I have an SBS2003 server running ISA 2004 in a Single Network Adapter configuration. (We have an ASA5510 on the outside.) This is mainly running for cache and site blocking purposes. I noticed the other day that I can access the "Welcome to Windows Small Business Server 2003" page from the outside. This is the page that is at the root of the web server and should not be available from the outside. I can even launch /ConnectComputer and get prompted to install the ActiveX control from the outside. I really need to get this sealed back up.
I have reviewed the ISA logs and the SBS Inbound Access Rule is what is processing my inbound request. The IIS logs show that the ISA server's IP is both the source and the destination address. Since the IP Address Restrictions on the root of the Default Web Site in IIS are configured to Grant Access to the entire subnet, this translation appears to be what is allowing me to come through from the outside. It seems like ISA is doing some sort of translation that is making IIS think the request is coming from an internal IP address.
Any thoughts on what to do or where to look next?
Note - ISA used to be configured as an Edge Firewall. When we got in the ASA5510, we backed ISA down to just caching. When it was an Edge Firewall, there were a couple of Web Server Publishing rules in existence. Now there are none. I am assuming that this is just due to the difference in ISA config rather than possibly being the problem here. However, I figured I would throw that out there.
|