TMG SSL3.0

Hi,
SSL 3.0 vulnerability was founded.
Vulnerability in SSL 3.0 Could Allow Information Disclosure
https://technet.microsoft.com/en-us/library/security/3009008
I’m anxious about this vulnerability.
And I’ll take action to this problem.
I’m using “Forefront Threat Management Gateway (TMG) 2010”.
Is it OK if the TMG SSL3.0 be disabling?
Thanks
Hiroko Haijima

Hello,
As far as I know you need to test it i lab environnement to be sure that the publication and the application using them work as expected.
You could found more information here:
http://www.isaserver.org/articles-tutorials/configuration-security/improving-ssl-security-forefront-threat-management-gateway-tmg-2010-published-web-sites.html
http://tmgblog.richardhicks.com/2014/09/08/recommended-forefront-tmg-2010-ssl-and-tls-configuration/
Regards,
Follow me on Twitter http://www.twitter.com/liontux | My Blog (French/English) :
http://security.sakuranohana.fr/

Similar Messages

How to populate values in F4 help based on another F4 help in a TMG

Hello All,
I have created a TMG for a table. Have added that to customization also. Now, in that table I have 2 fields say carrid and connid. In the F4 help of carrid, all carrids will be displayed. Now if the user selects one carrid, the next field connid should show only those connids related to carrid. How this can be achieved in a TMG. If in a module pool, we can write POV or etc. But in TMG, how can we ?
Rgds,
Renjith

See the table maintaince has events ,you can write the code under events.
Reward Points if it is helpful
Thanks
Seshu

Sharepoint Internet site with NLB via TMG

I have configured two wfes in NLB, the nlb name is say 'spwebnlb'
Using this name as 'hostheader' I have created a webapplication, so that I can access
http://spwebnlb , I am able to achieve this.
Now the issue is I want this site to be accessed with url
https://www.companyname.com
First thing I added this url in AAM of central admin
I have published the site using TMG
In IIS i have added binding for SSL (in iis host name is spwebnlb)
Now I am not able to access the site it give me error as, it is actulally taking me to /pages/variationroot.aspx
The Web application at https://www.companyname.com could not be found. Verify that you have typed the URL correctly. If the URL should be serving existing content, the system administrator may need to add a new
request URL mapping to the intended application.

Hi Rizzk,
According to your description, my understanding is that you cannot access the site after publishing the site via TMG.
For troubleshooting your issue, could you access the site in the Intranet? Please make sure you have extended the web application for internet zone and blinded the internet URL in IIS.
For more information, you can refer to the Video :
http://technet.microsoft.com/en-in/video/configure-an-alternate-access-mapping-in-sharepoint-2010.aspx
Best Regards,
Eric
Eric Tao
TechNet Community Support

When I try to open Firefox I receive this message, "Application has failed to start because ssl3.dll was not found." HELP!

I've been using Firefox for about 3 years. Today, I ran a scan of my computer Webroot Anti Virus and deleted all "risky stuff" they checked. Don't know if this is a coincidence but right after the scan I could not open Firefox. I receive the message, "Application has failed to start because ssl3.dll was not found. Reloading application may remedy this." I reloaded Firefox, the current version, clicked on open and received the same message. I've reloaded Firefox 3 more times with the same results. Now I need HELP.

See if you can make Webroot restore that file in the Firefox program folder (C:\Program Files\Mozilla Firefox\).<br />
If not then you need to reinstall Firefox and make sure that Webroot doesn't do that another time.
You can find the latest Firefox release here:
*Firefox 8.0.x: http://www.mozilla.com/en-US/firefox/all.html

Kerberos double hop works internally, but not when published via TMG

Hi all,
Have 2 x IIS 8.5 servers internally with .net applications on them
The IIS servers have been configured to use a domain account for their apppool... and credentials are pass successfully from the front end server to the back end server.
When publishing the front-end server via TMG, the front-end web pages show up fine, but the delegated credentials aren't passed to the "back end" pages and a 401 - unauthorised error is presented.
The TMG computer account has the front end and back end http SPN's defined for delegation in its AD account properties.
Is this expected ? is this a limitation of TMG ? or have I simply done something incorrect ?

