Adding/Accessing different HTTPS ports with ISA Server 2006

You will get the error below when you try to create a connection to HTTPS by using a different port than 443. This is very normal behaviour of ISA because the port you want to use is not in the range of TunnelPorts, (TunnelPortRanges)

HTTP/1.1 502 Proxy Error (The specified Secure Sockets Layer (SSL) port is not allowed. ISA Server is not configured to allow SSL requests from this port. Most Web browsers use port 443 for SSL requests.)

But you can easily add necessary ports to TunnelPortRanges by the help of a very simle VB script, to do it create a clean vbs file and paste the code below to your vbs, and change the port numbers as you wish, example code is for port 8443, save and run the vbs. It will add the port you have written to TunnelPortRanges, you will need to restart Firewall Service to apply and activate your new port.

set isa=CreateObject("FPC.Root")
set tprange=isa.GetContainingArray.ArrayPolicy.WebProxy.TunnelPortRanges
set tmp=tprange.AddRange("SSL 8443", 8443, 8443)
tprange.Save

You can also use the vbs below to list ranges.
set isa=CreateObject("FPC.Root")
Dim tpRanges, tpRange

Set tpRanges = isa.GetContainingArray.ArrayPolicy.WebProxy.TunnelPortRanges

If tpRanges.Count > 0 Then
For Each tpRange In tpRanges
WScript.Echo tpRange.Name & " : " & tpRange.TunnelLowPort & "-" & tpRange.TunnelHighPort
Next
Else
WScript.Echo "No tunnel port ranges are defined."
End If
( Adding/Accessing different HTTPS ports with ISA Server 2006 )

ISA 2006 da farklı HTTPS portları kullanmak/eklemek

ISA Server 2006 da TCP 443 den farkli portlar ile HTTPS baglantisi kurmaya calistiginizda, baglanmak istediginiz port veya portlar TunnelPortRanges kapsaminda bulunmadigi icin baglanti hatasi alacaksinizdir.

HTTP/1.1 502 Proxy Error (The specified Secure Sockets Layer (SSL) port is not allowed. ISA Server is not configured to allow SSL requests from this port. Most Web browsers use port 443 for SSL requests.)

Bu durumda ihtiyaciniz olan portlari TunnelPortRanges'a eklemeniz gerekmektedir, bunu basitce bir VBScript ile yapabilirsiniz, bir text dosyasi olusturun, adi ornegin 8443.vbs olsun, 8443 burada benim eklemek istedigim port. Dosyayi notepad ile acip icine asagidaki kodu yapistirin

set isa=CreateObject("FPC.Root")
set tprange=isa.GetContainingArray.ArrayPolicy.WebProxy.TunnelPortRanges
set tmp=tprange.AddRange("SSL 8443", 8443, 8443)
tprange.Save

Siz 8443 olan port degerlerini kendi ihtiyaciniz olan portla degistireceksiniz tabiiki, bir den fazla port ekleyecekseniz ornegin 8443 ile 8448 arasindakiler gibi o zaman

set tmp=tprange.AddRange("SSL 8443-8448", 8443, 8448) seklinde de yazabilirsiniz, ardisik degilse her portunuz icin ayti bir vbs olusturun, daha sonra vbs dosyasini calistirarak portu ISA ye ekleyin, degisikligin gecerli olmasi icin Firewall Servisini restart etmeniz gerekecektir.

Mevcut portlari listelemek icin ise asagidaki vbs scriptini kullanabilirsiniz.
set isa=CreateObject("FPC.Root")
Dim tpRanges, tpRange

Set tpRanges = isa.GetContainingArray.ArrayPolicy.WebProxy.TunnelPortRanges

If tpRanges.Count > 0 Then
For Each tpRange In tpRanges
WScript.Echo tpRange.Name & " : " & tpRange.TunnelLowPort & "-" & tpRange.TunnelHighPort
Next
Else
WScript.Echo "No tunnel port ranges are defined."
End If

( ISA 2006 da farklı HTTPS portları kullanmak/eklemek )

ISA/TMG de Exchange Listener Connection TimeOut Degeri

Exchange 2007/10 kullanirken asagidaki gibi bir uyari Event Log'unuzda beliriyor ise
Event ID: 1040, MSExchange ActiveSync

The average of the most recent heartbeat intervals [443] for request [Ping] used by clients is less than or equal to [540].

Make sure that your firewall configuration is set to work correctly with Exchange ActiveSync and direct push technology. Specifically, make sure that your firewall is configured so that requests to Exchange ActiveSync do not expire before they have the opportunity to be processed.

For more information about how to configure firewall settings when using Exchange ActiveSync, see Microsoft Knowledge Base article 905013, "Enterprise Firewall Configuration for Exchange ActiveSync Direct Push Technology" (http://go.microsoft.com/fwlink/?linkid=3052&kbid=905013).

Bunun sebebi ISA/TMG de kullandiginiz Web Listener'in varsayilan Connection TimeOut degerenin 1800 sec'e ayarlanmis olmasi, bu durumda ya Sync klasoru altinda bulunan Web.config dosyasindaki asagida gozuken yerleri degistirmelisiniz yada

"MinHeartbeatInterval" value="60"
"MaxHeartbeatInterval" value="3540"

ISA/TMG sunucunuzdaki Listener degereni benim tavsiyem ISA daki Listener Connection Timeout degerini degistirmenizdir, bunun icin ISA/TMG sunucunuzda Exchange icin klullanmis oldugunuz listener ozelliklerine girip, Connections tabinda Advanced Settings'i secip 1800 olan mevcut degeri Exchange ile eslemek icin 3540 seklinde degistirmeniz yeterli olacaktir.

Script ile ISA Server Cache'ini temizlemek

ISA Server'da Cache dosyasini temizlemek icin asagidaki basit script ten yararlanabilirsiniz, aslinda manual olarak yaptigimiz Firewall servisinin durdurulmasi , ardindan Cache dosyasinin silinmesi ve servisin yeniden baslatilmasindan farkli bir islem yapmamakta, ancak otomatize etmek icin duz bir batch dosyasindan daha faydali olacaktir surucu ismi statik olmadigi icin ve birden fazla dosyaniz var ise bulup temizleyebilecegi icin.

Unutmayinizki Firewall servisi bu islem sirasinda durdurulup yeniden baslatilacagi icin baglantilarinizda kesinti olacaktir.


Set root = CreateObject("FPC.Root")
Set server = root.GetContainingServer()
server.StopFirewallService()
Set cacheDrives = server.CacheDrives
Set fso = CreateObject("Scripting.FileSystemObject")
For Each cacheDrive In cacheDrives
cacheFilePath = CacheDrive.Name & "\urlcache\Dir1.cdat"
WScript.echo "Cache dosyasinin yeri: " & cacheFilePath
fso.DeleteFile cacheFilePath
Next
server.StartFirewallService()
WScript.Echo "Cache icerigi temizlenmistir"