Table of Contents

Next Page

Microsoft Internet Security and Acceleration (ISA) Server 2004 Administrator's Pocket Consultant
Microsoft Internet Security and Acceleration (ISA) Server 2004 Administrator's Pocket Consultant
byJason BallardandBud Ratliff
Microsoft Press 2006 (432 pages)
ISBN:0735621888

Delivering immediate answers for the day-to-day administration of ISA Server 2004, this guide offers the focused, straightforward information you need to solve problems and get the job done.

Table of Contents
 | Microsoft Internet Security and Acceleration (ISA) Server 2004 Administrator's Pocket Consultant
 | Introduction
 | Chapter 1 | - | Overview of Microsoft ISA Server 2004 Administration
 | Chapter 2 | - | Installing and Configuring Microsoft ISA Server 2004 Standard Edition
 | Chapter 3 | - | Installing and Configuring Microsoft ISA Server 2004 Enterprise Edition
 | Chapter 4 | - | Installing and Configuring Microsoft ISA Server 2004 Clients
 | Chapter 5 | - | Upgrading from Microsoft ISA Server 2000
 | Chapter 6 | - | Monitoring and Reporting
 | Chapter 7 | - | Configuring Toolbox Elements
 | Chapter 8 | - | Configuring Microsoft ISA Server Firewall Policy
 | Chapter 9 | - | Configuring Multinetworking
 | Chapter 10 | - | Microsoft ISA Server Security and Administration
 | Chapter 11 | - | Securing Virtual Private Network Access
 | Chapter 12 | - | Scripting with Microsoft ISA Server 2004
 | Chapter 13 | - | Configuring Arrays Using Centralized Management
 | Chapter 14 | - | Using Enterprise and Array Policies
 | Chapter 15 | - | Working with Enterprise Technologies and Microsoft ISA Server 2004
 | Chapter 16 | - | Configuring Microsoft ISA Server with Microsoft Exchange Server 2003
 | Chapter 17 | - | Configuring Microsoft ISA Server with Microsoft Sharepoint Portal Server 2003
 | Chapter 18 | - | Configuring Microsoft ISA Server with Microsoft Operations Manager 2005
 | Chapter 19 | - | Configuring Microsoft ISA Server with Microsoft Virtual Server 2005
 | Chapter 20 | - | Configuring Microsoft ISA Server 2004 with Microsoft Small Business Server 2003
 | Appendix A | - | Additional Resources
 | Index
 | List of Figures
 | List of Tables

Next Page


Back Cover

Previous Page
Next Page

Back Cover

Portable and precise, this pocket-sized guide delivers immediate answers for the day-to-day administration of ISA Server 2004. Zero in on core support and maintenance tasks using quick-reference tables, instructions, and lists. You’ll get the focused, straightforward information you need to solve problems and get the job done. Whether you’re at your desk or in the field!

Get fast facts to:

  • Install and configure ISA Server 2004
  • Upgrade from ISA Server 2000
  • Use scripts to automate recurring tasks
  • Administer firewall, Web proxy, and SecureNAT clients
  • Define networks and manage access policies and publishing rules
  • Implement a multi-networking environment
  • Set up VPNs and perimeter networks
  • Configure ISA Server security features and detect intrusions
  • Monitor system performance, traffic, and events
  • Manage arrays with Active Directory Application Mode
  • Optimize integration with other Windows Server System software

About the Authors

Jason Ballard is an Information Systems Assistant Manager for Toyota Motor Manufacturing North America. He is responsible for servers, storage, and backup technologies. Jason received a bachelor's degree in Business Administration from the University of Kentucky.

Jason is an accomplished presenter and public speaker, having presented seminars and demonstrations for emerging technologies to a variety of audiences.

Bud Ratliff, a Microsoft ISA Server MVP, is also a project management professional, MCSE, MCT, and principal partner in The Solarity Group, a Microsoft Certified Partner providing training, consulting, and support for clients internationally. He helps clients improve their ability to do business through the strategic application of processes, training, and technology. Bud travels internationally to speak on topics related to leadership, productivity, project management, security, and Windows operating systems

Previous Page


Microsoft Internet Security and Acceleration (ISA) Server 2004 Administrator's Pocket Consultant

Bud Ratliff and
Jason Ballard with the Microsoft ISA Server Team
Image from book
PUBLISHED BY Microsoft Press A Division of Microsoft Corporation
One Microsoft Way Redmond, Washington
98052-6399

Copyright © 2006 by Bud Ratliff and Jason Ballard

ISBN:0735621888

All rights reserved. No part of the contents of this book may be reproduced or transmitted in any form or by any means without the written permission of the publisher.

Library of Congress Control Number: 2005935316

Printed and bound in the United States of America.

1 2 3 4 5 6 7 8 9 QWE 0 9 8 7 6 5

Distributed in Canada by H.B. Fenn and Company Ltd.

A CIP catalogue record for this book is available from the British Library.

Microsoft Press books are available through booksellers and distributors worldwide. For further information about international editions, contact your local Microsoft Corporation office or contact Microsoft Press International directly at fax (425) 936-7329. Visit our Web site at www.microsoft.com/mspress. Send comments to mspinput@microsoft.com.

Microsoft, Active Directory, ActiveSync, FrontPage, Microsoft Press, MSDN, NetMeeting, Outlook, SharePoint, Win32, Windows, Windows Media, Windows NT, Windows Server, and Windows Server System are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Other product and company names mentioned herein may be the trademarks of their respective owners.

The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred.

This book expresses the author's views and opinions. The information contained in this book is provided without any express, statutory, or implied warranties. Neither the authors, Microsoft Corporation, nor its resellers, or distributors will be held liable for any damages caused or alleged to be caused either directly or indirectly by this book.

Acquisitions Editor: Martin DelRe

Project Editor: Laura Sackerman

Body Part No. X11-50519

Acknowledgements

The process of writing this second edition of the Microsoft Internet Security and Acceleration (ISA) Server Administrator's Pocket Consultant took a lot longer than any of us expected. One would think a second edition would be a lot easier, but with the rich set of new features available in ISA Server 2004, we rewrote almost the entire book. Furthermore, we added five chapters to the previous edition to bring the grand total to 20 chapters that cover a range of new features and scenarios.

