Windows 8, Store and MS TMG Proxy - Can't install apps

November 1, 2012, 6:25 am

≫ Next: TMG 2010 Ent. / ESXi 5.1 / NetApp Setup

≪ Previous: Yahoo Messenger not working through FTMG 2010 Standard SP1

Hi All,

Hoping for some information/assistance. Currently testing Windows 8 Ent x64 in our Domain Environment. All works well for the built in apps and certainly looks promising. Hoping to get quite a few Surface or other W8 Tablets in the organisation if I can fix this final issue.

I currently cannot install any Apps via the App Store through or Microsoft TMG 2010 SP2 product. I can change rules on the TMG to help make this work if necessary.

This is the message I am currently experiencing when I attempt to install an App:

"Your purchase couldn't be completed. Something happened and your purchase can't be completed"

I hit Try Again and immediately I get the same message. I have traced it to WindowsUpdate.log in the Windows dir which shows:

2012-11-01	12:12:30:243	 852	47cc	Agent	*************
2012-11-01	12:12:30:243	 852	47cc	Agent	** START **  Agent: Finding updates [CallerId = WSAcquisition]
2012-11-01	12:12:30:243	 852	47cc	Agent	*********
2012-11-01	12:12:30:243	 852	47cc	Agent	  * Include potentially superseded updates
2012-11-01	12:12:30:243	 852	47cc	Agent	  * Online = Yes; Ignore download priority = No
2012-11-01	12:12:30:243	 852	47cc	Agent	  * Criteria = "AppCategoryIDs contains '5e19cc61-8994-4797-bdc7-c21263f6282b'"
2012-11-01	12:12:30:243	 852	47cc	Agent	  * ServiceID = {117CAB2D-82B1-4B5A-A08C-4D62DBEE7782} Third party service
2012-11-01	12:12:30:243	 852	47cc	Agent	  * Search Scope = {Current User}
2012-11-01	12:12:30:243	 852	47cc	Agent	  * Caller SID for Applicability: S-1-5-21-1390067357-746137067-1202660629-26658
2012-11-01	12:12:30:243	 852	47cc	EP	Got 9482F4B4-E343-43B6-B170-9A65BC822C77 redir SecondaryServiceAuth URL: "http://fe1.ws.microsoft.com/w8/2/redir/storeauth.cab"
2012-11-01	12:12:30:244	 852	47cc	EP	Got 117CAB2D-82B1-4B5A-A08C-4D62DBEE7782 redir Client/Server URL: "https://fe1.ws.microsoft.com/v6/ClientWebService/client.asmx"
2012-11-01	12:12:30:247	 852	47cc	PT	Skipping StartCategoryScan, no categories require server checks.
2012-11-01	12:12:30:248	 852	47cc	PT	+++++++++++  PT: Synchronizing server updates  +++++++++++
2012-11-01	12:12:30:249	 852	47cc	PT	  + ServiceId = {117CAB2D-82B1-4B5A-A08C-4D62DBEE7782}, Server URL = https://fe1.ws.microsoft.com/v6/ClientWebService/client.asmx
2012-11-01	12:12:30:256	 852	47cc	WS	WARNING: Nws Failure: errorCode=0x803d0006
2012-11-01	12:12:30:256	 852	47cc	WS	WARNING: There was an error communicating with the endpoint at 'https://fe1.ws.microsoft.com/v6/ClientWebService/client.asmx'.
2012-11-01	12:12:30:256	 852	47cc	WS	WARNING: The operation timed out after 60000 (0xEA60) milliseconds.
2012-11-01	12:12:30:256	 852	47cc	WS	WARNING: The operation could not be completed because the channel has been aborted.
2012-11-01	12:12:30:256	 852	47cc	WS	WARNING: Web service call failed with hr = 8024401c.
2012-11-01	12:12:30:256	 852	47cc	WS	WARNING: Current service auth scheme='None'.
2012-11-01	12:12:30:256	 852	47cc	WS	WARNING: Proxy List used: 'PROXYIPHERE:8080', Bypass List used: '(null)', Last Proxy used: 'PROXYIPHERE:8080', Last auth Schemes used: 'None'.
2012-11-01	12:12:30:256	 852	47cc	WS	FATAL: OnCallFailure(hrCall, m_error) failed with hr=0x8024401c
2012-11-01	12:12:30:256	 852	47cc	PT	WARNING: PTError: 0x8024401c
2012-11-01	12:12:30:256	 852	47cc	PT	WARNING: SyncUpdates_WithRecovery failed.: 0x8024401c
2012-11-01	12:12:30:256	 852	47cc	PT	WARNING: Sync of Updates: 0x8024401c
2012-11-01	12:12:30:256	 852	47cc	PT	WARNING: SyncServerUpdatesInternal failed: 0x8024401c
2012-11-01	12:12:30:256	 852	47cc	Agent	  * WARNING: Failed to synchronize, error = 0x8024401C
2012-11-01	12:12:30:256	 852	47cc	Agent	  * WARNING: Exit code = 0x8024401C
2012-11-01	12:12:30:256	 852	47cc	Agent	*********
2012-11-01	12:12:30:257	 852	47cc	Agent	**  END  **  Agent: Finding updates [CallerId = WSAcquisition]
2012-11-01	12:12:30:257	 852	47cc	Agent	*************

The key line here being: Last auth Schemes used: 'None'

Which gives the error: hr=0x8024401c - Authentication error?

This leads me to the TMG live Proxy log. Which shows all as Allowed Connection but the HTTP Status Code is 407 Proxy Authentication Required:

Status: 407 Proxy Authentication Required
Rule: Allow Unfiltered Internet
Source: Internal (172.16.2.23:64163)
Destination: External (172.23.0.10:443)
Request: fe1.ws.microsoft.com:443
Filter information: Req ID: 0f74228b; Compression: client=No, server=No, compress rate=0% decompress rate=0%
Protocol: SSL-tunnel
User: anonymous Is there a rule that needs to be added to the TMG/Web Access Policy to allow Unauthenticated traffic to certain domains or is there something on Windows 8 (without having to install anything as this is not an easy solution to roll out to RT tablets for example) Many Thanks for any assistance. I may crosspost this to the Windows 8 forum too. Regards, Dan.

↧

TMG 2010 Ent. / ESXi 5.1 / NetApp Setup

November 1, 2012, 8:58 am

≫ Next: Outlook 2010 cant geting emails through TMG SERVER

≪ Previous: Windows 8, Store and MS TMG Proxy - Can't install apps

Hi All,

I have some questions regarding the setup and implementation of TMG and a pure ESXi vmware environment. I have been tinkering in a lab / non-production environment to get things situated before proceeding with a full deployment. Here's a basic rundown of the environment:

Server Hardware:

(1) HP DL380G7, 1 x 6-core Intel CPU, 96GB RAM, 1TB Internal SAS storage (RAID 6), 10 Broadband/Intel GBit NIC

(1) HP DL580G5, 4 x Quad Core Intel CPU, 96 GB RAM, 500GB SAS storage (RAID 1+0), 10 Broadband/intel Gbit NIC

Core Switch:

(2) Cisco 3750G 48-port. No Stack configuration, only one is being utilized

Storage:

NetApp FAS2040, 8 x internal 300GB SATA drives, 1 x DS14 MK2 Shelf with 14 x 250GB FC drives

That's a rundown of the hardware involved. ESXi 5.1.0 is installed on both servers. I have installed a vCenter 5 Appliance on one host, 10.20.10.13 GW 10.20.10.1. The networking is broken out by VLAN's on the core switch. I didn't want to do VLAN tagging from within the ESXi hosts / vCenter server because I've always used vlan's on the core. I have a number of vlans created on the core i.e. vlan 5 (Perimeter DMz) 192.168.0.2, vlan 10 (INT-LAN) 10.20.10.2, vlan 30 (iSCSI) 10.20.30.1, vlan 40 (ESX MGT)10.20.40.1, vlan 50 (VMOTION) 10.20.50.1.

The ESX hosts were assigned a management vlan IP, 10.20.40.5/6 Gateway 10.20.40.1. My internal Domain Controller has an IP of 10.20.10.9 GW 10.20.10.1 I then installed TMG as a 3-network template, Internal, Perimeter, External. It is a member of the domain.

