ISAServer.org Chat Transcript — May 29 2003

 

ISAServer.org Chat Transcript

May 29, 2003

Note: The Chat Room is always open! We have scheduled chats once a week but you’re welcome to visit the chat room at any time to discuss ISA Server related issues. The Chat Room is at:

http://groups.msn.com/ISAServerorgChat/chat.msnw

 

Please wait, connecting to server…

Connected!

 

 

DrTom : Hey guys, sorry I’m late!

Stefaan : Ha…. I’m living now for more than 25 years in the networking world. So, I would say experiences…

frihani : Hey DrTom

Stefaan : Hi Tom!

DrTom : Hi Frihani!

DrTom : Hi Stefaan!

DrTom : What are you guys talking about today?

frihani : 25+ years.. Ah ha! now i know your secret

DrTom : Stefaan — I really appreciate your protocol approach to solving ISA Server config and connection problems

frihani : Should we start a topic?

DrTom : What is a popular topic that everyone seems to have problems with?

frihani : Dr Tom, What have you been currently working on vis a vis vmware lab?

Stefaan : Well I was and am still very interested in how all those protocols really work: tty, bsync, x25, tcp/ip ……..

DrTom : How about publishing OWA?

DrTom :

DrTom : Frihani — I have been working on VPN client setups for all versions of Windows

frihani : ohh! good one.. actually i need to publich RPC and have just found your article Dr.

DrTom : Using the new L2TP/IPSec client too!

DrTom : Publishing Exchange RPC is pretty easy, as long as you get the name resolution issues handled correctly

DrTom : Although, I hear there are a lot of problems with Windows XP SP1. I don’t use XP SP1, so I haven’t had a chance to test it, it works fine without SP1

frihani : interesting.. I only recently became interested in vpn configs.. quite powerful

DrTom : Stefaan — yes, protocol level understanding is key to really understanding how these things work, your analysis is always very interesting and enlightening!

Stefaan : Tom, thanks! Did you already test ISA on W2K3 as VPN endpoint for L2TP/IPSec NAT-T?

DrTom : Frihani — yes, the VPN configs are very interesting. I’m putting together a very comprehensive VPN deployment kit on VPN client setup, VPN server setup, VPN gateway setup and Certificate Server setup

DrTom : It will be very easy to find the information you need, when you need it

DrTom : And its hard to do that now! It won’t be hard when I’m done

DrTom : I hope

DrTom : Stefaan — I have tested the L2TIP/IPSec client and it works great!

frihani : that is quite a monster.. btw. your books have become the one stop resource of all isa server admins

DrTom : Stefaan — I tested the Win9x and the Win2k L2TP/IPSec VPN client with the client behind an ISA/Win2003 server and the clients were connecting to a ISA/VPN/Win2003 server. Works great!

Stefaan : Tom, which packet filters do we need on ISA UDP 500 and 4500 for sure, but is UDP 1701 also needed?

frihani : Dr tom, are you using traversal (UDP ?)

DrTom : Frihani — Yes! The VPN deployment kit is going to be really big — it it will be easily managable because there will be a doc at the beginning that will guide you through the docs you need to go through

frihani : ecnapsulating the data packets and all that.

DrTom : Stefaan — NO protocol rules are required for UDP 1701. However, a packet filter is required for UDP 1701 on the Win2003 VPN Server.

DrTom : You need to create packet filters for UDP 500 receive/send and UDP 4500 receive/send and UDP 1701 receive/send.

DrTom : You need to create Protocol Rules for UDP 500 send/recieve and UDP 4500 send/recieve

DrTom : That’s all you need.

DrTom : The ESP header is encapsulated in the UDP 4500 header

frihani : Do you have problems dropping the line?

DrTom : Frihani — no problems with dropping the line

DrTom : When the ESP header is removed, it exposes UDP 1701, and at this point its not exposes to the ISA Server packet filters

frihani : So you could basically set it up once and have it run continuously?

frihani : I thought that was IP Protocol 51 or something like that

DrTom : Frihani — yes! Once it setup, it just works.

frihani : interesting.. quite valuable knowledge

DrTom : Frihani — you don’t need to allow any IP protocols through because the IPSec policy agent handles the packet before the packet filters see it

DrTom : Check out the VPN server and VPN gateway docs for Windows 2003 over at the www.microsoft.com/vpn site — they are very very good!

frihani : As you see it now, is the configuration difficult, i mean, are there lots of room for problems

DrTom : because, how does the UDP header become exposed? We don’t need to open a packet filter for IP Protocol 51!

frihani : have you seen any industry shifts with regard to vpn and firewalls?

DrTom : Stefaan — perhaps the ISA Server packet filters “see” IP Protocol

frihani : like checkpoint, symantec etc

DrTom : Sorry that’s IP Protocol 50

DrTom : Frihani — what type of shifts are you thinking of?

DrTom : I know that they are getting more interested in layer 7 — which they’ve essentially ignored in the past

DrTom : I think they see Microsoft biting at their heels in this area — and I’m sure subsequent versions of ISA Server will have even more powerful layer seven inspection

frihani : Well checkpoints solutions ie: vpn client had good intention but is just too messy to work with

frihani : I wonder if any improvements have been mad

DrTom : Frihani — third party VPN clients are really paradoxical to me. Here you have a VPN client, the MS VPN client, built into every Windows operating system. It works great, and connects to MS VPN server with no problem and the client is so, so very easy!

frihani : Can you point to a reference regarding the “layer” idea

DrTom : I’ll never understand why people want to use 3rd party VPN!

frihani : well people normally responded with that the other end had limited requirements (specific firewall version)

DrTom : Frihani — the layer 7 idea? There were some front page articles on CNET a few weeks ago that they were getting into “advanced layer 7 filtering” when ISA Server already does this and can be easily extended by 3rd parties or even yourself if you’re good

DrTom : with C++

frihani : Has anyone worked with C++ filters etc? Like the SOCKS5 build?

DrTom : frihani — yes. I think price is the thing. You can get a “SOHOware” or FireBox or something like that with a limited number of connections for less than a Win2k/Win2003 box. And businesses that are price sensitive will go with those solutions

DrTom : Frihani — the SOCKS 5 filter in the SDK was just an example, I don’t believe it actually works

frihani : With regard to price.. the proven features of ISA are certainly worth it…

frihani : Yea i have not heard any positive response from SOCK5

DrTom : Frihani — yes, I agree. What is a challange is that people want to put it on things like SBS server! That immediately reduces the functionality and protection provided by the firewall

Stefaan : Tom, do you have any news about when the updated L2TP/IPSec client with NAT-T will be available again?

DrTom : Stefaan — I was able to get the NAT-T client for Win2k yesterday, but I still haven’t found the NAT-T client for WinXP — no information yet on when it will come back

DrTom : It seems that the problem was with interoperability with Symantec firewalls — that doesn’t seem like a bug to me

DrTom :

Stefaan : Haha… that’s a good one

Stefaan : Can you install ISA server on W2K3 web edition or isn’t that possible?

frihani : I dont think that is possible…

DrTom : I think one thing ISA Server has a problem with is that it sees the world in terms of “internal” and “external”. Most firewall admins want to use the firewall as a “firewall/router”

frihani : Have you tried W2k3 with isa at all?

DrTom : Stefaan — I haven’t tried on Web Edition yet! That would be interesting. I’ll put it on my list of things to check.

DrTom : Frihani — I’ve been using ISA Server on Win2003 for a couple of months

frihani : production serveR?

DrTom : Very, VERY stable in my limited experience (limited in that I have no customers using it on Win2003 yet)

frihani : when willl you feel comfortable migrating your clients?

DrTom : Production in that my own business depends on it and it handles about 20-25 GB of traffic/month

DrTom : Frihani –YES. I feel very comfortable moving my clients to an ISA/Win2003 solution. More stable, more secure, and some neat features like NetBIOS proxy for the smaller businesses

frihani : “Very, VERY stable” sounds quite convincing… and behind the firewall? Exchange, services etc on w2k3?

DrTom : Frihani — no problem publishing Exchange RPC, SMTP, POP3, IMAP4 or SSL

Stefaan : Tom, when will the hotfix be public available for the UDP publishing issue?

frihani : what about running exchange on w2k3

DrTom : It does it all without a hitch. Same as Win2k, but I almost forget about it in Win2003 because services never seem to get “hung up”

DrTom : Stefaan — its available now. Check out the latest fixpack. Hold on and I’ll point you to it.

DrTom : Here is it: http://support.microsoft.com/default.aspx?scid=kb;EN-US;810493

frihani : Has anyone worked with intrusion detection systems? I’ve worked with Snort,

frihani : but after ISA, i never caught anything

DrTom : Frihani — I’ve not found the ISA Server IDS very useful

Stefaan : Tom, I saw that KB, but you have to contact MS to get it. So, no free download yet?

DrTom : Stefaan — that’s true. Jim told me it was a fix for the problem, but I haven’t installed it yet to confirm

DrTom : Maybe we can post to the ISAServer.org mailing list and someone will make it available?

Stefaan : Good idea!

DrTom : I hate sitting on the phone, and even though I don’t have to pay for it, it still takes a good amount of my time to get it.

frihani : hehe

DrTom : Anyone use the SMTP filter?

Stefaan : Can Jim not publish it on isatools.org?

DrTom : I find that it can be very useful, but its very difficult to manage

frihani : Dr Tom, I’ve tried it but it was rejecting exchange to exchange communication

frihani : and had to disable it

DrTom : Most people don’t want to spend hours and hours comes up with keywords and domains and then not have an easy mechanism to back up and restore this information

frihani : Isnt there scripting for that?

DrTom : Frihani — what type of Exchange to Exchange? SMTP messages from one Exchange Server to another?

DrTom : Frihani — if there is scripting for that, I haven’t found it!

frihani : I think it was some sort of Auth smtp command that was getting blocked

DrTom : Frihani — Oh! Yes, the original release of the SMTP filter did not support AUTH. That meant that you couldn’t use credentials based authentication

frihani : right.. why has that been fixed?

DrTom : But if you install ISA Server Feature Pack 1 — the SMTP filter works! You can now authentication when the SMTP filter is enabled

frihani : oh boy

DrTom : You might need to create a entry in commands list for : AUTH and the size should be 1024 bytes

frihani : I have installed FP1

DrTom : Frihani — then it should work, just make sure to add the entry to the command list. AUTH and 1024 bytes for the size

frihani : I’ll have to test it.. thanks for the info

frihani : my bosses will be pleased

DrTom : Frihani — you bet! Let me know how it works out for you!

DrTom : Frihani — tell them you figured it out yourself, then you’ll get a raise in pay

frihani : I think spam (keywords and all that ) are a bit difficult to manage…

frihani : maybe someone should bribe Jim to write a script to import export smtp settings

DrTom : Frihani — interesting you say that. I used keywords only. I have a very extensive keyword list that works well for out business

Stefaan : Tom, does RainWall support an ISA trihomed DMZ configuration?

DrTom : It catches about 99% of all spam and a very very very low false positive rate, because I whitelist legit domains so that they bypass the keyword rules

DrTom : Frihani — LOL! I’ll ask him about that

DrTom : Stefaan — good question. I haven’t check out that scenario yet. Are you wanting to load balance and failover the DMZ interfaces too?

DrTom : I’ve only tried RainWall with machines that have 2 network interfaces, internal and external

frihani : DR Tom, where do you get your kw list from?

Stefaan : Yep, a customer have asked that one!

DrTom : Frihani — I’ve created my own over the years. Its very extensive.

DrTom : Stefaan — ouch! I can ask for you. Do you know Reiko Sato? She is very smart, very friendly and very helpful on RainWall and RainConnect questions!

frihani : Dr Tom, you were right, the AUTH Command is set for 500 length

DrTom : Frihani — 500 might be enough in some circumstances, but MS recommends 1024

Stefaan : No, I have not worked with Rainfinity yet, but have just emailed them for some price info. We have some interest in their products.

