TMG SP2 Hotfix Rollup 2 released!
The TMG team has released a new hotfix release:
Changelog:
| KB number | Title |
| 2701952 | FIX: "Access is denied" status error when you use a delegated user account to try to monitor services in Forefront Threat Management Gateway 2010 |
| 2700248 | FIX: A server that is running Forefront Threat Management Gateway 2010 may randomly stop processing incoming traffic |
| 2700806 | FIX: connectivity verifier that uses the "HTTP request" connection method may not detect when a web server comes back online in Forefront Threat Management Gateway 2010 |
| 2705787 | FIX: The Firewall service may intermittently crash when it processes client web proxy requests in a Forefront Threat Management Gateway 2010 environment |
| 2701943 | FIX: Error message when you try to join a Forefront Threat Management Gateway 2010 server to an array: "The Operation Failed. Error code - 0x80070002 - the system cannot find the file specified" |
| 2705829 | FIX: The Firewall service may stop responding to all traffic on a server that is running Forefront Threat Management Gateway 2010 |
| 2694478 | FIX: Dynamic Caching may incorrectly delete recently cached objects from a caching server that is running Forefront Threat Management Gateway 2010 or Internet Security and Acceleration Server 2006 |
download it here:
http://support.microsoft.com/kb/2689195
How to: Manually assign the Direct Access client subnet on UAG
Recently, I configured a Direct Access setup with a single external loadbalancer and two UAG nodes for one of our customers.
To get the idea, here's a simple diagram of this setup:
(Please don't mind the "publicness" of the IPv6 range depicted above. I tried using a site-local IP (fec0:someting:someting) but since this is incompatible with UAG Direct Access, I picked this range).
As one can tell from the picture above: Only the outside interfaces of the UAG (IPv4) are loadbalanced, and the customer is running IPv6 (dual-stack) on his LAN network.
To enable Direct Access client connectivity, i had intended to configure a different /64 range per UAG for DA clients, and use internal routing to deliver the chosen subnets to the appropriate UAG node acting as the gateway for that subnet.
With this TechNet article in mind, I configured cef0:1:1:d000::/63 as the IP-HTTPS subnet for our DA clients, and set up routes to cef0:1:1:d000::/64 via UAG node1 and cef0:1:1:d001::/64 via UAG node 2 on the core switch. So I ran the wizard in UAG, applied the policies, activated the configuration and got about to testing this setup. So far, so good.
First thing I noticed though, was that, regardless of which UAG the DA client connected to, it would always get an IP address from the cef0:1:1:d000::/64 range.
As suggested in the previously mentioned TechNet article, I ran netsh interface ipv6 show route on both UAG nodes to determine which node got which part of the subnet. Much to my surprise I saw they both contained this route:
According to said TechNet article, this meant that both UAG nodes were configured to use that specific subnet for their Direct Access clients, which was indeed what appeared to be the case.
Unfortunately though, I couldn't find how to fix this issue anywhere. I tried reconfiguring the policies, reapplying the configuration, wiping the routing table entirely, etc. etc. to no avail.
As a final suggestion I tried to manually intervene in the automatically created routes and just enter the correct routes manually.
I fired up an administrative command console and executed the following commands:
netsh int ipv6 add route prefix=cef0:1:1:d001::/64 interface=IPHTTPSInterface metric=1 publish=yes store=persistent
netsh int ipv6 delete route prefix=cef0:1:1:d000::/64 interface=IPHTTPSInterface
netsh int ipv6 delete route prefix=cef0:1:1:d000::/128 interface=IPHTTPSInterface
Fully expecting that this wouldn't work (I had previously learned not to mess with anything UAG DA does automatically), I reconnected my DA clients to UAG node 2 and noticed they were now using the cef0:1:1:d001::/64 subnet!
Emboldened by these results I upped the ante and configured cef0:1:1:d000/56 as the subnet for all UAG nodes, and tried using every available /64 in that range on both nodes, simple by deleting and adding routes. It worked each and every time 
The only thing you should keep in mind is that, when you (re)apply the DA policy on UAG, the wizard will delete the configured routes and substitute the original one. A minor inconvenience imho, as long as you remember to reconfigure the static routes later on (a good idea would be to add them to your maintenance procedures for DA, for example).
So there you go: With those simple commands, you can manually assign which UAG node uses which (part of the) subnet!
Server 8 Direct Access https null encryption
Server 8 Beta has a great new feature which will increase performance when using an https tunnel.
It's called https null encryption. It uses the null cipher as encryption method.
