Tag Info

Hot answers tagged

5

255.255.255.255 is the layer 2 broadcast address. NetBIOS is a layer 3 protocol. As such you should be seeing NetBIOS broadcasts to x.x.x.255, where x.x.x is your subnet address. Broadcast traffic to 255.255.255.255 is related to some layer 2 protocol, not NETBIOS. Here's an example of a NetBIOS name query on my home network from my workstation ...


4

Looks like this is a ISA/TMG built-in behaviour, and it can't be altered at all.


4

Look at enabling HTTPS inspection and push out the Forefront TMG client to set up your workstations to correctly set the browsers proxy values. A great many of Forefront's more advanced features require the web browser to be correctly configured to use the Forefront server as a proxy. Also there is an existing web mail category you can block without having ...


4

This apparently is an issue with iOS. It does not automatically pick up WPAD. You can work around this by going into the Wi-Fi settings for your network, setting the HTTP Proxy setting to Auto and entering http://wpad/wpad.dat? into the URL setting for the device.


4

From the perspective of defense from attack, not filtering in/out data of course does not add anything of value. One could argue that proxying without forethought in fact lowers security in that: greater complexity is introduced, often with a vengeance. less transparency in that multiple log and alerting layers need correlation per transaction. attack ...


3

"During that time switches hanged 2 times and required hard resets" I'm not trying to be elitist here, but Linksys/D-Link/Netgear isn't even mid-size grade hardware. iSCSI and Virtualization requires a very stable and quick network to perform properly. I strongly suggest you buy better networking gear (Cisco, HP etc).


3

The problem is twofold: your browser is sending an internal request to TMG in the first place, and TMG is preventing a possible reflection attack (or at least, has no rule to allow it) Depending on how your browser is configured, the better solution from a minimum-wasted-computing-cycles perspecive is to to provide it with information that lets it not ...


3

I'm pretty sure this has to do with the way TMG is designed. According to: http://technet.microsoft.com/en-us/library/cc995133.aspx Bypassing Forefront TMG for firewall client requests Microsoft Forefront Threat Management Gateway is designed to handle communications between different networks. Usually, clients on a specific network should ...


3

It looks like Microsoft has "officially" announced support of of TMG on Hyper-V - http://www.microsoft.com/forefront/threat-management-gateway/en/us/default.aspx As Tatas stated. Just because TMG is on the hypervisor, there is no technical requirement for the hypervisor itself to be exposed. The virtual-to-physical NIC assignments under the hypervisor is ...


3

A VPN network is actually a router. And a router does not forward unlimited broadcasts (255.255.255.255). Those broadcasts are only valid in a local sub net. In order to forward those broadcasts through a VPN you have to bridge the layer 2 (Ethernet) through the VPN.


3

That tutorial describes how to set up your networks in TMG but it makes no mention of firewall rules. After installation, TMG is configured with just one firewall rule which denies all traffic from anywhere, to anywhere. It's up to you to configure the access rules. Did you? EDIT: Regarding your GMail problem, does it do this with any SSL site? If so, have ...


3

The problem is caused by the TMG gateway doing HTTP inspection, which disables certain not-oft-seen-in-the-wild HTTP verbs. Watching the connection attempt in WireShark, we see: CONNECT /sdkTunnel HTTP/1.1 And reproducing this in Telnet shows us: <LI id=L_default_11>Error Code: 500 Internal Server Error. The parameter is incorrect. (87) <LI ...


2

We run TMG in VMWARE, so yes virtualization is definitely a viable option. Hyper-V is no different. You could create a new VM network specifically for the TMG guest(s). That would help isolate the nics/traffic. Our TMG's are publicly addressed (we use them to reverse proxy exchange). I don't see an overwhelming reason to put it in the DMZ, but it would ...


2

You'll need the second NIC in a different subnet in order for Windows routing to be happy. Then, TMG NATs between the internal subnet, and the external subnet (using the Edge layout anyway). To push all traffic through the TMG box, point clients to it as the default gateway. It's likely to be a fairly major change to how the network works at the moment, so ...


2

TMG can act in the manner you described, but it can also act a normal firewall, or as a NAT/firewall as well. It can also act as a reverse proxy. If your application sticks to standard TCP/UDP communication, TMG can publish it. If it uses HTTP, then TMG can publish it, route it, and even inspect it.


