TMG 2010 RSA things you have to remember.

 

IF your setup requires you to setup TMG & RSA communication to meet two way government requirement and you have never done this keep reading hopefully the check list here will get you trough.

Assumption , you have configured your TMG server and you have RSA server in your network.

Summary

1. Add static route to RSA servers from TMG servers

2. Modify .Reg key on TMG server, specify what IP will be used for ACEClient

3. Go to network connections panel and make sure the Internal NIC is selected as the first NIC on the NIC bindings

4. make sure under networking from TMG, , Networks the RSA server IP addresses or Subnet is identified as internal subnet

5. You need to obtain SDconfig file from RSA Administrator (Generate Sdconfig from RSA server and save the file on TMG server on two places)

6. Locations for SDConfig on the TMG servers

• C:\Windows\System32
• E:\Program Files\Microsoft Forefront Threat Management Gateway\sdconfig

7. Download the tool from here ****Install this tool into same directory as the TMG binaries***

8. Your TMG and publishing rule for CAS2010 wont work unless you get the test working

1. On the TMG servers you have to make sure you have persistent static route added so that your TMG does know how to talk to RSA servers ( network routing)

Open CMD with Administrator privileges on TMG server and fallow the one line command ( Swap the IP address and proper DG , suits to your scenario)

RSA Server IP= 172.26.4.202

TMG Internal NIC = 172.26.7.105 / 27    ( /27 = 255.255.255.224)

TMG External NIC = 172.26.7.12 / 27

My default gateway for TMG server is =10.0.0.1

route add 172.26.4.202 mask 255.255.255.255 172.16.7.97 -p

Let me explain little bit what these 255.255.255.225 mean here, it means any traffic comes to destination IP=172.26.4.202 will be routed to Internal NIC Default gateway =172.16.9.97  on the TMG Server.

IF you want to have route to entire network, you would use Class less Subnet mask in this case it would be like this

This open entire network, not one host !!!!!!!!!!!!

route add 172.26.4.202 mask 255.255.255.0 172.16.7.97 -p

Delete Route ( if you make mistake and want to delete persistent route

route delete 172.26.4.202

IF you like to see static route table

route print

*****If there is no static route defined the TMG server will route the traffic to the external NIC=172.26.7.12 which is different subnet and Internal and external NIC, thus interfaces separated each other not only TMG firewall and most likely another ( CISCO etc) type of firewall. thus they wont allow to talk.****

Now on the TMG server you have to hack the register and tell TMG what the IP address will be used to talk to RSA server on each TMG server.

• HKEY_LOCAL_MACHINE
• SOFTWARE
• SDTI
• AceClient

PrimaryInterfaceIP"="172.26.7.105"

Respectfully,
Oz Casey, Dedeal ( MVP north America)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

Cannot rename this connection. A connection with the name you specified already exist. Specify a different name.

If you are trying to rename the existing NIC and receiving above warning on VMWare host fallow the easy steps to fix the problem, hidden NIC card in the device manager is causing issues….

1.Click Start, click Run, type cmd.exe, and then press ENTER. 2.Type set devmgr_show_nonpresent_devices=1, and then press ENTER. 3.Type Start DEVMGMT.MSC, and then press ENTER. 4.Click View, and then click Show Hidden Devices. 5.Expand the Network Adapters tree. 6.Right-click the dimmed network adapter, and then click Uninstall

 

 

 

http://support.microsoft.com/kb/269155

Respectfully,
Oz Casey, Dedeal ( MVP north America)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog)

How to Disable SSLv2 on a Windows Server 2008 and Windows Server 2008 R2

If you are trying to fallow the WIKI post "How to Disable SSLv2 on a Windows Server 2008 and Windows Server 2008 R2" after doing the work, you reboot the problem server, and after rebooting your security scan is still alarming about "SSLv2" enabled on the problem server , create the fallowing key instead.

1. Open the registry and create a key named Server under the following entry :

• HKEY_LOCAL_MACHINE
• SYSTEM
• CurrentControlSet
• Control
• SecurityProviders
• SCHANNEL
• Protocols
• SSL 2.0

1. Under the registry key Server, create a DWORD value named “DisabledByDefault” and change the value data to “00000001”
2. Reboot the server

 

Wiki

Respectfully,
Oz Casey, Dedeal ( MVP north America)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog

Move Public Folders All replica to Exchange 2010 Server PS Script

If you are in the middle of migration and it is time to move all PF folder replicas from Exchange 2007 to Exchange 2010 server PS is your friend.

Lets say your Existing Exchange 2007 Server name is EXC07 and you want to move all PF replicas to newly build Exchange 2010 Server called EXC210 , you can use fallowing PS commands…..

Connect to your Exchange Server , open EMS

Navigate fallowing directory from PS command line

[PS] E:\Program Files\Microsoft\Exchange Server\V14\Scripts>

• AddReplicaToPFRecursive.ps1
• RemoveReplicaFromPFRecursive.ps1
• ReplaceReplicaOnPFRecursive.ps1
• MoveAllReplicas.ps1

Now we are ready to execute existing scripts sits on this directory. All PF replicas sits on the server called “EXC07” and I like to add Exchange 2010 Server called “EXC210 into PF replica  folders as second server.

 

.\AddReplicaToPFRecursive.ps1 –Server EXC210 –TopPublicFolder \ –ServerToAdd “EXC07”

Remove Replica  ( pay attention  Exchange  server must have all of its public folder replicas removed before it can be decommissioned…. )

.\RemoveReplicaToPFRecursive.ps1 –Server EXC210 –TopPublicFolder \ –ServerToRemove “EXC07”

• Now System folders

.\AddReplicaToPFRecursive.ps1 -TopPublicFolder "\NON_IPM_Subtree" ServerToAdd "EXC210"

• To view a list of the replicas in the public folder hierarchy

Get-PublicFolder -recurse |fl name,replicas

• Move all replicas from EXCH07 to EXC210

MoveAllReplicas.ps1 –Server EXC07 –NewServer EXC210

• For System Folders

Get-PublicFolder -recurse \non_ipm_subtree |fl name, replicas

• To compare content replicated between the source and destination servers

Get-PublicFolderStatistics | FL

• Also

Get-PublicFolderStatistics –Server ServerA

• Compare Output to ServerB

Get-PublicFolderStatistics –Server ServerA

 

 Resources:

• Administration of Public Folders with the introduction of Exchange 2007
• Scripts for Managing Public Folders in the Exchange Management Shell

Respectfully,
Oz Casey, Dedeal ( MVP north America)
MCITP (EMA), MCITP (SA)
MCSE 2003, M+, S+, MCDST
Security+, Project +, Server +
http://smtp25.blogspot.com/ (Blog)
http://telnet25.wordpress.com/ (Blog