SBS 2003 - ISA and ExchangeDefender IP Subnets

Since our switch to the ExchangeDefender service for our own e-mail is now over 72 hours old, we can be reasonably confident that there are no other e-mail servers out there that are using our old DNS MX records that pointed to our three SBS sites.

Since we purchased SBS 2003 R2 Premium SA for two of our sites, we will be migrating both sites to SBS 2008 and still be eligible to protect those sites with ISA.

In the mean time, our sites are still behind ISA running on SBS 2003 R2 Premium.

Now, the ExchangeDefender Deployment Guide addresses the need to limit the IP subnets to protect the internal Exchange server without getting into too much detail. The recommendation is to limit SMTP traffic at the firewall, but since there are so many firewall products out there, the deployment guide only shows us how to set the IP subnet restrictions into Exchange itself.

Here are the ExchangeDefender IP subnets:

ExchangeDefender IP Subnets

For SBS 2003 R2 Premium with ISA 2004 SP3 installed, and for the time when we migrate to SBS 2008 protected by our Software Assurance benefit of ISA 2006 SP1, the setup is actually quite simple.

In the case of SBS 2003 R2 Premium, we took the default SBS Smtp Server Access Rule that had the External network set as the From/Listener and removed it. We then created the ExchangeDefender Subnets in the Add dialogue on the From tab for the rule. The following screenshot shows the modification:

ISA - SBS Smtp Server Access Rule Properties - From Tab

And, once the edit is complete and the APPLY button in ISA has been clicked on:

Default SBS SMTP Rule modified with the ExchangeDefender subnets

The rule setup will be similar on the standalone ISA 2006 SP1.

Once the 72 hours have passed and legitimate e-mail is flowing solely through the ExchangeDefender network, head into the ISA live Logging feature and delimit the query on the SMTP protocol. It will become readily apparent that there are a lot of illegitimate SMTP connection attempts being made.

ISA blocking SMTP attempts

In this particular screenshot, the IP address is from Kiev (Kyyiv) in the Ukraine.

And this one is from Kuala Lumpur:

ISA blocking SMTP attempts

We certainly hope that as time goes by that the IP address associated with our Exchange server no longer resides on spammer's e-mail server IP address list.

Now that we have seen this, ExchangeDefender makes even more sense to us.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS 2008 Premium on Open Value Licensing - ISA considerations

This post is more to generate some creative juices in the old grey matter. ;)

Given the experiences we have had configuring ISA 2004 to work with our SBS 2008 lab setups, there look to be a couple of possible methods to make things work.

The key to it all folks: Take a very close look at your SBS 2003 SP1/R2 Premium setups with ISA 2004 installed and configured properly.

Look at how the SSL setup works and just how the Configure E-mail and Internet Connection Wizard sets the ISA SSL bridging up.

From there, it is possible to see two possible ways of configuring ISA:

1. Bridging using the SBS self-issued cert for RWW and an internal URL for RWW. ISA will bridge SSL for remote.mysbs2008.com to remote.mysbsdomain.local without the dreaded 500 errors.
2. Bridging using the split DNS setup built into SBS 2008. ISA bridge Internet remote.mysbsdomain.com calls to remote.mysbsdomain.com on the SBS 2008 box.

We have been using the second method to make everything work so far. The key factor is to make sure to import the third party SSL certificate with the Private Key in it.

But, since the current SBS 2003 SP1/R2 Premium setups with ISA 2004 use method 1, we will experiment with it to see if using the internal URL will break things on SBS 2008 ... a distinct possibility given the wizard's use of a split DNS setup.

We won't be able to do this until our lab setup has the SBS 2008 Win2K3 setup in place with ISA 2006 installed and waiting to be configured for use with the Springers' SBS 2008 network.

If the trial runs at setting up option 1 do not work, we will make sure to let you know...

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS 2K3 Premium - Configuring an SSL Wildcard Cert

Finding information on getting a third party SSL certificate installed on SBS Premium is a struggle.

In our case, we are looking to get away from the SBS self-issued certificate as much as possible. The amount of support related issues around that setup can be eliminated with the addition of a rather inexpensive investment in a third party certificate.

The process for setting up for the certificate is rather straight forward. The Official SBS Blog has a post on the initial part: How to Install a Public 3rd Party SSL Certificate on IIS on SBS 2003.

We create a dummy Web site in IIS, issued the certificate request from there, obtained the certificate from DigiCert, import it into the Intermediate Certification Authorities, and finally imported the certificate via the dummy site's certificate wizard. All of these steps are clearly outlined in the above blog post.