Hi,
Please check the following article to see if you missed anything.
About Kerberos constrained delegation
https://technet.microsoft.com/en-us/library/cc995228.aspx
Best Regards,
Joyce
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

FireFox will not start due to message indicating that ssl3.dll is missing and indeed it is not in the program files. But I can not seem to be able to reinstall Firefox or to copy the ssl3.dll file into the program files. Help?

Webroot identified ssl3.dll as a threat and deleted it. Now I can not start Firefox, nor can I copy ssl3.dll into the Firefox Program file. I tried uninstalling Firefox and reinstalling it, but it always shows as an upgrade and does not seem to add ssl3.dll. HELP?

1. Open Webroot
2. Click on PC Security
3. Click on the Quarantine tab
4. Select ssl3.dd
5. Click restore

Apple Mail on Macbook via windows domain network and microsoft TMG

Hi folks.
We run a windows network with server 2008 tmg, dcs, and exchange 2007.
We have a few mac clients on our internal network. They log on locally but have all the correct network settings etc for proxy, network and internet access. Everything works fine through TMG including apple mail to our exchange server, and web browsing etc.
The one thing that isn't working is apple mail to other mail providers. Specifically Gmail.
I've created an access rule for testing purposes to allow all outbound traffic from a macbook pro. It still doesn't work, with the following being the only error:
Denied Connection RHSTMG 21/05/2010 10:27:07
Log type: Firewall service
Status: An ingoing packet was dropped because its destination address does not exist on the system, and no appropriate forwarding interface exists.
Rule: None - see Result Code
Source: Internal (10.1.0.81:5353)
Destination: External (224.0.0.251:5353)
Protocol: Unidentified IP Traffic (UDP:5353)
Additional information
•Number of bytes sent: 0 Number of bytes received: 0
•Processing time: 0ms Original Client IP: 10.1.0.81
Someone on another (microsoft) forum said this:
224.0.0.251:5353 is RendezVous protocol, which is used by Mac OS for locating services. it is multicast protocol and it's only purpose is locating things.most it has nothing to do with Google Mail.
The mac has entirely unrestricted access to everywhere (in theory).
Gmail account through windows 7 client using outlook is fine by the way.
Nothing else is denied or refused when looking at the live logging.
Any help with this would be great.
Thanks
Dave

I had this problem too, but I found a post burried on the web that said to add " p06- " (without quotes) before the imap and smpt server names and that worked:
p06-imap.mail.me.com
p06-smtp.mail.me.com
Everything stays checked, SSL for both, authentication and use same username and password checked.

TMG - 0x80090325 -Certificate Chain was issued by an authority that is not trusted

Hello,
I am having some problems with testing a OWA (SSL) rule. I get that message.
The TMG belongs to the domain and therefore as far as I know it gets the root certificate of my CA (I have deployed a Enterprise CA for my domain).
That is why I don't understand the message: "...that is not trusted."
The exact message:
Testing https://mail.mydomain.eu/owa
Category: Destination server certificate error
Error details: 0x80090325 - The certificate chain was issued by an authority that is not trusted
Thanks in advance!
Luis Olías Técnico/Admon Sistemas . Sevilla (España - Spain)

