Re: Site-to-Site with ISA 2004

On 11 Apr 2007 11:07:33 -0700, "Dan24" <dliberty@xxxxxxxxx> wrote:

On Apr 11, 3:38 pm, Jim Behning SBS MVP
<jimbehn...@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
On 10 Apr 2007 23:33:55 -0700, "Dan24" <dlibe...@xxxxxxxxx> wrote:





On Apr 10, 1:29 pm, v-rob...@xxxxxxxxxxxxxxxxxxxx (Robert Li [MSFT])
wrote:
Hi Danny,

Thanks for posting in our newsgroup.

From your description, I know that set up a site-to-site VPN between SBS
server and client's office. When you try connecting to the remote office on
SBS server, the VPN doesn't work. If I am off-base, please don't hesitate
to let me know.

Please let me know the following to make the situation more clearly:

Which device is used at your client's office side, ISA server or third
party router? If you use third party router, the problem may also be caused
by the third party router and you can contact the hardware manufacture for
more help.

First please make sure you strictly followed this document to create
site-to-site VPN.

Creating IPSec Tunnel Mode Site to Site VPNs with ISA Server 2004 Firewallshttp://www.isaserver.org/tutorials/2004ipsectunnelmode.html

Suppose you created an access rule from SBS server to client's office named
Main to Branch, please check the following access rule:

Main to Branch:

From: Internal
To: Branch
Action: Allow
Protocol: All Outbound Traffic
Schedule: Always
Users: All users

If you are using third party router, please check according to the
following articles:

Configuring IPSec Site-to-Site Connections Between ISA Server 2004 and
Third-Party Gatewayshttp://www.microsoft.com/technet/isa/2004/plan/sitetositeipsec.mspx

Configuring IPSec Tunnel Mode VPN Between ISA Server 2004 and Cisco PIX
v6.3.1http://www.microsoft.com/technet/isa/2004/plan/ipsecvpn.mspx

If the problem persists, please help me collect the following information
for further research:

1. Please help to gather the ISA Info:

1) Download the file from the following
URL:http://www.isatools.org/isainfo/ISAInfo.zip
2) Extract all files to a folder on ISA server.
3) Double click Isainfo.js. This will generate 2 files
ISAInfo2004-<computer-name>.log and ISAInfo2004-<computer-name>.xml in the
current folder.
4) Please send these files to me.

2. Please also help to gather the ISA logs:

1) Schedule a down time.
2) Open ISA 2004 management console.
3) Expand the server node and highlight 'Monitoring'.
4) In the right pane, switch to the 'Logging' tab, make sure the 'Task
Pane' is showed there.
5) In the 'Task Pane', click 'Configure Firewall Logging' under 'Logging
Tasks', and then switch the 'log storage format' from 'MSDE database'
(default) to 'File'.
6) Switch to the 'Fields' tab, click 'Select All', and then click OK.
7) In the 'Task Pane', click 'Configure Web Proxy Logging' under 'Logging
Tasks', and then switch the 'log storage format' from 'MSDE database'
(default) to 'File'.
8) Switch to the 'Fields' tab, click 'Select All', and then click OK.
9) Click 'Apply' to save changes and update the configuration.
10) Temporarily disable the Firewall service.To do that, please click
Monitoring | Services tab, and then right click 'Microsoft Firewall' to
choose 'Stop'.
11) Clear the current existing W3C logs. To do that, go to the log saving
directory and clean any existing .W3C logs. By default, the logs will be
saved to 'C:\Program Files\Microsoft ISA Server\ISALogs'. (Some MDF
may not be able to deleted, that's normal.) You may backup them first and
then delete them.
12) Go back to the ISA 2004 management console, and then start the stopped
'Microsoft Firewall' service.
13) Reproduce the problem, stop the service, and then gather the resulting
W3C files to me for analysis.

Please send the information to v-rob...@xxxxxxxxxxxxx with subject:
38684558-Site-to-Site with ISA 2004.

I am looking forward to hear from you.

If you need further assistance, please don't hesitate to let me know.

Best regards,

Robert Li(MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! -www.microsoft.com/security

=====================================================

This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
checkhttp://support.microsoft.comforregional support phone numbers.

Any input or comments in this thread are highly appreciated.

