I have two web sites I wish to publish to the Internet via ISA 2006 (integrated mode).
The first one works fine and has done for a while. The second one I am trying to get working recently. It works for external clients (i.e. Internet), but not for internal clients (i.e. behind the ISA server). I have two listeners, and two publishing rules.
First, the listeners:
First (fully functional) Listener: (mySite)
Networks: Internal, External Connections: Enable SSL (HTTPS) connections on port 443 Certificates: mysite.mydomain.com.au Authentication: No authentication
Second (new) Listener: (mySite8083)
Networks: Internal, External Connections: Enable SSL (HTTPS) connections on port 8083 Certificates: mysite.mydomain.com.au Authentication: No authentication
Now, the web publishing rules:
First (fully functioning) Web Publishing Rule:
Protocols: HTTPS From/Listener: mySite From: Anywhere To: mysite.mydomain.com.au To (computer name): webA.mydomain.local, (forward original host header) Condition: All Users Public Name: mysite.mydomain.com.au Bridging: Redirect to SSL port 443 Link Translation: no
Second (new) Web Publishing Rule:
Protocols: HTTPS From/Listener: mySite8083 From: Anywhere To: mysite.mydomain.com.au To (computer name): webA.mydomain.local, (forward original host header) Condition: All Users Public Name: mysite.mydomain.com.au Bridging: Redirect to SSL port 8083 Link Translation: no
It's probably not relevant, but
webA.mydomain.local:443 is served by IIS7 and
webA:mydomain.local:8080 is served by Tomcat.
Browsing from the External (Internet) or Internal (behind ISA) networks to
https://mysite.mydomain.com.au:443/ has always worked and none of my changes has affected this.
Browsing from the External network to
https://mysite.mydomain.com.au:8083/ works fine and brings up the same site that an Internal user would get if browsing to
Browsing from Internal network to
https://mysite.mydomain.com.au:8083/ doesn't work (it rejects connection immediately) and this is the problem. At first I got this error while tracing the logs:
Log type: Web Proxy (Forward) Status: 12204 The specified Secure Sockets Layer (SSL) port is not allowed. ISA Server is not configured to allow SSL requests from this port. Most Web browsers use port 443 for SSL requests.
Some web searches later I came across this article Managing Tunnel Port Ranges at TechNet, and used this information to add port 8083 to the SSL-Tunnel-er. Now my internal clients generate a different log message (takes 4-5 seconds to reject now):
Log type: Firewall service
Source: Internal (my.ip.0.123:56891)
Destination: Local Host (public.ip.0.123:8083)
Protocol: Unidentified IP Traffic (TCP:8083)
I think I could probably fix it by getting a wildcard certificate, publishing the second rule on a different public name such as
myothersite.mydomain.com and using the first listener
mySite which uses port 443. The bridging to 8083 should still work. I might not be able to get a wildcard certificate though due to the extra cost.
Does anybody have any other ideas or perhaps can see if I am doing something wrong or could do something better that might also solve my dilemma?
Thanks in advance.