ISA Server and OSX

[game_over]

I'm having a nightmare with ISA server and OSX. After googling i can see there are known issues but nothing seems to fix my problems.

I only really care about access to HTTP, HTTPS and FTP.

In network prefs page in go to proxies and have entered the correct settings: firewall:8080 username domain\username and then password.

HTTP works fine.

I entered the same info for HTTPS and only some websites work. why is this?

For example, https://mail.gmail.com works flawlessly. https://olb2.nationet.com (online banking) doesn't work at all. It just loads for about 5-10 mins then hangs.

FTP doesn't work at all. It just times out.

Any ideas?

----

I read i should configure OSX and a SecureNAT client by putting the Router (default gateway) as the IP of the FIREWALL SERVER. In this case it's 192.168.16.4, and then unticking 'all must authenticate' on ISA. This doesn't work at all, but we have a complicated structure. i can't actually ping 192.168.16.4 from my workstation, if i wanted to access the firewall directly i would be required to login to the server.

network layout:

Workstation (192.168.16.X) -> Server (192.168.16.2) -> ISA Firewall (192.168.16.4) -> Internet (10.83.112.10)

I think the firewall is hidden behind the server, so i can't connect to it unless i'm at the server level. Even though, we connect to 'firewall' proxy, so maybe there is a way?

If this rules out SecureNAT what other ways can i try and allow authentication to the server as the Firewall Proxy is windows software only.

[game_over]

I managed to get HTTPS working by using the following settings:

IP: 192.168.16.9

Subnet: 255.255.252.0

Router: 10.83.112.1

DNS Server: 192.168.16.2

I can now access all HTTPS websites, but FTP still won't work

[+BudMan MVC]

So your behind a double nat - and your wondering why your having issues? Your ISA firewall should have a PUBLIC address on internet facing interface.

Confused about how your drawing a server between you and the ISA firewall?

Also its impossible for your router/gateway to be on a different segment than your inteface is on -- how exactly do you expect the packets to get there?? I don't know about OS X, but windows is smart enough to warn you of this. Your gateway is used to send packets to different network, so to talk to it it has to be on the same network your interface is on.. So how would your machine on the 192 send traffic to a 10 network when its on a different network??

I am confused by your drawing for sure.. you have server inline with your isa firewall -- are they all connected to a switch and you just didn't draw it that way? Are you running the 10 network on the same physical wires as the 192 network?

Please give better details of your network layout and will get you fixed up.. But yeah from that drawing with double nat 192 to 10 to public yeah your going to have problems with things working, especially stuff like ftp and https

[game_over]

Yes sorry, they are all connected to a switch.

We are given our 10.x... address scope by our LEA, they provide our internet and it's configured to use 10.83.112.X

A couple of years ago we got some bespoke software in, including a new DC to run it on. They changed our network to 192.168.16.X because that's what they had built their software around (or something along those lines). It's hard to explain in these terms so i'll show you IP layout will probably explain better:

Workstation - 192.168.16.XX picked up from DHCP (Server)

-

Server -

1 NIC -> SWITCH

IP Address: 192.168.16.2

Subnet Mask: 255.255.252.0

Default Gateway: 10.83.112.1

Preferred DNS: 192.168.16.2

-

Firewall ISA -

1st NIC (LAN) -> SWITCH

IP Address: 192.168.16.4

Subnet Mask: 255.255.252.0

Default Gateway:

Preferred DNS: 192.168.16.2

2nd NIC (Internet) -> SWITCH

IP Address: 10.83.112.3

Subnet Mask: 255.255.240.0

Default Gateway: 10.83.112.1

Preferred DNS: 10.83.112.2

Cachepilot (Internet box) -> SWITCH

IP Address: 10.83.112.2

I can't ping the Firewall from a workstation, i must be logged into the Server. Which is annoying because i need to remote into the server to remote into the firewall.

HTTP, HTTPS and FTP all works fine on Windows. Just not OSX.

[+BudMan MVC]

To be honest -- from what I can make of your setup -- nothing should work.. Your running 2 different addresses spaces on the same physical wire, but not putting IPs in the space on the machine.

So no you should not be able to rdp from your box on the 192.168.16/22 -- why are you using that mask I am curious -- how many hosts do you have on that network.. with a /22 like that you could have 1022 hosts, then on your 10 your using a /20 = 4096 hosts... Why are your masks so large?? And no from what your showing even the server should not be able to rdp too it.. Unless you have another IP address setup on it that your not showing in the 10 network?

Your telling it its on the 192.168.16/22 -- but telling it to talk to gateway with IP 10.83.112.1, which device has that IP?? You posted that the internet box has a 10.83.112.2 address -- so what is this .1 device? You can not talk to devices on other networks without routing it.. What your doing is not according to how its suppose to work.. So yeah your going to have all kinds of weird issues.. Remember how my windows machine bitched at me when I told it its gateway was on a different network than its interface.