Thanks Keith for your reply and apologies for the delay in my answer.
I coud not wait and I reinstalled the whole machine (W28k R2 + TMG 2010) . I suppose I am still a bad troubleshooter, I have experience setting up ISA, TMG, PKI, Active directory but to a certain extent.
1. Yes, I saw it when hitting the button "Test Rule" in the Publising rule in the TMG machine.
2. No, it did not work in this implementation but it has worked in others, this is not difficult to set up, until now, hehe.
3. You said: "...If you are seeing it when running "Test Rule" then it simply means that TMG does not trust something about the certificate that is on your Exchange Server...."
But the certificates are auto-enrolled, and when I saw the details of the certificates they all are "valid" , there is a "valid" message.
4. You wrote: "...Easiest way see everything is create an access rule that allows traffic from the LocalHost of TMG to the CAS and open up a web browser. Does the web browser complain?..."
But as I said, I re-installed the whole thing because nobody jumped in here , and I needed to move forward, I hope you understand.
5. S Guna kindly proposed this:
If you are using internal CA,
You need to import the Root CA certificate to TMG servers.
Import Private Key of the certificate to Server personal
Create a Exchange publishing Rule and Point the lisitner to the Correct certificate.
Since you are using internal CA, You need to import the Root CA certificate to all the client browers from where you are accessing OWA
But I think I do not have to perform any of those tasks, although I am not an expert but have worked with Certificate for one year or so.
Luis Olías Técnico/Admon Sistemas . Sevilla (España - Spain)

TMG Error code 500 Certificate chain was issued by an authority that is not trusted

Hello colleagues
I have site https://site.domain.ru:9510/pmpsvc
In site work: http://imgur.com/2cQ6vlF
I publish this site through TMG 2010, but I have error:
500 Internal Server Error. The certificate chain was issued by an authority that is not trusted (-2146893019).
On TMG server via MMC I imported certificate to:
http://imgur.com/eYqjrQg and reboot TMG server, but problem is not solved.
Maybe someone solved this problem?
Thanks.

This is because your certificate is unable to reach CA to verify the certificate
Ensure your TMG can reach the certificate authority
Import Root CA certificate to Trusted Root certificate authority in CertMGR
If you are using intermediate CA then import the intermediate CA certificate to intermediate CA in certmgr
Thanks, but I use certificate "*.domain.ru" and another https sites without port 9510 works fine. Maybe problem with site on TMG because problem with certificate on web-server (about Certificate error) -
http://imgur.com/2cQ6vlF ??

Disable DELETE Button for TMG

Dear All,
I have a TMG for one of the Custom DBT.
In the maintenance screen, I want to delete the DELETE Button.
Is this posible ?
If yes, any help is appreciated !
Regards,
Deepu.k

Hello Guy,
Yes, I did the same.
I used the following :
a. Go to the TMG
b. Go to the Maintenance Screen.
c. Double click on the screen number.
d. In the PBO write amodule : module disable_delete.
e. module disable_delete output.
       excl_cua_funct-function = 'DELE'. "(function code for delete)
       append excl_cua_funct.
   endmodule.                 " disable_delete OUTPUT
It worked fine !
Thanks,
Deepu.K

What is the alternative to TMG/ISA For SSL-Bridging-Capable Reverse Proxy For System Center 2012 R2 IBCM?

When I look up alternatives to TMG many other answers say something like "Don't worry about it. TMG 2010 is under support until 2020."
Well, we don't have TMG and can't buy it since it is off the market. Can it still be legitimately purchased through any resellers?
We need a reverse proxy that specifically supports SSL-Bridging so that device certificate authentication is not broken when the connection passes through the proxy.
Which reverse proxies that are currently on the market are known to work successfully with System Center Config Manager Internet-Based Client Management and also with other Microsoft products such as Lync 2010 and RD Gateway 2012 R2?
Do any Cisco ASA or ACE models support the required functionality for machine certificate authentication?
We have ISA 2006 licenses available, but I would hate to roll that out and then have to replace it in only 2 years rather than using something that can stay in place long term. Maybe we could use ISA 2006 temporarily as a stopgap if the next version
released of Windows Server Web Application Proxy would meet the requirements and can be deployed in production before ISA 2006 is completely EOL.
I hate that Microsoft keeps discontinuing all the related products to this before they have their replacements ready.

