Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just set up a TMG 2010 server as an edge firewall. The TMG machine has two NICs:

  1. LAN: IP-, Netmask-, DNS-, Gateway-(blank)
  2. WAN: IP-119.x.x.98, Netmask-, DNS-(blank), Gateway-(119.x.x.97)

The TMG's LAN NIC is plugged into a switch, into which all other subnet PCs are also plugged; while the TMG's WAN NIC is plugged with the ISP's cable coming into our office. That's the network topology. The subnet PCs are set up to use static IPs 192.168.1.x, DNS and Gateway

I followed the steps in this tutorial, and also enabled Web Protection, so that created two additional firewall rules: one for block some default categories (like porn, etc), the other rule enables internal access to external network for HTTP and HTTPS for all users. But, the subnet PCs don't have internet access. I am new to ISA/TMG, and Firewall/Gateway in general, can someone please shed a light on this? Thanks.

UPDATE: I got the internet working, finally. It turned out that I accidentally enabled web proxy on the LAN NIC, so it's turned off. Also, I added DNS to the allow internal web access rule in addition to HTTP and HTTPS. So now it's working fine.

But, there is still some problem: I can't access the gmail page, it says the site's security certificate is not trusted and just won't load the page.

share|improve this question
up vote 3 down vote accepted

That tutorial describes how to set up your networks in TMG but it makes no mention of firewall rules.

After installation, TMG is configured with just one firewall rule which denies all traffic from anywhere, to anywhere. It's up to you to configure the access rules. Did you?

EDIT: Regarding your GMail problem, does it do this with any SSL site? If so, have you perhaps enabled HTTPS inspection? If you do this, you will also need to deploy a certificate to your clients. TMG uses this certificate to re-encrypt the connection from the client to the TMG server.

share|improve this answer
Yes, I enabled Web Protection, so that created two additional rules: one for block some default categories (like porn, etc), the other rule enables internal access to external network for HTTP and HTTPS for all users. – Tong Wang Jun 11 '12 at 12:25
Is my network topology OK? Can the TMG server as the default gateway for internal subnet? – Tong Wang Jun 11 '12 at 12:26
Yes, TMG can be your default gateway (if you're not configuring your clients to use the proxy service or the firewall client, this is known as SecureNAT). If you're still having problems, check out the Logging section under the Logs and Reports area. You can define a filter that specifies the client IP of one of your internal client machines. Try and access the web and see what the logging shows. If the traffic is being denied, the log will tell you why. – Chris McKeown Jun 11 '12 at 14:25
Yes, I enabled HTTPS inspection. Can you please elaborate a little bit more on how to create this certificate and how to deploy it to client PCs? Do I need to have a AD CS role on the PDC? Thanks. – Tong Wang Jun 15 '12 at 17:13
TMG can generate one by itself - but you'd obviously have to deploy that manually to your clients to ensure that they trust it. If you do have a CA on your domain, you can generate a cert singned by that and use it for TMG's HTTPS inspection. Since your domain clients trust the domain CA, you won't have to manually import the cert on your clients. – Chris McKeown Jun 18 '12 at 7:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.