Microsoft Forefront Threat Management Gateway 2010 is the current version of the product previously known as ISA Server. TMG 2010 adds subscription-based URL filtering and malware protection, the free-subscription-based Microsoft IPS Network Inspection System, and HTTPS inspection.

learn more… | top users | synonyms (1)

10
votes
8answers
11k views

ActiveSync devices causing accounts to lockout

When a user changes his account password for whatever reason (read: expired), and the old password is stored in his mobile device connected through EAS. This will cause his account almost immediately ...
6
votes
3answers
1k views

Best way to authenticate users to the proxy in mobile devices

As example, in Forefront TMG I can have a wpad entry in the DNS and computers discover it and autoconfigure the web proxy. When the user tries to go to the Internet he is promptped for the ...
5
votes
1answer
945 views

Threat Management Gateway 2010 is killing SQL Connections

My company has just started using TMG 2010 as our Firewall / Web Proxy on a Windows 2008 R2 server. Since moving, all connections to SQL Server are closed after around 30 seconds. For example: ...
4
votes
2answers
102 views

Why bother reverse proxying applications if you aren't using mod_security or TMG/UAG?

Common wisdom is that internal applications that live inside of the trusted network, such as Exchange, should be reverse proxies whenever they are exposed to the Internet. Microsoft recommends using ...
4
votes
2answers
439 views

IPSec tunnel on ASA keeps disconnecting

I have an ASA IPSec tunnel configured between an ASA5505 and Microsoft TMG 2010 SP2. The tunnel sometimes works for a few hours, and then disconnects, and other times it works for 5 minutes and then ...
3
votes
1answer
173 views

vSphere Site Recovery Manager cannot connect, gives Error 500

I am attempting to set up a vSphere Site Recovery Manager lab. I have two datacenters linked via a site-to-site VPN with Microsoft Threat Management Gateway 2010 SP1. I am attempting to add the two ...
3
votes
2answers
9k views

TMG 2010 does not proxy back to the same network as the request

I have an issue where websites that are hosted on a web server (www.example.com) are not accessible from their own network when accessed via its public IP address, but they are accessible from every ...
3
votes
1answer
1k views

How to bypass Forefront TMG for downloading from Adobe Cloud

I hope that this question has not been asked as I've spent a couple of days googling around trying to find a solution. I have one computer that needs to download from Adobe Cloud to install ...
3
votes
1answer
273 views

redirect all youtube video requests to a specific one

I'm on an IT team in my company and I would like to block youtube to users. I don't want to just deny access to the whole youtube domain, but only to replace the .flv/.mp4 request with the one that I ...
3
votes
1answer
2k views

Limiting bandwidth of workstations in MS Forefront TMG

We have configured Microsoft forefront TMG 2010 Enterprise as the cache server which provides internet access for all computers in our department. Is there any way to limit download speed per ...
2
votes
3answers
2k views

Allow Broadcast to 255.255.255.255 through TMG/VPN (for NetBios Resolution)

Is it possible to allow a VPN client to do NetBIOS broadcast name resolution through TMG? In the TMG Queries I can see the rule that is blocking ClientIP->255.255.255.255 I've tried adding ...
2
votes
3answers
436 views

How to send authentication credentials to a published web site without prepending the AD domain name?

ISA Server 2006 publishing a web site; ISA does forms-based authentication against an Active Directory domain (which ISA itself is joined to), then, if the user is authorized, ISA sends the user's ...
2
votes
2answers
1k views

TMG/ISA FWX_E_NETWORK_RULES_DENIED

I've got three disparit networks that all terminate at a TMG machine. I am trying to communicate between two of these networks, but the TMG firewall keeps dropping the connection as ...
2
votes
2answers
4k views

How can I setup RD Gateway on the same server as TMG?

I have used the following guides with no luck: http://www.rayheffer.com/953/building-a-remote-desktop-gateway-rdg-rd-gateway-server/ ...
2
votes
1answer
343 views

Changing Forefront TMG VPN Certificate

I need to change my TMG server from an old VPN server certificate to a new one due to changing my internal CA structure. Where the heck do I do that? I don't see any certificate references in TMG ...
2
votes
1answer
3k views

Access FTPS from behind Forefront TMG

I have a web server on which IIS 7 host an SSL-enabled site. The client in am trying to connect with is behind the corporate Forefront TMG. The app is Total Commander - a file manager shell, that has ...
2
votes
2answers
181 views

How to configure a windows phone 7 to access website behind Forefront Threat Management Gateway

As in the title. We have a WCF service, and a Windows Phone 7 client. One of our customers wants to install the service behind a TMG server. I know that TMG is an update to the old ISA server and I ...
2
votes
3answers
1k views

Are there other application layer firewalls like Microsoft TMG (ISA) that do advanced http rules?

