Since there are a couple of users how have (had) the same problem as me (running TrendMicro's InterScan WebSecurity Suite and ISA 2004 on the same box), I think it might be helpful for one to know one working solution.
Scenario:
ISA is listening on port 8082 for incoming web proxy requests. Each user has to authenticate against AD to get Internet access and enforce the rules to be applied. After a successful authentication, ISA forwards the requests to IWSS (port 8084), which retrieves the URL directly via a leased line.
Small howto:
1) Configure ISA and IWSS to your needs. 2) Set up ISA to listen on port 8082 and IWSS on port 8084. 3) Create a rule that allows LocalHost to LocalHost traffic for all the protocols users may use, condition "All Users". 4) Create a rule that allows Internal to External traffic (choose correct protocols, users,...). 5) Remove the Web Proxy Filter from all (!) protocols you mentioned in the two rules. 6) Create a web chaining rule with the following properties: - Action: Redirect them to a specified upsteam server and set <localhost>:8084 for IWSS. Disable automated polling for configuration. - To: External - Bridging: HTTP requests as HTTP requests and SSL requests as HTTP requests.
That's it.
This works fine for me on several boxes, but: no warranty at all. :-)
If you have any suggestions, problems or improvements, feel free to contact me.
Hi Msillman, I have ISA and IWSS working in same machine , i configure it as you menstioned, every thing work fine except any https sites not workig , i get message : Network Access Message: The page cannot be displayed Technical Information (for Support personnel)
when i log ISA monitor i get this meesage Failed Connection Attempt Log type: Web Proxy (Forward) Status: 0x80002f79 Rule: Web Access Only Source: Internal ( 10.10.21.71:0) Destination: External ( 172.32.1.34:8888) Request: www.google.com:443 Filter information: Req ID: 0afc2009 Protocol: SSL-tunneli tried for days but failed ..
Where does port 8888 come into play? ISA only allows SSL over 443 unless you change it. The best way is to use Jim Harrison's site : http://isatools.org/tools.asp?Context=ISA2004 and use the ISA TRPE utility. It allows you to use SSL over ports other than 443. It does restart the firewal lservice when you apply yhe change, though.
this port used for chain proxy ( IWSS 2.5) installed in the same box with ISA as mentined in the artical .. it's working fine for every thing except any HTTPS site..
Posts: 21
Joined: 13.Mar.2001
From: Clifton Springs, Vic, Australia
Status: offline
Hi Maik,
I know this thread is a little old, but to get this working did you need to have the firewall client installed?
It is just that you turn off the web proxy filter and if you set authentication on the rules the browsing fails. If I set the rule to All Users the browsing works.
And what is the reason for a localhost to localhost rule? It looks to me that you don't need rules to access services on the firewall if you are already on the firewall. I used telnet as an example.
|
My Subscription |
My Forums |
Address Book |
Member List |
Search |
FAQ |
Ticket List |
Log Out
Printable Version
All Forums >> [ISA Server 2004 Misc.] >> 3rd Party Add-ons >> A Solution for ISA 2004 SP1 + TrendMicro IWSS on the same Box 
A Solution for ISA 2004 SP1 + TrendMicro IWSS on the sa... - 
RE: A Solution for ISA 2004 SP1 + TrendMicro IWSS on th... - 
New Messages
No New Messages
Hot Topic w/ New Messages
Hot Topic w/o New Messages
Locked w/ New Messages
Locked w/o New Messages
Post New Thread