quote:

---

Originally posted by Mark Hodges:
I think I figured it out...

As I was going down through the article again to see why at the top they tell you to leave the ISA server part of the domain, but then have you add users to the config from the domain (which means it has to be part of the domain). The single document is 511 pages, but it doesn't really build upon itself from section to section.

The part of about adding the users was in a completely different section...I didn't notice that as I scrolled down the pages setting up the environment that I must have someone how jumped a couple sections down...and when I scrolled a couple pages to find where I was in the setup, I actually used the lab setup section from a different area....

Guess thats what happens when you are playing with your virtual lab in the middle of the night

Later on I also read another article you wrote about how it doesn't actually matter if its not on your domain anyhow..as soon as that box is compromised you are 0wnp3d anyhow...

One question I do have though...I have a virtual lab setup and on the Local network I have an edge ISA server providing PPTP site - site tunnels with a Windows 2000 server at a Remote Branch office location (to allow client machine the ability to use Exchange mode in Outlook through the tunnel) which works great...

I also then wanted the ability to vpn into the local network to access resources using pptp. When I enabled client VPN access and try to dial in it gives me the following error:

Error 913: A Remote Access Client attempted to connect over a port that was reserved for Routers only.

So ISA server will not allow you to create a Remote Site and authenticate incoming PPTP clients as well?

---

Hi Mark,

You must be referring to the VPN Deployment Guide on the MS site. I did that doc, and I was disappointed that they decided to make it a single doc, since it was designed to be a collection of docs that should be independent from one another, with a common config scenario that is covered in one of the earlier docs in the series. I agree that making it so long, and putting on the independent docs into a single doc isn't the best way to present the material.

You are correct. The best way to go is to make the ISA firewall a member of the domain. If your firewall is oWN0rErd to the extent where they might leverage in some way the firewall's domain membership, you're fux0red in the same way as if the machine weren't a member of the domain

The ISA firewall can be a site to site VPN gateway and a remote access VPN server. Is that the issue you're running into now?

Thanks!
Tom

(in reply to tshinder)

quote:

---

Originally posted by P. Dijkman:
Hi Tom,

I posted my problem earlier...
http://forums.isaserver.org/ultimatebb.cgi?ubb=get_topic;f=30;t=000386
And yes i followed this great article to.
The only question i have is why the DHCP Relay Agent is not supported on the ISA Server itself.
I still haven't found a sollution to this problem.

Could you help me this one??

Kind Regards,
P. Dijkman

---

quote:

---

Originally posted by cpaulw:
Hi Tom,

The problem I am struggling with is that I am using a certificate purchased brom Verisign. I do not have a CA. I am not sure how to use this certificate although it is an all purpose certificate. I have imported it into personal as well as Root certificates and tried .cer as well as PKCS#7 with the whole chain.

PPTP works fine but I get a error 789 on the client with an event 547 IKE SA negotiation failed on the ISA server's security log.

I have tried to chose the right sections from this article but I either have another problem or chose the wrong ones.

I do not have a "Administrator" certificate only one for the site.

Thanks,

PaulW

---

quote:

---

Originally posted by Mark Hodges:
I think I figured it out...

As I was going down through the article again to see why at the top they tell you to leave the ISA server part of the domain, but then have you add users to the config from the domain (which means it has to be part of the domain). The single document is 511 pages, but it doesn't really build upon itself from section to section.

The part of about adding the users was in a completely different section...I didn't notice that as I scrolled down the pages setting up the environment that I must have someone how jumped a couple sections down...and when I scrolled a couple pages to find where I was in the setup, I actually used the lab setup section from a different area....

Guess thats what happens when you are playing with your virtual lab in the middle of the night

Later on I also read another article you wrote about how it doesn't actually matter if its not on your domain anyhow..as soon as that box is compromised you are 0wnp3d anyhow...

One question I do have though...I have a virtual lab setup and on the Local network I have an edge ISA server providing PPTP site - site tunnels with a Windows 2000 server at a Remote Branch office location (to allow client machine the ability to use Exchange mode in Outlook through the tunnel) which works great...

I also then wanted the ability to vpn into the local network to access resources using pptp. When I enabled client VPN access and try to dial in it gives me the following error:

Error 913: A Remote Access Client attempted to connect over a port that was reserved for Routers only.

So ISA server will not allow you to create a Remote Site and authenticate incoming PPTP clients as well?

---

quote:

---

Originally posted by Nobbyness:
Tom, just one comment on the VPN doc on the MS site - it would be real nice if they'd put pages numbers on it properly. I share your comment about wishing it hadn't all been wrapped into one, but if it must then at least it can be done right.

I killed a tree printing off all 511 pages (one of those tactile types, y'know?) and then my 2yr old decided to help daddy out by knocking the stack on the floor.

Otherwise a very useable and well thought out doc. Thanks for all the time and effort you put into it.

---

Hi Nob,

Thanks!


Tom

(in reply to tshinder)