Since the old days, ISA and now TMG have had several great features that I often want to deploy to my customers because of the enhanced functionality and security, but often the cost of an additinal ...
2
votes
2answers
188 views

Use a dedicated subnet to connect all routers/firewalls?

I have a couple router/firewall boxes (pfSense, TMG 2010, ISA 2006) on my network that are stateful. Right now they all have an interface on the same subnet as most end user devices and servers. I ...
2
votes
1answer
133 views

Does TMG Reporting hate the month of July?

We have a ForeFront TMG 2010 SP1 installation. Reporting in the past has worked great. However, I now need to find out why we've ripped through half our monthly quota in the first 6 days of the ...
2
votes
3answers
2k views

Forefront TMG 2010: Can you monitor realtime TCP connections and bandwidth on a per-user basis?

I'm just starting a trial of ForeFront TMG to use as a proxy server. I know I can get a real time activity monitor and filter on a per user basis, but would like to be able to get a real time ...
1
vote
2answers
922 views

Should I Run TMG as a Hyper-V Guest

Okay here's an interesting question. In two parts: Is it advisable to run TMG as a hyper-v guest in production? (something is nagging me that it's not a good idea, but it's possible to give a VM ...
1
vote
1answer
2k views

TMG 2010 Edge Firewall Setup - Internal subnet has no internet access

I just set up a TMG 2010 server as an edge firewall. The TMG machine has two NICs: LAN: IP-192.168.1.1, Netmask-255.255.255.0, DNS-192.168.1.3, Gateway-(blank) WAN: IP-119.x.x.98, ...
1
vote
1answer
13k views

Forefront TMG Proxy blocking internal HTTP requests for FQDN

I have Forefront TMG installed as a proxy server. However, whenever I make HTTP requests to servers on the Internal network with a fully qualified DNS name, the proxy denies the connection. Denied ...
1
vote
2answers
773 views

Publishing multiple web servers with reverse proxy on localhost, retaining original client IP and hostname

I have been using ISA on Windows Server 2003 to publish multiple web servers hosted on the same machine. Setup as follows: ISA HTTP/S listener bound to 127.0.0.1 + external IP IIS bound to 127.0.0.2 ...
1
vote
1answer
1k views

How to install TMG 2010 for SBS 2011

I would like to install TMG 2010 for an SBS 2011 installation. I only have one physical server. I'd like to know if the SBS premium add-on windows 2008 R2 license can be installed on a virtual server ...
1
vote
1answer
2k views

General Forefront TMG 2010 network / proxy configuration

We have decided to test and then deploy a Forefront TMG server on our network of 50 - 75 users (Windows 7, XP Clients, Windows Server 2008R2 Servers and a few Linux Boxes) Our Network Topology is : ...
1
vote
2answers
5k views

Configuring TMG to allow a connection through the firewall

Here's the basic outline of the problem: I'm trying to ping from 192.168.0.2 to 192.168.10.2, but the ping dies on reaching 192.168.10.1. Obviously TMG is blocking it with the firewall. :) ...
1
vote
1answer
1k views

Can Microsoft Forefront TMG handle users that are not part of a domain?

I'm a newbie and please excuse me if my question is so foolish :) Here is the scenario: In our company we have 50 PCs: 40 PCs have joined to the domain and 10 PCs haven't joined to the domain (simply ...
1
vote
1answer
193 views

BGP Multipath & return routes

I'm probably a complete n00b concerning serverfault related questions, but our IT department makes a bold statement I wish to verify. I've searched the internet, but can find nothing related to my ...
1
vote
2answers
220 views

Dedicated Server, Multiple VMs on the back, HyperV Up Front… Where do i put TMG?

As a follow up question to How Do i host multiple servers on HyperV with only a few public IP Addresses I am now trying to figure out where to put the ISA/TMG Server? Should it be virtualized, ...
1
vote
1answer
1k views

Publishing Activesync through TMG with client certificates (403.7 Forbidden)

I'm trying to publish Exchange 2003 activesync on a Server2K3 box, through TMG 2010 on a 2008R2 box, using client certificate on Android mobiles. From what I can tell, the issue is with TMG, as when ...
1
vote
2answers
787 views

Forefront 0xc0040017

I recently began to receive a huge (600 thousand to 2 million per day) number of FWX_E_TCP_NOT_SYN_PACKET_DROPPED, 0xc0040017 entries in my Forefront TMG logs. If the top 3 source IPs are any ...
1
vote
1answer
820 views

Redundancy and Automated failover using Forefront TMG 2010 Standard between Production-DR site?

