RSA OWA & ISA 2008 Exchange 2007

100; Access denied, RSA ACE/Server rejected the passcode that you supplied. Try again with a valid passcode.

One last thing I forgot to mention is to copy the local secret SecureID file from system32 into SDConfig folder.

• SECURID from <windir>\system32 to …\Microsoft ISA Server\sdconfig
• On each ISA Server, run the SDTEST.EXE utility.  This utility allows you test user authentication from an Agent Host to the RSA Authentication Manager Server.  Upon a successful user authentication, the Node Secret file (SECURID) will be created in the <windir>\system32 folder.

• The SDTEST Authentication Utility is used to verify that a computer running ISA Server can authenticate to a computer running RSA Authentication Manager.  Note the following:   SDTEST.EXE requires the SDCONF.REC to be located in the …\system32 folder to run and test authentication successfully.  However, for ISA server to successfully authenticate to the RSA server, SDCONF.REC must be located in the ..\Microsoft ISA Server\sdconfig folder.  Also note that SDTEST.EXE does not require a Node Secret to authenticate, but the ISA Server does require a Node Secret to authenticate.

oz Casey Dedeal,

MVP (Exchange)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +

Http://smtp25.blogspot.com (Blog)

Http://telnet25.spaces.live.com (Blog)

Http://telnet25.worldpress.com (Blog

RSA ISA 2006 Exchange 07 CAS Configuration Part III

Now it is time to jump on ISA server and make the configurations to make RSA work. lets start with backing up ISA configurations in case (-:, things go bad ( yada boktan (-: ) , and we might need to roll back the changes to get things up and running....

Log into ISA server Open ISA Console we will backup entire ISA configuration as well as one rule which we will make the changed on , click on Arrays, server right click Export (backup)

Next

we can accomplish same for single rule

Now the first rule I have is existing OWA Rule , you can disable this rule create another one delete if you wish or modify it all these will work, I prefer modifying existing one…

right click on the existing rule go to properties

Click Properties once more and place check mark on

• HTML form Authentication
• RSA SecureID

Click on

• Authentication delegation
• Basic authentication

• Click okay to get out, log into CAS server
• Server configuration
• Client access
• open properties Exchange ( default Web Site)
• click Authentication and set it to (Basic authentication , password is sent in clear text)

click okay and issue

• iisreset /noforce

Now if you open your webmail URL you will see similar window to below

Username: Your username

Passcode: Your 6 pin secret + 6 Pin RSA Generated Code

If your 6 Pin Code is 123456 and RSA token is showing XXXYYY

Passcode:123456XXXYYY

Password: Your Password

you will see your e-mails after successful login to OWA with two ways authentication…

oz Casey Dedeal,

MVP (Exchange)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +

Http://smtp25.blogspot.com (Blog)

Http://telnet25.spaces.live.com (Blog)

Http://telnet25.worldpress.com (Blog

RSA & OWA ( 2007) Two Factor Authentication with ISA 2006

Here is part two we continue troubleshooting the implementation RSA & ISA 2006 Exchange 2007 CAS servers.

As I said earlier on part I, don't bother to pock around if you cannot make the SDTEST.exe

Because, rest of the steps wont work and you will at the end need local secret to be copied from.

In previous post we were getting “106-web-server-is-busy-try-again” and when we try to use SDTEST.exe from ISA 2006 Server we start getting

Problem: cannot communicate with RSA ACE/Server

Possible cause: you have two NIC Cards on the ISA server one is Public other one is Internal Communication. The test utility does not know how to use the Internal NIC and using External NIC and hence cannot even start communication with RSA server. If you go to Application event log you will notice ACECLIENT errors as fallows

make sure the SDTEST and does know which interface to use so add static route to your ISA Servers as needed. ( see Part 1 for details)

if static route is there and you are getting this time “Access Denied” yet you do know the user name and postcode is correct check the fallowing

Add the following String Value registry entry on each ISA Array Member restart “wspsrv.exe”

• PrimaryInterfaceIP
• HKEY_LOCAL_MACHINE\Software\SDTI\AceClient
• Where the string value of PrimaryInterfaceIP is the IP address assigned to the interface that communicates with the RSA Server.

After restarting firewall service test once more , bingo it works

oz Casey Dedeal,

MVP (Exchange)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +

Http://smtp25.blogspot.com (Blog)

Http://telnet25.spaces.live.com (Blog)

Http://telnet25.worldpress.com (Blog

RSA with OWA 106: The Web server is busy.

I am in the process of configuring RSA with OWA 2007 , ISA server and posting some of experiences as I face them

here is the error “106-web-server-is-busy-try-again” this one is real generic and if you Google you will get several hits and scenarios how to deal with below situation….

The best way in my opinion is to deal with error above fallow the tips below and save time and headache to yourself

I assume you are using as fallow

• ISA server ( or servers)
• CAS server ( or servers)
• RSA / ACE Server ( servers)

The goal is

• Enable RSA token with OWA to accomplish two way authentication

First before you do anything ask your RSA Admin guy to give you SDCONF.REC  file. This file contains the source IP addresses ( ISA servers) destination IP addresses for RSA servers  and some other authentication information to make the  RSA work.

Once you get this file copy  the file on the ISA servers below directories

• Windows\System32 folder
• C:\Program Files\Microsoft ISA Server\sdconfig directories

Now download RSA Test Authentication Utility or Internet Security and Acceleration (ISA) Server 2006

RSA Test Authentication

Now you need to extract the files and place them to this directory

• C:\Program Files\Microsoft ISA Server ( assume you install ISA binaries on C drive if not change it accordingly

now find  sdtest.exe  in this directory and double click on it

Now click on the RCA ACE /Server Test Directly

if you are having problem it might be ISA server or remember in DMZ firewall needs to be configured allow access from ISA server to RSA server UDP port 5500, this is mentioned ion the RSA implementation paper, if you have done all these move on with below scenario

ISA is blocking traffic or  your test does not even getting to RSA servers because, ISA has two legs one is external interface one id internal interface, most likely your RSA server sitting inside and you have to add static route to ISA servers as fallows

issue route print

172.26.7.197  gateway for internal network

172.26.114.202 ISA server IP

route add 172.26.114.202 mask 255.255.255.255 172.26.7.197 –p

after this go to ISA Server click on networks

click on Addresses , use Add range

• insert the IP addresses of RSA server to allow communication

Now you test should work and you should be ready to move on second step

I will post part two for the rest of the work

download RSA Guide

 

oz Casey Dedeal,

MVP (Exchange)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +

Http://smtp25.blogspot.com (Blog)

Http://telnet25.spaces.live.com (Blog)

Http://telnet25.worldpress.com (Blog