403 - Forbidden: Access is denied.

[adobe_mayur]

I am getting a "403 - Forbidden: Access is denied." error.

We have multiple websites are setup on 2 IIS servers.

The 2 IIS servers have same apps on both servers.

The IIS servers are behind VIP.

I am getting the above error on only one of the site on only 2nd IIS server.

Also, the error is only for accessing .cfm page and hot htm pages at same location

If I turn off the 2nd IIS server and have only 1st IIS server behing the VIP. Then everything works.

for e.g.

we have

VIP 1 - Site 1 - port 81

VIP 2 - Site 2 - port 82

VIP 3 - Site 3 - port 83

https://vip1/webapps/Test.cfm - works

https://vip1/webapps/Test.htm - works

https://vip2/webapps/Test.cfm - does not work

https://vip2/webapps/Test.htm - works

https://vip3/webapps/Test.cfm - works

https://vip3/webapps/Test.htm - works

Ruling out Netscalar issues,

1. other sites on 2nd iis server works

2. on the problem site, htm pages works

3. the VIP settings look identical

Is that correct, or we need to look at something specific on netscalar

Is there any setting on the CF admin server wea are missing. Or is there a way to compare CF admin setting for the problem site, across 1st IIS server and 2nd IIS sever, that would show us the difference and highlight the issue

[Charlie Arehart]

On the server not working, in iis for the site not working, is there a jakarta virtual directory, like in all the working sites? If not, if all the working sites' Jakarta virtual directories point to the same folder (which should be one within the cf config/wsconfig folder), add that virtual directory to the site, and try again. No need of any restart of iis or the site or of cf.

If that's not it, there are more thinga to consider, but let's start with this simple one. 

(This problem can happen when one configures the cf web server connector for "all sites" - - but it can only add the jakarta virtual directory to those there at that time m if you add a new site after that, YOU have to add that virtual directory. It's not a cf bug, just a reality due to how both iis and tomcat work.) 

[adobe_mayur]

All working site essentially point to the same folder d:/iserver/domain

All working sites have the jakarta virtual directory configured.. Its in config\wsconfig\3 (each site has its own)

[Charlie Arehart]

I'd asked you about the failing site. 

[adobe_mayur]

I am sorry I am not understanding the comment..
What info about the failing site can I provide.

[Charlie Arehart]

I had said, "On the server not working, in iis for the site not working, is there a jakarta virtual directory, like in all the working sites?"

Then I offered subsequent info based on your yes or no. 

[adobe_mayur]

Thanks for the clarification.

Yes, for the site not working, there is a jakarta virtual directory, like in the other working sites

[Charlie Arehart]

And are you saying it points to that same dll that the others do? If so, does that site have a "tomcat" isapi filter, and is it pointing to the same folder? And does it have a cfm handler mapping, pointing to the same folder?

If all this is so, let's focus on the 403. There can be many causes. Tell us first what iis app pool is used by a working site and this not working site, and then for each what is their app pool identity? And then if the Tomcat isapi filters for each (the working and non working site) don't point to the same folder, how do the permissions for each folder differ (if at all)? 

If instead you may want to "just solve this" without all the back and forth, I can offer direct remote assistance (even this weekend) to likely resolve this in less than 15 mins. If we don't solve it, you'd need not pay me. See carehart.org/consulting.

If you prefer to slog things out here, let us know what you find on what I've shared here.