Web server and TMG

[notleyhigh]

Hello

our web servers are published using tmg

at the moment i have a security rule form l3-trust to l4 untrust with any set

what do i need to do to allow traffic through to the web servers and tmg?

[npare]

Hi,

Can you provide a bit more information on your setup? Is your web server published from the inside or from the outsite? Is your web server in your trust zone or is it in a DMZ zone?

[mikand]

If possible (as a test) you can use appid:any and service:any and enable log on session start AND session end.

Then take a peak in the traffic log to see how the traffic is being identified, lets say "sharepoint" (or whatever).

Finally change this rule from any into appid:sharepoint (or whatever you found), service:application-default (or manually specify which TCP/UDP ports you wish to allow) and disable "log on session start" (just keep log on session end).

Dont forget to enable the IPS while your are at it (in the options).

Edit: And if you have SSL traffic you should take a look at enabling SSL-termination so the PA device can inspect the encrypted data aswell...