mike_virgilio
asked on
ISA 2006 HTTPS publishing reveals PRIVATE IP assigned to the NIC
I have an ISA 2006 server in a DMZ behind a PIX firewall.
The ISA server has a private IP assigned to it's NIC.
The PIX is NATing the private IP behind a public IP.
Everything works perfect how it should.
The ISA server is HTTPS publishing a LINUX APACHE server
When scanning the PUBLIC IP from the OUTSIDE of the network (via Internet) with Nessus, the scanner is able to determine the PRIVATE IP address of the ISA SERVER (not the published web server).
I've tested adjusting the firewall to NAT directly to the Apache Web server. The same scan does NOT reveal the IP address. This is definately something that the ISA 2006 server is leaking.
I have been unable to find any security procedures/fixes to stop this problem.
Ideas?
The fixes I've found for this type problem are related to IIS, but NOT ISA.
thanks.
The ISA server has a private IP assigned to it's NIC.
The PIX is NATing the private IP behind a public IP.
Everything works perfect how it should.
The ISA server is HTTPS publishing a LINUX APACHE server
When scanning the PUBLIC IP from the OUTSIDE of the network (via Internet) with Nessus, the scanner is able to determine the PRIVATE IP address of the ISA SERVER (not the published web server).
I've tested adjusting the firewall to NAT directly to the Apache Web server. The same scan does NOT reveal the IP address. This is definately something that the ISA 2006 server is leaking.
I have been unable to find any security procedures/fixes to stop this problem.
Ideas?
The fixes I've found for this type problem are related to IIS, but NOT ISA.
thanks.
giltjr
What type of scan is being done that shows the private IP address of the ISA box?
ASKER
When I scan the PUBLIC IP with Nessus (http://www.nessus.org/nessus/), it is able to get the PRIVATE IP address from the HTTPS port. If I setup the webserver to be directly connected with a NAT and scan the published web server directly, it does NOT reveal the private IP.
What happens if you run the same scan as just plain HTTP?
My thought is that ISA is putting a "via" type header in the HTTP stream and putting it's IP address. Some proxy servers do this and in this case ISA is acting like a proxy server.
If you see the "leak" in plain HTTP, then you can look at the actual data stream with a packet sniffer and see what the ISA box is doing.
My thought is that ISA is putting a "via" type header in the HTTP stream and putting it's IP address. Some proxy servers do this and in this case ISA is acting like a proxy server.
If you see the "leak" in plain HTTP, then you can look at the actual data stream with a packet sniffer and see what the ISA box is doing.
ASKER
After trying to adjust headers via ISA server, I was unable to fix the problem. I DID come up with a solution by adjusting the service policies on the PIX to SPOOF the HTTP/HTTPS Server headers for inbound connections to the ISA public address (I'm using 8.0 software on Pix 515)
I would like a bit more on the solution, as I am confused. I can see how the PIX can spoof the HTTP headers, but the headers for a https stream should be encrypted and the PIX would never be able to see them. Can you provide more information on how you got the pix to change encrypted data?
ASKER CERTIFIED SOLUTION
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.