Hi,
You are correct, all TMG product sales officially ended in December 2012.
In addition, an ISA Server and a TS Gateway server can be used together to enhance security for remote connections to internal network resources. However, it
seems that ISA 2006 cannot support that on Windows Server 2012 R2. For more detailed information:
Configuring the TS Gateway ISA Server Scenario
Personally, Web application proxy would be an alternate. In addition, for the question related to Cisco product, you can contact Cisco for assistance.
Best regards,
Susie

Internet Access through TMG for all HO & Branch office

Dear Experts!,
I am new to the Forefront TMG 2010. Have requirement to implement internet access.
Head office : 192.168.11.x/24 (192.168.11.1 is the TMG server)
Branch Office 1: 192.168.12.x/24
Branch Office 2 : 192.168.14.x/24
Branch Office 2 : 192.168.16.x/24
Forefront TMG 2010 standard edition.
Having 3 NIC's two have different ISP network addresses and one has 192.168.11.1.
Branch office are connected using MPLS network, the requirement is all branch site internet must be accessed through TMG 2010 server which is homed in Head Office. How to achieve ?
What needs to be done in external firewall and in TMG for enabling internet access.
Thanks!
Regards, Ganesh, MCTS, MCP, ITILV2 This posting is provided with no warranties and confers no rights. Please remember to click Mark as Answer and Vote as Helpful on posts that help you. This can be beneficial to other community members reading the thread.

Hi Ganesh,
Hope this helps
1 - If you wish to give internet as Proxy to users.
Ensure the Below subnet is able to reach TMG Internal Interface that is 192.168.11.1
Subnet
Branch Office 1: 192.168.12.x/24
Branch Office 2 : 192.168.14.x/24
Branch Office 2 : 192.168.16.x/24
Configuration
Enable Proxy in TMG and configure Proper Ports as per your requirements
On the Client IE – Ensure you put Proxy IP as TMG and Port configured in TMG configuration.
Enable a Rule
Access Rule
Source : Internal
Destination : External
Ports : HTTP / HTTPS
Users : Authenticated Users
2 As normal Internet as Gateway to users
You need to request your MPLS provider to change the Default Route of below subnet to 192.168.11.1. By doing this, all the internet request from the below subnet to internet will hit TMG.
Subnet
Branch Office 1: 192.168.12.x/24 Default Route 192.168.11.1
Branch Office 2 : 192.168.14.x/24 Default Route 192.168.11.1
Branch Office 2 : 192.168.16.x/24 Default Route 192.168.11.1
IF you have any L3 Switch then you can also make Default gateway as L3 for all the subnet and from L3 device point it to TMG
Enable a Rule
Access Rule
Source : Internal
Destination : External
Ports : HTTP / HTTPS
Users : All Users ( Important )
Two ISP
In network Rules : You need to use NAT
You will have a Rule which NATS internal to External
On external - Choose which ISP interface should be used and Apply NAT rule

TMG load balance and publishing issues

Dear Experts,
I have some questions about publishing multiple services with TMG's ISP redundacny with load balancing:
We are using a single TMG 2010 server to protect our network and providing Internet connection to them. We manage our own domain providing the name service with the DNS server component installed on the TMG box and published it outside. We are using Exchange
for mail service, as well we publish web sites too and terminal services via RDP. There wasn't any problem till today, when we got an other, separate Internet connection via a new different ISP. When I set ISP Redundancy to Load Balance I faced to a problem.
The Internet connection works fine, but the partner SMTP's drop our letters, because they can not complete the reverse DNS check.
How can I set the TMG and/or the DNS to provide a correct mail publishing service? How should I set our DNS to provide access to our web sites and other services when one of the Internet connections brake down?
Thank you in advance!
Thomas

Dear Quan,
Yes, this is the problem.
Would you tell me, how should I configure my DNS for working properly if I publish my services to all my IPs/Internet connections? Do I have to double all my A and MX records?
Is it possible to publish services on all IPs/Internet connections or should I publish on only one an use NLB only for to provide Internet connection to our computers?
What is the good solution to make a fail-safe internet-gateway which publishes multiple services fail-safe too?
Thank you
Thomas