We want to thank several contributing authors who provided us with specific content:

Chapter 11, "Securing Virtual Private Network Access," benefited from the assistance of Frédéric Esnouf, who is the author of a French-language ISA Server book (see a link in the "Additional Resources" appendix), and the developer of QSS, a Quarantine Solution for ISA Server. QSS is available at http://esnouf.net/qss.

Chapter 12, "Scripting with Microsoft ISA Server 2004," was written by Jesper Hanno, who is a Microsoft MVP with ISA Server, and also an expert in Microsoft Exchange, Microsoft Windows Server, and Microsoft Internet Information Services (IIS). He provides community news and solutions through his Web sites at http://www.hanno.dk and www.it-experts.dk.

Chapter 16, "Configuring Microsoft ISA Server with Microsoft Exchange Server 2003," was partially written by Jonathan Hassel, who is a writer, speaker, and consultant. You can find out more about him at http://www.jonathanhassell.com.

Chapter 17, "Configuring Microsoft ISA Server with Microsoft SharePoint Portal Server 2003," was developed by Barry Martin of The Mirazon Group (www.mirazon.com), who is an MCT and MCSE.

Chapter 19, "Configuring ISA Server with Virtual Server 2005," was developed by John Ross of The Mirazon Group (www.mirazon.com), who is an MCT and MCSE.

In addition, each chapter traveled through four different teams before it could be completed: the wonderful Microsoft Press editorial staff, the ISA Server MVPs, the Microsoft ISA Server Product Team, and the Microsoft Security Content Review Board (SCRB). We want to thank all the folks who helped make this book accurate and complete.

ISA MVP Reviewers:

  • Deiter "Ramblin' Man" Rauscher, Frédéric "Mssr. Incredible" Esnouf, Kai "You Talkin' to Me?" Wilke, Dr. Tom "The Godfather" Shinder, and all the other great MVPs who helped!

ISA Team Reviewers:

  • We thank the talented Microsoft ISA Server Team who helped build this great product and review many chapters: Adina Hagege, Alexandra Faynburd, Ilan Herbst, the ever wise and generous Jim Harrison, Nathan Bigman, Pesach Shelnitz, Yoram Singer, David Roundtree, and Josue Fontanez.

SCRB:

  • Michael Glass and David Visintainer were the SCRB team members who recruited the reviewers and coordinated their time. Our reviewers were Vic Shahid, Kimmo Bergius, Mark Kradel, Joel Schaeffer, and Matthijs ten Seldam. Thanks for your great suggestions.

The nSight team made sure all the punctuation, grammar, and wording were correct. Many thanks to the following folks:

  • Susan McClung, nSight Project Manager

  • Teresa Horton, Copyeditor

  • Karmyn Guthrie, Proofreader

  • Peter Amirault, Gabe Weiss, Terrie Robertson, and Angela Montoya, Desktop Publishing Specialists

  • Jack Lewis, Indexer

We want to particularly thank Tony Northrup, our Technical Editor, who helped to shape the book into sturdy form and improve its quality. We also want to thank Laura Sackerman, our Project Editor, and Martin DelRe—you couldn't ask for better folks to help guide you through the process of building a book. Thanks for your understanding and extra work in helping to adjust the schedule to accommodate the unavoidable realities of life.

Because we're writing this at 2:00 in the morning (the time most of this book was written), please forgive us if we haven't named you specifically. You know who you are, and we thank you so much!

Bud thanks his wife for her patience, and for only saying "I told you so" once. He thanks his son for providing welcome door-pounding interruptions for some father/son time. He also thanks the many, many people in the ISA Server, Microsoft, and Lexington communities for their support, friendship, and generosity.

Jason would like to thank his wife and son for their tremendous support throughout the entire book. The project took longer than expected, but you both remained positive and encouraged me to keep working to get the book completed.

About the Authors

Jason Ballard

Jason Ballard is an Information Systems Assistant Manager for Toyota Motor Manufacturing North America. He is responsible for servers, storage, and backup technologies. Jason received a bachelor's degree in Business Administration from the University of Kentucky.

Jason is an accomplished presenter and public speaker, having presented seminars and demonstrations for emerging technologies to a variety of audiences. Outside of work, Jason enjoys many activities, including time with his family, running, cycling, golf, and basketball.

Bud Ratliff

Bud Ratliff, a Microsoft ISA Server MVP, is also a project management professional, MCSE, MCT, and principal partner in The Solarity Group (www.solarity.com), a Microsoft Certified Partner providing training, consulting, and support for clients internationally. He helps clients improve their ability to do business through the strategic application of processes, training, and technology. Bud travels internationally to speak on topics related to leadership, productivity, project management, security, and Windows operating systems. Bud enjoys time with his family, reading, running, playing his bass guitar, and meeting new and interesting people around the world. You can reach Bud at Bud.Ratliff@solarity.com.


Introduction

Overview

If you need to quickly learn how to use Microsoft Internet Security and Acceleration (ISA) Server 2004, the Microsoft Internet Security and Acceleration (ISA) Server 2004 Administrator's Pocket Consultant is for you! This book will help administrators who are new to ISA Server learn the system and will provide valuable guidance to ISA Server 2000 administrators who want to learn the rich features available in this upgrade of the software. If you already know how to use ISA Server 2004, this book will serve as a quick reminder of how to perform certain tasks.

Our goal is to provide a specific resource for administrators of ISA Server—those people who use the product on a day-to-day basis. With this book, you don't need to wade through the theory behind how ISA Server could or should work in different environments; instead, you can find the right reference that concisely explains how to conduct a specific activity right away.

With the increase in the number of viruses, threats from hackers, and the need for protecting data (as so much more proprietary company information is exposed these days), your need for a well-tuned ISA server also increases daily. An incorrectly configured firewall is worse than no firewall at all in many cases, as it provides you with a false sense of security.

So many of the books on ISA Server on the market today provide a wealth of information, but they can't be neatly tucked under your arm while you're rushing to troubleshoot this hour's crisis with your systems. With the lack of time and resources available in most companies, administrators need a practical reference guide that provides fast and accurate answers to most basic questions about how to install, configure, and operate ISA Server 2004.

