Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two web sites I wish to publish to the Internet via ISA 2006 (integrated mode).

The first one works fine and has done for a while. The second one I am trying to get working recently. It works for external clients (i.e. Internet), but not for internal clients (i.e. behind the ISA server). I have two listeners, and two publishing rules.

First, the listeners:

  1. First (fully functional) Listener: (mySite)

    Networks: Internal, External
    Connections: Enable SSL (HTTPS) connections on port 443
    Certificates: mysite.mydomain.com.au
    Authentication: No authentication
    
  2. Second (new) Listener: (mySite8083)

    Networks: Internal, External
    Connections: Enable SSL (HTTPS) connections on port 8083
    Certificates: mysite.mydomain.com.au
    Authentication: No authentication
    

Now, the web publishing rules:

  1. First (fully functioning) Web Publishing Rule:

    Protocols: HTTPS
    From/Listener: mySite
    From: Anywhere
    To: mysite.mydomain.com.au
    To (computer name): webA.mydomain.local, (forward original host header)
    Condition: All Users
    Public Name: mysite.mydomain.com.au
    Bridging: Redirect to SSL port 443
    Link Translation: no
    
  2. Second (new) Web Publishing Rule:

    Protocols: HTTPS
    From/Listener: mySite8083
    From: Anywhere
    To: mysite.mydomain.com.au
    To (computer name): webA.mydomain.local, (forward original host header)
    Condition: All Users
    Public Name: mysite.mydomain.com.au
    Bridging: Redirect to SSL port 8083
    Link Translation: no
    

It's probably not relevant, but webA.mydomain.local:443 is served by IIS7 and webA:mydomain.local:8080 is served by Tomcat.

Browsing from the External (Internet) or Internal (behind ISA) networks to https://mysite.mydomain.com.au:443/ has always worked and none of my changes has affected this.

Browsing from the External network to https://mysite.mydomain.com.au:8083/ works fine and brings up the same site that an Internal user would get if browsing to https://webA.mydomain.local:8080/.

Browsing from Internal network to https://mysite.mydomain.com.au:8083/ doesn't work (it rejects connection immediately) and this is the problem. At first I got this error while tracing the logs:

Log type: Web Proxy (Forward) Status: 12204 The specified Secure Sockets Layer (SSL) port is not allowed. ISA Server is not configured to allow SSL requests from this port. Most Web browsers use port 443 for SSL requests.

Some web searches later I came across this article Managing Tunnel Port Ranges at TechNet, and used this information to add port 8083 to the SSL-Tunnel-er. Now my internal clients generate a different log message (takes 4-5 seconds to reject now):

Denied Connection
Log type: Firewall service
Status:
Rule:
Source: Internal (my.ip.0.123:56891)
Destination: Local Host (public.ip.0.123:8083)
Protocol: Unidentified IP Traffic (TCP:8083)

I think I could probably fix it by getting a wildcard certificate, publishing the second rule on a different public name such as myothersite.mydomain.com and using the first listener mySite which uses port 443. The bridging to 8083 should still work. I might not be able to get a wildcard certificate though due to the extra cost.

Does anybody have any other ideas or perhaps can see if I am doing something wrong or could do something better that might also solve my dilemma?

Thanks in advance.

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.