Today there is much more inspection into filtered traffic, than it used to be, because of IPS and Application Control, but still packet filters don't alter the the traffic that passes them. When you create a new rule, you directly choose between proxies and filters. In WatchGuard's Fireware, there is no hiding about what is a proxy and what is a packet FILTER. These communication problems happen primarily with Dynamic NAT, while Static NAT (used mostly for server connectivity) has less issues. Solution: There is no workaround for these limitations at this time. The only exception is if the session is initiated by an external Internet client that is not behind a NAT device. ISA Server does not have a SIP application filter at this time to handle such traffic.

Instant text messaging from an internal client to an external client can go out through Web proxy.Īudio, video, and whiteboard features use SIP/SIMPLE. This avoids NAT issues that arise when an external client needs the IP address of the internal client. Presence and instant message is essentially a client/server application, where the server mediates the communication between the two clients. Problem: Not all Live Communications Server functionality works through ISA Server 2004.Ĭommunication between two clients on the same side of the ISA Server computer should work in a simple internal network configuration. Live Communications Server Has Limited Functionality through ISA Server Relevant part of the article quoted below Live Communications Server used SIP and it became a problem. Troubleshooting Unsupported Configurations The article was for ISA2004 but it continued to be a problem all the way to TMG2010. SIP being the example here, but was true for any complex protocol that carries connection information inside the payload where the NAT process is left 'unaware' of it and hence cannot manage the connection properly. This is a link to the material using ISA Server as an example to show the issue with complex protocols. People from the product team back then even admit to that to us (the MVPs), but never changed the documentation or the wording in the GUI. Even MS does in the ISA/TMG product when they refer to Application Layer Filters which are actually Application Layer 'proxys'. I am saying that Watchguard does that in how they use terminology in their documentation.

Watchguard sip alg disable