The networking of the ESXi hosts use Virtual Distributed Switches that I created in vCenter. I was meticulous about breaking out NIC's for each VLAN and tried to keep the traffic separate. For instance, vmnic0 is vDS CSI-MGT_VLAN40 connected to 3750 on vlan 40 and has vmk0 10.20.40.5/6 per respective esx host. I have vmnic1/vmnic2 for internal traffic on a separate vDS CSI-INT-LAN_VLAN10, connected to the 3750 on vlan 10. I have vDS for Vmotion/iSCSI/DMz done this way as well, a physical NIC is connected to the uplink and assigned the appropriate VLAN on the switch. I have the External vDS setup to a single vDS with assigned vmnic6 attached directly to the Internet and only the TMG VM has this NIC vDS assigned to it.

I have only ever used a physical server for my ISA before, this is my first time testing/configuring with a pure virtual environment. The TMG Internal NIC has IP settings: 10.20.10.1 255.255.255.0 No Gateway DNS: 10.20.10.9. The DMZ NIC has IP settings: 192.168.0.1 255.255.255.0 No Gateway DNS: 192.168.0.9. The External NIC has internet provider IP settings. The thought bing the TMG is basically the router/firewall for systems. I have the Internal network defined as IP ranges 10.20.10.0-10.20.10.255 and 10.20.40.0-10.20.40.255. I have a route 10.20.40.1 > GW:10.20.10.1 allowing the TMG to act as the route path for traffic from the vCetner server management (vlan10) to the ESXi hosts (vlan40). All Internal LAN systems use the INT GW of the TMG Internal NIC. Management services i.e. iSCSI / VMOTION do not pass through the TMG and traffic is routed on the core switch.

To my only issue I seem to be having trouble with, vSphere Client / vCenter server communication's. I have the vCenter appliance on the internal network, 10.20.10.13. I have a vSphere Client installed on an internal PC, 10.20.10.17. I have created an access rule allowing the many specified protocols for the vCenter Appliance to communicate with the ESXi hosts(8080, 443, 902, 512, etc. etc. etc.). The problem comes when I'm on the PC with the vSphere Client installed and try to connect to the vCenter appliance to manage the vmware environment. It can connect to the vCenter. I was able to add the host's but seem to be running into issues now, unable to communicate with the ESXi hosts. When I change the GW IP of the client pc to 10.20.10.2 (core switch vlan10 IP) the issues almost goes away completely. I'm not quite sure what the TMG might be blocking or denying from the client PC to the vCenter or the ESXi hosts? I see connections initiated from the vCenter Appliance to the ESXi hosts as well as being blocked. The most repetitive error is a Port 902 TCP_SYNC_DROPPED_PACKET from the PC vSphere client to the ESXi Hosts (10.20.40.5/6). I created a rule allowing port 902 from the vCenter Appliance and the Client PC (both INT LAN) to the ESXi hosts. I'm still having some issues.

So from all the information above, can anyone see any configuration issues? Possibly change some things around differently, either vlan tagging in vCenter instead of the core switch. Possibly install the vCenter IP on the same subnet as the ESXi hosts (vlan40) rather than having the ESXi hosts in the 40.x SN and the Appliance in the 10.x SN? Any suggestion anyone could offer would be appreciated.

-Slevin

↧

Outlook 2010 cant geting emails through TMG SERVER

October 23, 2012, 5:18 am

≫ Next: Microsoft is killing the TMG?

≪ Previous: TMG 2010 Ent. / ESXi 5.1 / NetApp Setup

Dear All,

I have recently installed TMG server in my network after configuration basic rules outlook was unable to connect , We using SSL 993 PORT and smtp 465 port. Every thing are working fine except email there is no email server in my network.

Please advise or give some steps to allow ssl ports to ge email.

Thanks

kashif

↧

Microsoft is killing the TMG?

June 6, 2011, 4:00 pm

≫ Next: FF TMG 2010 on Server 2012

≪ Previous: Outlook 2010 cant geting emails through TMG SERVER

I don't want to cause any confusion, but last week emerged some rumors that Microsoft would be killing the Forefront TMG, the Gartner Magic Quadrant to publish entitled "Magic Quadrant for Secure Web Gateway" on the last day 25 even included the TMG as it does every year. Gartner says in the report that Microsoft has confirmed that it is discontinuing the product but that the support will remain active. The question is not about anyone who is saying, is Gartner! How are customers using TMG today in long-term perspective? Microsoft will release another product?Finally, the report was released on 25 may, and it is reasonable to imagine that it took some months to get ready, so Gartner already has this information awhile ago right? And Microsoft will not say anything to your community that uses/supports/disseminates the product? Microsoft in no longer blindfolded while offer TMG for our clients at the risk of I sell a product that could be discontinued tomorrow?

