Solved

ISA 2006 Client VPN to Terminal Server

Posted on 2009-07-01
2
511 Views
Last Modified: 2013-11-21
Our employees on our network can't rdp to a separate network pc over VPN.  We are using an ISA 2006 Server as our gateway.  The client machines are using the ISA Firwall Clients.  The VPN to the client's site is extablished successfully.  When you attempt to RDP to any usual client machine, it fails while the ISA Firewall client is running.  If the employee disables the ISA Firewall client and reconnects the VPN and then trys to RDP, it works fine.  What would cause RDP connections to fail when the ISA Firewall client enabled?
0
Comment
Question by:smccurnin
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 5

Expert Comment

by:JohnmenZ
ID: 24758326
The ISA firewall client has settings in place to prevent client computer to go beyond the ISA VPN server, which can be changed from ISA server side.
0
 
LVL 29

Accepted Solution

by:
pwindell earned 500 total points
ID: 24758428
The FWC is doing exactly what it is expected to do,...which isn't what you are wanting it to do in this case.  You have the exact same thing going on here that I just dealth with in another thread.
Here is a quote from that other thread:
---------------------------------------------------------------------------------------------------------
The problem is that this is a VPN and the IP Range on the Remote Network is not configured within ISA as being part of the Internal Network,...therefore the FWC interprets it as being a connection attempt to "External" and winging it out to the Internet where it fails.  So it isn't being denied,..it is being allowed,...it is just failing because it is being tossed down the wrong path.

Why does it work without the FWC?  Because without the FWC the local machine's regular "routing" takes over.  By the very nature of how VPN works,..the VPN is overriding the local machines Default Gateway with itself (the VPN becomes the new Default Gateway).  Since the target IP# is obviously not part of the local machine's local network the traffic gets "tossed" to the Default Gateway (which happens to be the VPN at the moment) and it works.
So....
(Option #2 is often the easiest choice)

Option #1
Find out the IP Range (or at least the one you are targeting) and add it to the Internal Network Definition.  This would be the IP Range inside the Tunnel,...not the outside of the Tunnel.  Then from a command prompt create a "blackhole" Static Route on the ISA machine for the same IP Range.  This route will never actually get used,...it is only there so that ISA has a route that corresponds to all the listed IP Ranges in the Internal Network Definition.  Without the Route it will probably whine and complain about it and give alerts that it sees address on the LAN that may be spoofed. In other words it will complain that is see addresses on the Internal Interface that have no corresponding route.
 
Option #2
Just disable/enable the FWC as needed as you are already doing and don't worry about it.
 
0

Featured Post

Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Some time ago I faced the need to use a uniform folder structure that spanned across numerous sites of an enterprise to be used as a common repository for the Software packages of the Configuration Manager 2007 infrastructure. Because the procedu…
On July 14th 2015, Windows Server 2003 will become End of Support, leaving hundreds of thousands of servers around the world that still run this 12 year old operating system vulnerable and potentially out of compliance in many organisations around t…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…
Finding and deleting duplicate (picture) files can be a time consuming task. My wife and I, our three kids and their families all share one dilemma: Managing our pictures. Between desktops, laptops, phones, tablets, and cameras; over the last decade…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question