Cannot Access FTP or Company Website (Externally Hosted) - HELP!!!

[cassand...@ureach.com]

Hi Everyone,

I'm having an unusual problem with getting access to an external FTP
site (our company website). Our setup is as follows...

SBS 2003 R2 Premium Edition
Dell PowerEdge 1800
2 NICS
TZO host relay services (as we are behind a dynamic IP address)
External Company website

Ok, TZO told us that to access our company website's ftp server we have
to type in ftp://www.companywebsite.com (and enter username and
password). This is no problem if we access the ftp externally, that is
from any computer outside the sbs network (i.e. home computer).

But when we try to do this internally, within the sbs network, we keep
getting denied access. I've followed the instructions in this article,
but still cant get it to work.

http://msmvps.com/blogs/kwsupport/archive/2005/06/02/50299.aspx

When I check the ISA logs, it says it tries to access the correct ip
address of the website through port 21, but is denied and lists the
"SBS Protected Network Access Rule" as the culprit.

Also, I just noticed I cannot access the company website at all (from
internally). It gives me the following error:

Error Code: 502 Proxy Error. The host server is unreachable. (10065)
IP Address: xx.xx.xxx.x
Date: 10/15/2006 9:31:22 PM
Server: server.company.local
Source: proxy

Can anyone give me some insight as to what I need to do? I'm ready to
pull my hair out over this!!! I don't need a wig!!!

**H&K**

~Cassie~

[cjobes]

When you do a ping www.yourcompany.com does it display the correct IP
address for your external server?

<cassand...@ureach.com> wrote in message
news:1160951400.9...@k70g2000cwa.googlegroups.com...

[cassand...@ureach.com]

Hi,

When I ping company website, I get the correct IP address, but also a
message stating " destination host unreachable". Here's a snippet of
the message...

Pinging www.company.com [xx.xx.xxx.x] with 32 bytes of data:

Request timed out.
Destination host unreachable.
Destination host unreachable.
Destination host unreachable.

Ping statistics for xx.xx.xxx.x:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)

I can access the website/ftp from outside the sbs network, just not
internally. I just tested this from a home machine and its accessible.

What am I doing wrong? I really appreciate your assistance.

**H&K**

~Cassie~

C:\Documents and Settings\Administrator>

[Cris Hanna[SBS-MVP]]

Look at your FTP firewall policy in ISA, thats the problem
Right Click on the FTP Outbound Rule, Choose Configure FTP, Uncheck the box
for Read Only. Save changes

--
CRIS HANNA [SBS-MVP]
----------------------------------------
Please only communicate in the newsgroup. Please do not contact me
directly.
----------------------------------------
Sent via Windows Mail on Windows Vista, Business Edition RC 2

<cassand...@ureach.com> wrote in message
news:1160951400.9...@k70g2000cwa.googlegroups.com...

[cassand...@ureach.com]

Hi Cris,

Thanks for the advice, but it still does not work. I tried this
already. Phoeey!!!

In the ISA firewall logs, its says the following:

Destinaton Port 21, FTP, Denied Connection, SBS Protected Networks
Access Rule

Also, when I tried to access the FTP through Network Neighborhood's
"Add Network Places" feature, a popup windows it says the following:

The folder "ftp:na...@ftp.companywebsite.com/" is read-only because the
proxy server is not set up to allow full access. To move, paste, or
delete files, you must use a different proxy." Blah blah blah...

So I went to SBS Protected Networks Access Rule, selected configure
FTP, and made sure to unchecked the read only box. Still no luck.

Any other ideas???

HELP!!!

**H&K**

~Cassie~

[cjobes]

I assume that you get out to other sites on the Internet. If that is correct
then it looks like a misconfiguration on your DNS and/or ISA. Destination
host unreachable means that your SBS box cannot route to your website.

Post an ipconfig /all from your server. Did you implement any static routes?
What kind of router sits between the SBS WAN and the Internet? Did you
configure anything on that router?

<cassand...@ureach.com> wrote in message
news:1160955188.3...@m73g2000cwd.googlegroups.com...

[cassand...@ureach.com]

Hi cjobes,

Thank you for your response! Here are the results of ipconfig /all...

Windows IP Configuration

Host Name . . . . . . . . . . . . : server
Primary Dns Suffix . . . . . . . : company.local
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : Yes
DNS Suffix Search List. . . . . . : company.local

Ethernet adapter Network Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/100 S Server
Adapter
Physical Address. . . . . . . . . : 00-0E-0C-B3-18-F6
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.1.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 192.168.16.2
Primary WINS Server . . . . . . . : 192.168.16.2
NetBIOS over Tcpip. . . . . . . . : Disabled

Ethernet adapter Server Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network
Connection
Physical Address. . . . . . . . . : 00-13-72-FD-E4-EC
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 192.168.16.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 192.168.16.2
Primary WINS Server . . . . . . . : 192.168.16.2

A SonicWall Firewall exists, and rules are configured as follows...