This "survival manual" helps provide you with a quick and easy-to-access set of answers for common ISA Server configuration and operations questions. This book focuses on the most common tasks you need to perform, such as installing ISA Server, publishing a web server, or setting up a virtual private network (VPN). Of course, this book will not provide an answer for every question, but it will provide clear and useful instructions for the most common scenarios in use today, and will provide references that direct you to other, more comprehensive resources.


Support

Every effort has been made to ensure the accuracy of this book. Microsoft Press provides corrections for books through the World Wide Web at the following address:

  • microsoft.com/learning/support

If you have comments, questions, or ideas about this book, please send them to Microsoft Press using either of the following methods:

Postal Mail:

Microsoft Press

Attn: Editor, Microsoft Internet Security and Acceleration (ISA) Server 2004 Administrator's Pocket Consultant

One Microsoft Way

Redmond, WA 98052-6399

E-mail:

mspinput@microsoft.com

Please note that product support is not offered through the mail addresses above. For support information, please visit Microsoft's Web site at

support.microsoft.com


Chapter 1: Overview of Microsoft ISA Server 2004 Administration

Overview

In this first chapter we provide an overview of the capabilities of Microsoft ISA Server, outline the ISA Server 2004 user interface (UI) for both the Standard and Enterprise Editions, and provide guidance for using ISA Server in different modes and scenarios.

Note

Throughout the book, Internet Security and Acceleration Server 2004 is referred to as ISA Server to denote the product. When you see ISA server with the lowercase s in server, be aware we're referencing the physical server itself and not the ISA Server 2004 product. If we are drawing a comparison between ISA Server 2004 and ISA Server 2000, we reference the particular product name.


ISA Server Capabilities

ISA Server was developed to provide a true Open Systems Interconnection (OSI) Layer 7 firewall, which cannot only determine whether packets coming from the Internet are from allowed addresses, or that they are allowed packets, but can also open the content of packets such as Web (HTTP) traffic to see if any other malicious information is hidden in its payload—see Figure 1-1 for a comparison between standard firewalls and an application inspection firewall. This ability to inspect not just the packet headers, but the contents of packet, is much more advanced in ISA Server than in other firewalls.

Image from book
Figure 1-1: Comparison of OSI Layer 4 and Layer 7 firewalls.

ISA Server specializes in being able to provide the most secure access to other Microsoft products, such as Exchange Server and Sharepoint Portal Server. ISA Server can also provide companies with the ability to improve users' experience when accessing Internet content by functioning as a proxy server. ISA will handle all requests for Internet traffic from internal users. Based on access rules that are defined within the ISA Console, you can allow or deny certain computers or users access to certain Web sites or types of Web content, and control the times that these rules apply. With the Enterprise Edition of ISA Server, you can set rules on a large number of different ISA servers from a single location, provide the ability to have several machines share high traffic loads, and distribute cached Internet content on different ISA servers based on mathematical algorithms.


How ISA Server Operates as a Caching and Firewall Server

ISA Server can perform several functions. It can cache Web content to provide accelerated access for users, which is how it was used in its first release as Microsoft Proxy Server. In the past two releases, the product's focus has been increasingly on being a very robust Layer 7 firewall that can inspect the payload of network packets to ensure they contain secure content.

ISA Server also can be installed to function as a caching server and a firewall, although caching is now disabled by default. Both functions have many complex aspects, so it is important to understand some of the more widely used functions of each.

Firewall: The Secure Server

As a firewall, ISA Server stands between your internal network(s) and the Internet; it protects your internal resources from external attacks, and can prevent internal computers from accessing certain external sites. It can even protect traffic within your network by filtering the traffic at the highest network level. The following are the key firewall benefits of ISA Server:

  • Secure publishing This function makes internal resources, like a Microsoft Exchange server, safely available to clients connecting across the Internet. External clients use the public Internet Protocol (IP) address of the ISA Server to access content. The transaction is checked and delivered to the internal server only if the right conditions are met. The internal servers are never directly exposed to the Internet, making them much more secure. See Chapter 8, "Configuring ISA Firewall Policy," for more information about publishing.

  • Packet, circuit, and application-layer filtering Filters make explicitly allowed resources available to specified applications, computers, and users only when needed. Filters make it possible to protect your network when the protocols you use aren't secure in themselves; for example, you can force user authentication for legacy Transmission Control Protocol/User Datagram Protocol (TCP/UDP) connections using ISA Server 2004. See Chapter 8 for more information.

  • Integrated intrusion detection There are several preconfigured conditions that, when met, will trigger alerts that inform an administrator of attempts to breach the firewall. These attacks include the following: generic port scan attack, enumerated port scan attack, IP half scan attack, SYN/LAND attacks, ping of death attack, UDP bomb attack, and Windows out of band attack. ISA Server also contains application filters that help to identify and prevent common Domain Name System (DNS) and Post Office Protocol 3 (POP3) attacks.

By default, no traffic is allowed through your ISA Server installation. You must set up an access rule to allow communication between the internal clients and the Internet. See Chapter 8 for more information.

A detailed description of each of the named attacks is included in Chapter 6 , "Monitoring and Reporting."

Several new features include setting quotas on TCP/UDP connections, protection against syncookies exploits, and spoof detection. See Chapter 10 , "ISA Server Security and Administration," for more information.

Caching: The Acceleration Server

ISA Server functioning as a caching server allows Internet content, such as images on a Web page, to be stored (cached) to a location on your internal network. When the Web content is requested again, it is provided to the requestor from an internal server rather than from a more distant Internet location. This improves the speed at which Web content can be served, because the files can be retrieved at the speed of your local network instead of the much slower speed of your Internet connection, also leaving valuable Internet bandwidth for other applications. ISA Server configured as a Web-caching server brings many improvements over earlier versions of the software. The following are some of ISA Server's caching features:

  • High-performance Web cache Most cached objects are stored in the server's RAM as well as on disk, which significantly improves the speed at which the ISA server can provide content to requesting clients. The cache is now in a single, indexed file on each ISA server, which allows for quicker and more efficient searches of cached content. You can also configure arrays, which allows you to distribute the cache across several different computers. In ISA Server 2000, Web content had to be forwarded to a separate proxy process (W3proxy.exe)—in ISA Server 2004, Web content now is processed by the new Hypertext Transfer Protocol (HTTP) filter, which improves both authentication and performance.

