Redirect script no longer works after SP1
Jeremy Gollehon
C:\Inetpub\wwwroot. It worked great before the SP1 install (with the
upgrade to ISA 2004). Now however, ISA is blocking the redirect:
"Error Code: 403 Forbidden. The server denied the specified Uniform Resource
Locator (URL). Contact the server administrator. (12202)"
I posted about this before, and must have figured out the solution, but
didn't post back. :-(
http://snipurl.com/haom
I'm sure it's an ISA firewall policy of some sort, but I'm not sure what I
did to solve the problem before. Any help is greatly appreciated.
-Jeremy
default.asp
-------------------------------------------------------------------------
<%
Select Case Request.ServerVariables("HTTP_HOST")
Case "remote.mycompany.com"
Response.Redirect("https://remote.mycompany.com/remote/")
Case Else
Response.Redirect("/homepage.htm")
End Select
%>
-------------------------------------------------------------------------
Brandy Nee [MSFT]
Thank you for posting to the SBS Newsgroup.
I have read through your old post in the following weblink:
Redirect address
http://groups.google.com/group/microsoft.public.windows.server.sbs/browse_fr
m/thread/a8b5e82498209c6b/
Combining with your current post, I understand that you want to redirect
http://www.fqdn.com/remote to https://www.fqdn.com/remote. If I have
misunderstood your concern, please let me know.
Actually, on SBS 2K3 server, we use Internet Server Application Programming
Interface (ISAPI) Filter to achieve this function.
An ISAPI filter, SBSFLT (%systemdrive%\Inetpub\sbsflt\sbsflt.dll), is
loaded on the Default Web Site. The filter is used to redirect all incoming
RWW requests from HTTP to HTTPS if SSL is enabled. In case one forgets to
access the RWW securely, the ISAPI filter can redirect the request to a
secure channel to ensure that all communications through Remote Web
Workplace are encrypted.
Another feature of this filter is to redirect all SharePoint traffic from
port 443 to 444. If you connect to Companyweb by http://companyweb with the
SBSFLT filter enabled, you will be redirected automatically to
https://companyweb:444.
When you access the http website which requires SSL on the default website
of SBS 2k3 server, the traffic will be redirected to the https
automatically. This is functioned by the ISAPI redirection filter on the
SBS 2k3 Default website with name of SBSFLT and path of
c:\inetpub\sbsflt\sbsflt.dll.
However, please understand this filter is designed for the SBS specific
website and web portal. We cannot guarantee it will work fine for your
custom website. Generally, if you need to enforce SSL for your own website,
you have to use HTTPS URL, or you will get error 'HTTP Error 403.4 -
Forbidden: SSL is required to view this resource.'
To do so, please see:
a. Open Internet Information Services\Yourdomain (local computer)\Web
Sites\Default Web Site.
b. Right click Default Web Site, go to Properties, ISAPI Filters.
c. Click Add, click Browse, go to %system root%\inetpub\sbsflt.
d. Select sbsflt.dll.
For companyweb, repeat the same steps above, select shrptflt.dll.
e. Click Open and OK twice.
f. Open a command window and type "iisreset" (without quotation marks).
g. Test the issue again.
To ensure the SBS filter is functioning well you could have the following
test on the internet or intranet.
They should be redirected to following addresses automatically.
Hope this information helps. If you meet any error when trying to access
above web sites, please fee free to let me know. I am looking forward to
your reply!
Best regards,
Brandy Nee
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.
Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.
For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
>From: "Jeremy Gollehon" <j_golleho...@hotmail.com>
>Subject: Redirect script no longer works after SP1
>Date: Mon, 29 Aug 2005 11:35:37 -0700
>Lines: 30
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2527
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
>X-RFC2646: Format=Flowed; Original
>Message-ID: <emv2yhMr...@tk2msftngp13.phx.gbl>
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 66-224-14-74.atgi.net 66.224.14.74
>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!tk2msftngp13.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:148853
>X-Tomcat-NG: microsoft.public.windows.server.sbs
Jeremy Gollehon
Thanks for the response.
