Using IPSec on TMG to secure access to Exchange not working

Question

Hello,
I am trying to following the
MS white paper to use IPsec to secure Exchange 2010 Outlook Anywhere via TMG.
However, I am having trouble with getting IPsec configured properly on the TMG server. When I configure the IPsec Connection rule, Exchange site is still accessible without any restrictions.
- I assigned an additional IP to the TMG server and created a new Web Listener
- As a first step to ensure that everything works without IPsec, I have published Exchange on TMG and verified that I can access the server normally using OWA and Outlook Anywhere
- The Root CA have been imported on the TMG servers.
- I then follow the steps to create the Connection Security Rules where endpoint1 is any IP, and endpoint-2 is the IP of the TMG server, and configured it for computer authentication for inbound and outbound
- At this point I believe that the published Exchange site should no longer be accessible since it requires IPsec for HTTPS access to the Web Listener. However, this is not the case. I suspect that it is ignoring the Connection Security Rule that was configured
within Windows 2008 R2 and not TMG
The part I am confused with is that the white paper outlines adding the Connection Security Rule in the Windows Firewall advanced security. However, I thought that TMG basically overrides any Windows firewall configuration with the firewall policies within
TMG. So is there another way to set this up on TMG without having to configure any IPsec rules on the actual Exchange server.

Answer 1

Lutz,
I already have "Require inbound and outbound" selected. It seems like TMG is just ignoring the connection security rule.
Environment:
TMG: Workgroup
External NIC: x.x.1.1, gw set, no DNS
- additional IP binded to external NIC x.x.1.2 dedicated for the web listener
- Public NAT: x.1.1.2 translates to x.x.1.2
ran "netsh advfirewall set global ipsec ipsecthroughnat serverandclientbehindnat"
Internal NIC: x.x.2.1, no gw, DNS set
The Web listener network is set to x.x.1.2
OWA publishing rule is set to use the Web listener
I verified that OWA is working normally without IPSec. The TMG logs shows HTTPS connections to the destination IP for x.x.1.2 (listener) during logon. After successful logon the log shows the Exchange server in the destination IP address column.
I create a Connection Security Rule
- Endpoint 1: any IP
- Endpoint 2: x.x.1.2 (listener IP)
- Protocols: TCP, endpoint 1: all ports, Endpoint 2: Specific: 443 (I also tried selecting the protocol to ANY)
- Authentication: Require inbound and outbound
- Advanced: all profiles selected
When I enable this Connection filter, I can still access Exchange normally without using IPSec on the client. I can see that TMG still allows 443 access to the web listener without requiring IPSec authentication. It behalves exactly the same as before I
created the connection filter.