Sign in
 
HomeProductsLibraryLearnDownloadsSupportForums
Microsoft Forefront TechCenter >
> 
> 
TMG 2010 not processing HTTP traffic, treating it as BranchCache- Retrieval packets

Proposed TMG 2010 not processing HTTP traffic, treating it as BranchCache- Retrieval packets

  • Thursday, August 04, 2011 1:25 PM
     
     
    Sign In to Vote
    0

    Hello,

     

    We have a new implementation of TMG 2010 EE and are running into a problem accessing a published website on the gateway. Upon running the traffic Simulator, I have noticed that the packets are being denied. According to the log, the traffic is being treated like BranchCache-retrieval and is hence being skipped by our web publish policy. Here is the log that i'm seeing:

     106 8/4/2011 9:16:42 AM fff8a749 Firewall service The Firewall service is performing rule evaluation.

    2107 8/4/2011 9:16:42 AM fff8a749 Firewall service Protocol: BranchCache - Retrieval

    2108 8/4/2011 9:16:42 AM fff8a749 Firewall service Packet properties: Source IP address: 11.248.10.119 Source array network: External Destination IP address: 11.48.28.238 Destination array network: External

    2109 8/4/2011 9:16:42 AM fff8a749 Firewall service Forefront TMG will check only rules that are associated with the protocol BranchCache - Retrieval.

    2110 8/4/2011 9:16:42 AM fff8a749 Firewall service Forefront TMG is evaluating the rule [System] Allow MS Firewall Control communication to selected computers.

    2111 8/4/2011 9:16:42 AM fff8a749 Firewall service The source port does not match the rule.

    2112 8/4/2011 9:16:42 AM fff8a749 Firewall service Forefront TMG is evaluating the rule [Enterprise] Backup Servers.

    2113 8/4/2011 9:16:42 AM fff8a749 Firewall service source does not match the packet.

    2114 8/4/2011 9:16:42 AM fff8a749 Firewall service Forefront TMG is evaluating the rule TMGTest.

    2115 8/4/2011 9:16:42 AM fff8a749 Firewall service This Web publishing rule was skipped for this packet.

    2116 8/4/2011 9:16:42 AM fff8a749 Firewall service Forefront TMG is evaluating the rule Test Default Landing Page.

    2117 8/4/2011 9:16:42 AM fff8a749 Firewall service This Web publishing rule was skipped for this packet.

    2118 8/4/2011 9:16:42 AM fff8a749 Firewall service Forefront TMG is evaluating the rule TMGTraining.

    2119 8/4/2011 9:16:42 AM fff8a749 Firewall service This Web publishing rule was skipped for this packet.

    2120 8/4/2011 9:16:42 AM fff8a749 Firewall service Forefront TMG is evaluating the rule [Enterprise] Default rule.

     

    2121 8/4/2011 9:16:42 AM fff8a749 Firewall service The rule [Enterprise] Default rule matches the packet and may deny it. However, a rule that precedes this rule in the list of policy rules and matches the packet will take precedence and may allow the packet.

    2122 8/4/2011 9:16:42 AM fff8a749 Firewall service The rule [Enterprise] Default rule blocked the packet.

    Thanks for your help

     

All Replies

  • Saturday, August 06, 2011 4:00 AM
     
     
    Sign In to Vote
    0

    I'm having this exact same problem as described above. I have Exchange RPC and OWA already created in TMG and both of them work fine. I also am utilizing the VPN functionality of TMG and it works great. The only thing that I am not able to do is get an HTTP hosted Web Server published. I have been trying to publish a couple of redirects for OWA and also a couple of SharePoint sites and none of them are working. I have gone through and recreated the HTTP web listener a couple of different times and tried just setting up one HTTP site at a time and none of it works.

    Like Mr. Counts I ran the traffic simulator and get almost the exact same results as he did. All the HTTP protocols are treated as BranchCache-Retrievals and none of them are ever applied correctly to the corresponding firewall rule. The rules at the top of the firewall policy are just skipped like Mr. Counts' and then it eventually hits the default rule and stops.

    Any help would be greatly appreciated. I am just trying to find out where the problem lies as the simulator doesn't give very detailed information. I believe that the traffic is getting to TMG because I know that OWA and RPC and things are working but I don't know if it is getting to the firewall rule, or where the stoppage is occuring.

    I'm right there with you Mr. Counts and would love any help that anyone could offer.

    Tmark86

     
  • Monday, August 08, 2011 4:02 PM
     
     Proposed
    Sign In to Vote
    0

    I think that I got my issue figured out and I thought that I would share it just in case it helps you or anyone else. TMG was not accepting any HTTP traffic on port 80 and was treating it all as BranchCache as I said above. I didn't know where the disconnect was and was going through and slowly disabling everything else on my TMG server until I got it working.

    It turns out that at some time IIS was installed and was running. The default site only had an asp.net folder underneath it. I stopped the default website and immediately my HTTP traffic on port 80 started working. This didn't change the BranchCache - Retrieval from the traffic simulator but it got my web publishing working and that was my end goal.

    Hopefully this is helpful to someone or someone can give a little insight as to whether IIS is needed on the TMG box at all. I would have never installed it and nothing is really setup on it. I just left it disabled and everything works.

    Tmark86

    • Proposed As Answer by Tmark86 Monday, August 08, 2011 4:03 PM
    •  
     
  • Monday, August 08, 2011 5:37 PM
     
     
    Sign In to Vote
    0

    Tmark86,

    Thanks for the update! I actually took a look at this myself and I did have IIS running on one of my array nodes. I removed that role but am still facing the issue. Interestingly enough If I create a general port 80 allow access rule, then that rule picks up the packets on the traffic simulator and shows the protocol as HTTP. But as soon as I turn that rule off, it goes back to the BranchCache - Retrieval. I'm thinking about setting up a brand new array, and spinning up a couple of nodes on it and seeing if i can get a different result. I should mention that all the machines in this environment are virtual.

     

    MrCounts

     
  • Thursday, August 11, 2011 12:41 AM
     
     
    Sign In to Vote
    0

    I hear you man. I really had no idea what was cutting off my HTTP traffic and was really glad when turning off IIS worked. Sorry it didn't work for you. This is my second TMG setup box and the first one had none of the issues that this second one has had. 

    I don't know if you have tried the microsoft network monitor or the built in TMG logging but either one of those may be of help. The TMG logging helped guide me a little bit but I was having a tough time reading the NetMon output. 

    Tmark86