Use the following procedure to create a new Web publishing rule for ISA Server 2004.

1. On the ISA Server, open ISA Server Management. To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

2. In the console tree, browse to <Local ISA Server>.

3. Right-click Firewall Policy, point to New, and then click Secure Web Server Publishing Rule.

4. On the Welcome to the SSL Publishing Rule Wizard page, in the SSL Web Publishing Rule Name box, type a name for the new server publishing rule, and then click Next.

5. On the Publishing Mode page, click SSL Bridging, and then click Next.

6. On the Select Rule Action page, click Allow, and then click Next.

7. On the Bridging Mode page, do one of the following:

   • To enable HTTPS-HTTP bridging, click Secure connections to clients, and then click Next.
     
     
   • To enable HTTPS-HTTPS bridging, click Secure connection to clients and Web server, and then click Next.
     
     

8. On the Define Website to Publish page, do the following:

   1. In the Computer name or IP address box, type the name of the TS Gateway server. The specified name must match the name of the TS Gateway server through which users will connect in this scenario. This name must also match the certificate name (CN) in the certificate that is installed on the TS Gateway server.
      
      
   2. Select the Forward the original host header instead of the actual one (specified above) check box.
      
      
   3. In the Path box, type /*.
      
      

9. On the Public Name Details page, do the following:

   1. In Accept requests for, ensure that This domain name is selected.
      
      
   2. In the Public name box, type the name of the TS Gateway server. The specified name must match the name of the TS Gateway server through which users will connect in this scenario.
      
      
   3. In the Path box, type /*.
      
      
   4. Click Next.
      
      

10. If required, create a new SSL Web listener. If you have a pre-existing listener with a certificate that matches the public name, you do not need to create a new SSL Web listener. In this case, select the appropriate Web listener, click Next, and then proceed to Step 11.

    If you do need to create a new SSL Web listener, do the following:

    1. On the Welcome to the New Web Listener page, in the Web Listener Name box, type a name for the Web listener, and then click Next. If Web listeners have already been configured for the ISA Server, on the Select Web Listener page, click New to open the Welcome to the New Web Listener page and begin specifying a new Web listener.
       
       
    2. On the IP Addresses page, under Listen for requests from these networks, select the External check box, and then click Next.
       
       
    3. On the Port Specification page, do the following:
       
       
    4. Under SSL, select the Enable SSL check box, and then clear the Enable HTTP box.
       
       
    5. Click Select, and in the Select Certificate dialog box, click the certificate that you want to use.
       
       

       Note
       ISA Server 2004 cannot process certificate Subject Alternative Name (SAN) attributes. The Subject of the certificate installed at the published server must match the published host name used in the Web Publishing rule.

    6. Click OK to close the Select Certificate dialog box, and then click Next.
       
       
    7. On the Completing the New Web Listener Wizard page, click Finish.
       
       

11. On the Select Web Listener page, confirm that the correct Web listener properties appear, and then click Next.

12. On the User Sets page, click All Users, and then click Next.

13. On the Completing the New SSL Web Publishing Rule Wizard page, click Finish.

14. To save the changes and update the ISA Server firewall policy, in the details pane of the ISA Server Management console, click Apply.

15. In the Apply New Configuration dialog box, click OK after the changes are applied (a progress bar appears while the changes are being applied).

Use the following procedure to create a new Web publishing rule for ISA Server 2006 or ISA Server 2006 Service Pack 1 (SP1).

1. On the ISA Server, open ISA Server Management. To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

2. In the console tree, expand the ISA Server name. (If you are using ISA Server 2006 SP1 Enterprise Edition, expand Arrays, and then expand the ISA Server name.)

3. Click Firewall Policy.

4. On the Tasks tab, click Publish Web Sites.

5. On the Welcome to the New Web Publishing Rule Wizard page, in the Web publishing rule name box, type a name for the new publishing rule, and then click Next.

6. On the Select Rule Action page, click Allow, and then click Next.

7. On the Publishing Type page, ensure that Publish a single Web site or load balancer is selected, and then click Next.

8. On the Server Connection Security page, select Use SSL to connect to the published Web server or server farm, and then click Next.

9. On the Internal Publishing details page, in the Internal site name box, type the name of the TS Gateway server, and then click Next.

   If the ISA Server cannot resolve the name of the TS Gateway server, type the IP address of the TS Gateway server. Alternatively you can include this information in the Hosts file.

