topic Re: ISA (TMG) Problem with PA-500 in vwire mode in General Topics

ISA (TMG) Problem with PA-500 in vwire mode

d_ballam — Thu, 26 Jan 2012 09:48:54 GMT

background:

we have a new installation of a PA-500 (running 4.1.2) which sits behind our edge firewall (TMG 2010) in vwire mode.

basic setup. the pa-500 external interface connects directly into the edge firewalls internal interface and the pa-500 internal interface connects directly to our production network. our DNS, AD etc are all on this production network. the PA-500 is only doing content filtering for web / applications.

we have have the following rules (simplified but basically the important parts)

rule #1 allow internal to external for <selected users>

rule#2 allow internal to external for any users

rule #3 deny from internal to external for any

as you can see rule one is used for selected members on the domain

rule 2 shouldnt be required as this basically lets anyone who isnt a member of the selected group from rule 1 out to the internet anonymously.

and rule 3 is ther as a deny all (which should be there by default)

as you can see rule 2 should be removed BUT the problem is this

If we remove rule#2 our TMG firewall loses connectivity with the production network so loses its secure channel with the domain / domain controls. this causes the firewall to stop authenticating users thus the firewall kills all conenctions.

can you pleae confirm that rule#2 should never be in the pa-500 setup and confirm that in vwire mode the device should not stop non web/application protocols from communicating.

Re: ISA (TMG) Problem with PA-500 in vwire mode

kalyanram.piratla — Thu, 26 Jan 2012 11:01:14 GMT

Hi Dave,

Could you please confirm if "selected users" are hitting rule #1, or are they hitting rule #2. If there a few users from the "selected users" used in rule #1 and are hitting rule #2, then we would need to look how the User-ID agent has been configured.

Thank you

Kal

Re: ISA (TMG) Problem with PA-500 in vwire mode

d_ballam — Thu, 26 Jan 2012 12:43:49 GMT

users who are a member of selected group hit rule one. anyone outwith rule one hits rules two (as you would expect)

we seem to have our user group issue solved kal.

now the main problem is getting rid of rule two and why the pa-500 is restricting our edge firewall from communicating with the network.