Microsoft, more respect with the partners and technical community!

Sources:

http://blogs.isaserver.org/shinder/2011/05/27/death-of-tmg/

http://blog.konab.com/2011/05/what-will-happen-with-tmg/

↧

FF TMG 2010 on Server 2012

July 6, 2012, 11:29 pm

≫ Next: Multiple Listeners with a Single IP Address

≪ Previous: Microsoft is killing the TMG?

Has anyone tried successfully installing Forefront TMG 2010 on Windows Server 2012?

I tried but failed, it complained about unable to add roles and features.

Valuable skills are not learned, learned skills aren't valuable.

↧

Multiple Listeners with a Single IP Address

November 1, 2012, 8:27 am

≫ Next: Can TMG solve this problem?

≪ Previous: FF TMG 2010 on Server 2012

We currently have TMG 2010 that publishes Access Rules for an Exchange 2010 server farm. We are looking at bringing in Canadian email into our system. My question is if I can have two listeners using the same IP address for different domains (mail.mysite.com and mail.mysite.ca) with two wildcard certificates and connecting to the same Server Farm?

↧

Can TMG solve this problem?

November 1, 2012, 1:36 pm

≫ Next: 12210 An Internet Server API (ISAPI) filter has finished handling the request, InfoPath Forms Services

≪ Previous: Multiple Listeners with a Single IP Address

I have an issue which I hope TMG can solve, but I could do with some expert advice before engaging with Microsoft.

I have an Oracle 10g application which I need to upgrade to 11g. In order to use the 11g application, the client must be running JRE 1.6.26 or later. However, the customer flatly refuses to install JRE and won't budge from Jinitiator (which is needed for the 10g application).

I have considered TS RemoteApp, but the customer won't allow RDP on the client either.

If I have JRE 1.6.26 installed on the TMG server and publish the Oracle 11g application as a web application on the TMG server would that negate the need for JRE on the client?

Any help or alternative suggestions would be appreciated.

↧

12210 An Internet Server API (ISAPI) filter has finished handling the request, InfoPath Forms Services

November 1, 2012, 3:25 pm

≫ Next: TMG server having network connectivtyt issues.

≪ Previous: Can TMG solve this problem?

Background:
Forefront TMG 2010 on Server 2008 R2
SharePoint 2010 on Server 2008 R2 (different box)

Client had a working setup on ISA 2006 box but they called me one morning after they found it laying dead in the rack. Tried to find the backups but they appear to have left with the last guy who worked for them.

I built up a new box with TMG 2010 and got it dialed in to their SharePoint. All (navigation, button clicks, etc.) work as expected. However, they have several forms that they use: one customized list form and one straight-up browser based form (no code). From inside the network the forms operate exactly as expected. Once someone opens the form from an external network the TMG logs:
"12210 An Internet Server API (ISAPI) filter has finished handling the request, InfoPath Forms Services"

Wireshark shows: HTTP/1.1 401 Unauthorized , NTLMSSP_CHALLENGE

I get the same "HTTP/1.1 302 Moved Temporarily" in TMG logging as noted in this post.

Anyone have any ideas? The post I linked to did not suggest a specific fix.

Thanks,

Chris

↧

TMG server having network connectivtyt issues.

November 1, 2012, 7:54 am

≫ Next: Create one Static VPN IP over a DHCP scenario

≪ Previous: 12210 An Internet Server API (ISAPI) filter has finished handling the request, InfoPath Forms Services

A Vmware VM hosting Windows 2008 R2 server running TMG is having frequent network dropouts and unable to RDP. Tracert is clean.How to tackle this issue.

Urgent

↧

Create one Static VPN IP over a DHCP scenario

May 16, 2012, 2:56 am

≫ Next: TMG Identifying Bad Login Attempts

≪ Previous: TMG server having network connectivtyt issues.

Hello

In my new work that i arrived some weeks ago they have a forefront configured to assign VPN´s using DHCP but right now, they need one IP from a remote server conect to an internal server with an static IP, i tried to configure an access rule from that server to that internal IP.

For some reason, doesnt seems working at all. i could use some advice here since im bit new using forefront.

i got this in the event viewer

Event ID: 20253

CoId={NA}: The user domain\user connected to port VPN3-98 has been disconnected because no network protocols were successfully negotiated.

