• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2077
  • Last Modified:

User cannot authenticate to ISA 2006 with firewall client

I have a ISA 2006 server setup in single adapter mode, it's being used just as a proxy, it has web filtering software installed on it.

Many users have the firewall client installed. Starting a few days ago users have a red x in the firewall client. "Disabled: cannot authenticate to ISA server".

Any ideas? I'm not sure how to trouble shoot this or what logs to look at, thanks. I have rebooted the pc's and the server itself, no luck.

Thanks
0
cb_it
Asked:
cb_it
  • 6
  • 4
1 Solution
 
cb_itAuthor Commented:
OK, I've done a full days worth of trouble shooting. The problem still exists but I have narrowed it down some. I have 2 ISA servers here. Proxy1 and Proxy2.

All users MS firewall client point to proxy1. If I point the fw client to proxy2 everything works as normal. Moving back to proxy1 and the problem returns. The red x will popup on the tray icon.

I'm the only IT person here and I have not made changes to the ISA server or anything else in the past couple days, that I can remeber!

I enabled logging on both servers and I can see on proxy1 the client "initiated connection" and then right away "closed connection". This shows port 1745.

Logging on proxy2 shows the initiated connection port 443 going out to the external ip address, rule is Allow ALL. This is good.

So it seems to be an authentication issue on proxy1 - any ideas?

I checked the event viewer on the client and found the following when the fw client points to proxy1. I'm logged in as a domain admin.



Event Type:      Error
Event Source:      Microsoft Firewall Client 2004
Event Category:      None
Event ID:      2
Date:            1/14/2013
Time:            11:12:08 AM
User:            N/A
Computer:      BR05CSR1
Description:
Application [EZTellerENT.EXE]. Authentication failed.
Verify that the user account running this application has the required permissions.
If the application is running under a system account, you can apply different credentials for
this application via the client configuration and FwcCreds.exe.
0
 
Suliman Abu KharroubIT Consultant Commented:
From networking node ( ISA managment console), open internal network properties and try to disable firewall client and re enable it again.
0
 
cb_itAuthor Commented:
Clients are also getting this kerberos error at the same time as the above error. I dont have any dup machine accounts, that I can find. I've researched this error and many people talk about duplicate SPN's. (I changed the server and domain name below)


Event Type:      Error
Event Source:      Kerberos
Event Category:      None
Event ID:      4
Date:            1/14/2013
Time:            3:34:13 PM
User:            N/A
Computer:      BR05CSR1
Description:
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/proxy1.mydomain.com.  
This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server.
Commonly, this is due to identically named  machine accounts in the target realm (MYDOMAIN.COM), and the client realm.
0
Cloud Class® Course: CompTIA Cloud+

The CompTIA Cloud+ Basic training course will teach you about cloud concepts and models, data storage, networking, and network infrastructure.

 
Suliman Abu KharroubIT Consultant Commented:
0
 
cb_itAuthor Commented:
I ran "setspn -L proxy1" on the actual proxy1 server and got the following. Doesnt look like I have any dup SPN's??

C:\Documents and Settings\bstrain\Desktop>setspn -L proxy1
Registered ServicePrincipalNames for CN=PROXY1,OU=Other Servers 2,DC=DOMAIN,DC=com:
    MSSQLSvc/PROXY1.DOMAIN.COM
    HOST/PROXY1
    HOST/PROXY1.DOMAIN.COM

any other spn test or checks I can do?? Thanks.
0
 
Suliman Abu KharroubIT Consultant Commented:
did you check the internal netowrk properties ?
0
 
Bruno PACIIT ConsultantCommented:
Hi,

I suppose your ISA servers are members of an AD domain !?
In this case, in the IP settings of these ISA servers, what DNS servers do interrogates ?

If you use internal and external DNS servers in your DNS servers list you will randomly encounter that sort of problems.

The ISA server must resolve internal AND external DNS names, but to do that IT MUST NOT interrogate external and internal DNS servers.
Why ? Because of that :

If you ISA server have to locate DCs of the AD domain to authenticate users, and if the ISA server interrogate external DNS servers for that, these DNS servers wil ALWAYS answer "domain does not exist", which is an authoritative negative answer.
With this type of answers the DNS client on the ISA server will stop to try to resolve the name by any other way and will suppose the domain does not exists and is unreachable. So the authentication will fail.


What MUST be done:
Your ISA servers must ONLY interrogate internal DNS servers. The internal DNS servers host the DNS zone for the internal AD domain and must be configured with DNS forwarders that point to external DNS servers.
Doing like this the internal DNS servers will retransmit DNS request for any external name to external DNS servers.


Have a good day.
0
 
cb_itAuthor Commented:
Sulimanw - what would I check the internal network properties for? Nothing has changed. I'm the only one with access to make any changes.

As for the last comment, our ISA servers are not used as firewalls, they are just in a single adapter mode, they dont have any external DNS settings, they just point to our internal DNS server.
0
 
Suliman Abu KharroubIT Consultant Commented:
Even if nothing changed, it worth's to check basices as a first troubleshooting step .
0
 
cb_itAuthor Commented:
I checked the internal network properties for both proxy1 and proxy2, they are the same and all settings seem OK.

I do have 'require all users to authenticate' turned on, this is needed for our web content filtering software on proxy1 to work properly. If I turn 'require all users to authenticate' off then all works well, so it seems more and more to point to some authentication problem on proxy1.

Any ideas??
0
 
cb_itAuthor Commented:
Anyone out there have ANY more ideas?? This error still keeps popping up on clients trying to authenticate to my ISA server.

I even tried removing the ISA server from the domain, deleting it's AD computer account, and rejoining to the domain. The problem persists!

Event Type:      Error
Event Source:      Kerberos
Event Category:      None
Event ID:      4
Date:            1/14/2013
Time:            3:34:13 PM
User:            N/A
Computer:      BR05CSR1
Description:
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/proxy1.mydomain.com.  
This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server.
Commonly, this is due to identically named  machine accounts in the target realm (MYDOMAIN.COM), and the client realm.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: Certified Penetration Testing

This CPTE Certified Penetration Testing Engineer course covers everything you need to know about becoming a Certified Penetration Testing Engineer. Career Path: Professional roles include Ethical Hackers, Security Consultants, System Administrators, and Chief Security Officers.

  • 6
  • 4
Tackle projects and never again get stuck behind a technical roadblock.
Join Now