  • Scheduled download service When clients access certain popular and quickly changing Web content, such as the MSN home page, you can schedule ISA Server to download the content automatically on a regular basis (e.g., every 15 minutes). This allows only certain sites to be updated on a regular basis, rather than updating all sites more frequently.

  • Distributed and hierarchal caching Rather than duplicating Web content on all servers, ISA Server allows Web content to be distributed across the enterprise. Certain servers are responsible for certain sites and content, making more efficient use of space on internal servers and leveraging the higher speed access of the LAN to share Internet content. Distributed caching is available only in the Enterprise Edition.

  • Active caching This feature is no longer available in ISA Server 2004.

For information on how to configure caching, see Chapter 2 , "Installing and Configuring Microsoft ISA Server Standard Edition."


Differences Between ISA Server 2000 and ISA Server 2004

The primary difference between ISA Server 2000 and ISA Server 2004 is in the way in which networks are defined. With ISA Server 2000, there was a somewhat binary system in which all computers inside the company had to be defined by IP address ranges within the Local Address Table (LAT). Everything that was not defined in the LAT was considered external to the firewall.

With ISA Server 2004, the ability to define different networks is greatly improved. Now you can identify any range of IP addresses as a network, which opens up the possibility to allow or deny access between groups of machines inside the company as well as between machines inside and outside the company. Table 1-1 describes other features introduced in ISA Server 2004. For the complete listing of new features in ISA Server 2004, check out http://www.microsoft.com/isaserver/evaluation/features/.

Table 1-1: New Features in ISA Server 2004
Feature Name | Description
Multinetworking | Replaces the LAT from ISA Server 2000, allowing you to create and configure multiple networks. You are no longer limited to a binary approach in which the LAT contains internal addresses and everything else is considered external addresses. Instead, you have a relative LAT, which allows the configuration of multiple networks based on IP address ranges.
Per-network policies | Allows you to control how the clients within specified networks will communicate with one another.
Network relationships: Routed or NAT | Allows you to control how the networks will communicate with one another: Network Address Translation (NAT) or routed.
Built-in network templates | Allows you to easily configure your firewall policies based on the location of your ISA Server.
Advanced HTTP policies | Allows the ability to perform real OSI Layer 7 application inspection on a per-rule basis, control downloads by file extension, and control access for every connection, as well as blocking of unwanted content based on exploit and common application signatures.
Advanced FTP policies | Allows the ability for users to upload and download using File Transfer Protocol (FTP) while giving administrators the ability to selectively filter FTP requests.
Link translation | Provides a dictionary of internal server names mapped to external accessible names to prevent broken links by external users. This feature was available with the installation of ISA Server 2000 Feature Pack 1, but is now built-in.
Network Access Quarantine Control | Segregates clients onto a separate network to ensure predefined conditions have been met before allowing access to the internal network.
Port Redirection | Allows ISA server to accept connections for internal resources on a different port than that used by the internal server.
Advanced VPN Functions | Allows stateful filtering and inspection, monitoring, and logging, as well as support for Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Tunneling Protocol/IP Security (L2TP/IPSec), strong authentication, and virtual private network (VPN) quarantine.

Because of low levels of use, performance degradation, or potential security risks, Microsoft removed some of the features included with ISA Server 2000. Table 1-2 describes the features no longer available in ISA Server 2004.

Table 1-2: Features Removed in ISA Server 2004
Feature Name | Description
H.323 gateway | Allowed call handling and routing of H.323 Voice over IP (VoIP) calls.
Live media split streaming | Allowed organizations using Windows Media Technology to split the media streams, improving bandwidth for video and audio.
Bandwidth control | Allowed prioritization of connections based on the quality of service (QoS) packet scheduling service.
Active caching | Allowed the cache to manage the most commonly used items in the cache, and refresh itself as needed. In ISA Server 2004 Standard Edition, even though the functionality was removed, the tab will appear until ISA Server SP1 is applied.

Some features are available (or supported) only on ISA Server 2004 Enterprise Edition. See Table 1-3 for a list of these features and their functions.

Table 1-3: Features Unique to ISA Server 2004 Enterprise Edition
Feature Name | Description
Enterprise policies | Enterprise policies apply to a range of ISA servers, allowing centralized management of many ISA Server computers. Enterprise policies can override lower level policies.
Enterprise networks | Enterprise networks are composed of IP address ranges, and are global to all arrays in the enterprise.
Enterprise rule elements | In the Enterprise Policy node, you can configure protocols, users, content types, schedules, and network objects that are available to all permitted array members.
NLB support | Network Load Balancing (NLB) supports the ability to scale the use of ISA Server to more and more clients by using a single IP address to support several physical computers.
Site-to-site VPN failover | When VPNs are used with NLB, one array member is assigned as the connection owner. If the owner server becomes unavailable, the VPN connection is re-established with another array member.
CARP | Cache Array Routing Protocol (CARP) allows cached data to be stored on, and retrieved from, specific ISA servers throughout the enterprise without duplicating cache content.
Array reporting | ISA Server 2004 Enterprise Edition can combine the log files from different ISA servers (array members) and create a combined report summary.

In this section you've seen some of the new features included in ISA Server 2004, old features that are no longer available, and some of the capabilities available only in the Enterprise Edition of the ISA Server product.


Choosing the Right ISA Server for Your Environment

If you want to support NLB or CARP with your ISA Server product, then purchase ISA Server 2004 Enterprise Edition. By the same token, if you require the ability to centrally create rules and manage policies for multiple locations and network segments for a larger number of ISA servers, ISA Server 2004 Enterprise Edition meets your needs.


Product Editions and Requirements

ISA Server 2004 is available in two different editions (Standard Edition and Enterprise Edition), with the Standard Edition being provided as a stand-alone product, and also as part of Microsoft Small Business Server 2003 Premium Edition Service Pack 1.

Table 1-4 lists the features that differ between editions.

