Tuesday, August 18, 2009 1:38 AMI am having trouble after reading to getting the reverse proxy working.I will start off with basically what I have.I have two nics. One nic is dedicated to the INTERNAL network (internal IP, subnet, etc).The other nic is opened up to the entire world.Now on the networks tab I do not have any Address Ranges specified for the Perimeter since technically tis not perimeter IP's, they are external.For the Internal I have it set to the network adapter that is assigned to the internal network.Our ISA 2006 server IS joined to the domain.I have one Web Listener "No Authentication SSL":Networks: External (184.108.40.206)Connections: 'Enable SSL (HTTPS) connections on port: 443Certificate: Assigned from DigicertAuthentication: No AuthenticationThen I have a Web Publishing rule "OCS 2007 R2 Web Downloads"It is enabledAction: AllowFrom: ExternalTo: OCS2007.adem.arkansas.gov (Request appear to come from the ISA Server computer) <-- this is the INTERNAL server (STandard Edition of OCS2007R2)Traffic: HTTPSListener: No Authenticatoin SSLPublic Name: 'Request for the folloiwng websites' ocsrp.adem.arkansas.gov (you can ping it and get the correct IP.. 220.127.116.11)Paths: <same as internal> /*Authentication Delegate: 'No delegation, but client may authenticate directly'Bridging: Web Server 'Redirect request to SSL port: 443'Users: All UsersSchedule: AlwaysLink Translated: 'Apply link translation to this rule'I have applied this, rebooted, everything!I cannot even telnet to port 443 on ocsrp.adem.arkansas.gov.I do not get it. I have checked our CISCO firewall and it is correct. All the ports are opened. I am lost, any help would be grateful! I thought I followed the documentation exactly. Oh by the way, I did use the lcscmd to register OCSRP.adem.arkansas.gov as the external web farm on the OCS 2007 R2 serverThanks!
Wednesday, August 19, 2009 1:15 AMOk it seems I did some more and finally got to access port 443.
I don't know, maybe it is just me but it seems like it is hit or miss for ISA server. I can change something and it works, then change something else and taht first thing that worked doesn't anymore. Change it back to exactly the way it was and the first thing that did work doesn't anymore!
I got it to connect and saw a "Failed Connection Attempt"
So I pinged my internal OCS server and it was successful. But port 443 to the internal OCS server was not!
So I created an access rule to allow HTTPS to the internal OCS server only from the local host. Now I can hit:
https://<internal standard edition>/GroupExpansion/Int/Service.asmx
BUT I CANNOT hit:
http://<internal standard edition>:443/GroupExpansion/Int/Service.asmx
And it seems ISA server uses the second. Why can one work but not the other one?
Wednesday, August 19, 2009 4:07 PMCan you give the full description of the error message?
Also ensure that you are using ISA 2006 SP1 because prior versions cannot handle SAN certificates very well
- Belgian Unified Communications Community : http://www.pro-exchange.be -
Wednesday, August 19, 2009 5:40 PMOk I installed SP1 like you mentioned.
I have added *.adem.arkansas.gov (our domain) to the System Allowed Websites.
In the ISA IE I have added this as the proxy: localhost:8080
It is working fine, I can get to microsoft, and
But the problem is I cannot get to:
which is what seems to be ISA is trying to use. So they use a colon:Port instead of HTTPS.
When I get an error back it is:
Network Access MEssage: The page cannot be displayed
The request timed out before the page could be retrieved.
I am new to ISA and trying to figure this out. We purchased it for a Reverse proxy for our OCS 2007 R2 server. HEre is a more detailed message:
Technical Information (for support personnel)
- Error Code 64: Host not available
- Background: The gateway or proxy server lost connection to the Web server.
- Date: 8/19/2009 5:37:55 PM [GMT]
- Server: ocsrp.adem.arkansas.gov
- Source: Remote server
Thursday, August 20, 2009 1:27 AMOk after that I still gave the Communicator a try and it worked! The reverse proxy thing is still working even though I get that error message from the ISA server.
Thursday, August 27, 2009 12:45 PMSo even though you are getting the error. MOC will expand Active Directory Groups? I am just curious.
Mitch Roberson |MCITP:Enterprise Server Admin, Messaging |MCTS:OCS with Voice Achievement |MCT
Wednesday, October 14, 2009 1:45 AMYou may see that the error on MOC is gone, because it can successfully Socket-connect to the ISA server. The MOC client doesnt run a test DL expansion, so you will need to test DLExpansion manually.
In addition, I suggest you first add routes on your ISA Server using "route add -p"command, and then reconfigure your internal network (add the routes).
This way you will not have use ISA proxy on your IE settings.
Test the DL expansion web page from the ISA Server (logged in as a user).
- Proposed As Answer by Sri Todi Monday, October 26, 2009 4:17 AM