Back in May 2009 when TMG 2010 was still on Beta 2 I wrote this post talking about a new feature on TMG 2010 that allows you to customize the error message if the user hits a deny rule. Since them I received many questions related to how to customize that page itself. After testing it and do it myself I wrote a post for TMG Team Blog that was reviewed by two developers from TMG Team in Haifa and one of our Escalation Engineers in France. This post explains how to make this customization, see the complete article at: http://blogs.technet.com/isablog/archive/2009/11/26/deny-page-customization-on-forefront-tmg-2010.aspx

I hope you enjoy it.

Microsoft Press revealed last Friday an overview of the Microsoft Forefront Administrator’s Companion Book that includes a brief explanation about the Table of Contents and what we cover throughout the 33 Chapters and 4 appendices. Read the complete post at http://blogs.msdn.com/microsoft_press/archive/2009/11/20/forefront-tmg-2010-administrator-s-companion-available-for-pre-order.aspx

What you were waiting for so many months is finally ready and available for public download, Microsoft Forefront Threat Management Gateway 2010 is now RTM. I’m particularly excited for this product because I work with this line of product from Microsoft since Proxy 2.0 (back in 1997) and now I had a chance to see TMG growing from ground zero.  

Since February 2008 this journey of engagement with TMG started, first with MBE and then with 2010 version. From there to now I delivered some presentations about TMG (TechReady, TechEd and MS Community Day were the main ones) and there is on slide in particular from my TMG presentation that I like to pause and discuss more about it, because it is really a question that many people will ask at some point, which is:

By looking to the spectrum of features that is listed in this slide you can see not only random features, but you can see how it fits in a edge scenario. This really reflects what TMG can do to answer this question because it gets the edge to another level of integration and control. Recently in TechEd EMEA 2009, David Cross (Product Unit Manager from TMG) was interviewed by David Tesar and he highlighted some of those features. Watch the complete interview at

http://edge.technet.com/Media/Forefront-TMG-RTM-Overview-Interview/

TMG 2010 is not a dream anymore, it is reality and you probably will start playing with it soon; therefore you need resources to read more about this before deploy. Here are some useful links for that:

TMG 2010 Deployment Guide

http://technet.microsoft.com/en-us/library/cc441445.aspx

TMG 2010 Operations Guide

http://technet.microsoft.com/en-us/library/cc441590.aspx

TMG 2010 Troubleshooting Guide

http://technet.microsoft.com/en-us/library/dd897100.aspx

Microsoft Press Book – Forefront TMG 2010 Administrator’s Companion

Written by Jim Harrison, Yuri Diogenes and Mohit Saxena

Technical Reviewed by Tom Shinder

Foreword by David Cross
 

Pre Order at Amazon.com.

1. Introduction

When you install ISA Server 2006 by default the Advanced Logging feature is installed and this installs the Microsoft SQL Server Desktop Engine as shown in the screen below from Add or Remove Programs:

Introduction

Recently working a case where customer was trying to implement the approach explained by my friend Tom Shinder on his post “Clever Way to Redirect OWA Users Who Can’t Remember to Include /Exchange in the Path” and it was not working. The approach explained by Tom is valid and works, but there is a catch and this is what I will explain in this post.

Problem

For this particular case the Exchange OWA publishing rule was working, but only when we typed the full path, in this case https://mail.contoso.com/owa , however the goal was to be able to type only https://mail.contoso.com and get to the OWA logon form. In order to do that the deny rule with the redirect was created as mentioned in Tom’s post “Clever Way to Redirect OWA Users Who Can’t Remember to Include /Exchange in the Path” but after typing the path we got to an endless attempt to access the page and it times out.

Since the traffic from the outside was encrypted, we decided to use HTTP Watch to understand why this behavior was happening. Here it is the result:

Notice that we have tons of HTTP Redirect 302 and this list goes on and on until it times out, in other words: we have a loop right there.

Resolution

The catch for this loop is that the deny redirect rule had one extra character in the paths as shown below:

The flowchart below explains why this loop was happening and the problem with the asterisk (*) in this case:

Recently Tom Shinder published two very useful and well explained (as usual) articles about TMG ISP Redundancy. This is a new TMG feature that for years ISA administrators were looking for and I’m sure you will be very happy with the end results for this feature on TMG. But, before implement it is good to read through the article to understand how it works. Visit the links below for more info on Tom’s article:

http://www.isaserver.org/tutorials/Kicking-Tires-TMG-2010-RC-ISP-Redundancy-Part1.html

http://www.isaserver.org/tutorials/Kicking-Tires-TMG-2010-RC-ISP-Redundancy-Part2.html

1. Introduction

This post is about a specific condition that can triggers the error 502 while browsing some web sites through TMG 2010 RC. The error message that the end users receives is similar to the one shown below: