403 Forbidden

[KPI]

I am looking for help with a frustrating problem I am having with MS ISA. Recently I set up ISA to be our firewall for my small company. Behind the ISA firewall I have a fileserver that is my PDC/fileserver, and another box that is a Lotus Domino server. When outside users attempt to access their email via the Lotus Notes web application, ISA prompts them for their system logon information and next prompts them for their Notes logon information. Then they can retrieve their mail through the Notes interface.

The WEIRD problem is that if a user hits the refresh button about six times, then they get a message that appears in their browser window

Error is as follows;
403 Forbidden - The server denies the specified Uniform Resource Locator (URL). Contact the server administrator. (12202)
Internet Security and Acceleration Server


The user also gets this message if they are idle for 1 minute! Does anyone have any thoughts on what to try?

Thanks,
Chip

 

[noeleon]

Try to investigate SITE AND CONTENT RULE OF ISA.

 

[KPI]

I have checked the SITE AND CONTENT RULE and everything is set to allow.

 

[noeleon]

Please try this:

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q295089&

 

[KPI]

I have tried that Knowledge Base Article, but that is not really my problem. I 'can' get to the internal site from an outside computer. But it only allows my connection to remain active as long as there is activity and the user does not wait longer than 60 seconds between reading messages. I wonder if there is some TTL setting somewhere that I am missing?

 

[noeleon]

Please try this:

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q271272&

 

[HowardL]

Hi, I have a similar problem, but I cannot access the Exchange system from the internet, using OWA (Outlook Web Access)

I have looked at all my firewall settings in ISA and I get the dreaded "403 Forbidden - The server denies the specified Uniform Resource Locator (URL). Contact the server administrator. (12202)" like you.

Any help would be appreciated!

Thanks.

 

[noeleon]

I may suggest that it might involve folder permission and you have to set it to everyone.

 

[KPI]

I 'solved' my problem today. But in order for my users to have continuous access to their web based mail, I had to turn off the 'authenticate unknown users' feature in the incoming web request properties of ISA. Now I am not as secure, but my users are not screaming at me. It turns out that ISA was blocking their requests after 60 seconds, even though I had the TTL set to 240 seconds. So I have to now find a way to get the authentication working. The quest continues.

 

[HowardL]

I managed to solve my problem on Friday. I added a packet filter to ISA allowing all HTTP traffic through port 80. Users have to enter in ID, password & domain, and this allows Web Outlook to open. I was amazed how quick it is!

I also changes the default IP address under IIS to the external network card, as it was set to "all unassigned"

The only problem I can see is that most attackers would scan port 80 by default, so my next step is to only open up 1 port (random) and change this in IIS. Users could then access by typing the port in the URL. Phew!

 

[fluid11]

You might also want to consider running OWA over SSL.

http://support.microsoft.com/default.aspx?scid=KB;EN-US;q234022&

ChrisP