Table 1-4: Feature Comparison by Product Edition Open table as spreadsheet
Features | ISA with Small Business Server | ISA Server Standard Edition | ISA Server Enterprise Edition
Scalability | Very limited | Limited | Full
Distributed and hierarchical caching | None | Hierarchical only | Both
Active Directory integration | Can use users and groups to manage security and administrative roles | Can use users and groups to manage security and administrative roles | Can use users and groups to manage security and administrative roles; uses Active Directory Application Mode (ADAM) to store configuration information
Tiered policy | No | No | Yes
Multiserver management | No | No | Yes
NLB | No | Not supported | Yes

Several vendors, like Celestix and Network Engines, have created hardware appliances that utilize ISA Server. These products vary in functionality, but are designed to provide a more easily configured or updated installation of ISA Server 2004. See http://www.microsoft.com/isaserver/howtobuy/hardwaresolutions.asp for more information.

ISA Server 2004 with Small Business Server

Small Business Server 2003 comes in two versions: Standard Edition and Premium Edition. Only the Premium Edition includes ISA Server 2000, along with Microsoft SQL Server and Microsoft FrontPage 2003. Small Business Server 2003 Service Pack 1 includes the ability to upgrade to ISA Server 2004 Standard Edition.

For more information about this upgrade, see Chapter 20 , "Configuring ISA Server with Small Business Server 2003."

Scalability The most obvious drawback to using Small Business Server 2003 is the inability to expand beyond 75 clients without purchasing the Small Business Server 2003 Transition Pack. If your company will grow in the near future, you should consider moving to a more traditional Microsoft Windows 2000 or Microsoft Windows Server 2003 domain structure with a separate ISA Server installation.

For more information about Small Business Server 2003 licensing and the transition pack, see http://www.microsoft.com/WindowsServer2003/sbs/techinfo/overview/licensingfaq.mspx.

Hardware and Software Table 1-5 shows both the minimum and recommended requirements for Small Business Server 2003.

Table 1-5: System Requirements for Microsoft Small Business Server 2003 Premium Edition
Hardware | Minimum | Recommended | Maximum
Processor | 300 megahertz (MHz) | At least 550 MHz | Multiprocessor support for up to two processors (hyper-threading is supported)
Memory | 256 MB of RAM | 1 GB of RAM | 4 GB of RAM
Hard disk | 5 GB plus space for data storage | 6 GB plus space for data storage, though this size will vary based on your requirements | N/A
Network adapters | 1 | 1 or 2 depending on your topology | N/A
CD or DVD drive | Bootable CD or DVD drive | Same | N/A
Monitor and video adapter | Super VGA (SVGA) monitor Video adapter with 800 × 600 or higher resolution and a minimum of 256 colors | Same | N/A
SBS Service Pack Level | Service Pack 1 | The most current updates available for Small Business Server 2003 | N/A

Licensing To find the most current information regarding Small Business Server product licensing, visit the Microsoft Small Business Server Web site at http://www.microsoft.com/sbserver/howtobuy.

A basic Small Business Server license comes with five Client Access Licenses (CALs), which allow clients to connect to the SBS machine. You can add additional CALs by purchasing Client Add Packs, which are available in 5-user or 20-user increments.

Small Business Server 2003 allows an unlimited number of user accounts, but restricts the number of computer connections to 75.

For more information regarding using ISA Server with SBS, refer to Chapter 20.

ISA Server 2004 Standard Edition

Scalability ISA Server 2004 Standard Edition has a greater ability to scale than Small Business Server (which includes the Standard Edition of ISA Server) only because its connections are not limited to 75 computer connections. Standard Edition cannot take advantage of server arrays or enterprise policies. If your company plans to use server arrays or enterprise policies in the future, you must have the Active Directory directory service known as Active Directory Application Mode (ADAM) and use ISA Server Enterprise Edition. If your organization plans to grow to accommodate a large number of users who are located in different facilities, or a number of users who might overwhelm the server, you should consider using ISA Server Enterprise Edition, which also supports NLB.

Hardware and Software See Table 1-6 for the ISA Server 2004 Standard Edition requirements.

Table 1-6: System Requirements for ISA Server 2004 Standard Edition

Requirement

Minimum

Recommended

Processor

Pentium II 550 MHz computer

Pentium III 1Ghz or higher

Operating system

Windows 2000 Server with:

  • Service Pack 4

  • Internet Explorer 6

  • Hotfix in Knowledge

  • Base 821887

Windows Server 2003 with all updates applied

RAM

256 MB

512 MB or higher; increasing RAM increases cache response

Disk space

Local NTFS partition with at least 150 MB of free space

Dedicated partition for ISA Server files, and another partition to hold log files to ensure that logging does not affect disk space needed for the system and program files

Network interface card (NIC)

At least one for caching functionality, plus an additional NIC for each additional network

Same

Licensing ISA Server 2004 Standard Edition is licensed per processor. For each processor that the product utilizes, you will need to purchase one license. Contact an ISA Server reseller to determine your price, which will vary based on your situation.

See http://www.microsoft.com/isaserver/howtobuy for more information.

ISA Server 2004 Enterprise Edition

ISA Server 2004 Enterprise Edition provides the same functionality as Standard Edition, but adds features that improve the management and redundancy of your ISA Server environment.

Scalability If you have a large or widely distributed organization, cost savings result from being able to centrally manage multiple ISA servers (grouped in what are known as arrays) from a single management console. These servers can provide high availablility by allowing new sessions from clients that were connected to failed array members. In addition, all servers can be governed by a single enterprise policy, which in ISA Server 2004 is stored in ADAM. Consider the amount of time it would take one administrator to configure 25 different servers with the same access policy. With enterprise and array policies, one administrator can configure all 25 servers with the same policy using a central management console.

By default, the Domain Admins group of the forest root domain and any members of the Enterprise Admins group have the ability to manage enterprise policies. They, in turn, assign permissions to manage array policies.

Enterprise and array policies provide consistent administration for managing ISA servers across one's entire organization. They provide the highest level of control, overriding all array policies, except for enterprise system policies. Enterprise policies are stored in a central database known as the Configuration Storage Server (CSS), which relies on ADAM; these policies can apply across the entire forest. Enterprise policies provide the base level of access available to an array. An array policy can further restrict access to items from the enterprise policy baseline.

