Networks

Ask something
Discussion Locked

Multiple domains accessing ISA 2004

0 helpful
13 replies

by dmead74 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I've got two seperate Active Directory domains that I want accessing the internet through an ISA 2004 proxy server. The proxy is configured to direct requests to an external upstream proxy. Our server is a member of domain A, and I want users on domain A to require authentication for traffic monitoring purposes. Domain B users don't need to be monitored so authentication is turned off (I figured that would be the easiest way to give them annonymous access).

I have configured both domains as seperate Networks in ISA, using the default Internal network for domain A and a new entry for B. I have an access rule to allow all outgoing for all users from B to external, and another to allow all outgoing from the allowed user group in A to external.

I can access the web from domain A, but not B. From domain B IE attempts to contact the IP of the ISA server eventually timing out with the server no found or DNS error message. The ISA log shows connections from the domain B network to Local Host on the proxy port and a Denied action with no rule specified. This is a problem as it gives no indication as to WHY it's denied. I have tried using a all outgoing/all users/all networks rule with the same result. I just don't get why it's being blocked.

13 replies

by lumpyhed

Have you tried a different browser to see if that differs? Even though you've got it set to anonymous access (afaik) it still sounds like an authentication issue. If you still find yourself completely stuffed and no one comes up with anything & you some spare capacity, i suppose you could always run a very basic squid server for domain B or something.

by dmead74

I was thinking along the same lines with the authentication thing. It does seem as though the ISA server is trying to do user level checking even though I've told it odmain B doesn't require auth. Still, I'm not sure that's it. I'm not really happy with the idea of using the squid as well...it would bug the hell out of me having to do a dodgey setup like that, and I'm concerned about the added overhead in processing requests by double proxying. I'll have to try some additional configurations

by dmead74

Thanks Leo. Just read the article and it's not really what I'm after. It only looks at communications between networks and not with the ISA server itself. You'd think it would be the same thing just with different destinations but then again I would think my current config would work :) It does make me wonder if using two NICs might help though. Seems silly, but maybe ISA doesn't want to play with multiple network definitions on the same NIC.

by curacao_dejavu

oh

I was under the impression that you had a nic for each domain/segment.

From what I have read so far of isa 2004 it's that's how you can define seperate network segments.

but I might be missing something, you need one nic for the upstream proxy, and 2 for your 2 domains. I am understanding that you have currently only 1 nic ?

by dmead74

Yep, did I really leave that out? Damn. I guess I was trying to be as detailed as possible and still forgot something. My understanding was that ISA considers all defined networks as protected/internal except for "External". Since we're only using it for proxy service I have used single NIC mode, that's what it's for after all.

by d'solve it

Hi,

1. Install 3 NICs on your ISA server (I'll call this PC OBWAN) - one external and 2 internal (one for each domain - I1 is for Domain A and I2 for Domain B).
2. The external NIC retains the original configuration.
3. I1 has the original configuration MINUS the multihome information (I'll assume 192.168.0.1 for I1)
4. Configure the third NIC (I2) with IP 192.168.1.1.
5. I1 is not a problem so I'll concentrate on I2.
6. Set up the authoritive DNS for the second domain to resolve the I2 IP to name. (Resolve OBWAN to 192.168.1.1)
7. Install the Firewall Client on the Domain B clients.
8. From Domain B clients try and ping OBWAN (open a command prompt and enter ping OBWAN) - you should get a reply response.

Reply from 192.168.1.1: bytes=32 time<1ms TTL=63
Reply from 192.168.1.1: bytes=32 time<1ms TTL=63
Reply from 192.168.1.1: bytes=32 time<1ms TTL=63
Reply from 192.168.1.1: bytes=32 time<1ms TTL=63

If this does not, let me know with further details.

The above is a solution based on certain assumptions. I assume that you have 2 domains (A & B) each having separate networks (or at least separate masks - the above is based on separate sub mask). Each of the 2 domains have their own authoritive DNS servers. There is no implicit or explicit trusts between the 2 domains.

My recommendation would be to remove the proxy (OBWAN) from the domain altogether and leave it as a standalone server (from a security point of view this is recommended).

by dmead74

OK, this looks promising but I have some issues (I think "Unacceptable" sounds a bit harsh):

1) I only want to proxy web traffic, so is Firewall client really necessary. Can't I just use web proxy through the browsers?

2) Our internet link is provided through a managed fibre to head office, therefore we don't have an "external" link I can connect to the proxy. I only have access to the two internal domains and their address spaces, head office retains control of the router than connects the two domains and the wan link together. The proxy must be in one of the two address spaces to be visible to the router or either domain.

3) I would think that having the proxy be a member of domain A would be the easiest way to provide transparent user-level access to the proxy. Since it is purely a proxy for controlling outgoing requests I don't think domain membership is a security issue.

by d'solve it

OK, now we are getting somewhere :-)

I'd like some more answers before I can provide you with a solution that will work. Nevertheless, I'll post a workaround and if it works we can skip the question/answer session. (if not you can send me some more details and vi?la!)

1. On the client PC of domain B add a hosts entry. Enter the IP of OBWAN (192.168.1.1).
2. Now ping OBWAN. Do you get a reply?
3. If yes, then simply open the TCP/IP properties of the client PC and and add 192.168.1.1 as the gateway.
4. Open Internet Explorer. Go to Tools|Internet Options. Go to Connections Tabs and click on LAN settings. Enter the details of the proxy server in the space provide (192.168.1.1 and port 8080 (ISA default).

Firewall client gives you greater control on user activity, but you could skip and use browser proxy through (above is based on just that)

by dmead74

OK, it seems the single NIC - dual network is what was tripping me up. I didn't need the hosts entry since you had me configure DNS for the server before :) I also couldn't set the default gateway for clients to the proxy because they need direct connection to head office through the router (the current default gateway), but the web proxy solution is fine. In hindsight it makes sense that it wouldn't allow addresses from outside the subnet of the NIC, hence the need for another one.

by curacao_dejavu

re-see the isaserver.org and the link that I sent you before. That's is what you are trying to do.
Further more, dsolve and I are on the same "frequency" :)
an external network is defined as one that you are tryong to connect to, that is not perse internet but head office etc as well.
so you need 3 nic's. 1 head office, 1 segment a , one for the segment b.

you could go with the webproxy adress in the IE, but I almost work exclusively with the proxy client. (but in this case check in the eventviewer of the isa server if you are receiving authentication error messages, I have seen once these kind of errors at a client while trying to do this)

In my setup's the ISA server is always a member of the domain.
go steo by step, since you are in the middle of configuration changes.
Get the ISA server running first.(preferable as a member of the domain)

then the clients of that same domain A.
Then the clients of the domain B.

If you need more help, contact me too via my hotmail account.

Leopold

by dmead74

I'll keep the server on domain A because that's where I want user-level control, and it's working fine. But I literally can't set an external interface up because I don't have an IP I can use for it. The router only allows traffic from the A and B addresses so it has to be in one of those. I could set up two NICs on the same subnet but that seems pointless. It seems OK though as ISA interprets External as a catch-all for any undefined address, with the default gateway set to the router and Web-Chaining pointing to the head office array it can get through OK. Thanks for the info.

This discussion is closed to new replies.