Testing IAG SP2 Update 3 - Part 3

Having been distracted from IAG with the impending launch of UAG on the Celestix platform, and Websense launching their Triton platform, I finally found time today to do some more testing.

Uri from Eurodata dropped me an email checking if my AD repository was the same as my domain (which it isn't!), as this would save having to edit inc files after an upgrade.  Step 9 of the following article: http://blogs.technet.com/edgeaccessblog/archive/2008/07/24/publishing-microsoft-activesync-through-iag-2007-part-1-of-2.aspx

Today I reset my demo appliance and tried the following:

• Configure the networking components of my Celestix WSA applaince
• Install Java, Active Perl, SP2 and SP2 Update 2
• Create an ActiveSync trunk
• Import my Exchange certificate
• Use an AD repository that is named the same my domain
• Modify the ASP file mentioned above
• Test - Success!
• Install SP2 Update 3
• Test - Success!
• Recreate my portal trunk for my applications
• Test - Success!

Now IAG SP2 Update 3 is working successfully in a new installation (albeit via SP2 Update 2, rather than straight to SP2 Update 3), I will try an in-place upgrade on my known working appliance.

Thanks for the email Uri, as it motivated me to look at this issue again!! :)

Testing IAG SP2 Update 3 - Part 2

Here is some useful information from the MS UAG Blog about IAG SP2 Update 3.

The table in the link is very useful at summerising what is and isn't supported.

Socket forwarding is not supported by any 64 bit Windows operating system, as well as Mac & Linux machines.  I have seen this with my Windows 7 64 laptop, which does not work with published RDP sessions, but can confirm that XP compatibility mode does work.

The Network Connector will not work with either 32 or 64 bit Windows 7 machines, as well as Mac & Linux machines.  I can confirm this as a customer and I have tested this, although I have yet to test a Windows 7 in XP compatibility mode with the Network Connector, but I suspect it will work.

Although this update was meant to be the "fix" for Windows 7 and IAG, I'm afraid there are still limitations.

IAG is dead.... long live UAG!

Testing IAG SP2 Update 3 - Part 1

I managed to get my hands on SP2 Update 3 for IAG v3.7 a week or so ago.

So far I've only managed to deploy this to my live environment, but with some good and bad results!

My current IAG platform is a Celestix WSA 4000, and it has been Service Packed and updated pretty much as and when these updates have been available.

As I'm a little wary of these things, I use the Celestix Last Good Version (LGV) feature, which allows me to take a snapshot of my appliance and save this to a Linux partition on the appliance. It takes around 15 minutes to make this snapshot, and around 10 minutes to rollback... if required!

My appliance hosts a portal with various applications such as OWA, Intranet, RDP, etc, as well as an ActiveSync tunnel for our mobile devices.

After the update was applied, the portal worked perfectly with both Windows 7 32-bit and 64-bit machines, but it broke my ActiveSync tunnel!

One of my authentication methods is Active Directory and it is used for both the Portal and ActiveSync tunnel. The authentication using AD was perfect on the Portal, but it failed for the ActiveSync tunnel. All the mobile devices said the wrong password was being presented.

No changes were made to the mobile devices and this impacted both Nokia E71 and Apple iPhones. Changing the password on the device made no difference, but we knew that the AD authenication should be working correctly as the portal works.

Rolling the appliance back to SP2 Update 2 using the LGV feature, allowed all the mobile device to authenicate again, even though someof these devices did not have their password changed.

Since then, I've managed to get hold of another appliance to test with, so Part 2 will continue tomorrow.....

Microsoft IAG SP2 Update 3

Information from Microsoft regarding: IAG SP2 Update 3

Once this has been tested by Celestix, it will be available for download from the webiste.

It will also give me a chance to test it in my lab as well.

IAG SP2 Update 3?

Well I've had word that IAG SP2 Update 3 should be out in a month or so.

The components being addressed with this update, are that Windows 7 will be recognised correctly and 64-bit clients will be supported.