Priority Source Destination Service Action
1 LAN 192.168.1.1 (LAN) HTTPS Management Allow
2 LAN 192.168.1.1 (LAN) HTTP Management Allow
3 * 192.168.1.2 (LAN) Send E-Mail (SMTP) Allow
4 * 192.168.1.2 (LAN) Remote Web Workplace Allow
5 * 192.168.1.2 (LAN) Network Time Protocl Allow
6 * 192.168.1.2 (LAN) Outlook Allow
7 * 192.168.1.2 (LAN) Windows Share Point Services Allow
8 * 192.168.1.2 (LAN) HTTPS Allow
9 * 192.168.1.2 (LAN) Terminal Services Allow
10 * 192.168.1.2 (LAN) PPTP Allow
11 LAN * Any Allow
12 * LAN Any Deny

Lastly, in case you didnt read in my earlier post (and in case this
makes a difference), we are using TZO.com as we are sitting behind a
dynamic ip address. All mail, sharepoint, owa, etc is properly going
to the SBS box. All www.companywebsite.com requests are properly going
to the external web hosting server. So there doesnt seem to be a
problem with routing.

I'm really confused here. Any ideas what I did wrong???

**H&K**

~Cassie~

[cjobes]

I think I misread your first post. I understood that beside the FTP issue
you could also not reach www.yourcompany.com from inside your network. Is
that not correct?

Your IP configuration looks fine.

<cassand...@ureach.com> wrote in message
news:1160966647.1...@f16g2000cwb.googlegroups.com...

[cassand...@ureach.com]

Correct, I cannot access our company website (www.company.com) or edit
it in Dreamweaver via FTP. Something is amiss and I dont know what.

Any ideas???

[cjobes]

That's why I said there is a routing problem inside your network. If you can
access other websites but not www.yourcompany.com it cannot be an ISA issue.
We first have to resolve that before we can look at the FTP issue.

I assume that you used CEICW to configure your SBS. I also assume that you
used yourcompany.com for the email part of thing. Did you make and entry in
your DNS for the www record to point to the external IP? I believe that your
ISA thinks that www.mycompany.com is local and therefore doesn't route it to
the outside world.

<cassand...@ureach.com> wrote in message
news:1160970683.9...@m73g2000cwd.googlegroups.com...

[cassand...@ureach.com]

Yes I ran CEICW to configure the SBS server. I also used
yourcompany.com for the email. And no I did not make an entry in my
DNS for the www record to point to the external IP. I just looked up
the instructions and they are as follows:

1. Start the DNS Management console by Start > Programs >
Administrative Tools > DNS
2. Drill down into the SERVERNAME, then Forward Lookup Zones and then
your domain name.
3. Right click the domain name folder and select New Host from the menu
4. Enter www into the Name box
5. Enter the external IP of the website as provided by your ISP or web
hosting company and click Add Host

My question is, when I get to the Foward Lookup Zones, I see the
following:

_msdcs.server.local
companywebsite.local

There is no "companywebsite.com" listed to add the www and external IP
address to. So where to I add the New Host information to?

**H&K**

~Cassie~

[Mick]

Hello,

I think what you are looking at is a loopback issue with the router.
You could allways put an entry into the host file with the domain name
and the internal IP address of the server to get around this.

I would contact our Technical Support Department at 978-433-6865 (m-f
9-5 EST) and we can walk you through it.

Regards,
Michael

[Cris Hanna[SBS-MVP]]

Cassie
You're doing the right thing
Only other thing I would check...although I bet you already have...
Check the Outbound FTP Rule and make sure that its set to Allow and not deny

You could also add Internal Network in the From and All Computers/Anywhere
in the To list.

--
CRIS HANNA [SBS-MVP]
----------------------------------------
Please only communicate in the newsgroup. Please do not contact me
directly.
----------------------------------------
Sent via Windows Mail on Windows Vista, Business Edition RC 2

<cassand...@ureach.com> wrote in message
news:1160962702.9...@m7g2000cwm.googlegroups.com...

[cassand...@ureach.com]

Hi Cris,

I'm Chris too. Cassie went home as she tried getting this to work all
night and needed sleep.

Anyways, I just tried your suggestion and still no luck. I double
checked everything and can't seem to get it to work. Any other ideas?

Chris

[Mick]

Chris,

Were you able to tempory deiable the proxy server? When we spoke you
disabled the proxy but were still getting proxey server messages. It
is to my understanding that if the proxey server is disabled we shouldl
not get proxey server messages.

Mike

[cjobes]

<cassand...@ureach.com> wrote in message
news:1160984619.1...@k70g2000cwa.googlegroups.com...

[cjobes]

Cassie,

As long as you don't get to www.yourcompany.com from within your network the
FTP will not work either. Somewhere is an entry that makes the SBS believe
that www.yourcompany.com is local. Given that a ping to www.yourcompany.com
returns the correct external IP the lookup seems to be working but the
routing isn't working. I saw the other post and I think it's a good idea to
disable the proxy and see what happens.

Claus
<cassand...@ureach.com> wrote in message
news:1160984619.1...@k70g2000cwa.googlegroups.com...