My Fried Tech! - Isa 2006

ISA 2006 and Status: 64 The specified network name is no longer available

papabear — Mon, 29 Mar 2010 15:28:31 GMT

Recently someone reported that a banner ad they wanted posted on a page was not showing up internally, although it did when viewed from their home. The banner ad was a hyperlinked picture - snagged from an external site. What was happening internally was that the image simply did not appear, although the rest of the page rendered fine and the call to the remote site's page (wrapped in a javascript script tag) was in the page source.

When I tried to open the specific page I received a error status 64 - The specified network name is no longer available.

Suspecting that the blockage was caused by ISA, and also suspecting that the blockage might actually be a good thing, I loaded fiddler on a outside client and tried to access the page. Sure enough, fiddler (once again) came through. The issue? In the words of fiddler 'This buggy server did not return headers.'

The issue is that whoever was returning the code stripped out all headers. While browsers will let that pass, ISA will block it.

The solution? Fix those darn headers!!!!

ISA 2006, Sharepoint 2010 giving HTTP 500 internal server error on HTTP Filter

papabear — Tue, 16 Mar 2010 19:26:51 GMT

Recently when playing around with the Sharepoint 2010 beta I extended a site to use Forms and passed that through ISA 2006.

This is all very basic stuff, there are a number of good references on how to set this up, but what I did not expect was the http 500 internal error on my browser (see below).

The solution was to modify the HTTP filter (egad! an error message that actually gives the correct problem!) within ISA for that Rule (right-click the rule and select "Configure HTTP") and uncheck "Verify normalization" (see image below). I do not know if this is restricted to Sharepoint, but I suspect that will all the razzle-dazzle that SP2010 is trying to pull off it is tripping over the big feet of ISA...

Error Code: 403 Forbidden. ISA Server is configured to block HTTP requests that require authentication. (12250)

papabear — Wed, 03 Jun 2009 17:41:17 GMT

When moving to a new IP address range I decided to clean up some of my ISA rules. I consolidated a number of websites into a new listener, but when I tried to access them I got:

Error Code: 403 Forbidden. ISA Server is configured to block HTTP requests that require authentication. (12250)

Now I was pretty sure I had setup the listener for No Authentication, and sure enough it was. But I have forgotten to specify that the client could allow authentication over HTTP (see image below). Once it was "allowed" everything was back to normal...

Edge Server unable to send or receive emails

papabear — Wed, 03 Jun 2009 17:35:07 GMT

Hint: it isn't ISA

We recently moved to a new set of IP addresses and a new router and while most everything was running fine our Edge Server was having trouble sending/receiving from the world at large.

Now I have the Edge in a DMZ in order to use a public address since ISA does not doing client NATing at all (curse you!) and initially I suspect there was something in my subnetting or some such that was the problem. Maybe it was the "Perimeter" network object that was the issue? Could it be something whacky with my ruleset?

However, I was able to connect from our hub server to the edge server (ie from in to out). I was able to connect back to the hub server. I could even get out from the hub server (using the default NAT address). I just could not get OUT from the edge server. No DNS lookup (using outside), no web browsing, and definitely no SMTP happening here...

I kept going over and over looking for what I had configured wrong on ISA or on the Edge server or in DNS...

So I enabled pinging on the ISA server for all Networks so I could check and sure enough, while I could ping the "External" Nic's ip addresses from the router, I could not ping the DMZ Nic, much less the Edge server on the other side of it.

There was no route manually specified for the particular IP address that the Edge server was running. DOH!!!! A wee bit o cisco magic and *voila* email flowing like there is no tomorrow.

Assumptions, assumptions, assumptions...

Note to self - watch out for ISA 2006 Listeners and Sharepoint AAM

papabear — Mon, 01 Jun 2009 17:43:34 GMT

I had setup AAM w/ Sharepoint and our ISA servers. What had not occured to me was that the Connection Verifier was tied to port 80 (I had not put it somewhere else). So when I removed that site *boom*.

Changed ISA Verifier to the correct port and it works fine...

Activesyncy 2007, Isa 2006 and 0x85010014 error

papabear — Fri, 15 May 2009 17:40:10 GMT

When we migrated to x07, our Activesync started throwing the ol' 0x85010014 error. If you search for this online you will discover that it is one of the more common errors and there are about a dozen ways to fix it.

None of them worked. Everything was as it should be. I was completely flummoxed, until I stumbled across a post in a forum where someone said that he had solve the problem by changing the ISA "To" tab on the rule to cause the Request to come from the Original Client (see pic below). Tried that and voila, it worked!

Now I am not sure if there was not something else going on and I have not tried to change the rule back (my users get antsy if their phone stops synching), so take this with a grain of salt. Still, if you are pulling your hair out, try this:

Installing ISA 2006 on Windows 2008

Thu, 30 Apr 2009 19:26:07 GMT

Can't be done.

Any attempt to install will be met with "This operating system in not supported..." Supposedly the next version of ISA will be happy, happy, joy, joy, but not this one.

Could there be a hackaround? Probably. Should you do it? Probably not. Hacks can leave doors open unless you are positive you know where all the moving parts are.

So, buck up and used the old w03. At least for now...

The Web Proxy filter failed to bind its socket to .... or why you can't have Virtual Server & ISA 2006 on the same box

papabear — Sun, 26 Apr 2009 19:29:53 GMT

I installed ISA 2006 on a new firewall box. Or rather reinstalled, since I had stuck the trial version on because I NEEDED IT UP NOW!!!!!!!!!!!!!!

Of course I had stuck on the trial version and then let it expire so our website was suddenly unavailable. My cohort Patrick spent many frurstrating hours trying to get SOMEONE at MSoft to give us a license key so we could reactivate it.

Meanwhile....

I downloaded the MSoft Virtual Server for Windows 2003 R2, whipped it on the box, installed the trial version of ISA 2006 (AGAIN), and got it up and running.

Don't try this at home. I mean you, Lee.

Anyway, that was dandy and finally, much later, Patrick finally got ahold of someone who let him know that the license key was already in the product that we download via EA.

Ahhhhh

So today I decide to install ISA 2006 for real, and shut down the Virtual Server. I do so, and discover that I no longer have a site. My web server is groovy, but my firewall is throwing hissy fits. Egads, horror in the land.

So I restart the Virtual server, shutting down the ISA 2006, and now IT does not work. Shut down the Virtual Server and try again with the real thing.

hmmm

A wee bit o troubleshooting later I figure out that the network cable is bad (although it DID appear to work on the screen, it just couldn't GET anywhere).

Problem one solved.

Now I reboot it (why not) and see the error above. Thank the heavens for Google - turns out that ISA 2006 refuses to run if you have IIS installed. Virtual Server (for administration) requires IIS to be installed. Hence the bloody battle.

Deinstall Virtual Server. Deinstall IIS.

*boom*

it is working and I am going home!