The reason this increases performance is the following:
Normally Direct Access works in the following way: (see picture 1)
- Your client will first create an https connection using encryption.
- After that it will create an IPsec connection with encryption.
Windows Server 8 Beta works in the following: (see picture 2)
- Your client (Windows 8 required) creates an https connection using null encryption.
- After that it will create an IPsec connection.
Because of the null encryption there is less overhead on the connection and it will be faster.
I used Wireshark to see the difference:
On a windows 7 client the following happens:
Figure 1 https tunnel with normal encryption
On a windows 8 consumer preview the following happens:
Figure 2 https tunnel with null encryption
My Server 8 DirectAccess Lab
My DirectAccess Lab:
This post will describe my DirectAccess lab for Windows server 8 beta.
The requirements:
- Connect using https tunnel.
- Connect using the teredo protocol (this is not used in Direct Access Server 8 Beta, more on this later.)
- Connect using the 6to4 protocol.
- Have multiple networks to simulate Nat & Direct internet connectivity.
- Being able to enable multisite.
- Having a PKI to generate certificates.
- Have fake external ip addresses.
- Being able to deploy ipv6 throughout the network (including external).
- Integrate NAP & OTP.
- Being able to demo the three deployment possibilities for DirectAccess.
I have created the following networks:
- Client NAT: This connection simulates a work from home situation. It's a private subnet with a nat router.
- Simulate Internet1: This connection is used to simulate internet. This is used for 6to4 connectivity from the client.
- Simulate Internet2: This connection is used to simulate internet. This is the subnet where the DrectAccess Server will be published.
- Domain a: This connection simulates the corporate network.
- Domain b: This connection simulates a different site at the corporate network (for multisite connectivity).
Between every network I have deployed a virtual m0n0wall installation:
Mono1 is connected to: (NAT functionality)
- Client NAT (192.168.5.254/24)
- Simulate Internet1 (1.1.2.1/29)
Mono2 is connected to: (Routing functionality)
- Simulate internet1 (1.1.2.6/29)
- Simulate internet2 (1.1.2.9/29)
Mono3 is connected to: (Nat functionality)
- Simulate internet 2 (1.1.2.14/29)
- Domain A (172.16.1.1/24)
- Domain B (172.16.2.1/24)
- Real internet (Because I want to be able to install updates)
I made a Visio drawing to make things more clear.
The virtual machines:
I did setup the following virtual machines:
In domain A:
- Windows Server 8 beta Domain controllers. (172.16.1.1/24)
- Windows Server 8 beta Active Directory Certificate Services. (172.16.1.2/24)
- Windows Server 8 beta Direct Access. (172.16.1.3/24) (for edge deployment: 1.1.2.10/29)
- Windows 8 consumer preview client. (DHCP)
In Domain B:
- Windows Server 8 beta Domain controllers. (172.16.2.1/24)
- Windows Server 8 beta Active Directory Certificate Services (172.16.2.2/24)
- Windows Server 8 beta Direct Access (172.16.2.3/24) (for edge deployment: 1.1.2.11/29)
In the upcoming blog posts I'll describe the three deployment options of DirectAccess on Windows Server 8 Beta.
UAG SP1 Update 1 Rollup 1 & TMG SP2 Rollup 1 released
Hello,
Because of my holiday I didn't mention this updates for UAG & TMG yet.
