Hi Volker,
Post by Volker SträhleEs ist ja nicht so, dass der ISA ein böhmisches Dorf für mich ist, aber
dieser hier bringt mich um den Verstand.
Ich habe jetzt einen alten Rechner mit Win2003 Server und ISA2004, beide
Std. neu aufgesetzt, durchgepatched, Zertifikate installiert und Regeln
erstellt - und geht auf Anhieb!
Aber was mit dem ISA2006 ist???? Den stell ich jetzt erstmal nebenhin und
schau es mir später nochmal an.
wie lange machst Du jetzt schon damit rum?
Wäre es da nicht einfacher, sich jemanden zu holen, der sich damit auskennt
und es Dir ggf. erklärt, was Du evtl. falsch gemacht hast?
Bei unseren Kunden (egal ob ISA 2006 für SBS 2008 aus der SBS 2003 SA oder
ISA 2006 Appliance) läuft es .. ;)
!!! Wichtig !!!
An alle: Bitte beachten, dass bei einem SBS 2008 "remote.blabla.com" default
als "Split-DNS"-Konfiguration (mit "remote.blabla.com" als Subdomain im
internen DNS-Server mit Verweis auf die INTERNE IP des SBS 2008) vorliegt
und während der SBS 2008 Installation eine Root-Zertifikat in die Enterprise
CA angelegt wird, welche optional ein Leaf-Zertifikat u.a. für die
IIS-Anwendungen mittels IAMW austellt (s.u.)
!!! Wichtig !!!
Hintergrundinformationen:
SBS 2008 - Changes that the IAMW makes
(http://technet.microsoft.com/en-us/library/dd335248.aspx)
[..]
Internal DNS
When you run the IAMW, the Forward lookup zone is created locally in
Windows SBS 2008 and points to remote.<YourDomainName>.Extension with the
following records:
* Start of authority (SOA) resource record. Points to the internal fully
qualified domain name (FQDN) of the server that is running Windows SBS 2008,
for example server.contoso.local.
* Name service (NS) resource record. Points to the FQDN of the server that
is running Windows SBS 2008.
* Host (A) resource record Points to the IP address of the server that is
running Windows SBS 2008.
[..]
External naming conventions
[..]
By default, the self-signed certificate that is created when you run the
IAMW uses the remote naming convention remote.<YourDomainName>.
* Web applications
* When you run the IAMW, the values of the Windows SBS 2008 Web application
host headers are configured with your chosen domain name. A leaf SSL
certificate is created and bound to the Web applications site on port 443
and bound to the Windows Sharepoint® * Services site on port 987.
For example, if your remote FQDN is remote.constoso.com and the external DNS
records are correct, you access the following resources as follows:
* Outlook Web Access: https://remote.contoso.com/owa
* Remote Web Workplace: https://remote.contoso.com/Remote
* Internal Web site: https://remote.contoso.com/:987
Terminal Services Gateway
Terminal Services Gateway (TS Gateway) is configured to use the SSL
certificate that the IAMW creates.
[..]
Exchange Server
* The Internet Send and Receive Connector banners are stamped with your
domain name.
* The URLs for Outlook Web Access, ActiveSync, and the Outlook Address Book
virtual directories are configured with your domain name.
* An Accepted Domain and Email-Address Policy is created by using your
domain name.
* An SSL certificate is configured for IMAP4, POP3, Web, and SMTP access.
This is the same certificate that is bound to the Web applications and the
Windows Sharepoint Services sites, and that is used by TS Gateway.
Certificate distribution
The first time you run the IAMW, a certificate distribution package is
created for deployment to non-domain joined client computers and mobile
devices.
[..]
Source: http://technet.microsoft.com/en-us/library/dd335248.aspx
Manage Self-Issued Certificates
(http://technet.microsoft.com/en-us/library/cc546020.aspx)
[..]
During installation, Windows SBS 2008 creates the root certificate by using
the internal domain name and then stores it in the certificate authority.
The certificate authority pushes the certificate via a Group Policy object
to all client computers that are joined to the domain.
When you finish running the Internet Address Management Wizard, Windows SBS
2008 creates a leaf certificate by using the Internet domain name that you
set up. This self-issued certificate is used to help protect remote access
to your network that uses Remote Web Workplace, Microsoft® Office Outlook®
Web Access, or Office Outlook Mobile Access.
The self-issued root certificate is a 1024-bit key that is issued for five
years. Before the expiration date, you receive a warning that the
self-issued certificate is expiring. When you receive the warning, you must
run the Fix My Network Wizard to renew it, and redistribute the root
certificate to all the remote client computers and devices. The
leaf-certificate will automatically renew every two years and does not
affect your users' connectivity to the server.
[..]
Source: http://technet.microsoft.com/en-us/library/cc546020.aspx
--
Tobias Redelberger
StarNET Services (HomeOffice)
Frankfurter Allee 193
D-10365 Berlin
Tel: +49 (30) 86 87 02 678
Mobil: +49 (163) 84 74 421
Email: ***@starnet-services.net
Web: http://www.starnet-services.net