For more information about ADAM, see the reference material at http://www.microsoft.com/windowsserver2003/adam.

ISA Server Enterprise Edition also provides the ability to spread the work of protecting your environment across several different ISA servers using NLB. For more information on NLB, see Chapter 15 , "Working with Enterprise Technologies and ISA Server 2004."

Hardware and Software The hardware requirements for ISA Server 2004 Enterprise Edition are the same as those for the Standard Edition listed earlier, with just a few important distinctions, as shown in Table 1-7.

Table 1-7: System Requirements for Microsoft ISA Server 2004 Enterprise Edition
Requirement | Minimum | Recommended
Processor | Pentium II 550 MHz computer | Pentium III 1 Ghz or higher
Operating system | Windows Server 2003 | Windows Server 2003 with all updates applied
RAM | 256 MB | 512 MB or higher; increasing RAM increases cache response
Disk space | Local NTFS partition with at least 150 MB of free space | Dedicated partition for ISA Server files, and another partition to hold log files to ensure that logging does not affect disk space on the program files
NIC | At least one for caching functionality, plus an additional NIC for each additional network | Same

Licensing ISA Server 2004 Enterprise Edition requires a license for each processor in use. For that reason, it might be more cost-effective to upgrade existing processors to higher speed processors, rather than adding additional processors to multiprocessor-capable systems. Contact an ISA Server reseller to determine your price, which will vary based on your situation. See http://www.microsoft.com/isaserver/howtobuy for more information.

Note

Hyperthreaded processors, in which a single processor appears as two, require only one license. Dual core processors also will require only one license.


ISA Server Tools and Utilities

Many tools and utilities are available to you in ISA Server 2004. We start with the most commonly used tool, the ISA Server Management console, describe some of the wizards available, and then refer you to Microsoft Partner tools and third-party Web sites that provide a wide range of tools that can help extend the functionality of ISA Server.

See Chapter 12 , "Scripting with Microsoft ISA Server 2004," for information about how to use scripts to automate and extend ISA Server's functionality.

The ISA Server 2004 Management Console

This section describes the different components of the new ISA Server Management console UI.

Tip

When you are administering ISA Server using the ISA Management console, pressing the F1 key will bring up information from the ISA help file about the area that you are currently using. For example, if you are working with Networks under the Configuration node and press F1, the ISA help file will open to the multinetworking overview section. Be sure to refer to the "Additional Resources" appendix at the end of this book for more helpful information.

You manage ISA Server using the ISA Server Management console, which has been greatly improved over the management console from ISA Server 2000. A comparison of the ISA Server 2000 Management console and the ISA Server 2004 Management console is shown in Figure 1-2 (ISA Server 2000 Standard Edition) and Figure 1-3 (ISA Server 2004 Standard Edition).

Image from book
Figure 1-2: The ISA Server 2000 Management console is very basic compared to the rich features in the ISA Server 2004 Management console.
Image from book
Figure 1-3: Tabbed pages in the ISA Server 2004 Management console make accessing common tasks simpler.

You can access the ISA Server Management console by clicking Start, choosing All Programs, Microsoft ISA Server, and then clicking the ISA Server Management icon.

Note

The key improvements to the ISA Server 2004 Management console include a three-pane window, tabbed pages in the content view, and an all new task/help pane for single-click access to the most common tasks.

The ISA Server 2004 Management console has three panes: console tree (left pane), the details pane (middle pane), and the task pane (right pane), as shown in Figure 1-3. ISA Server 2004 Enterprise Edition has the same basic components as ISA Server 2004 Standard Edition with several additional features, which we describe later.

The console tree (left pane) shows all the different components of ISA Server. The details pane (middle pane) shows content, such as the Welcome information displayed in Figure 1-3. The task pane (right pane) contains prescriptive and descriptive information about the tasks on which you're working. For example, on the first screen you can click Connect To Local Or Remote ISA Server, Open The Microsoft Internet Security And Acceleration Server 2004 Online Help, or Read About Securing Your ISA Server. Tabs at the top of this section allow you to switch between functions, such as changing from the Tasks list to the Help information.

When you select the ISA server itself, you will see a Getting Started Guide for that server in the content pane, which steps you through the basics of configuring your ISA Server. Follow these steps to set up the most common configuration of ISA Server.

The task pane (right pane)—as shown in Figure 1-3—has several actions that are described in Table 1-8.

Table 1-8: ISA Server Tasks
Task | Application
Define Administrative Roles | Use this wizard to configure roles for users who need to perform ISA Server tasks.
Disconnect Selected Server From Management Console | Use this task to disconnect from your local or remote ISA server.
Backup This ISA Server Configuration | Use this task to back up your ISA server configuration to an .xml file.
Restore This ISA Server Configuration | Use this task to restore your ISA server configuration from a previous backup (.xml file).
Export ISA Server Configuration To A File and Import From An Exported ISA Server Configuration File | The import and export functions of ISA Server are used to clone the configuration settings from one ISA server to another. This provides more granular options than backing up and restoring a file. For example, you can choose Export User Permission Settings or Export Confidential Information.

To view the other components of the ISA Server Management console, click the plus sign (+) to the left of the ISA server you're using (in our case, the ISA server's name is ISA2004-SE). You will then see the other areas: Monitoring, Firewall Policy, Virtual Private Networks (VPN), and Configuration.

Monitoring

The Monitoring node now incorporates a dashboard for enhanced system monitoring. When you select the Monitoring node in the console tree (left pane), you have seven (or eight with Enterprise Edition) tabbed pages in the details pane (middle). See Table 1-9 for a description of each page.

Table 1-9: Monitoring Mode Page Descriptions
Page | Description
Dashboard | High-level overview of the overall health of the ISA server
Alerts | Displays alerts based on your configuration of the server
Sessions | Shows the sessions currently connected to the ISA server
Services | Shows the services running and their states
Reports | Allows you to manage and view reports
Connectivity | Shows the connection between the local ISA server and other ISA servers
Logging | Allows you to create, view, and filter queries
Configuring (ISA Enterprise Edition only) | Provides the ability to view the configuration version of all members of an array

Firewall Policy

The Firewall Policy node is where you will spend the majority of your time administering ISA Server. The firewall policy consists of access rules, server publishing and Web publishing rules, and system policies.