Error the service FWSRV of TMG 2010 on Windows server 2008 R2 Enterprise

Please help me about a issue of TMG 2010:
My company installed TMG 2010 on Windows server 2008 R2 Enterprise but it happen error " Due to an unexpected error, the service fwsrv stopped responding to all requests. Stop the service or the corresponding process if it does not respond, and
then start it again. Check for related error messages."
and " The Firewall service stopped because an application filter module C:\Windows\SYSTEM32\ntdll.dll generated an exception code C0000005 in address 0000000077A72F86 when function CompleteAsyncIO was called. To resolve this error, remove recently
installed application filters and restart the service."
I have reinstall but there error also appear again. My company use about 2000 clients access through TMG 2010.
i have try update windows and TMG latest but can not solved this issue.
i hope everyone help me as soon as. thank you so much.

HI Luis,
Not sure whether this will fix your issues however give it a try and let us know so that other can also provide suggestion.
Disable
Antivirus
Monitoring Tools / Hardware Diagnostics tools which comes with Server vendor
Try -
http://support.microsoft.com/kb/2649961
http://support.microsoft.com/hotfix/KBHotfix.aspx?kbnum=2649961&kbln=en-us
Ensure you have enough space for Log to be stored

Publish RD Gateway and Web Access with One-Time Password (OTP) / Two-factor Authentication WITHOUT ISA/TMG server

Hi everybody,
I've been struggeling with this problem for a few weeks now and can't find a way to solve it.
We have an RD farm (Server 2012) which consists of two Remote Desktop Servers with Connection Broker and Web Access.
I've recently published a new server, containing RD Gateway and Web Access in our perimeter network.
Now we've got restrictions that OTP/2FA must be used for the external deployment and we've decided to go for a solution from Gemalto.
The "program" is called IDConfim and the server is called SA Server (Strong Authentication).
Also it's important that NO ISA/TMG server is supposed to be used, the OTP/2FA is supposed to work seamless with the Web Access/Gateway.
After hours discuss we came to a point were their NPS agent setup would be the only way to accomplish our goals.
The setup is supposed to be like this:
LAN:
1 DC (2008 R2)
RD Farm (2012)
1 SA Server (2012)
DMZ:
RD Gateway/Web Access (2012)
Were Gateway and Web Access should forward the authentications with NPS to the NPS agent on the SA server.
When you print your AD account to authenticate you add the 6 digits of OTP which you recieve from you mobile app.
Initially this seems to work, the Gateway forwards the request to the remote NPS server, BUT only if you write the correct AD password
(without the OTP extension).
If you write the correct AD password the authentication is forwarded to out SA Servern and it's beeing rejeced because the password doesn't
contain the correct OTP extension.
The problem comes here.
When you write you AD password along with the OTP extension you get a Windows Security error in the eventlog (On thw Gateway server) like this:
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: user
Account Domain: domain
Failure Information:
Failure Reason: Unknown username or password.
Status: 0xc000006d
Sub Status: 0x0
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: server
Source Network Address: 192.168.x.x
Source Port: 63003
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
What i can see it's a NTLM error, but hey?! aren't we supposed to forward all authentication handeling to the remote NPS server?
The problem is that no matter what i try the above problem stays there.
Is it not possible to just forward ALL authentication handeling to a remote server?
The only solution I've found to get it working someday in the future is this:
"Remote Desktop Pluggable Authentication and Authorization", which is supposed to be introduced in 2012 R2.
Also this link describes it:
http://archive.msdn.microsoft.com/Release/ProjectReleases.aspx?ProjectName=rdsdev&ReleaseId=3745
Please, bring me some answers before my head explodes! :)
PS, long question = maybe some errors, ask me if something is unclear.

Hi,
Based on our experience, if the NTLM error occurs, please check the password.
Regards,
Mike
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

TMG SSL3.0

Similar Messages

Maybe you are looking for