and the certificate in proper place in the machine store?  OR, if ISA-to-client session can support Windows-integrated authentication and the latter provides even minimal coding or encryption of credinitals, why not using WIA? 
Thanks
Yba

(in reply to tshinder)
Post #: 54
RE: Discussion about article on Publishing OWA using IS... - 4.Jan.2006 5:50:50 AM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi YBA,

You don't need to authenticate or prove your identity in any way to use a CA certificate or install it in the machine certificate store on the client system. You could email the CA certificate to the users and provide them simple instructions on how to install it on their machines. They need to log on as local admins, but after that, they can follow a simple to follow step by step, complete with pictures, as I've done in the deployment kits and in many of the articles on this site.

So, no need for them to connect to the CA to get the CA certificate. They just need to install it on their own machine.

HTH,
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to yba)
Post #: 55
RE: Discussion about article on Publishing OWA using IS... - 12.Jan.2006 9:30:11 PM   
stoppen

 

Posts: 1
Joined: 12.Jan.2006
Status: offline 		Hello Tom,

Thanks for the article. I followed the steps but it won't work. When I go to https://webmail.mycompany.nl/exchange/ I first get the Securtity warning and then:

The page cannot be displayed
Error Code: 500 Internal Server Error. The network logon failed. (1790)

Any ideas what goes wrong? ISA 2004 on Windows 2000 Server, Exchange 2003 on Windows 2000 Server too.

(in reply to yba)
Post #: 56
RE: Discussion about article on Publishing OWA using IS... - 13.Jan.2006 3:18:05 PM   
jeremie_ingram

 

Posts: 13
Joined: 3.Nov.2005
From: Wheaton, IL
Status: offline 		Tom,

First off thanks for all of the great information. I have used the guide and now have both my OWA and a secure website up and running. I took liberty with the directions in order to conform them more towards my situation (single network adapter), but all is well now. I was wondering if you were planning to offer up similar informative articles for using the ISA server in this situation. Most articles I read for ISA are focused more towards the front end firewall scenario, and when a newbie such as me reviews them for setting up a reverse proxy it can be a bit confusing.

I had implemented most of my settings step-by-step from your guide, and found it to be very accurate and informative. Since ISA has a variety of templates that can be used, could there be sidebars on the variances between them and the configurations given?

On one note, in the single network adapter mode, I couldn’t get it to work remotely until I changed the listener to INTERNAL networks. Once I made the change, everything worked fine and we established connectivity. Since we have the Wildcard SSL, additional publishing’s were a snap.

Thanks a million Tom, keep up the outstanding work.
 


_____________________________

~ In search of knowledge ~

(in reply to stoppen)
Post #: 57
RE: Discussion about article on Publishing OWA using IS... - 16.Jan.2006 3:27:25 PM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi Jeremie,

Thanks!

Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to jeremie_ingram)
Post #: 58
RE: Discussion about article on Publishing OWA using IS... - 16.Jan.2006 3:38:31 PM   
tshinder

 

Posts: 47490
Joined: 10.Jan.2001
From: Texas
Status: offline
quote:

ORIGINAL: stoppen

Hello Tom,

Thanks for the article. I followed the steps but it won't work. When I go to https://webmail.mycompany.nl/exchange/ I first get the Securtity warning and then:

The page cannot be displayed
Error Code: 500 Internal Server Error. The network logon failed. (1790)

Any ideas what goes wrong? ISA 2004 on Windows 2000 Server, Exchange 2003 on Windows 2000 Server too.


Hi Stoppen,

Is the ISA firewall a domain member and correctly communicating with the DCs?

Thanks!
Tom

_____________________________

Thomas W Shinder, M.D.
Sr. Consultant/Technical Writer
Prowess Consulting http://www.prowessconsulting.com/
Blog: http://blogs.isaserver.org/shinder/

GET THE NEW ISA 2006 Book!: http://tinyurl.com/2gpoo8

(in reply to stoppen)
Post #: 59
RE: Discussion about article on Publishing OWA using IS... - 20.Jan.2006 2:35:00 AM   
jle2005

 

Posts: 33
Joined: 19.Jan.2006
Status: offline 		Hi Tom,

After following your article on Publishing OWA using ISA Firewalls, I was able letting my external client to access my Exchange Mail Server by Form Based Authentication. However, I've been strugling about letting internal client to access my Exchange mail server by Form Base Authentication and I don't know what I have done wrong. Below is my server configuration;

a. mail.mydomain.com ( domain controller with DNS)
b. isa04.mydomain.com (ISA Firewall Server with two nicks, 1 for internal and 1 for external, and it's join to the domain), Internal Nick is setup with 192.168.0.x, subnet 255.255.255.0, dns point to the domain controller with no default gateway. External Nick is setup with public IP address, default gateway and DNS  all static IP addresses which obtain from ISP.
c. mail.mydomain.com and internal client are setup with SecureNAT Client
d. internal client cannot access Exchange server by public name https://mail.mydomain.com/exchange, external client does.

Please point me to the right direction on how to fix this and thank you very much for your time.

(in reply to MrKill)
Post #: 60

Page:   <<   < prev  1 2 [3] 4 5   next >   >> << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2004 General ] >> Exchange Publishing >> RE: Discussion about article on Publishing OWA using ISA Firewalls Page: <<   < prev  1 2 [3] 4 5   next >   >>
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts