Re: AD Auth for standalone ISA in DMZ

"Use Global Catalog box is checked" - this means that you need TCP:3268 open
through the firewall; not TCP:389.
http://www.microsoft.com/technet/security/smallbusiness/topics/ServerSecurity/ref_net_ports_ms_prod.mspx
--
Jim Harrison (ISA SE)

This posting implies no warranty and confers no rights.
http://catb.org/~esr/faqs/smart-questions.html



<doug.masters@xxxxxxxxx> wrote in message
news:1182955938.166927.305380@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
On Jun 25, 5:19 pm, doug.mast...@xxxxxxxxx wrote:
Standalone ISA 2006, single nic, in a DMZ. I need to configure ISA
to poll AD to see if a user is allowed access to the internet or
not. The network boys tell me that they have port 389 open between
my ISA server and my DC's.

The information I'm finding is about using LDAP to authenticate
incoming traffic, and I want to authenticate outbound traffic.



OK, I didn't provide much info, so let me add more about what's been
done and what's been tested.

1. The Network boys finally got 389 open, previously I could not
telnet on port 389 to the DC's and now I can.

2. System Policy #1 (Authentication Services) has been enabled. I
created a Computer Set for the DC's and applied them to the
destination of the System Policy.

3. Under Specify RADIUS and LDAP Servers, I created an LDAP Server
Set with the two DC's, the FQDN is entered, the Use Global Catalog box
is checked, and a valid username & password are entered. The
login Expression to <domain>\* and LDAP Server Set is set.

4. When I try to create a new User Set, I choose the LDAP Server Set
I created and enter the group name of the AD Group that is allowed
internet access. After clicking OK I get a username/password prompt,
after entering that I get the error "None of the configured LDAP
servers are available for verifying the user."


What, if anything, am I missing?

.

Relevant Pages

  • RE: LDAP authentication with UPN - ISA 2006
    ... The connectivity between the ISA server and LDAP server is fine - everything ... a login expression can only be assigned ... You may use the LDP.exe tool to test the connectivity between the ISA ... LDAP authentication with UPN - ISA 2006 ...
    (microsoft.public.isa)
  • ISA blocking outbound - strange
    ... There is a windows app for a h/w key authentication. ... when this app is done on a PC on the LAN with the ISA ... SBS2k, but the LDAP server is not found. ... LDAP server directly, but it first has to pass thru ISA. ...
    (microsoft.public.isa)
  • RE: LDAP authentication with UPN - ISA 2006
    ... an LDAP server set can have more than one login ... a login expression can only be assigned ... You may use the LDP.exe tool to test the connectivity between the ISA ... LDAP authentication with UPN - ISA 2006 ...
    (microsoft.public.isa)
  • Re: USE of ADFS
    ... but have users in y domain, you cannot authenticate users from y domain ... unless you specify that domains ldap server. ... All domains in the forest trust each other. ... I don't know if ADFS would really help you here or not. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Using LDAP Authentication
    ... If what you need is for you ldap server to authenticate into active directory, ... If what you want is for an authenticated session of your win2k professional ...
    (Focus-Microsoft)
Loading