Microsoft Sharepoint Products and Technologies Resource Kit eBook

Chapter 25: Firewall Considerations for SharePoint Portal Server Deployments 685
Testing SSL Bridging Configuration
Before you go any further, you need to test your SSL bridging configuration. On an
external computer that is not connected to your network, start Internet Explorer and
type in https://. In our example, we would open https://external.contoso.com.
A security alert might appear because the certificate of the root
CA that issued the portal site certificate is not installed on the external client’s
machine. If the security alert appears, click Yes to proceed. Because the SharePoint
site is set up to support Basic authentication, you should see the credentials dialog
box. Enter your credentials, and you should be able to see the portal site’s home
page.
If an error message—specifically, “500 Internal Server Error”—is returned to
the browser, you might need to reconfigure the Web publishing rule. The reason this
error might occur is the difference between the common name in the certificate and
the name of the server in the Web publishing rule where the requests are redirected.
The common name in the certificate is the external FQDN, whereas the name of the
server in the Web publishing rule is the server internal name. In our example, the
common name is external.contoso.com and the internal name is internal. The
workaround is to use the external FQDN for the name of the server the requests are
redirected to.
To change the name, go to the Web publishing rule Properties, click the Action
tab, and in the Redirect The Request To This Internal Web Server (Name Or IP
Address) box, type external FQDN. However, for this configuration to work, ISA
Server must be able to resolve the external FQDN to the internal IP address of the
SharePoint site—in our example, 192.168.1.1. To enable this name resolution, you
can create a hosts file entry that maps the FQDN to an internal IP address. The solution
is either to set up a split DNS or to add an entry to the hosts file on the ISA
Server computer. For instructions on how to set up a split DNS, refer to Chapter13.
If you want to use the hosts file, add a line to it with an external FQDN and an internal
IP address—for example: 192.168.1.1 external.contoso.com
Note The hosts file is located in the %SystemRoot%\System32\Drivers\Etc
folder on the ISA Server computer.
Configuring Link Translation
Using link translation on an ISA Server addresses several problems that external
users might encounter when connecting to an internal SharePoint site through a firewall.
Link translation is implemented as a Web application filter that is installed in
Feature Pack 1 for ISA Server 2000. By default, this filter is disabled.