Here they are:
TMG: http://support.microsoft.com/kb/2649961
UAG: http://support.microsoft.com/kb/2647899
TMG Fixes:
| KB number | Title |
| 2654016 (http://support.microsoft.com/kb/2654016/ ) | FIX: A client may be unsuccessful in accessing a Java SSO application published to the web in a Threat Management Gateway 2010 environment |
| 2653703 (http://support.microsoft.com/kb/2653703/ ) | FIX: You receive an "Error: Subreport could not be shown" error message in the User Activity or Site Activity report in a Forefront Threat Management Gateway 2010 environment |
| 2654585 (http://support.microsoft.com/kb/2654585/ ) | FIX: UDP packets may become backlogged when you increase the "Maximum concurrent UDP sessions per IP address" setting in a Forefront Threat Management Gateway 2010 environment |
| 2624178 (http://support.microsoft.com/kb/2624178/ ) | FIX: Threat Management Gateway 2010 administrators may be unable to generate reports |
| 2636183 (http://support.microsoft.com/kb/2636183/ ) | FIX: Both sides of a TCP connection are closed when the client or remote application half-closes the TCP connection in a Forefront Threat Management Gateway 2010 environment |
| 2653669 (http://support.microsoft.com/kb/2653669/ ) | FIX: Summary information for the Top Overridden URLs table and for the Top Rule Override Users table display incorrect information in a Forefront Threat Management Gateway 2010 environment |
| 2617060 (http://support.microsoft.com/kb/2617060/ ) | Forefront TMG 2010 enables L2TP site-to-site connections in RRAS |
| 2655951 (http://support.microsoft.com/kb/2655951/ ) | FIX: Japanese characters in the subject line of an Alert email message are not readable in the Japanese version of Forefront Threat Management Gateway 2010 |
| 2654068 (http://support.microsoft.com/kb/2654068/ ) | FIX: "The Web Listener is not configured to use SSL" warning message may occur when you configure a Web Listener to use a valid SSL certificate in a Forefront Threat Management Gateway 2010 environment |
| 2654193 (http://support.microsoft.com/kb/2654193/ ) | FIX: You receive a "Bad Request" error message when you try to access Outlook Web App in a Forefront Threat Management Gateway 2010 environment |
| 2654074 (http://support.microsoft.com/kb/2654074/ ) | FIX: String comparison may become case-sensitive when you publish a website by using Forefront Threat Management Gateway 2010 |
| 2658903 (http://support.microsoft.com/kb/2658903/ ) | FIX: The Forefront Threat Management Gateway Firewall service (Wspsrv.exe) may crash frequently for a published website secured by SSL after you install Service Pack 2 |
UAG Fixes:
| KB number | Title |
| 2653898 (http://support.microsoft.com/kb/2653898/ ) | FIX: Forefront Unified Access Gateway 2010 incorrectly notifies users that their password expires 2 days later than the actual expiration date |
| 2655667 (http://support.microsoft.com/kb/2655667/ ) | FIX: You receive a notification that hotfix 977342 is missing when you run the Direct Access Configuration Wizard on a Forefront Unified Access Gateway 2010 server that is running Windows Server 2008 R2 SP1 |
| 2655669 (http://support.microsoft.com/kb/2655669/ ) | FIX: The system may stop responding when you start a tunneled Java application on a 64-bit client after you apply Service Pack 1 Rollup 1 for Forefront Unified Access Gateway 2010 |
| 2655670 (http://support.microsoft.com/kb/2655670/ ) | FIX: The window title of a webpage is incorrect when you publish a SharePoint site by using UAG 2010 |
| 2652712 (http://support.microsoft.com/kb/2652712/ ) | FIX: "You do not have permission to view this folder or page" error when you try to access a web application published by UAG 2010 SP1 |
| 2654055 (http://support.microsoft.com/kb/2654055/ ) | FIX: Cookie names pass through host address translation when the cookie domain attribute is the same domain as the portal public host name |
| 2655027 (http://support.microsoft.com/kb/2655027/ ) | FIX: "HTTP 503" errors may occur when you publish AD FS 2.0 servers in a Forefront Unified Access Gateway 2010 environment |
| 2655012 (http://support.microsoft.com/kb/2655012/ ) | FIX: Error message occurs when you try to change your password in a Forefront Unified Access Gateway 2010 environment: "The URL contains an invalid path" |
| 2654990 (http://support.microsoft.com/kb/2654990/ ) | FIX: "The value of 'Attribute Type' must be bigger than 0 and must not exceed 255" error message when you try to configure a RADIUS repository through Forefront Unified Access Gateway 2010 |
| 2655671 (http://support.microsoft.com/kb/2655671/ ) | FIX: You cannot start a UAG SP1 Update 1 array configuration that contains an HTTP to HTTPS redirection trunk |
| 2655008 (http://support.microsoft.com/kb/2655008/ ) | FIX: Intermittent crashes may occur for the w3wp.exe process on a server that is running in a Forefront Unified Access Gateway 2010 array |
| 2655007 (http://support.microsoft.com/kb/2655007/ ) | FIX: DefaultAppPool may crash when you try to install Forefront UAG Service Pack 1 Update 1 |
| 2655088 (http://support.microsoft.com/kb/2655088/ ) | FIX: Form-based SSO logon fails after you install Forefront Unified Access Gateway Service Pack 1 Update 1 |
Directaccess Connectivity Assistant beta 2.0 released
Microsoft has just released the DCA 2.0 beta for Windows 7.
Windows 8 actually has the connectivity assistant built in.