The blog author indicates that a further blog post is forthcoming on installing that certificate into ISA but none appear to be found.

The Configure Email and Internet Connection Wizard (CEICW) does have the ability to import a third party certificate, but it wants a *.cer file that does not seem to work from the many times we tried to get things configured that way.

So, that left us in a quandry: How do we get that certificate tied into ISA.

Having a little understanding as to how the CEICW configures both IIS and ISA together is a really important step to discovering how we need to get that certificate working.

With ISA installed on SBS, the configuration used to keep an end to end SSL tunnel between the user and IIS is called an SSL Bridge (MS TechNet Article).

When the browser requests https://rww.mydomain.com/remote and an SSL tunnel is established, ISA actually decrypts the tunnel to inspect the packets. ISA then re-encrypts the packets by establishing a subsequent SSL tunnel into the local IIS server.

When we look at the SBS ISA and IIS SSL setup from the user's perspective we see:

• https://rww.mydomain.com/ ---> ISA ---> https://publishing.mysbsdomain.local/
• SBS Self Issued to https://rww.mydomain.com/
• This certificate faces the Internet only.
• SBS Issued https://publishing.mysbsdomain.local/
• This certificate is only on the local LAN.

In this bridging setup, the key to realizing how we need to install the third party certificate can be discovered.

It is the Internet facing site that needs that certificate along with OWA, OMA, and direct SharePoint access.

The process is very simple:

1. On the SBS server open the ISA manager.
2. Click on the Firewall Policy item.
3. Double click on any SBS xxx Publishing Rule that uses the SBS Web Listener.
4. Click the Listner tab.
5. Click the Properties button beside "SBS Web Listener".
6. Click the Preferences tab.
7. Under SSL: Click the Select button.
8. The new third party certificate should be one of the available ones, click on it.
9. OK.
10. Apply & OK.
11. Double click on the SBS Windows SharePoint Services Web Publishing Rule.
12. Listener tab.
13. Properties button.
14. Preferences tab.
15. Select button
16. Choose the correct certificate as above.
17. OK.
18. Apply & OK.
19. Apply in ISA Manager.

From an external client, connect to the Remote Web Workplace and view the certificate. It should reflect the newly installed third party certificate. Connect directly to the SharePoint Companyweb site: https://rww.mydomain.com:444/ and verify the certificate there.

An important note regarding SSL wildcard certificates: For Outlook 2003/2007 clients using Outlook Anywhere (RPC/HTTPS), the msstd:rww.mydomain.com setting in Outlook needs to be changed to: msstd:*mydomain.com in order to avoid this:

Microsoft Office Outlook

There is a problem with the proxy server's security certificate. The name on the security certificate is invalid or does not match the name of the target site rww.mydomain.com.

Outlook is unable to connect to the proxy server. (Error Code 0)

Some helpful links:

• MS KB 923575: Error message when Outlook 2007 tries to connect to a server by using an RPC connection or an HTTPS connection: "There is a problem with the proxy server's security certificate"
• MS KB 831051: How to use the RPC Ping utility to troubleshoot connectivity issues with the Exchange over the Internet feature in Outlook 2007 and in Outlook 2003
• TechNet Forums: Outlook RPC/HTTPS setup with a wildcard

Now that we have discovered the process order and configuration steps, we are migrating all of our clients over to third party certificates.

Managing our client's SSL certification needs is one small service addition we have made to our managed services portfolio.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS Premium - SBS Post Install ISA Rule Must Do for DHCP

The reason that brought us to the aformentioned Mr. Client's location was a complaint that some machines were no longer able to connect to the network.

The possibility of a switch failure drew us to bring an extra Gigabit switch with us as we have seen switch failures before.

It turned out that we needed to create a special rule in ISA for client machines that have lost their IP completely and now had a 169. address.

The rule looks like the following:

Access Rule: DHCP (reply) & (request) via Internal and Local Host

Note that the Listener is set for only the Internal and Local Host interfaces. We don't want the DHCP rule to access the Internet NIC.

To create the rule:

1. Open ISA Manager
2. Right Click on Firewall Policy --> New
3. Click on "Access Rule"
4. Call it 169 DHCP Access or the like [Next]
5. Allow [Next]
6. This rule applies to: Selected Protocols
7. Add Button
8. Infrastructure: DHCP (reply) and DHCP (request)
9. Close and Next
10. This rule applies to traffic from these sources: Internal and Local Host [Next]
11. This rule applies to traffic sent to these destinations: [Add Button]
12. Network Sets: All Networks (and Local Host)
13. Close and Next
14. All Users [Next]
15. Finish
16. Apply and OK in the ISA Manager

Your now complete rule will look like the above pictured ISA Firewall Policy that is highlighted.