10. On the second instance of the Internal Publishing Details page, do the following:

    1. Ensure that the Path box is empty.
       
       
    2. Ensure that the Forward the original host header instead of the actual one specified in the Internal site name field on the previous page check box is cleared.
       
       
    3. Click Next.
       
       

11. On the Public Name Details page, do the following:

    1. In Accept requests for, ensure that This domain name (type below) is selected.
       
       
    2. In the Public name box, type the name of the TS Gateway server. The specified name must match the name of the TS Gateway server through which users will connect in this scenario. This name must also match the certificate name (CN) or the Subject Alternative Name (SAN) in the certificate that is installed on the TS Gateway server.
       
       

       Note
       If you are using the Subject Alternative Name (SAN) attributes of certificates, clients that connect to the TS Gateway server must be running RDC 6.1. RDC 6.1 is available with Windows Server 2008, Windows Vista with SP1, and Windows XP with SP3. The RDC 6.1 (6.0.6001) client supports Remote Desktop Protocol 6.1.

    3. Ensure that the Path box is empty.
       
       
    4. Click Next.
       
       

12. If required, create a new SSL Web listener. If you have a pre-existing listener with a certificate that matches the public name, you do not need to create a new SSL Web listener. In this case, select the appropriate Web listener, click Next, and then proceed to Step 13.

    If you do need to create a new SSL Web listener, do the following:

    1. On the Select Web Listener page, click New.
       
       
    2. On the Welcome to the New Web Listener Wizard page, in the Web Listener Name box, type a name for the Web listener, and then click Next.
       
       
    3. On the Client Connection Security page, click Require SSL secured connections with clients, and then click Next.
       
       
    4. On the Web Listener IP Addresses page, do the following:
       
       
    5. Under Listen for incoming Web requests from these networks, select the External check box.
       
       
    6. Ensure that The ISA Server will compress content sent to clients through this Web Listener if the clients requesting the content support compression check box is selected.
       
       
    7. Click Select IP Addresses.
       
       
    8. On the External Listener IP Selection page, do the following:
       
       
    9. Click Specified IP addresses on the ISA Server in the selected Network. Under Available IP addresses, select the appropriate IP address, click Add, and then click OK.
       
       
    10. Click Next.
        
        
    11. On the Listener SSL Certificates page, click Assign a certificate for each IP address, click the appropriate IP address, and then click Select Certificate.
        
        
    12. On the Select Certificate page, under Select certificate, click the TS Gateway server certificate, click Select, and then click Next.
        
        

        Note

        ISA Server 2006 is able to use either the Subject or the first Subject Alternative Name (SAN) entry. For example, if ISA Server is expecting the certificate to read “contoso.com,” the name should be in one of the following formats: The certificate “Subject” (AKA “common name”) Or The first entry in the Subject Alternative Name (SAN) list (ISA Server 2006 only) These restrictions do not impact ISA Server 2006 SP1.

    13. On the Authentication Settings page, click No Authentication, and then click Next.
        
        
        1. If ISA Server is a member of a domain and:
           
           
           • Client authenticates by using only a password:
             
             
             1. On the Authentication Settings page, click No Authentication, and then click Next.
                
                
             2. On the Single Sign On Settings page, click Next.
                
                
           • Client authenticates by using only a smart card:
             
             
             1. On the Authentication Settings page, click SSL Client Certificate Authentication or No Authentication, and then click Next.
                
                
             2. On the Single Sign On Settings page, click Next.
                
                

           Note
           If both password and smart card authentication are allowed on the TS Gateway server, Authentication setting SSL Client Certificate Authentication must be set to No Authentication.

        2. If ISA Server is in a workgroup and the client authenticates by using either a password or smart card or both:
           
           
           1. On the Authentication Settings page, click No Authentication, and then click Next.
              
              
           2. On the Single Sign On Settings page, click Next.
              
              
    14. On the Completing the New Web Listener Wizard page, click Finish.
        
        
    15. On the second instance of the Completing the NewWeb Listener Wizard page, confirm that the correct Web listener properties appear, and then click Finish.
        
        

13. On the Select Web Listener page, confirm that the appropriate Web listener is selected, and then click Next.

14. On the Authentication Delegation page, click No delegation, but client may authenticate directly, and then click Next.

    Important
    Selecting the incorrect Authentication Delegation option will cause clients to be unable to connect to the TS Gateway server. Clients will receive a continuous credential prompt indicating that the logon failed.

