Is it possible for my remote pc to monitor the ISA? (Full Version)

All Forums >> [ISA Server 2004 Firewall] >> Management



Message

finbom -> Is it possible for my remote pc to monitor the ISA? (22.Jun.2005 6:51:00 AM)

Hi everyone!
I have this problem that keeps me awake..
I have a server running a monitor utility (WhatsUp Pro) that is supposed to check the status on the ISA NT-services.

Problem is that the ISA refuse to let the server see the services.
First I tried to shutdown the firewall completely, just to see that I was doing right.. and that worked.
And now I have tried to create several firewall-rules that include tha isa and monitor-server as source/destinations.
I have tried "all outgoing", created own rules, disabled all RPC-filteing, Included the remote server as a magagement-machine.. nothing works.

I used the ISA-logging to monitor whats traffic that is used and all it says is secure-nat and RPC(135).

Has anyone any ideas on whats to try?

Regards, Magnus Finbom



trung -> RE: Is it possible for my remote pc to monitor the ISA? (22.Jun.2005 8:01:00 AM)

Hi Magnus,

can you try to create an "all outbound" rule, In the rule, specify your Management server as Source, Dest. is Localhost.



trung -> RE: Is it possible for my remote pc to monitor the ISA? (22.Jun.2005 8:04:00 AM)

Hi Magnus,

can you try to create an "all outbound" rule, In the rule, specify your Management server as Source, Dest. is Localhost.



finbom -> RE: Is it possible for my remote pc to monitor the ISA? (22.Jun.2005 8:12:00 AM)

Hello! Thanks for replying.
I have done that test several times, both with and without rpc-filtering on the rule. The rule is on top.

I just cant figure out how to let this remote server comminucate on all possible ports with all kind of traffic, or at least why the "all outbound" cant work.

Regards, Magnus Finbom



trung -> RE: Is it possible for my remote pc to monitor the ISA? (22.Jun.2005 8:32:00 AM)

Hi Magnus,

You can try to create an rule with "seleted protocols", then try to add the RDP (3389) to the list. You can see the protocols in Protocols/Remote Terminal at the right side.



trung -> RE: Is it possible for my remote pc to monitor the ISA? (22.Jun.2005 8:33:00 AM)

Hi Magnus,

You can try to create a rule with "seleted protocols", then try to add the RDP (3389) to the list. You can see the protocols in Protocols/Remote Terminal at the right side. Or you can use Logging feature in ISA console to observe the communication between your management server and ISA server when the "all outbound" is applied.



finbom -> RE: Is it possible for my remote pc to monitor the ISA? (22.Jun.2005 9:43:00 AM)

Hello again!

First it is not RDP but RCP im fooling around with. :-)

I have used the ISA-logging with a filter and when accessing from the remote server it says PORT: 135 and protokoll: RPC(All interfaces).

But even if I create a rule allowing that protokoll on port 135 the problem remains.. Really anoying. :-/

Regards, Magnus Finbom



finbom -> RE: Is it possible for my remote pc to monitor the ISA? (23.Jun.2005 6:05:00 AM)

Hello!

A breakthrough...

I found out that if I connect from the remote server with the local administrator-account it works just fine.
But I cant use my domain admin-account... Can anyone explain this? My domain account is member of the local admin-group.

wierd..

Regards, Magnus Finbom



Rickymag -> RE: Is it possible for my remote pc to monitor the ISA? (26.Jun.2005 9:36:00 AM)

Hello Finbom,

It sounds like you do not have access privileges to access what you want to though the rules that you have setup. The best way to test and verify what exactly is happening is to review the live logs as they are streaming though.

You can do this under monitoring. the fact that it is working with the local admin account indicates that that account is allowed though.

HTH

RM



stevea-uk -> RE: Is it possible for my remote pc to monitor the ISA? (15.Aug.2005 8:22:00 AM)

got it working.......
stupid error on my part... having looked at this for days it was a routing problem between the 184 & 190 range to the Internal network card - added 2 persistant routes and hey presto!
[Cool]

Thanks for your help.

Steve



stevea-uk -> RE: Is it possible for my remote pc to monitor the ISA? (15.Aug.2005 8:23:00 AM)

sorry - having bad day - posted reply to wrong message - will try again!



ClintD -> RE: Is it possible for my remote pc to monitor the ISA? (15.Aug.2005 10:05:00 AM)

Run the delegation wizard in the ISA console to allow your domain account ISA Server Full Administrator permissions.

The "Administration Delegation" option is available when you right click the %ServerName% icon.

I've monkied with mine so I can recall what the defaults are - even if the local Administrators group is in there, I'd add you domain account explicitly to see if it makes a difference.



Page: [1]