Doing a release and renew will allow the client computer to now connect.

The reasoning as we understand it can be found in a previous post: SBS 2K3 Premium - All Editions, ISA, and DHCP on SBS.

This particular SBS Premium box was installed last year during a run of large installs and apparently we missed this step during setup and the DHCP issue didn't rear its head until now!

The importance of this Firewall Rule being there on Premium boxes is the reason behind this post. :D

UPDATE 2007-10-12: Image of ISA if one tries to add the broadcast address to the Internal Range:


It does not seem to work.

The default ISA Internal does include the full subnet though:


But only for that particular IP range.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS - ISA 2K4 - Publishing a DNS Server behind ISA

When we did our very first SBS 2K to SBS 2K3 Premium upgrade for one of our Internet facing clients who have their own little Web farm and Internet DNS settings, it was a lot of "fun"! :(

This is what we found in the ISA 2004 help file for publishing their DNS servers:

Publishing DNS servers

ISA Server does not translate the IP address of DNS servers. To publish a DNS server, configure a route network relationship between the Local Host network and the network that includes the DNS server. Similarly, ISA Server must know the IP address of the DNS server.

Um, huh?!?

We ended up having to call the Partner Support line and work with the ISA troubleshooting team for hours upon hours spanning days. Eventually, while on the phone with a Microsoft tech, we actually figured it out. And, guess what? The answer was just too simple.

1. Create a Server Publishing rule
2. Call it DNS Publishing or the like
3. Assign the DNS Server's internal IP
4. Assign the DNS Server protocol
   
   
   
5. Select the External Network
6. Click Finish
7. Click the Apply button in the ISA console
8. OK

That experience over a very poorly written Help File entry was an incredible amount of frustration for us! It was even more so because we had a number of SBS 2K3 Premium migrations with Web farms behind them waiting on us to do after that.

Truly, it must have been a real pain point because Microsoft actually published a KB article about it: How to publish a DNS server in Internet Security and Acceleration (ISA) Server 2006 or in ISA Server 2004.

When publishing any form of manual for users, it must be "User" tested. It must pass the, "My mom can read and do it" test. The language must be simple and bullet proof. All of the bases need to be covered. If we professionals can't read and understand whatever was written in the manual or Help File in the first place, then we can sure as heck count on the phone to be ringing with our users calling us for clarification.

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists

*All Mac on SBS posts are posted on our in-house iMac via the Safari Web browser.

SBS 2K3 Premium - All Editions, ISA, and DHCP on SBS

I haven't seen this problem in a while, but, every once in a while it pops up and takes a bit of time to figure out.

We were updating a Lenovo laptop - wow, they sure have a lot of software updates for their laptops - and when it rebooted, it could no longer connect to the network.

After some troubleshooting, it turned out that it looked like the physical connection was dead.

Nope, take it to another network connection and still the same thing.

The bad thing was, it was one partner in the firm, and when the other partner decided to take his Lenovo out of its docking station and plug in the troublesome one, he could no longer connect!

I ended up heading in to verify just what was going on as a remote session could only get me so far.

I took a new network switch with me just in case. Plug all the active nodes in, and nope, problem still existed, only now everyone couldn't connect even after a reboot of their systems.

I remembered dealing with this before, and low and behold I found my culprit:


Whenever a network connection is released, you see 0.0.0.0 when the "IP" comes up via ipconfig /release. If you try and renew your address, and no DHCP server answers, then you end up with a 169.x.x.x IP. However, when the machine calls out to the DHCP server, it still broadcasts itself from 0.0.0.0.

Guess what? ISA says, "No way & no how are you coming in here!"

I belive that most of us do not encounter this situation often, because the network adapter tends to hold on to the address it had until it expires, then ask for another one, FROM the now expired address. And so on, and so on...

So, here is the fix:



Or should I say, the fix that I came up with in a pinch! :D It works though, and that is the main thing.

Take careful note when creating the Access Rule, that I have both DHCP services, both Internal and Local Host included in the From part of the rule, and All Protected Networks (including Local Host) in the To part of the rule!

Philip Elder
MPECS Inc.
Microsoft Small Business Specialists