The DCA 2.0 adds the following functionality:
1. DCA 2.0 provides one-time password (OTP) authentication functionality to Windows 7 clients using Windows Server “8” Beta DirectAccess server.
2. DCA 2.0 provides logging information about the OTP process.
The installation of DCA 2.0 beta removes older versions (1.0 or 1.5).(1.5 didn't replace 1.0 and you would end up having both versions installed).
The installation comes with new gpo templates as well.
download it here: http://www.microsoft.com/download/en/details.aspx?id=29039
Known Issues
1. An unsuccessful installation of DCA 2.0 during an upgrade of a previously installed DCA version (1.5 and 1.0) will result in the removal of the previous DCA version as well.
2. Restarting the computer is required after every install and uninstall on DCA 2.0. The behavior of DCA 2.0 will be unpredictable if the restart is not performed.
3. Cancellation of a DCA 2.0 installation can result in difficulty in removal, and therefore the installation process should not be canceled once started. If the DCA 2.0 installation has been started, then complete the install, restart the computer, uninstall DCA 2.0, and restart the computer again. This will ensure that DCA 2.0 is removed cleanly.
4. On 64-bit DirectAccess client machines the “One-time password (OTP) state” in the DCA logs shows the wrong status, and should be disregarded.
5. The setting AdminScript is not available in the admx configuration file. It can be manually added to the DCA GPO.
Reinstalling TMG fails, cannot assign port 2171: already in use by another service.
Recently I had to fix a broken TMG install at one of our customers.
After some initial troubleshooting, I found that the OS was functional, but none of the TMG services could be started.
In an attempt to keep the time to fix as low as possible (this was a live production environment) I went to the Programs and Features and tried to repair the install.
This failed, since TMG setup could not reach the CSS server (which was running locally on the machine).
As a next step I decided to just reinstall the whole machine and restore the TMG configuration from a previously created configuration backup.
I started TMG setup again from Programs and Features and chose the "remove" option, waited for it to finish and rebooted the server. After logging in again, I decided to pop in the TMG installation media and I kicked off setup again, only to be greeted by an error saying that TMG could not create the required instance in AD LDS.
Some investigation later (A quick peek in my "Programs and Features"), it turns out TMG setup failed to remove the AD LDS instance "ISASTGCTRL", which is bound to port 2171 on the TMG server.
Unfortunately, the option to uninstall this instance was sorely lacking from my "Programs and Features" console. Still with the limited timeframe in mind (we needed a fix asap) I tried removing the instance by just removing the entire role with the server manager "Remove Roles" wizard, which of course failed with the mention that I had to remove all instances first using the "Programs and Features" console.
To recap: TMG told me that AD LDS was broken -> The remove option was missing from "Programs and Features" -> the "Remove Roles" wizard tells me to remove all instances first, using the "Programs and Features" console...
You can see where this was going.... 
(in a circle).
In a last ditch attempt at removing the role, without resorting to recovering the entire Windows install from scratch, I decided to try running the adamuninstall tool from commandline directly, and see if I could force the instance out of existence.
And wouldn't you know it: It worked!
I did get some error about not being able to connect to the local AD LDS tree for backups, but after skipping that message, ADAM uninstall ran like normal and the instance was gone. A quick reboot later and TMG setup ran like never before.
So, if you ever run into this error, the fix (after all normal methods have been exhausted) is to simple run "C:\Windows\ADAM\adamuninstall.exe" /i:ISASTGCTRL, press enter, skip all errors and wait for the instance to dissapear.
Quite simple, really.
TMG SP2 setup fails when upgrading ADAM.\r\n
Recently, I ran into the following issue when upgrading an EMS from SP1 Update 1 to SP2:
After completing the steps in the SP2 setup the process would hang while trying to open the Configuration Storage Server (CSS) and quit while trhowing the error mentioned above ("Setup failed to upgrade ADAM.\r\n").