=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

--------------------
<From: "Dan24" <dlibe...@xxxxxxxxx>
<Newsgroups: microsoft.public.windows.server.sbs
<Subject: Site-to-Site with ISA 2004
<Date: 9 Apr 2007 08:39:16 -0700
<Organization:http://groups.google.com
<Lines: 20
<Message-ID: <1176133156.465792.73...@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>
<NNTP-Posting-Host: 80.179.28.118
<Mime-Version: 1.0
<Content-Type: text/plain; charset="iso-8859-1"
<X-Trace: posting.google.com 1176133157 7567 127.0.0.1 (9 Apr 2007 15:39:17
GMT)
<X-Complaints-To: groups-ab...@xxxxxxxxxx
<NNTP-Posting-Date: Mon, 9 Apr 2007 15:39:17 +0000 (UTC)
<User-Agent: G2/1.0
<X-HTTP-UserAgent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2; .NET
CLR 1.1.4322; .NET CLR 1.0.3705; .NET CLR 2.0.50727),gzip(gfe),gzip(gfe)
<X-HTTP-Via: 1.1 GALR-SRVR
<Complaints-To: groups-ab...@xxxxxxxxxx
<Injection-Info: y80g2000hsf.googlegroups.com; posting-host=80.179.28.118;
< posting-account=u8AvCA0AAAD1liAqRATfkseTNIBPzfpY
<Path:
TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTFEEDS02.phx.gbl!newsfeed­­0
0.sul.t-online.de!t-online.de!news.glorb.com!postnews.google.com!y80g2000hs­­f
.googlegroups.com!not-for-mail
<Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:28583
<X-Tomcat-NG: microsoft.public.windows.server.sbs
<
<Hi,
<
<I am trying to set up a simple site-to-site VPN from my SBS 2003
<running ISA 2004 to a client's office. Our internal subnet is:
<192.168.16.X and the server internal IP is 192.168.16.2
<The client has defined an IPsec tunnel, defining 192.168.16.X as the
<remote subnet.
<Now it seems like the tunnel is working since if I use one of the
<machines on the network I am able to connect to the client's office.
<But when I try to connect from the server itself the VPN does not
<work. I can see in ISA monitoring that the request to connect to the
<remote network is coming from the external IP of the server and not
<the internal address, and I can assume this is the problem.
<
<How can I solve this issue?
<
<Thanks in advance!
<
<Danny
<
<

I think it's even simpler than that, but I'm not sure how to fix it.
When I try to connect to the remote network from the server (running
ISA), it automatically uses the External network adapter since the
Internal network adapter does not have a gateway defined and is only
used to access the internal network. Therefore, the source IP sent to
the remote site is the external IP of the server, and not the internal
as I would like it to be.
What I want to achieve is to have the SBS server computer behave like
any standard client computer on the network, and always use the
Internal network adapter for outbound access. Perhaps defining it's
own IP in the internal network adapter gateway can solve the problem,
but none of the configurations I've seen utilize this method.

You state that the remote site tunnel is on 192.168.16.x. The same
network as your SBS. SBS cannot know how to get there I would guess.
That is not the way I set up remote sites. The remote site is on its
own network like 192.168.15.x. I might add the command route add -p
192.168.15.0 mask 255.255.255.0 192.168.16.1 if the hardware vpn
router is at 192.168.16.1. I have only used hardware vpn routers for
site to site vpns.

Note that any network in the 192.168.x.x is private meaning
non-routable. Routes that can only be used for private stuff. They are
not used in the real world. Trying to obfuscate just makes making
sense of things more challenging.- Hide quoted text -

- Show quoted text -

You must have misunderstood me.
The remote site is not my subnet.
I was just restating what I read.

"I am trying to set up a simple site-to-site VPN from my SBS 2003
running ISA 2004 to a client's office. Our internal subnet is:
192.168.16.X and the server internal IP is 192.168.16.2 The client has
defined an IPsec tunnel, defining 192.168.16.X as the remote subnet."

So is this a software vpn? No routers involved? I never saw the answer
to the question what is the ip scheme is on the remote office?
.

Relevant Pages

  • Re: [Full-disclosure] Remote Desktop Command Fixation Attacks
    ... This set of steps is redundant in many places, and it's also enormously expensive, since you're using no less than three different expensive bits of networking hardware (AP, PIX, VPN Concentrator), in addition to a bunch of x86 server hardware, windows server licenses, and at least one ISA license. ... Your computers necessarily don't have full access to your network infrastructure when they aren't logged on, so GPOs, software updates, etc can't be applied at the times you want them to be applied. ... Turning on, enabling, and implementing every possible security setting and device you think of is not defence in depth, and will probably only have two effects - your users won't use your wireless network, and you'll burn so much cash you won't have any left to spend on *useful* security measures. ...
    (Full-Disclosure)
  • Re: Remote Access and ISA Server in SBS 2003?
    ... I am glad to hear the Remote Access Wizard is working fine now. ... there is no difference in VPN between SBS 4.5 and SBS ... Error Message: VPN Connection Error 800: Unable to Establish Connection ... the external NIC of the SBS Server. ...
    (microsoft.public.windows.server.sbs)
  • Re: VPN with SBS 2003 (not R2) and DSL.
    ... Reading property value for VPN returned OK ... Reading VPN Server Name returned OK ... identical network cards. ... it seems doubtful that SBS will work properly with two NICs ...
    (microsoft.public.windows.server.sbs)
  • RE: SBS 2003 sudden services problem over router based vpn
    ... I understand that your remote cannot receive POP3 emails through VPN ... SBS Server through routers. ...
    (microsoft.public.windows.server.sbs)
  • RE: VPN Connection Problems
    ... Note that we are able to successfully VPN into the office. ... to browse the network, RDP to the server or even ping the server. ... > This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)