If for whatever reason you think your locked to the 192.168.16/22 address space??? If you also wanting a machine to talk on the 10.83.112/20 network then you need to give it an IP address in that space on that interface.. So for example..

ipconfig /all

Ethernet adapter gig:

Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller

Physical Address. . . . . . . . . : 00-21-9B-03-AC-A7

DHCP Enabled. . . . . . . . . . . : No

IPv4 Address. . . . . . . . . . . : 192.168.1.100(Preferred)

Subnet Mask . . . . . . . . . . . : 255.255.255.0

IPv4 Address. . . . . . . . . . . : 10.83.112.100(Tentative)

Subnet Mask . . . . . . . . . . . : 255.255.240.0

Default Gateway . . . . . . . . . : 192.168.1.253

DNS Servers . . . . . . . . . . . : 192.168.1.4

NetBIOS over Tcpip. . . . . . . . : Enabled

Now I could put other machines on the same wire as my 192.168.1/24 with a 10.83.112/20 address - and this machine could talk to it.. But if wanted to get off either the 192.168.1/24 or 10.83.112/20 networks it would talk to the gateway at 192.168.1.1 to go to say the internet, or any other network that it is not directly connected too.

I would really suggest you rethink your addressing -- double check that you can not put your servers on the 10.83.112/20 directly?? If you have something that is hard coded for the 192.168.16/22 then can you change the IP of your internet router??

With this

"I can now access all HTTPS websites, but FTP still won't work "

IP: 192.168.16.9

Subnet: 255.255.252.0

Router: 10.83.112.1

Well how ever your managing to talk to that router -- your bypassing the ISA server all together. Your telling your machine there to talk to anything not on the 192.168.16/22 to talk to 10.83.112.1 -- which to be honest it shouldn't even really be able to do, Without a IP on that network.

If you can not change your devices to be on the 10, nor change your internet device to be on the 192 -- then I would put everything behind the ISA with it having one interface in the 192 and public interface in the 10.. Then all machines on your network should use the ISA 192 address as is its gateway to get off the 192 network. Now this is behind a double nat -- but atleast it can be worked with -- trying to run 2 different address space on the same wire is a cluster F___ that is going to be nothing but painful.

Im curious what your trying to do exactly with the ISA? Your already behind a NAT -- what are wanting to accomplish exactly with the ISA server?? That you could not do on the Cachepilot (Internet box)?

Glad to help you out there dude -- but unless Im missing some info, you got one cluster F there, and no wonder the MAC is not working -- from what you have shown, nothing should be working.

[game_over]

lol, that made me laugh, it is a confusing set up but it does work. We also have an admin network that goes straight from the 10 network. Your right, we are running 2 address spaces on the same wire. I can connect to 10 and 192.

I'm not sure why, it's not needed but that was just how it was set up when i came to work here, shortly after we got some software which is when ISA came into play. It was setup by a company, it worked.. so i left it.

I can only assume 10.83.112.1 is the router. The server interface has another IP address in the space 10.83.112.4 but that's so it can talk to the admin network (same as your image above)

I definitely can't change the IP of the router, we would need to move over to the 10.80 network but i'm pretty sure our software would stop working. ISA Server came into play when we bought some software to ease the deployment of software and internet services and websites, very quickly on the fly. For every group of computers in the building we have a set of access rules from which members of staff can apply web filtering and allow different levels of internet access, such as.. specific websites only, unrestricted internet access or no access at all. Each group has their own home page and a member of staff can push links and resources to it from the admin area. This is all powered by ISA servers access rules. The funny thing is that rarely get's used anymore but it may harm the other side of the software which allows staff to enable/disable software. Basically when a group of people logon to our network they get nothing, then a member of staff will assign programs and internet access to that group of computers which then appear in the start bar. Our computers are really locked down as they are mainly used by children, the aim was to eliminate distractions.

ISA Server doesn't really do much as a firewall because we Allow most protocols->from internal->to external and let the other network do the work. but we still run into these problems?

FTP works fine on windows boxes, so does http and https. but OSX: Assigning an IP and setting the gateway to the router seems to allow https but not ftp, http works fine regardless.

I have done live monitoring of my IP and it brings up:

Connection Initiated - HTTP Proxy

why is this?

--

Failed Connection Attempt FIREWALL 22/06/2010 09:45:45

Log type: Web Proxy (Forward)

Status: 1460 This operation returned because the timeout period expired.

Rule:

Source: ( 192.168.16.9:0)

Destination: ( 192.168.16.4:8080)

Request:

Filter information: Req ID: 09cc5608

Protocol:

User: anonymous

Additional information

Client agent:

Object source: Processing time: 0

Cache info: 0x0 MIME type:

Denied Connection FIREWALL 22/06/2010 09:45:45

Log type: Firewall service

Status: A packet was dropped because ISA Server determined that the source IP address is spoofed.