15. On the User Sets page:

    • If Authentication Settings in SSL Web listener is set to No Authentication, verify that All Users is selected, and then click Next.
      
      
    • If Authentication Settings in SSL Web listener is set to SSL Client Certificate Authentication, verify that All Authenticated Users is selected, and then click Next.
      
      

16. On the Completing the New Web Site Publishing Rule Wizard page, click Finish.

17. To save the changes and update the ISA Server firewall policy, in the details pane of the ISA Server Management console, click Apply.

18. In the Apply New Configuration dialog box, click OK after the changes are applied (a progress bar appears while the changes are being applied).

The following resources provide information about testing and troubleshooting RPC over HTTP through ISA Server:

1. Client symptoms: The RDC Client is unable to connect and continuous credential prompts are displayed to the user.
   
   The ISA Server logs will indicate a denied connection with status that the specified URL was denied. On ISA Server 2006 SP1 in the rule properties window, you can click Test Rule, and the error An unexpected response was received from the server. HTTP response: 404 not found. is displayed.
   
   Resolution: Use the ISA Server manager to select the rule that you created in step 4, “Create a new Web publishing rule on the ISA Server.” Right-click the rule, click Properties, and then verify the following settings:
   
   
   • Listener on the Gateway publishing rule: Verify that there is no warning on this page The selected web listener is not configured with certificates matching one or more of the public names defined in this rule, and that the public name of the TS Gateway server matches the certificate name.
     
     
   • Authentication delegation on the Gateway publishing rule: No delegation, but client may authenticate directly
     
     
   • Paths on the Gateway publishing rule: /*
     
     
2. Client symptoms: Clients receive an error that the TS Gateway server is unreachable. The ISA Server logs indicate failed connection attempt with error code 0x80090332. On ISA Server 2006 SP1, in the rule properties window, you can click Test Rule, and the error Name resolution error is displayed.
   
   Resolution: Use the ISA Server manager to select the rule that you created in step 4, “Create a new Web publishing rule on the ISA Server.” Right-click the rule, and then click Properties. On the To tab, verify that the This rule applies to the published site site is reachable from the ISA Server.
   
   
3. Client symptoms: Clients receive a timeout error for the connection with the TS Gateway server. The ISA Server logs indicate connected party failed to respond properly or within specific time. On ISA Server 2006 SP1, in the rule properties window, you can click Test Rule, and the error 10060 is displayed.
   
   Resolution: Use the ISA Server manager to select the rule that you created in step 4, “Create a new Web publishing rule on the ISA Server.” Right-click the rule, and then click Properties. On the Bridging tab, verify that the Web server ports are set as follows:
   
   
   • Redirect requests to HTTP port: 80
     
     
   • Redirect requests to SSL port: 443
     
     

After performing the appropriate troubleshooting tips, ensure that the client is correctly configured as a TS Gateway client as described in "Steps for configuring a Terminal Services client for the TS Gateway core scenario" in Configuring the TS Gateway Core Scenario [ http://technet.microsoft.com/en-us/library/cc754252(WS.10).aspx ] . To ensure that connectivity is successful in this scenario, follow the steps in "Verify that end-to-end connectivity through TS Gateway is functioning correctly" in Configuring the TS Gateway Core Scenario.

The following resources provide information about testing and troubleshooting RPC over HTTP through ISA Server:

• Description of the ISA Server 2006 hotfix package that is dated May 14, 2007 (http://go.microsoft.com/fwlink/?LinkId=107462 [ http://go.microsoft.com/fwlink/?LinkId=107462 ] )
  
  
• Testing RPC over HTTP through ISA Server 2006, Part 1: Protocols, Authentication and Processing (http://go.microsoft.com/fwlink/?LinkId=104828 [ http://go.microsoft.com/fwlink/?LinkId=104828 ] )
  
  
• Testing RPC over HTTP through ISA Server 2006, Part 2: Test Tools and Strategies (http://go.microsoft.com/fwlink/?LinkId=104830 [ http://go.microsoft.com/fwlink/?LinkId=104830 ] )
  
  
• Testing RPC over HTTP through ISA Server 2006, Part 3: Common Failures and Resolutions (http://go.microsoft.com/fwlink/?LinkId=104831 [ http://go.microsoft.com/fwlink/?LinkId=104831 ] )
  
  
• RPC over HTTP Logging Wildness (http://go.microsoft.com/fwlink/?LinkId=104832 [ http://go.microsoft.com/fwlink/?LinkId=104832 ] )