↧

TMG Identifying Bad Login Attempts

November 2, 2012, 1:13 am

≫ Next: User Activity Report Blank

≪ Previous: Create one Static VPN IP over a DHCP scenario

Hi,

Sometimes i recive bad login attempts on TMG server in event log. I cant find real ip/hostname with log, because logon process initiated by TMG service. In TMG console section this login name is absent. Please help me with recognizing, who initiate this session!

I replace in log this section %username% - name of user who attept to logon , %domainname% - real name of domain , %servername% - tmg server name.

An account failed to log on.

Subject:
Security ID:  NETWORK SERVICE
Account Name:  %SERVERNAME%$
Account Domain:  %DOMAINNAME%
Logon ID:  0x3e4

Logon Type: 3

Account For Which Logon Failed:
Security ID:  NULL SID
Account Name:  %username%
Account Domain:  %domainname%

Failure Information:
Failure Reason:  Unknown user name or bad password.
Status:   0xc000006d
Sub Status:  0xc0000064

Process Information:
Caller Process ID: 0x255c
Caller Process Name: C:\Program Files\Microsoft Forefront Threat Management Gateway\wspsrv.exe

Network Information:
Workstation Name: %servername%
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

PS Sorry for my English

↧

User Activity Report Blank

November 1, 2012, 11:53 pm

≫ Next: Cannot install service after SCW

≪ Previous: TMG Identifying Bad Login Attempts

Hi all

I have TMG 2010 with SP2 and roll up 1 install , but when i generate the User Activity its show blank , no data display , can any budy help me out please..

↧

Cannot install service after SCW

November 2, 2012, 1:58 am

≫ Next: Rollback Security Configuration Wizard (SCW)

≪ Previous: User Activity Report Blank

Hello,

Have a TMG 2010 on Windows 2008 R2. Ran Security Configuration Wizard (SCW) after installing TMG. I am now trying to add a Remote client (ScreenConnect) using goup policys and it keeps failing. I have tried manually installing the client and it installs successfully (shows in appwiz.cpl) but the service cannot start:

ScreenConnect Service failed to start. Verify you have the permission to start the service

It then rollback and uninnstalls the the software. Can I get this working?

Regards Tony "Great things can be expressed In fifteen words or less And bring that to your heart" - Kaiser Chiefs

↧

Rollback Security Configuration Wizard (SCW)

November 2, 2012, 1:42 am

≫ Next: Forefront TMG 2010 Spoofing issue preventing connections

≪ Previous: Cannot install service after SCW

I built my TMG server at the begiining of this year and ran SCW. Over time I have migrated the rules from ISA to TMG and am at the point I can now decommision the ISA. However over the last few weeks I have been getting problems with WMI, upgrading/installing software to the point where I have looked again at SCW. I have 2 issues that I am hoping the forum can resolve:

No matter what I do, it always want to disable Routing and Remote Access which is a problem as we have a site to site link running as well as 20 field based operatives that use VPN. I have turned on both Remote access/VPN Server roles.
Can I roll back to before I ran SCW for the first time (January 2012). I have not applied SCW since then.

Thanks
Tony

Regards Tony "Great things can be expressed In fifteen words or less And bring that to your heart" - Kaiser Chiefs

↧

Forefront TMG 2010 Spoofing issue preventing connections

November 2, 2012, 11:50 am

≫ Next: Search Engine Optimization

≪ Previous: Rollback Security Configuration Wizard (SCW)

Been struggling with IP spoofing issues on our TNG 2010 server.

We have web services published to public IP’s all bound to a NIC called WAN-PUBLIC which then NAT’s to the internal IP’s on the web servers.

In certain scenarios we’re unable gain access to the servers and the ISA logs are full of Spoofing errors such as this:

Log type: Firewall service

Status: A packet was dropped because Forefront TMG determined that the source IP address is spoofed.

Rule: None - see Result Code

Source: Local Host (213.122.169.54:18816)

Destination: Internal (192.168.9.130:443)

Protocol: HTTPS

The source host in this scenario is an IIS server / NLB using ARR so it’s almost acting like a reverse proxy.

Below is the relevant public IP’s bound to the WAN Nic and as you can see it has a default gateway set of un upstream ISP router.

Ethernet adapter WAN-PUBLIC:

Connection-specific DNS Suffix . :

IPv4 Address. . . . . . . . . . . : 213.122.169.50