Allow URL:Port in Forefront TMG

Question

I have Forefront TMG 2010 installed as a Proxy server to limit internet access to users. I usually have the following issues:

1- I can't configure Email clients (Outlook) with URLs of POP/IMAP and SMTP and I have to locate the respective IP to make it work directly through clients.

2- Accessing local network resources (i.e. Network printer) with a certain internal IP and an assigned port (i.e. 10.255.255.20:3911) is impossible while Firewall is ON.

3- Certain URLs (usually secure HTTPS) with different ports (i.e. https://www.contoso.com:2083) are not working.

I tried tens of walkthroughs to add new outbound protocol with specified protocols but none of them work for me.

Answer 1

1 - you need to plan name resolution. If the clients don't connect to a DNS server that does Internet names, this is expected. TMG can do that for HTTP URLs, but not random no-name stuff, unless you install the Firewall Client on the client computers.

2 - Confused question. Firewall where is on to break this? If you're using the firewall client (is that the "firewall ON"?), you need to make sure your internal network definition covers all IPs within the internal network, so that clients don't try to use the FWC for connections within the local network.

3 - TMG blocks random SSL ports by default, so you need to use the TunnelPortRanges script to fix that. https://technet.microsoft.com/en-us/library/cc302450.aspx

Answer 2

1- I can't configure Email clients (Outlook) with URLs of POP/IMAP and SMTP and I have to locate the respective IP to make it work directly through clients.

This means your clients' DNS requests are failing. You need to either allow DNS requests to go out to the Internet and configure external DNS servers on the client side, OR you need to set up a DNS server with root forwarders configured to external servers and your clients need to have your DNS server's IP configured as their preferred DNS server. You can also set it up on your TMG server.

2- Accessing local network resources (i.e. Network printer) with a certain internal IP and an assigned port (i.e. 10.255.255.20:3911) is impossible while Firewall is ON.

Add the local resource LAN IPs to exclusions in your browser and system Internet Options (in Control Panel) so the request always goes directly instead of via the proxy server.

3- Certain URLs (usually secure HTTPS) with different ports (i.e. https://www.contoso.com:2083) are not working.

You need to create and run a script to modify the TMG OS's definition of SSL. I use ISA_TPR which is pretty straightforward, i.e. delete SSL and add SSL with range set to your desired one, e.g. 443 8443 or 443 9999. The only drawback is that it doesn't allow the range to extend oover port 9999. http://www.isatools.org/isa_tpr.js