Because my public facing website (http://www.fqdn.com) is hosted offsite,
far away from the small business server, I set up http://remote.fqdn.com to
point at RWW (the SBS's external IP address). To make it easy for my users
when they're traveling, I want them to be able to type in that address and
get redirected to RWW at https://remote.fqdn.com/Remote (which my script
used to do).
To sum it up:
Redirect
http://remote.fqdn.com
to
https://remote.fqdn.com/Remote
Now that I think about it, opening up port 80 might have been how I did this
before. Probably not a good idea. Hopefully someone has a different
solution.
Thanks again,
-Jeremy
""Brandy Nee [MSFT]"" <v-br...@online.microsoft.com> wrote in message
news:8u3MtTR...@TK2MSFTNGXA01.phx.gbl...
<snip>
Brandy Nee [MSFT]
Thank you for posting back!
I understand that you host this website offsite, and I have performed a lot
of research and testing for your case, unfortunately, there is no nature
way on the SBS 2K3 server.
As this issue includes custom coding/programming, scripting, I suggest you
that post you questions in the Developer newsgroups. By posting there, you
may get some pointers from others who may have had similar experience that
they can share with you.
http://msdn.microsoft.com/newsgroups/default.asp
I am greatly appreciated your time and understanding! If you need any
assistance regarding SBS server in the future, please feel free to post
back. I am glad to be working with you again!
Best regards,
Brandy Nee
>References: <emv2yhMr...@tk2msftngp13.phx.gbl>
<8u3MtTR...@TK2MSFTNGXA01.phx.gbl>
>Subject: Re: Redirect script no longer works after SP1
>Date: Tue, 30 Aug 2005 09:11:38 -0700
>Lines: 31
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2527
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
>X-RFC2646: Format=Flowed; Original
>Message-ID: <OyKr$1XrFH...@tk2msftngp13.phx.gbl>
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 66-224-14-74.atgi.net 66.224.14.74
>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!tk2msftngp13.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:149182
>X-Tomcat-NG: microsoft.public.windows.server.sbs
Jeremy Gollehon
I remembered how I did this before (I think).
I believe I replaced the 403 error page with my .asp page.
However, it seems that it was a 403.6 error page before (which I can find to
replace), but I can't figure out where this new 403 error page is served
from.
It's this one:
Technical Information (for support personnel)
a.. Error Code: 403 Forbidden. The server denied the specified Uniform
Resource Locator (URL). Contact the server administrator. (12202)
If I could figure out where that is, I could replace it with my script and
everything would be all good. Thanks for any help!
-Jeremy
""Brandy Nee [MSFT]"" <v-br...@online.microsoft.com> wrote in message
news:nWdU9Sh...@TK2MSFTNGXA01.phx.gbl...
Brandy Nee [MSFT]
Thank you for posting back!
Please understand that the error information relates with your customize
script and coding/programming, so I still strongly suggest you that post
you questions in the Developer newsgroups cuase we do not have similar
issue problem in Public Newsgroup. By posting there, you may get some
pointers from others who may have had similar experience that they can
share with you. The address is:
http://msdn.microsoft.com/newsgroups/default.asp
Here, I can share some general information with you, but please understand
that we cannot guarantee that it is completely fix your issue. You still
need to contact the Developer newsgroups for the most accurate rolution.
Please see:
According to the error message, it seems that the ISA server rejected the
URL which you inputted in the browser. This problem can be caused because
the ISA destination set for the built-in site does not contain the public
IP address of the network. I assume that you inputted a Fully Qualified
Domain Name (FQDN) in the certificate configuration window when you ran the
CEICW to configure the server internet connections. Since the destination
sets are created according to the name which you inputted in CEICW for
certificate, if the URL of the incoming web request does not match the
name, the connection will be rejected. Here, you can try the following
steps:
NOTE: I use the OWA site path as the example. You can do the tests by using
other path such as /remote.
