Questions tagged [microsoft-ftmg-2010]

Microsoft Forefront Threat Management Gateway 2010 is the current version of the product previously known as ISA Server. TMG 2010 adds subscription-based URL filtering and malware protection, the free-subscription-based Microsoft IPS Network Inspection System, and HTTPS inspection.

Microsoft Forefront Threat Management Gateway (TMG) 2010 is the last iteration of the product previously known as ISA Server, and as of 2016, has been discontinued from sale. The base product will be supported by Microsoft until 2020.

ISA Server 2006 was the last product to use the ISA Server name.

TMG 2010 added:

  • subscription-based URL filtering (discontinued Jan 2016)
  • subscription-based malware protection (discontinued Jan 2016)
  • (free) subscription-based Network Inspection System (NIS), a Microsoft-centric IPS (no longer updated)
  • outbound HTTPS inspection
  • Forefront Protection for Exchange integrated management from the TMG console (Exchange Edge and FPE required, sold separately)

Other notable changes:

  • The Enterprise Edition EMS (roughly analagous to the older CSS) can now manage standalone Standard Edition servers, which can make branch office deployments cheaper
  • SP1 adds click-through user overrides for URL filtering
  • SP1 adds a simple BranchCache setup interface
  • SP1 Software Update 1 adds support for SafeSearch filtering
74 questions
12
votes
8 answers

ActiveSync devices causing accounts to lockout

When a user changes his account password for whatever reason (read: expired), and the old password is stored in his mobile device connected through EAS. This will cause his account to lockout almost immediately - as it should according to the…
6
votes
3 answers

Best way to authenticate users to the proxy in mobile devices

As example, in Forefront TMG I can have a wpad entry in the DNS and computers discover it and autoconfigure the web proxy. When the user tries to go to the Internet he is promptped for the crendentials. In iPhone or iPad it doesn't work. Which is…
Ricardo Polo Jaramillo
  • 2,039
  • 1
  • 18
  • 35
5
votes
1 answer

Threat Management Gateway 2010 is killing SQL Connections

My company has just started using TMG 2010 as our Firewall / Web Proxy on a Windows 2008 R2 server. Since moving, all connections to SQL Server are closed after around 30 seconds. For example: Run a query from SSMS which will run…
Dan Rowlands
  • 161
  • 5
4
votes
2 answers

IPSec tunnel on ASA keeps disconnecting

I have an ASA IPSec tunnel configured between an ASA5505 and Microsoft TMG 2010 SP2. The tunnel sometimes works for a few hours, and then disconnects, and other times it works for 5 minutes and then disconnects. When it disconnects, it sometimes…
Mark Henderson
  • 68,316
  • 31
  • 175
  • 255
4
votes
2 answers

Why bother reverse proxying applications if you aren't using mod_security or TMG/UAG?

Common wisdom is that internal applications that live inside of the trusted network, such as Exchange, should be reverse proxies whenever they are exposed to the Internet. Microsoft recommends using UAG/TMG for this as it has some built in security…
MDMarra
  • 100,183
  • 32
  • 195
  • 326
3
votes
1 answer

How to bypass Forefront TMG for downloading from Adobe Cloud

I hope that this question has not been asked as I've spent a couple of days googling around trying to find a solution. I have one computer that needs to download from Adobe Cloud to install applications like Photoshop etc... The issue I'm having is…
3
votes
1 answer

vSphere Site Recovery Manager cannot connect, gives Error 500

I am attempting to set up a vSphere Site Recovery Manager lab. I have two datacenters linked via a site-to-site VPN with Microsoft Threat Management Gateway 2010 SP1. I am attempting to add the two vSphere servers to each other, but I keep getting…
Mark Henderson
  • 68,316
  • 31
  • 175
  • 255
3
votes
1 answer

redirect all youtube video requests to a specific one

I'm on an IT team in my company and I would like to block youtube to users. I don't want to just deny access to the whole youtube domain, but only to replace the .flv/.mp4 request with the one that I want. That way, if someone tries to watch youtube…
iTayb
  • 771
  • 4
  • 10
  • 25
3
votes
2 answers

TMG 2010 does not proxy back to the same network as the request

I have an issue where websites that are hosted on a web server (www.example.com) are not accessible from their own network when accessed via its public IP address, but they are accessible from every other network. This is the network setup: I have…
Mark Henderson
  • 68,316
  • 31
  • 175
  • 255
3
votes
1 answer

Limiting bandwidth of workstations in MS Forefront TMG

We have configured Microsoft forefront TMG 2010 Enterprise as the cache server which provides internet access for all computers in our department. Is there any way to limit download speed per host/user by configuring forefront TMG? I have found a…
2
votes
2 answers

Use a dedicated subnet to connect all routers/firewalls?

I have a couple router/firewall boxes (pfSense, TMG 2010, ISA 2006) on my network that are stateful. Right now they all have an interface on the same subnet as most end user devices and servers. I will be making some changes and putting some servers…
Oliver
  • 23
  • 5
2
votes
2 answers

How can I setup RD Gateway on the same server as TMG?

I have used the following guides with no luck: http://www.rayheffer.com/953/building-a-remote-desktop-gateway-rdg-rd-gateway-server/ http://www.isaserver.org/tutorials/Microsoft-Forefront-TMG-Publishing-RD-Web-Access-RD-Gateway-Part2.html We have MS…
Name
  • 33
  • 1
  • 2
  • 4
2
votes
1 answer

Changing Forefront TMG VPN Certificate

I need to change my TMG server from an old VPN server certificate to a new one due to changing my internal CA structure. Where the heck do I do that? I don't see any certificate references in TMG nor in the RRAS MMC. The references I've found on…
Tim Brigham
  • 15,465
  • 7
  • 72
  • 113
2
votes
3 answers

Allow Broadcast to 255.255.255.255 through TMG/VPN (for NetBios Resolution)

Is it possible to allow a VPN client to do NetBIOS broadcast name resolution through TMG? In the TMG Queries I can see the rule that is blocking ClientIP->255.255.255.255 I've tried adding 255.255.255.255 to the Internal IP Range. My VPN Client…
Alex Duggleby
  • 67
  • 1
  • 6
2
votes
3 answers

How to send authentication credentials to a published web site without prepending the AD domain name?

ISA Server 2006 publishing a web site; ISA does forms-based authentication against an Active Directory domain (which ISA itself is joined to), then, if the user is authorized, ISA sends the user's credentials to the published web site using HTTP…
1
2 3 4 5