2

The "Network Rule" you show is actually a "Firewall Rule". As well as the firewall rule you have set up you also need a network rule that tells TMG what the relationship is between the two networks i.e. whether traffic should be routed or NAT'd Go to Network -> Network rules and add a rule in and it should start working


2

No, there's no bandwidth management built-in TMG 2010 as of SP1.


2

TMG doesn't support FTPS (that's FTP + SSL, rather than SFTP, or SSH File Transfer, which generally works fine) FTPS is Really Hard to do with an FTP filter, because the FTP NAT filter watches for information the client behind NAT sends to the FTP server, and encryption causes that not to be visible. And that annoys NAT inspectors. If Total Commander ...


2

It means your publishing rule is set up (correctly!) to only allow authorized users. When you connect to the OWA server the TMG first needs to find out who you are to work out what you are allowed to do with respect to the firewall e.g. what publishing rules apply etc. Once that is done the request is passed on to Exchange Server which then shows you the ...


2

DO NOT INSTALL HYPER V ON TOP OF SBS! YOU WILL BREAK THINGS! With that said, you may use Hyper V in conjunction with SBS, but you must install Windows Server Standard on the bare metal and only enable the Hyper V role on it. Once this is done, create a virtual machine for SBS and another virtual machine for Windows Server standard. That second virtual ...


2

The SSTP VPN service is always associated with a HTTPS web listener; you can change the certificate it uses in its properties. If you have lots of listeners around and/or don't know what listener the VPN service is using, you can check that in the VPN properties, in the "Protocols" tab. Edit: For L2TP/IPSEC, there is no option in the TMG (or ISA) ...


2

Normally what we tell users is to put the device in "flight" or "airplane" mode, cutting off network access when they are ready to change password, once they change the password on Desktop/Laptop, then they can enter the new password in device and connect back to network. Of course we also send the expiry notification so that they are well prepared for the ...


2

I think your best bet is to use a transparent proxy to intercept and redirect requests to your video. It's not for the average Joe but being on an IT team I have faith you can make it work with the existing howtos and tutorials. I did, and I'm just a hobbyist admin/programmer :). I accomplished it with Squid and iptables. Edit: What I did was test out this ...


2

You've got TMG set to inspect downloads (ie Scan for Malware). You need to disable that for the Adobe downloads to work correctly. Side note: You don't have to use Adobe's Updater, you can just download the update files from Adobe too. From Technet - Defining exemptions to malware inspection To specify destinations and sources exempt from malware ...


2

There was a time that the default install of Apache simply had fewer known security holes than a default install of IIS; that alone was a security improvement. Thus, it may have simply become tribal lore because it was once a best practice.


1

Just for the record, TMG can be installed with some tricks: Install the Microsoft Loopback adapter (hdwwiz) Set a static address in the private IP range (e.g. 10.0.0.1/255.0.0.0, no default GW) for the loopback adapter and disable DNS registration in the TCP/IP settings for the adapter Install TMG Upgrade TMG to SP1 or use a bootstrapped installation ...


1

You probably don't need to retain the original IP in the actual TCP header. Many reverse proxy setups will allow passing the original IP address the request was made from as an HTTP header. (See for example: Squid configuration directive forwarded_for.) Apache with mod_proxy would also do the trick, and will also add X-Forwarded-For headers for ...


1

The New > Cert to Issue thing, you just have to wait 5 minutes for AD to catch up. You are correct that you can't issue certs that are based on AD information to non-AD members. You can use the Web Interface, CA Management Console, certutil, or PowerShell to process the CSRs. Note: The above requires Enterprise or DC versions of Windows Server. Standard or ...


1

TMG as a VM works well, and there us a technet video that describes various scenarios using TMG, just google "Virtualize your ISA or Forefront TMG servers". As always in these things, there is best practice, good practice, and stupid . Best practice as espoused by the vid is to have your virtualised TMGs on hardware that's specifically used for perimeter ...


1

Grab a network trace from the inside of the TMG box while you're authenticating from a client; that'll show you the ticketing exchange with the DC. (assuming the logs don't have a particular error). Though 403.7 roughly translates to Client Certificate Required. If this is the error you're seeing in the W3 logs on the web server, you need to disable Client ...



Only top voted, non community-wiki answers of a minimum length are eligible