As any good Windows admin normally does, I decided to check the installation logfiles (usually under %systemrootr%\Temp) to determine the cause. After examining the TMG-KB2555840-amd64-ENU_Install.log, which turned up to be rather unreadable, I opened ISAADAM_IMPORTSCHEMA_ServicePack.log and noticed the setup failed whilst trying to perform the following action on ADAM:
Loading entries
1: CN=msFPC-Access,CN=Schema,CN=Configuration,CN={A3AD3CD8-8248-45D3-B49E-38BBAA06CE9F}
Entry DN: CN=msFPC-Access,CN=Schema,CN=Configuration,CN={A3AD3CD8-8248-45D3-B49E-38BBAA06CE9F}
changetype: add
Attribute 0) adminDescription:msFPC-Access
Attribute 1) adminDisplayName:msFPC-Access
Attribute 2) attributeID:1.2.840.113556.1.8000.901.1.1
Attribute 3) attributeSyntax:2.5.5.10
Attribute 4) isSingleValued:TRUE
Attribute 5) lDAPDisplayName:msFPCAccess
Attribute 6) name:msFPC-Access
Attribute 7) oMSyntax:4
Attribute 
objectCategory:CN=Attribute-Schema,CN=Schema,CN=Configuration,CN={A3AD3CD8-8248-45D3-B49E-38BBAA06CE9F}
Attribute 9) objectClass:attributeSchema
Attribute 10) searchFlags:0
With this specific error:
Add error on entry starting on line 1: Busy
The server side error is: 0x21a2 The FSMO role ownership could not be verified because its directory partition has not replicated successfully with atleast one replication partner. The extended server error is:
000021A2: SvcErr: DSID-030A0AF2, problem 5001 (BUSY), data 0
This puzzled me, as we are only running one EMS, so there shouldn't be any replication whatsoever.
Trying to solve this mystery I opened dsmgmt on the EMS and queried the AD-LDS to determine who had the roles, which turned out to be my local EMS server.
This led me to believe that there might be something wrong with the AD-LDS on this particular server, so I decided to seize the roles to try and fix this issue by overwriting the current setting regarding the naming and schema master by executing these commands:
- At the command prompt, type: dsmgmt
- At the dsmgmt: command prompt, type: roles
- At the fsmo maintenance: command prompt, type: connections
- At the server connections: command prompt, type: connect to server <FQDN>:2171
- At the server connections: command prompt, type: quit
- At the fsmo maintenance: command prompt, type: seize naming master
- Click yes to confirm you wish to transfer the role
- At the fsmo maintenance: command prompt, type: seize schema master
- Click yes once more to transfer the role
Turns out my assumption was right, because afterwards I was able to run and succesfully complete the SP2 setup.
(This article uses parts of: http://blogs.technet.com/b/isablog/archive/2009/03/31/transferring-configuration-storage-server-fsmo-roles.aspx)
Forefront UAG SP1 Update 1 Released
Forefront UAG SP1 Update 1 has just been released.
I just installed it on my test environment and no issues so far.
get it now: https://www.microsoft.com/download/en/details.aspx?id=27604
The version number of this release is 4.0.1773.10100
Changelog:
• Lync web services publishing—Forefront UAG now supports publishing Lync web services
• Dynamics CRM 2011 publishing—Forefront UAG now supports publishing Dynamics CRM 2011
• SharePoint 2010 with Office Web Apps—Forefront UAG now supports publishing SharePoint 2010 with Office Web Apps
• Improved browser support—Forefront UAG now supports more web browsers than in previous releases
If you are using DirectAccess:
After installing this update, it is possible that the NAT64 service is stopped and set to Manual.
Please go to services.msc and change to startup type to automatic
This updates includes yesterday's released hotfix: KB2522485 ( https://www.microsoft.com/download/en/details.aspx?displaylang=en&id=27640 )
https://technet.microsoft.com/en-us/security/bulletin/ms11-079
Forefront TMG SP2 Released!
Forefront TMG SP2 is just released.
Get it now: https://www.microsoft.com/download/en/details.aspx?id=27603
What's new?
- Kerberos authentication support with NLB. https://blogs.technet.com/b/isablog/archive/2011/10/12/new-in-sp2-kerberos-authentication-in-load-balanced-scenarios.aspx
- New look & feel for error pages.
- Error pages can be more easily customized and can include embedded objects.
- The new Site Activity report displays a report showing the data transfer between users and specific websites for any user https://blogs.technet.com/b/isablog/archive/2011/10/12/new-in-sp2-site-activity-report.aspx
- SSL memory pool increased from 1024 to 4096. Which leads to better performance via https://blogs.technet.com/b/yuridiogenes/archive/2011/10/10/unable-to-send-messages-from-outlook-behind-forefront-tmg-after-migrating-to-cloud-services.aspx
- Internet explorer 9 Bug is fixed.
- EMS/Array now detects version information about your TMG hosts.
Complete change log can be found here(not updated at the time of posting): http://go.microsoft.com/fwlink/?LinkId=225004
The version number of the server with SP2 is: 7.0.9193.500
The new error pages:
Before:
after:
To enable the new error pages:
Go to properties of your server and select error pages:
