Publishing exchange web through 2 ISA Servers

[Campell]

I have a ISA Configuration looking like this:
Internet - ISA1 - DMZ - ISA2 - Intranet

The DMZ and Intranet are using 192.168.x.xxx addresses.

On the intranet is a Exchange Server 2000 with the "integrated" IIS web
mail functionality.

I want to read the web mail from internet and therfore trying to publish
the exchange webserver via ISA2 and publish the ISA2 via ISA1. Since
exchange web mail relies on hostname I need to push the hostname all the
way through both ISA servers.

However, doing this I get the following error message when i browse this
page from the internet:
403 Forbidden - The server denies the specified Uniform Resource Locator
(URL). Contact the server administrator. (12202)
Internet Security and Acceleration Server

Any tips or ideas?

 

[wadifh]

I suggest you to vist this web site where you will find a lot of information about back to back isa configuration

http://www.isaserver.org/pages/learning zone.htm

you will find reall info in this site also

http://www.isaserver.org/shinder/tutorials/publishing_a_mail_Server_with_isa_server.htm

hope it works

let me know

 

[Knutern]

Hi,

are you trying to publish SMTP-Server and/or OWA (Outlook Web Access)? But from what you write, I take it, it is OWA.

1. You need to open the appropriate ports. OWA "unsecure" uses HTTP (80 tcp) and OWA "secure" HTTPS (443 tcp)
2. Is your first ISA (the one on Internet and DMZ) configured to act as "Integrated"? If yes, you need to set the server to listen for incomming web-requests, for example

http://www.mydomain.com

and be sure to include the following paths; /exchange* /exchweb* and /public* if you want to publish public folders too. Tell the server where to forward these requests. Be sure that the ISA Server in the DMZ knows the route where to forward.
3. Your second ISA must allow inbound traffic from the first ISA server (OWA-traffic and SMTP only for example). Your first ISA Server is the only one allowed to forward inbound.

Hope this is useful information for you. If not, let me know.. I've been working with this a lot recently and finally got it working.

Cheers
Knut Erik

 

[Campell]

Thanks for trying =)

The problem was that isa cannot use "forward host name" through 2 ISA servers. At least that was the problem for me.
My solution was to:
exchange.mydomain.com <-from internet
forward this (w/o hostname) to my inner ISA
inner isa forwards to exchange.mydomain.com BUT!! this is an alias to my internal exchange server on my intranet and this connection is made with the host file.

It would be much easier if OWA didn't use the hostname in the links.

Tricky but it solved the problem.