Hello.
We have an ISA 2004 ENT server we use for our firewall. It is configured with 2 interfaces (outside and inside). We have a monitoring system located on the inside network which uses WMI. We need to be able to WMI access the ISA server from the inside network. Currently we cannot.
Here is what I have done so far to try to get it to work:
*****Settings*****
Under Firewall Policy, I have created an Access Rule that allows all outbound traffic from "Internal" to "Internal" & "Local Host".
Under Firewall Policy, I have created an Access Rule that allows "RCP (all interfaces)" & "RPC Server (all interfaces)" traffic from "Internal" to "Internal", "External" & "Local Host".
Under "Edit System Policy"/Authentication Services/Active Directory, I have unchecked "Enforce strict RPC compliance".
Under "Edit System Policy"/Remote Management/Microsoft Management Console (MMC), I have enabled it. Also I have added "Internal" & the management server to the "From" tab.
Under "Edit System Policy"/Diagnostic Services/Windows Netowrking, I have enabled it. Also I have added "Internal" & the management server to the "To" tab.
Under "Edit System Policy"/Remote Monitoring/Remote Performance Monitoring, I have enabled it. Also I have added "Internal" & the management server to the "From" tab.
Under "Edit System Policy"/Remote Monitoring/Microsoft Operations Mananger, I have enabled it. Also I have added "Internal" & the management server to the "To" tab.
Using "wmimgmt.msc" I have made sure that "Root/CIMV2" security has the domain admin's user name listed with all rights.
*****Testing and logging*****
From my management server, using WBEMTEST to test WMI, I have done the following:
Set Namespace to \\isaserver\root\cimv2
Set user and password to the domain admin.
Clicked connect. I get the following error:
Number: 0x800706ba
Facility: Win32
Description: The RPC server is unavailable
While running the above test, I ran ISA server monitoring of the anything going to the ISASERVER's internal IP. I get the following messages:
Protocol Action Rule Result Code Source Network Destination Network
RPC (all interfaces) Initiated Connection Allow remote management from selected computers using MMC 0x0 Internal Local Host
RPC (all interfaces) Initiated Connection Allow remote management from selected computers using MMC 0x0 Internal Local Host
RPC (all interfaces) Closed Connection Allow remote management from selected computers using MMC 0x80074e24 FWX_E_CONNECTION_KILLED Internal Local Host
RPC (all interfaces) Closed Connection Allow remote management from selected computers using MMC 0x80074e24 FWX_E_CONNECTION_KILLED Internal Local Host
RPC (all interfaces) Initiated Connection Allow remote management from selected computers using MMC 0x0 Internal Local Host
RPC (all interfaces) Closed Connection Allow remote management from selected computers using MMC 0x80074e24 FWX_E_CONNECTION_KILLED Internal Local Host
RPC (all interfaces) Initiated Connection Allow remote management from selected computers using MMC 0x0 Internal Local Host
RPC (all interfaces) Initiated Connection Allow remote management from selected computers using MMC 0x0 Internal Local Host
RPC (all interfaces) Closed Connection Allow remote management from selected computers using MMC 0x80074e24 FWX_E_CONNECTION_KILLED Internal Local Host
Thank You