I'm using MS TMG 2010 Standard as my single firewall to publish my Exchange Server and IIS website to the internet, however it is just one VM in the DMZ network with just one network card (vNIC), what ...
1
vote
2answers
2k views

How do I allow access to a service running on a Forefront TMG Server?

I'm setting up Zabbix for monitoring on our network. So far everything is going well, the agent is installed on all the servers. All the servers except the Forefront one are communicating with the ...
1
vote
2answers
926 views

VPN access configuration with ForeFront TMG

I am trying to configure VPN Client access with Microsoft ForeFront TMG 2010. When I try to add domain groups to allow access to them, under Group column I can only see the SID of the domain group. ...
1
vote
0answers
26 views

Route between two branch offices via IPsec VPN to head office?

I have TMG 2010 running on Server 2008 R2 in our head office with 2 branch offices connecting in using Dray Tek 2930 routers with IPsec site to site VPNS. The remote sites can route between the head ...
1
vote
1answer
46 views

TMG returns uncompressed content response from IIS

I'm fighting with my customer's TMG for a few days already and I'm out of ideas. I hope you can help me. As I understand it TMG is set as a proxy between Internet and local computer with IIS with my ...
1
vote
0answers
1k views

Outlook client behind forefront TMG 2010 unable to connect to External Exchange server

Here is my situation. Our office just got sold and we are working on the migration to the new company's environment. Everything has worked fine until the Outlook client's migration. Our firewall is ...
1
vote
1answer
251 views

Publishing a web app listening on two different ports with TMG

We have an internal web app built on some custom Java stuff. The app listens on port 8080, but also uses IIS on port 80 to get user authentication. Opening the site in a browser produces HTTP GETs ...
1
vote
1answer
474 views

Asymmetric routing with two ForeFront TMG 2010 firewalls

I have a bizzarre networking problem. There is a network, a single IP subnet: 192.168.60.0/24. The network has two Internet-connected firewalls (running ForeFront TMG 2010), 192.168.60.253 ...
1
vote
1answer
557 views

TMG with client certificates for TS Gateway

How to set up client side certificate authentication using an enterprise CA for a TS gateway via Forefront TMG 2010? To date I have executed the following: I have a Terminal Services Gateway ...
1
vote
1answer
440 views

789 connecting Forefront VPN

I am receiving event 789 when connecting to my Forefront TMG VPN server from windows 7 clients via L2TP. This does not occur on XP systems. I've run through the debugging at ...
1
vote
0answers
207 views

Can I map IP addresses to allow 2 site to site VPNs with same IP range using Microsoft TMG

I have a Microsoft TMG server with a number of site-2-site VPNs which all have different IP address ranges. Now a client has asked for another site-2-site VPN but their IP range clashes with an ...
0
votes
2answers
4k views

TMG 2010: how to block HTTPS access to certain sites?

Just installed Forefront TMG 2010 and set up firewall rules. My company's policy requires to block access to webmail sites, like gmail, yahoo mail, etc. So I added these webmail domain names to a ...
0
votes
2answers
1k views

How to diagnose severe network problems in small network?

We have fairly small network with managed and unmanaged switches (Netgear GS748T, Linksys SLM2024, DGS-1008D, DES-1008D, DES-1026G, SRW224G4), about 8-10 hosts Hyper-V with multiple virtual machines, ...
0
votes
2answers
3k views

Forefront TMG 2010 RDP Connections without non-standard ports

From my reading, it looks like the Forefront TMG will not allow the passing of RDP connections through the firewall without configuring a non-standard port for each IP address of the internal servers ...
0
votes
1answer
368 views

Exchange 2010 when accessing thru OWA shows 2 prompts for passwords

I've setup Exchange 2010 thru TMG and everything seems to work fine except that when accessing OWA there are 2 screens where you have to enter login and pass. The first one looks exactly the same as ...
0
votes
1answer
83 views

Can browse ftp.microsoft.com but not our own FTP site in IE

We want to have an FTP site that works the same way ftp://ftp.microsoft.com works. We want to be able to browse the FTP site in web browsers. It seems that just recently, users are unable to ...
0
votes
1answer
45 views

Url-based web site publishing on Windows Server platform

I have a Windows 2008 Enterprise SP2 server in a datacenter. It is 32bit OS. I need to be able to do a "smart" url-based web site publishing. So that with a single external IP I can publish many sites ...