[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Forward source port in forefront TMG 2010?

Posted on 2014-03-12
7
Medium Priority
?
2,555 Views
Last Modified: 2014-03-13
I have a forefront TMG 2010 server setup as my firewall. I have a new vault to cloud system setup for my backups. The traffic leaves on UDP 1197 but comes back on a variable port from 10,000 to 65,000. The vault people claim the issue is with my firewall but I have never once seen traffic come back in the firewall on 1197. I can see that the source port is 1197 but the destination port is 10,000 to 65,000. If the traffic came back in on destination port 1197 then I can forward that with no problem.

Can I forward based on source port and not destination port? Is the issue on the vault side?

Here is what they sent me to show the traffic is leaving their firewall no problem but it looks to me like it is trying to access port 62221 on my firewall and not 1197.

16:25:45.145024 IP 10.200.1.41.1197 > 209.242.XXX.XXX.62221: UDP, length 22
0
Comment
Question by:Biofilminc
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
7 Comments
 
LVL 37

Accepted Solution

by:
Jamie McKillop earned 2000 total points
ID: 39926198
Hello,

You can't forward based on source port but you can set a port range as the destination. You should create a rule that forwards port 10,000 to 65,000. Since this is a large range, I recommend you lock the rule down to the source IPs of the cloud servers.

-JJ
0
 

Author Comment

by:Biofilminc
ID: 39927054
I read online its a bad idea to do that and takes up a lot of resources. Is this not true?
0
 
LVL 37

Expert Comment

by:Jamie McKillop
ID: 39927066
Can you provide the source that states this? I don't see why it would take up a lot of resources.

-JJ
0
Does Powershell have you tied up in knots?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 

Author Comment

by:Biofilminc
ID: 39927073
Either way I have never once received traffic on port 1197.

Does the info they gave me show that it should go to 1197 or in this case 62221.

They say its my fault and I don't know how to port forward 1197. I can't forward traffic that I do not get.

------------------------------------------------------------
16:25:45.145024 IP 10.200.1.41.1197 > 209.242.XXX.XXX.62221: UDP, length 22
0
 
LVL 37

Expert Comment

by:Jamie McKillop
ID: 39927101
You won't see traffic coming back in 1197. The traffic is coming back on a random port. You need to allow 1197 outbound and 10,000 - 65,000 inbound, if I understand correctly.

-JJ
0
 

Author Comment

by:Biofilminc
ID: 39927299
According to Unitrends that is not the case and it should come in on port 1197 and its not because it's my fault. They won't help, just point blame. I forwarded all the ports and have not seen anything get blocked but still no luck. Its a Unitrends problem not mine, they just won't do anything about it.

Thanks for your help.
0
 

Author Closing Comment

by:Biofilminc
ID: 39927304
Fixed my forwarding problems
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There are several problems reported according slow link speeds or poor performance in TMG 2010, UAG 2010 or ISA 2006. I want to collect here some of the common issues together to give a brief overview what can be the reason. Nevertheless, not all of…
Background Information Recently I have fixed file server permission issues for one of my client. The client has 1800 users and one Windows Server 2008 R2 domain joined file server with 12 TB of data, 250+ shared folders and the folder structure i…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

649 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question