Tag Info

Hot answers tagged

5

255.255.255.255 is the layer 2 broadcast address. NetBIOS is a layer 3 protocol. As such you should be seeing NetBIOS broadcasts to x.x.x.255, where x.x.x is your subnet address. Broadcast traffic to 255.255.255.255 is related to some layer 2 protocol, not NETBIOS. Here's an example of a NetBIOS name query on my home network from my workstation ...


4

Looks like this is a ISA/TMG built-in behaviour, and it can't be altered at all.


4

Look at enabling HTTPS inspection and push out the Forefront TMG client to set up your workstations to correctly set the browsers proxy values. A great many of Forefront's more advanced features require the web browser to be correctly configured to use the Forefront server as a proxy. Also there is an existing web mail category you can block without having ...


4

This apparently is an issue with iOS. It does not automatically pick up WPAD. You can work around this by going into the Wi-Fi settings for your network, setting the HTTP Proxy setting to Auto and entering http://wpad/wpad.dat? into the URL setting for the device.


4

From the perspective of defense from attack, not filtering in/out data of course does not add anything of value. One could argue that proxying without forethought in fact lowers security in that: greater complexity is introduced, often with a vengeance. less transparency in that multiple log and alerting layers need correlation per transaction. attack ...


3

The problem is caused by the TMG gateway doing HTTP inspection, which disables certain not-oft-seen-in-the-wild HTTP verbs. Watching the connection attempt in WireShark, we see: CONNECT /sdkTunnel HTTP/1.1 And reproducing this in Telnet shows us: <LI id=L_default_11>Error Code: 500 Internal Server Error. The parameter is incorrect. (87) <LI ...


3

That tutorial describes how to set up your networks in TMG but it makes no mention of firewall rules. After installation, TMG is configured with just one firewall rule which denies all traffic from anywhere, to anywhere. It's up to you to configure the access rules. Did you? EDIT: Regarding your GMail problem, does it do this with any SSL site? If so, have ...


3

A VPN network is actually a router. And a router does not forward unlimited broadcasts (255.255.255.255). Those broadcasts are only valid in a local sub net. In order to forward those broadcasts through a VPN you have to bridge the layer 2 (Ethernet) through the VPN.


3

"During that time switches hanged 2 times and required hard resets" I'm not trying to be elitist here, but Linksys/D-Link/Netgear isn't even mid-size grade hardware. iSCSI and Virtualization requires a very stable and quick network to perform properly. I strongly suggest you buy better networking gear (Cisco, HP etc).


3

I'm pretty sure this has to do with the way TMG is designed. According to: http://technet.microsoft.com/en-us/library/cc995133.aspx Bypassing Forefront TMG for firewall client requests Microsoft Forefront Threat Management Gateway is designed to handle communications between different networks. Usually, clients on a specific network should ...


3

The problem is twofold: your browser is sending an internal request to TMG in the first place, and TMG is preventing a possible reflection attack (or at least, has no rule to allow it) Depending on how your browser is configured, the better solution from a minimum-wasted-computing-cycles perspecive is to to provide it with information that lets it not ...


3

It looks like Microsoft has "officially" announced support of of TMG on Hyper-V - http://www.microsoft.com/forefront/threat-management-gateway/en/us/default.aspx As Tatas stated. Just because TMG is on the hypervisor, there is no technical requirement for the hypervisor itself to be exposed. The virtual-to-physical NIC assignments under the hypervisor is ...


2

DO NOT INSTALL HYPER V ON TOP OF SBS! YOU WILL BREAK THINGS! With that said, you may use Hyper V in conjunction with SBS, but you must install Windows Server Standard on the bare metal and only enable the Hyper V role on it. Once this is done, create a virtual machine for SBS and another virtual machine for Windows Server standard. That second virtual ...


2

The "Network Rule" you show is actually a "Firewall Rule". As well as the firewall rule you have set up you also need a network rule that tells TMG what the relationship is between the two networks i.e. whether traffic should be routed or NAT'd Go to Network -> Network rules and add a rule in and it should start working


2

TMG can act in the manner you described, but it can also act a normal firewall, or as a NAT/firewall as well. It can also act as a reverse proxy. If your application sticks to standard TCP/UDP communication, TMG can publish it. If it uses HTTP, then TMG can publish it, route it, and even inspect it.


