ISA 2006 VPN Clients are not able to access https (443) websites

[abdoelmasry]

Hi Profs

I have ISA server 2006 installed on Windows server 2003 enterprise Edition,

i configured isa server as remote access server, to support remote users access using VPN to my Local network and also access internet through ISA.

remote users are not able to access https websites,

i mean, i can access http://www.yahoo.com but cannot access https://login.yahoo.com

i have created access rule says (Allow All Traffic From VPN clients to All networks and local host) and also (allow all networks to access VPN Clients)

i checked logging to check dropped packets, no dropped packets.

local computers can access internet with no problems.

this problem happens with vpn clients only.

Any one have idea ?

Thank you

[sicarie]

Is the 'allow any any' rule the only one in your ISA config?

[sicarie]

Are you sure certificates are being handled correctly?

[abdoelmasry]

No, I have many other rules but i set the rule (allow any any) at first to override other rules.

what do you mean by (certificates)?
this is outgoing connection from vpn client to login.yahoo.com
i don't think that i will need certificate to connect to yahoo

it's very strange problem,
i know that ppp encrypts and compress data and also SSL encrypts data,
may ppp encryption conflict with SSL Encryption ??

Thank you

[sicarie]

I would recommend backing up your ruleset and then removing all the others - sometimes programs use the top as the highest priority, sometimes they use the last.

If you want to make sure that no other rules are interfering, I'd recommend removing all the others.

[abdoelmasry]

Hi sicarie

Problem Solved

the problem was CRL,

ISA server was unable to download Certificate Revocation List(CRL) to secure connection to SSL.

i set (CRL Download) in isa system policy(enabled) to All Networks and localhost.

Thank You Bro :)

[sicarie]

Awesome, thanks for posting the fix too!