Rule:

Source: Internal ( 192.168.16.9:59827)

Destination: Internal ( 192.168.19.255:137)

Protocol: NetBios Name Service

User:

Additional information

Number of bytes sent: 0 Number of bytes received: 0

Processing time: 0ms Original Client IP: 192.168.16.9

Client agent:

[+BudMan MVC]

"Status: A packet was dropped because ISA Server determined that the source IP address is spoofed. "

http://support.microsoft.com/kb/832659/

The IP Spoof Detection feature in ISA Server 2000 may drop legal packets on systems that have multiple external interfaces

Look at your setup -- you have both interfaces of the ISA plugged into the same switch so yeah your going to have packets being seen on both interfaces.

"The IP Spoof Detection feature may drop packets that arrive on network adapter 2 because they arrive on network adapter 2 but they leave from network adapter 1."

You can disable it

http://support.microsoft.com/kb/838114

How to disable the IP Spoof Detection feature in ISA Server 2004, ISA Server 2006, Microsoft Forefront Threat Management Gateway Medium Business Edition or Windows Essential Business Server 2008

But to be honest, I don't care if your calling it a admin network or not.. Your going to have problems with that sort of setup - PERIOD!! You don't run different address spaces on the same wire. If you want to run an admin lan -- then go for it.. You would use different nics, connected to different switches.

Why would your software stop working?? Just because the server came shipped with a address on it?? Change it to use the 10.. Or as already mentioned -- isolate your networks..

[game_over]

Hi BudMan,

I'm trying to find the original thread were we discussed my network. Anyway, i want to remove the ISA Server from the network and change all the leases back to 10.83.

The ISA Server is basically a second firewall that serves no actual firewall purpose as we allow-all-from-all. ISA's rules were used to push web addresses to workstations from a central location.

Is there a way i can see what 10.83 addresses are being used and by which devices?

We only have a few static addresses n the 192 range, is it just a case of removing the ISA, patch the cachepilot into the server (instead of isa), change the address range in DHCP and then giving the statics new IPs? or is more work involved.

[+BudMan MVC]

"Is there a way i can see what 10.83 addresses are being used and by which devices?"

If you are the physical wire that 10.83 is on, then just use your fav scanner, say angry ip scanner http://www.angryip.org/w/Download

This should give you your mac address of the devices if not more info, and then from there you can look at your switches (if managed or smart) arp table and find out which mac is connected to which port, etc.

[game_over]

Ok that should work thanks.

What about my next question does that sound about right? thanks

[+BudMan MVC]

I would have to relook over your network, the only thing I remember of it was that it was a complete and utter CF!! And I recall that something you were doing shouldn't have even worked, etc.

So off the top of my head I would say no ;) Just because it was a complete CF to start with :rofl:

Did we ever put together a drawing of your network? Other than what I posted, etc. If you have a actual drawing of your network I would be happy to look at it and check what your wanting to do.

[game_over]

I would have to relook over your network, the only thing I remember of it was that it was a complete and utter CF!! And I recall that something you were doing shouldn't have even worked, etc.

So off the top of my head I would say no ;) Just because it was a complete CF to start with :rofl:

Did we ever put together a drawing of your network? Other than what I posted, etc. If you have a actual drawing of your network I would be happy to look at it and check what your wanting to do.

Yes we did but i am struggling to find it. You setup the drawing on some online app. I've tried to find the thread i made it was around 3 pages long, i will keep looking anyway and let you know.

[+BudMan MVC]

I think we used gliffy if I recall, I would think the thread would of been around the time this thread was started?

But don't you have a current drawing? There has been no changes to your network in a year? How do you work on something if you don't even have a drawing of how its all connected?

If anything came of the thread I would of hoped a actual drawing of your network would of been it ;)

If I recall we had used a shared drawing on gliffy to work on it? I could see if I could dig up the account I used back then to see if drawings are still there, but I am pretty sure they were posted to the thread. So if we look around the date of when this thread was started we should be able to to find it. Can you search for threads that have us both talking in them around the time frame?

edit: ok I found the drawing on gliffy

But would be nice to find the thread to refresh my memory

[game_over]

Thats it.

The only change is that the junior cab now has a HP Pro Curve 2510-48 port switch instead of the 3com

This is all being ripped out next week and building closed for 6 weeks so now i want to jump in and remove that ISA Server.

I've found the thread:

https://www.neowin.net/forum/topic/936022-slow-access-to-server

and here's another:

https://www.neowin.net/forum/topic/881980-access-imapsmtp-behind-isa

There is a good chance a lot of problems will be resolved when we remove this ISA server.