We are running ISA Server 2006 SP1 on Windows Server 2003. I set up this ISA server about two weeks ago, before which FTP was working properly. Now we get a message "FTP is read-only because the proxy server is not set up to allow full access."
I ran the Best Practices Analyzer Tool and have attached the report. The report names three particular rules I have that block FTP uploads. It says I should right click on those particular rules and select "Configure FTP." When I right click these rules, however, configure FTP is not an option.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Sounds like the rules are all Deny rules with All Outbound Traffic. You will not get the option to Configure FTP (or HTTP) if the rule is a Deny rule. You can either exempt FTP protocol by selecting "All but selected" in the protocol list or create a new rule on top allowing FTP access to users.
Hope this helps.
Raj
You need to Right click on the protocol on the rule and click configure FTP there is a tick for read-only ftp.
The Client must be running as a SecureNAT or Firewall Client for it to work.
You should use an FTP Client that is *not* a web browser because the browser
will try to use the FTP "over" HTTP (Web Proxy Service) which by industry
standards dictates it to be "read-only" (no uploads).
I have the FTP access rule above the rules generating the alerts in the Best Practices Report. In fact, the FTP access rule is number #1. The FTP access rule is not set to "read only."
I thought ISA always uses two NICs. Anyhow we have two NICs.
I am going to test a couple different FTP sites and a couple different FTP clients outside of Internet Explorer 7. This may have something to do with an update to Internet Explorer 7, or it could be the GFI WebMonitor software that I recently installed. I can remove the GFI Webmonitor for testing.
No - ISA can use one, two, three or four nics - epending on what you need. For example, a proxy only ISA server will only need a single nic.
Please answer my second point - are you using FTP through the browser or a client application.
If you are right-clicking an access rule (not a publishing rule) that has FTP in the allowed list of protocols - including All Selected Protocols - and the Configure FTP option is not there then you have a serious issue with your installation. If you are saying that just the three rules that the BPA alludes to don't have that option that thats fine - it is just a generic statement the BPA can fire out.
You haven't mentioned GFI before - yes, removing that could be a useful step but so could reviewing the gfi logs to see if you get a pointer there.
Business Accounts
Answer for Membership
by: What90Posted on 2009-03-11 at 19:36:18ID: 23864294
The rule with FTP in it as a protocol is where you can select the Configure FTP option, if FTP isn't there then you can't configure it :-)
Do any of those three rules contain the FTP protocol or are they set to block all traffic?
ISA processes rules in top down order, so if you blocking FTP in a new rule or one above the existing FTP rule, it can stop your access.