2

You'll need the second NIC in a different subnet in order for Windows routing to be happy. Then, TMG NATs between the internal subnet, and the external subnet (using the Edge layout anyway). To push all traffic through the TMG box, point clients to it as the default gateway. It's likely to be a fairly major change to how the network works at the moment, so ...


2

We run TMG in VMWARE, so yes virtualization is definitely a viable option. Hyper-V is no different. You could create a new VM network specifically for the TMG guest(s). That would help isolate the nics/traffic. Our TMG's are publicly addressed (we use them to reverse proxy exchange). I don't see an overwhelming reason to put it in the DMZ, but it would ...


2

No, there's no bandwidth management built-in TMG 2010 as of SP1.


2

It means your publishing rule is set up (correctly!) to only allow authorized users. When you connect to the OWA server the TMG first needs to find out who you are to work out what you are allowed to do with respect to the firewall e.g. what publishing rules apply etc. Once that is done the request is passed on to Exchange Server which then shows you the ...


2

TMG doesn't support FTPS (that's FTP + SSL, rather than SFTP, or SSH File Transfer, which generally works fine) FTPS is Really Hard to do with an FTP filter, because the FTP NAT filter watches for information the client behind NAT sends to the FTP server, and encryption causes that not to be visible. And that annoys NAT inspectors. If Total Commander ...


2

The SSTP VPN service is always associated with a HTTPS web listener; you can change the certificate it uses in its properties. If you have lots of listeners around and/or don't know what listener the VPN service is using, you can check that in the VPN properties, in the "Protocols" tab. Edit: For L2TP/IPSEC, there is no option in the TMG (or ISA) ...


2

Normally what we tell users is to put the device in "flight" or "airplane" mode, cutting off network access when they are ready to change password, once they change the password on Desktop/Laptop, then they can enter the new password in device and connect back to network. Of course we also send the expiry notification so that they are well prepared for the ...


2

I think your best bet is to use a transparent proxy to intercept and redirect requests to your video. It's not for the average Joe but being on an IT team I have faith you can make it work with the existing howtos and tutorials. I did, and I'm just a hobbyist admin/programmer :). I accomplished it with Squid and iptables. Edit: What I did was test out this ...


2

You've got TMG set to inspect downloads (ie Scan for Malware). You need to disable that for the Adobe downloads to work correctly. Side note: You don't have to use Adobe's Updater, you can just download the update files from Adobe too. From Technet - Defining exemptions to malware inspection To specify destinations and sources exempt from malware ...


2

There was a time that the default install of Apache simply had fewer known security holes than a default install of IIS; that alone was a security improvement. Thus, it may have simply become tribal lore because it was once a best practice.


1

Considering tests we have done, i think there is a firewall that acts at application layer. I think they want to block FTP traffic coming from browser to only allow real FTP client (Filezilla and others). If it works fine with Chrome i think it is because Chrome acts more as a FTP client when url is ftp:// contrary to other browser.


1

Based on what I've read you should be able to continue down your current route. One thing that is very important if you are using a dual homed TMG is to use the "change source IP" options in your publishing rules. Without it you'll have your traffic routed back out the Cisco device and likely dropped since it doesn't have an established connection. That's ...


1

Well, first of all don't use port 443, that's the default SSL port. If you use a different port for RDP (your explanation doesn't ring true with me - I've never seen an ISP that filters port 3389, but I suppose anything's possible), then you should at least use a port that's not also in use by a common protocol or service. Second of all, TMG lets you ...


1

You have to configure the MSTSC client for the RD Gateway. The easiest thing to do would be creating Connection Files for each Workstation and providing them for the end users. Asking them to configure a Gateway on their own is a bit much for typical users. Once you have the file configured it should be easy to copy it, edit it with notepad and change the ...


1

You know, this would be funny if it would not show how little you understand from what you say. Some Microsoft products provide a dedicated proxy for external access, I'm thinking here about TFS Proxy TFS proxy is not for external access, it is a proxy an external location deploys to have a local cache of the data to improove speed. This basically ...



Only top voted, non community-wiki answers of a minimum length are eligible