Obviously you have seen that I have documented a 32-bit Windows 7 workaround, but there are still issues with this when using certain applications. The only 64-bit client that can be made work is Windows 7, as long as your computer has the ability to run XP Compatibility Mode (which will mean that only specific processors are supported)

As soon as I see that update, I will get it installed and tested, as my work laptop is both Windows 7 and 64-bit..... you can see I like a challenge!!

IAG SP2 Update 2... finally!

There were a number of rumours that SP2 Update 2 would include 64 bit client support, but it seems it was just that... a rumour! The current rumour is that 64 bit client support will be available with SP2 Update 3, which is good considering we were always told that IAG would never support 64 bit operating systems. We can make Windows 7 64-bit work by using XP Mode (and detailed in the previous blog posting)

After QA testing from Celestix, IAG SP2 Update 2 is now available from the Celestix website.

The following issues are addressed with this update:

• Fixed erroneous IAG behavior when headers contain blank characters
• For trunks which do not publish an AAM application, the IAG Session cookie will be a site cookie instead of a domain cookie
• Fixed bug for supporting Citrix XenApp5 application
• Fixed parsing of text/html response Content-type (not binary) body using Chunked encoding type
• Fixed a failure occurring when using IAG’s Socket Forwarding client component on a Citrix terminal server
• Fixed a SharePoint Persistent Cookie Name Race Condition
• Fixed an Authorization Key Header memory Corruption while using an "Authorization Key" header
• Fixed a failure in the endpoint detection policy of AVG on the client computer (mistyped value in the detection policy expression)
• Fixed an Incorrect header removal when header is substring of another header
• Fixed Day Light Saving change leading to a deletion of Internalsite and Portal rules
• The communication between Windows Mobile 6.1 and Exchange 2007 SP1 has changed slightly due to the updating of the EAS protocol to EAS v12.1 – added support/fix for it
• Enabling above 2KB http header request by modifying the following registry key (MaxAllHeadersLen), to prevent SNT from throwing the following error to the client: "Allow http header block of a request to exceed 2KB and avoid SNT throwing an error"
• Fixed non English locales inconsistent encoding/decoding detection
• Fixed few issues related to FormLogin authentication
• Modified the rule-set that broke Java SSL Wrapper
• Added support iPhone and Blackberry support
• Fixed non-IE detection security issues

IAG SP2 Update 2 - Release_Notes

IAG SP2 Update 2 - Installation File

Celestix and Microsoft IAG

What is Microsoft Intelligent Application Gateway (IAG)?

It's an remote application delivery platform or as some would call it.... an SSL-VPN.

It's a way of delivering the applicatons you use internally at work, to an external audience via HTTPS.

The IAG can interogate computers to check what operating system it runs, whether there are specific applications running (such as anti-virus software, software based firewalls, etc), whether the computer is a member of a domain, etc.

By coupling endpoint checks, along with user credentials, granular understanding of applications, reporting and monitoring. We have a secure delivery method, as we can ensure correct users, can access correct applications, with approved computers, and be able to see who, accessed what and when. Sounds pretty comprehensive!!

This product originally was made by Whale Communications and was developed about ten years ago, prior to being bought out my Microsoft. This software platform is avalable on the Celestix WSA appliance. If you are based in the UK and want to evaluate an appliance, contact e92plus on 020-8274 7000

Some useful resources for those new to IAG are available here:

Celestix WSA Quick Start Guide [3.8Mb]
Microsoft IAG User Guide [3.32Mb]
Microsoft IAG Advanced User Guide [2.77Mb]

Microsoft IAG 2007 Service Pack 2 - Notes
Microsoft ActivePerl (which must be installed prior to SP2) [15.8Mb]
Microsoft IAG 2007 Service Pack 2 [36.5Mb]

Microsoft IAG 2007 Service Pack 2 Update 1 - Notes
Microsoft IAG 2007 Service Pack 2 Update 1 [19.8Mb]