Virtual Private Networks (VPN)

VPN functionality has been extended in ISA Server 2004. The Microsoft ISA Server team went to great lengths to ensure that ISA Server administrators would be able to easily manage branch offices through the Virtual Private Networks (VPN) node. When you select the console tree, two tabbed pages appear in the details pane, as described in Table 1-10.

Table 1-10: PN Tab Descriptions
Tab Name | Description
VPN Clients | This view takes you through the five-stage process of configuring a VPN.
Remote Sites | To allow different sites to communicate over what is known as a VPN Site-to-Site connection you must configure a remote site network, which can be created here. For more information, see Chapter 11, "Securing Virtual Private Network Access."

Configuration

The Configuration node has four subnodes, as described in Table 1-11.

Table 1-11: Configuration Node Descriptions
Subnode Name | Description
Networks | Here you define the networks in your organization using IP address ranges and define the communication between those networks.
Cache | This section allows you configure the cache, which speeds up access to Internet or intranet content by storing it on the hard disk of the local ISA server.
Add-Ins | Here you configure the application and Web filters that allow secure communications with applications, such as HTTP, FTP, and DNS.
General | This section is a collection of other administrative activities, including configuring intrusion detection, firewall clients, client settings, and delegation of administration.

ISA Server Wizards

ISA Server 2004 includes several wizards that help automate tasks in a way that makes it easier to configure while using the most secure methods. Table 1-12 describes several of the more common wizards you will use.

Table 1-12: Commonly Used ISA Server Wizards
Wizard Name | Description
ISA Server Administration Delegation Wizard | Use this wizard to configure roles for users who need to perform ISA Server tasks.
New Network Wizard | This wizard allows you to create new networks, and can be accessed through the Networks node.
New Access Rule Wizard | Accessed through the tasks pane in the Firewall Policy node, this wizard steps you through the process of creating a new access rule.
New Web Publishing Rule Wizard | Access this wizard from the Firewall Policy node, and click Publish A Web Server to launch it.
SSL Web Publishing Rule Wizard | Access this wizard from the Firewall Policy node, and click Publish A Secure Web Server to launch it.
New Mail Server Web Publishing Rule Wizard | Access this wizard from the Firewall Policy node, and click Publish A Mail Server to launch it.
New Server Publishing Rule Wizard | Access this wizard from the Firewall Policy node, and click Create A New Server Publishing Rule to launch it.
New Cache Rule Wizard | Access this wizard from the Cache node, and click Create A Cache Rule on the Cache Rules tab.

Tools

ISA Server 2004 provides additional tools to assist with your day-to-day administration and troubleshooting efforts. Table 1-13 summarizes the tools that you will use most often.

Table 1-13: Useful ISA Tools and Resources
Tool or Resource Name | Description
Firewall Client Tool | Fwctoolpack.exe; tool to configure, manage, and trouble-shoot the ISA Server firewall client.
Firewall Kernel Mode Tool Firewall Engine Monitor | Fwengmon.exe; tool you can use to analyze and troubleshoot firewall connectivity issues by monitoring the ISA Server kernel-mode driver.
Remote Access Quarantine | Rqsutils.exe; tool to prepare an ISA server running on Windows Server 2003 as a Remote Access Quarantine Agent (RQS) listener component.
Frédéric Esnouf's Quarantine Security Suite (QSS) | Esnouf's QSS provides enhanced quarantine functionality to not only keep threatening machines from connecting to the corporate network, but also update the VPN client and allow it access to the network when it is deemed safe. This tool is free for up to five connections. See http://fesnouf.online.fr/qss_main.htm for more information.
Jim Harrison's scripts | See http://www.ISATools.org for more information.
Microsoft ISA Server Partner Site | See http://www.microsoft.com/isaserver/partners for more information.
Microsoft ISA Server Guidance | See http://www.microsoft.com/isaserver/techinfo/guidance/2004.asp for more information.

You also need to be familiar with Windows Server tools to configure ISA Server properly. See the Windows Help file for more information about tools like IP and Interface Configuration, Security Configuration, Netsh.exe, and Route.exe.

Extending ISA Server

There are many products created that help to extend ISA Server's functionality. For instance, software is available for handling intrusion detection, providing access control, monitoring traffic and events, reporting on logged content, and maintaining high availability (load balancing). For a complete listing of the add-ons for ISA Server, visit http://www.microsoft.com/isaserver/partners.

You can also use the ISA Server 2004 Software Development Kit (SDK) to create custom solutions. See http://msdn.microsoft.com/library/en-us/isasdk/isa/internet_security_and_acceleration_server_start_page.asp or download the SDK from http://www.microsoft.com/technet/downloads/isasrvr.mspx.


Administering ISA Server Remotely

There are several ways to administer ISA Server remotely. The following methods are the most commonly used:

  • ISA Management console

  • Terminal Services

  • Remote control applications

ISA Management Console

The Microsoft Management Console (MMC) is the framework that allows snap-ins to be used and configured. Snap-ins, such as the ISA Management console, provide a graphical user interface (GUI) for performing day-to-day administrative tasks. Nearly all of the administration performed in ISA Server is done within the ISA Management console.

Terminal Services

Windows 2000 Server and Windows Server 2003 include Terminal Services, a component that you can install during the installation of the operating system, as well as from the Add/Remove Programs utility in Control Panel.

In Windows 2000 Server, when installing Terminal Services, you can deploy it in one of two modes: application or remote administration. Windows Server 2003 has a mode called Remote Desktop that is already installed, and is like Terminal Services in administration mode.

Application mode is appropriate if you will be installing applications on the Terminal Server and configuring the server to provide server-based computing. Using application mode, you're required to license the terminal service clients that will be connecting to the Terminal Server. The appropriate mode for Terminal Services on an ISA server is remote administration mode. Remote administration mode doesn't require the purchase of Terminal Services client licenses, and it allows for two concurrent connections to the Terminal Server. Considering the main purpose of remote administration mode is remote administration, two concurrent connections are appropriate. Additionally, only members of the Administrators group can connect to the Terminal Server in remote administration mode. In Windows Server 2003, you can control who has access to connect to Remote Desktop.