DrTom : I have tested it out myself using 1024 and it works nicely!

frihani : What about the other commands, should i review them against real mail occurances or are they ok as is?

DrTom : Stefaan — they are very very helpful. I have always been impressed with their professionalism and willingness to work with customers on solving problems

DrTom : Frihani — I don’t find any compelling reason to remove any other commands. I’ve not had problems with the current command list and I haven’t run across anyone who’s had problems (other than the AUTH issue)

frihani : good news.

DrTom : Actually, there is one other issue: STARTTLS. But I think this will be fixed in the future

frihani : TLS security ?

DrTom : Frihani –YES. It would be very good to have that feature for SMTP from your private SMTP clients that are on the road

frihani : right.. well i wanted to move all external clients to Exchange RPC.. but i cant get it working

Stefaan : Tom – good to hear that! I will contact them (probably in the UK I suppose).

DrTom : Frihani — you can’t get RPC working? Do you know what the problem is?

DrTom : Steffan — yes! Let them know that I sent you and that you are very active on ISAServer.org and with MS too – and that you’re an MVP — they know what MVP’s are

frihani : Well it may just be my inexperinece with client settings in outlook. What i thought to do was add the ms Exchange server service in outlook services and point to the external mail dns

frihani : but the syn gets blocked

frihani : also, the rpc port is listening on 0.0.0.0

DrTom : Frihani — there are some issues with the various builds of Outlook

Stefaan : Hey guys, I have to leave. Thanks for the nice talk!

DrTom : Stefaan — good to have you here!

frihani : Stefaan, thansk again!

DrTom : Let us know what Raininfity has to tell you

DrTom : Frihani — is the Exchange Server on the ISA Server? If so, RPC publishing will not work

frihani : exchange is behind ISA

DrTom : Name resolution is very important. Also, don’t force encryption until you get the basics working

frihani : oh good thinking

frihani : name resolution meaning the mailboc name or fqdn

DrTom : Once thing you can do to help is to put a HOSTS file entry on the clients to confirm name resolution is not the issue

DrTom : Exchange depends on the NetBIOS name, it really doesn’t use the entire FQDN

DrTom : So, the host portion of the FQDN must be the same as the NetBIOS name

DrTom : For example, if the NetBIOS name is BLAH, you have to make a FQ

DrTom : sorry — you have to make the FQDN blah.domain.com

DrTom : and have the resolve to the external IP address that’s listening for the RPC publishing rule

DrTom : You can do this in your DNS, or you can create a HOSTS file entry

frihani : oh i see.. Netbois name is the same for the mahine i was [email protected]

DrTom : It gets trickly too, because not all clients will resolve the unqualfied request correctly!

DrTom : For example, since Outlook only cares about the NetBIOS name, it uses a single label name for the name query

frihani : Well exchange features are used mosltly in the intranet, but for those who want to pust the limits…

DrTom : If the query is sent to DNS, the query has to be “fully qualified” which means a domain name has to be appended

DrTom : That name is usually the same as the name of the domain the computer belongs to, now you see the problem?

DrTom : There are ways around this, such as using adapter specific settings, etc.

frihani : right… the HOSTS file overrides the dns resolution then

DrTom : Frihani — perhaps the HOSTS file entry would be the best place the start, then you can reengineeer your public DNS after you get things working the way you want them to

frihani : I am glad i have the auth to make site wide changes then

DrTom : Frihani — that’s right! The entries in the HOSTS file are automatically placed in the DNS client cache immediately after you save the HOSTS file

DrTom : Frihani — LOL! Yes, you will need that!

DrTom : OK guys, I’m going to have to leave. I turn into a pumpkin at NOON and I’ve been a pumpkin now for four minutes

DrTom : I appreciate everyone who had a chance to visit and I hope you can come next week. Let everyone know that you can actually learn something at these chats!

frihani : Thanks for the confidence Tom!

DrTom : Frihani — you bet! See you next week!

DrTom : Bye!

frihani : Ciao.

Leave a Comment

Your email address will not be published.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Scroll to Top