Segmenting Networks with ISA 2004 – Filtering access to Domain Controllers

Thomas Shinder Blog » Blog Archive » Stanislas Quastana’s Guide to Intradomain Communications Including AD UUIDs

Wed, 05 Apr 2006 17:28:16 GMT

PingBack from http://blogs.isaserver.org/shinder/2006/04/05/stanislas-quastanas-guide-to-intradomain-communications-including-ad-uuids/

re: Segmenting Networks with ISA 2004 – Filtering access to Domain Controllers

BlackPH — Thu, 13 Apr 2006 13:30:06 GMT

I have tried this perfect way of RPC filtering ,but nothing. Maximum result when i have - is error about wrong TCP checksum on EMP Map request level
"
Internet Protocol, Src: 172.16.2.2 (172.16.2.2), Dst: 192.168.1.248 (192.168.1.248)
Transmission Control Protocol, Src Port: 1130 (1130), Dst Port: epmap (135), Seq: 117, Ack: 85, Len: 156
Source port: 1130 (1130)
Destination port: epmap (135)
Sequence number: 117 (relative sequence number)
Next sequence number: 273 (relative sequence number)
Acknowledgement number: 85 (relative ack number)
Header length: 20 bytes
Flags: 0x0018 (PSH, ACK)
Window size: 65451
Checksum: 0x7169 [incorrect, should be 0x9142]
SEQ/ACK analysis
This is an ACK to the segment in frame: 6
The RTT to ACK the segment was: 0.000029000 seconds
DCE RPC Request, Fragment: Single, FragLen: 156, Call: 1 Ctx: 0
Version: 5
Version (minor): 0
Packet type: Request (0)
Packet Flags: 0x03
Data Representation: 10000000
Frag Length: 156
Auth Length: 0
Call ID: 1
Alloc hint: 132
Context ID: 0
Opnum: 3
DCE/RPC Endpoint Mapper, Map
"
I used "access" rule, not "public". DMZ and Internal have route relationship. When i remove my "RPC for AD Logon" filter protocol, and add predefined RPC (all interfaces) - all working fine.

re: Segmenting Networks with ISA 2004 – Filtering access to Domain Controllers

stanislas-quastana — Fri, 14 Apr 2006 12:45:07 GMT

Hi,

You must use a publication rule for RPC filtering (by design the RPC filter apply only to incoming traffic). It's "normal" (by design) that RPC filtering doesn't work with access rule

This publication rule works between 2 routed networks (don't forget to check source ip = client IP adress)

regards

Stanislas