1. If you have a registered FQDN and the name record is pointing to the
public IP address of the SBS server, you can configure the CEICW by using
the FQDN and access the built-in site with the URL: https://FQDN/exchange
to access the site.
2. If you do not have a FQDN and only have a static public IP address, you
can input the public IP address in the certificate configuration window.
Use the URL: https://Publicipaddress/exchange to access the OWA site.
Considering the current status, I suggest you manually modify the
destination set for the OWA site so that you can access the OWA site by
using a public IP address or different FQDN:
1. Open ISA Management console. Navigate to 'Policy Elements'\'Destination
Sets'.
2. In the right panel, double-click 'Small Business Exchange OWA
Destination Set'. In the properties window, click 'Destinations' tab. Click
'Add' button to add the following destinations:
IP Path:
Public IP address or FQDN /Exchange*
Public IP address or FQDN /public*
Public IP address or FQDN /Exchweb*
3. Click 'OK' to close the dialog boxes. Navigate to
'Monitoring'\'Services'. Restart the ISA related services.
You may also modify other destination sets so that you can access the SBS
built-in web sites by using FQDN or public IP.
For more information regarding the SBS network configurations, please refer
to the following KB article:
825763 How to configure Internet access in Windows Small Business Server
2003
http://support.microsoft.com/?id=825763
I am greatly appreciated your time time and understanding!
Best regards,
Brandy Nee
<OyKr$1XrFH...@tk2msftngp13.phx.gbl>
<nWdU9Sh...@TK2MSFTNGXA01.phx.gbl>
>Subject: Re: Redirect script no longer works after SP1
>Date: Fri, 2 Sep 2005 16:38:23 -0700
>Lines: 135
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2527
>X-RFC2646: Format=Flowed; Original
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
>Message-ID: <#S2xjeBs...@TK2MSFTNGP14.phx.gbl>
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 66-224-14-74.atgi.net 66.224.14.74
>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP14.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:150384
>X-Tomcat-NG: microsoft.public.windows.server.sbs
Jeremy Gollehon
Thanks again for the reply. Your response set me looking at ISA firewall
policies, and I stumbled upon a pretty simple solution.
I'm not sure if this is "legal" to post here, but for anyone following
along, find the full story on my blog at:
http://gollehon.blogspot.com/
It's easier to follow with the picures I think.
Thanks again!
-Jeremy
""Brandy Nee [MSFT]"" <v-br...@online.microsoft.com> wrote in message
news:K0Im2xbs...@TK2MSFTNGXA01.phx.gbl...
Brandy Nee [MSFT]
Thank you for posting back!
I am glad to hear that you have found the solution and thing is working
correctly on your side now. I definitely believe that your great experience
sharing will benifit the other customers who read the newsgroups regularly.
If you need any assistance in the future, please feel free to post back. We
are glad to be working with you again!
Best regards,
Brandy Nee
<OyKr$1XrFH...@tk2msftngp13.phx.gbl>
<nWdU9Sh...@TK2MSFTNGXA01.phx.gbl>
<#S2xjeBs...@TK2MSFTNGP14.phx.gbl>
<K0Im2xbs...@TK2MSFTNGXA01.phx.gbl>
>Subject: Re: Redirect script no longer works after SP1
>Date: Tue, 6 Sep 2005 14:19:08 -0700
>Lines: 297
>X-Priority: 3
>X-MSMail-Priority: Normal
>X-Newsreader: Microsoft Outlook Express 6.00.2900.2527
>X-RFC2646: Format=Flowed; Original
>X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
>Message-ID: <e1SMkiys...@TK2MSFTNGP15.phx.gbl>
>Newsgroups: microsoft.public.windows.server.sbs
>NNTP-Posting-Host: 66-224-14-74.atgi.net 66.224.14.74
>Path: TK2MSFTNGXA01.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP15.phx.gbl
>Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:151252
>X-Tomcat-NG: microsoft.public.windows.server.sbs