For more information, see the Windows Help documentation.

Remote Control Applications

A variety of other tools on the market allow you to perform administration from a remote computer. Some products are freeware, whereas others cost hundreds of dollars. The following are three cost-effective remote administration tools that you can use to administer ISA Server when choosing not to use Terminal Services or the ISA Management console.

  • Microsoft NetMeeting This is Microsoft's collaboration utility for whiteboarding, video conferencing, and desktop sharing. It ships with Windows 2000 and is a very handy, integrated solution for remote desktop connectivity. An administrator must configure the Remote Desktop Sharing service, which requires a reboot of the server. NetMeeting 3.0 ships with the operating system but can be downloaded separately from http://www.microsoft.com/netmeeting/.

  • Virtual Network Computing (VNC) VNC is a remote display system that allows connectivity from almost anywhere. This product is freeware and can be downloaded from http://www.realvnc.com/.

  • PCAnywhere This Symantec product has been around for many years. The product is a very stable remote control application and has a rich feature set, but is more costly than the other options listed here. See http://www.symantec.com/pcanywhere for more information.


ISA Server Community

Many Web sites are dedicated to the product and help make the day-to-day administration of ISA Server simpler.

Refer to the following Web sites for a rich set of detailed information and tools:

  • Microsoft's ISA Server home page at http://www.microsoft.com/isaserver.

  • ISA Server Firewall and Cache Resource site at http://www.isaserver.org.

  • Jim Harrison's ISA Server Tools Repository at http://www.isatools.org.

  • Microsoft's TechNet Support site at http://www.microsoft.com/technet.

  • Microsoft's MSDN site at http://msdn.microsoft.com/security/productinfo/isa.

  • ISA Server Newsgroups at http://www.microsoft.com/isaserver/community/newsgroups.

  • French-Language ISA Server and Security Web site at http://www.IsaServerFR.org.

  • German-Language ISA Server and Security Web site at http://www.msisafaq.de.


Chapter 2: Installing and Configuring Microsoft ISA Server 2004 Standard Edition

This chapter explains how to install and configure Microsoft ISA Server 2004 Standard Edition. Chapter 3, "Installing and Configuring Microsoft ISA Server Enterprise Edition," covers procedures unique to installing and configuring ISA Server 2004 Enterprise Edition. If you are upgrading from Microsoft ISA Server 2000, be sure to consult Chapter 5, "Upgrading from Microsoft ISA Server 2000." For information about installing ISA Server with Microsoft Small Business Server, see Chapter 20, "Configuring Microsoft ISA Server with Microsoft Small Business Server 2003." We also discuss in more detail how to install and configure optional components such as the Firewall Client Installation Share and the Message Screener.

Before You Begin

Before starting your installation, ensure that the ISA Server computer meets the prerequisites described in Chapter 1, "Overview of Microsoft ISA Server 2004 Administration," in addition to the following requirements:

  • Critical updates Be certain you install all critical updates for the computer on which you will install ISA Server 2004. On a Microsoft Windows Server 2000 computer, you must have Service Pack 4 or later and be running Microsoft Internet Explorer 6.0 or higher, and install the hotfix described in the Microsoft Knowledge Base article 821887.

  • Network adapters If you wish to use the firewall features of ISA Server, you need at least two network adapters, or a network adapter and a dial-up connection. If you wish to use only Internet content caching, one network adapter will suffice.

  • TCP/IP settings Ensure that your internal network adapters' Transmission Control Protocol/Internet Protocol (TCP/IP) settings are set to static addresses. To check the configuration, access your Network Settings, right-click the network interface, choose Properties, select Internet Protocol (TCP/IP), click Properties, and ensure that the IP address is not set to Automatically Obtain An IP Address.

  • Modem or ISDN adapter If you are using a dial-up connection to communicate with another network, you need to ensure that you first configure the dialup connection in Windows, and then configure ISA Server to use it.

  • Windows routing table Because ISA Server should not have a default gateway for the internal network adapters, ensure that the ISA Server's routing table provides paths to all computers with which it must communicate. You need to specify the default gateway for your external network adapter.

  • Secure your server Be sure to read the directions contained in the ISA Server 2004 Security Hardening Guide documentation, located at http://go.microsoft.com/fwlink/?LinkID=24507. This information will help guide you in placing your ISA server in the most secure environment possible.

  • Services When ISA Server 2004 installs, Internet Connection Sharing (ICS), Internet Connection Firewall (ICF), and IP NAT are disabled. The installation process stops the following services (if they are already installed and started) during the install:

    • Simple Network Management Protocol (SNMP) service

    • FTP Publishing service

    • Network News Transfer Protocol (NNTP)

    • Internet Information Services (IIS) Admin service

    • World Wide Web Publishing service

  • Message Screener If you will be using the Message Screener, which allows you to filter Simple Mail Transfer Protocol (SMTP) e-mails, you will need to install the IIS SMTP service prior to installing ISA Server 2004. You can install the Message Screener on another machine that is running SMTP after installing ISA Server.

    Note

    You should ensure that, if the ISA server is going to be your perimeter firewall, you do not connect the internal network adapter to the Internet, which prevents it from functioning as a firewall and opens it to compromise by attackers, worms, malware, and/or viruses.


Where Not to Install ISA Server

Unless you're using ISA Server as just a Web proxy and caching server, don't install any other services or applications on the ISA Server computer. By installing additional applications on your server, you will increase the attack surface, which reduces the security of your environment. Avoid running ISA Server on domain controllers or other existing server configurations whenever possible.

There are some exceptions to this rule. One notable exception is Microsoft Small Business Server, in which ISA Server—along with all the other services and applications—must be installed on the same computer. For more information about how to ensure the most secure Small Business Server configuration possible, see Chapter 20. In any case, adhere to the following guidelines when choosing where to install your ISA server:

  • Place ISA Server on a dedicated computer—if you must run other services or applications on the server, limit the number of them, and use accounts that have limited rights to run these services.

  • If you are using ISA Server as a front-end firewall, you should install it in a workgroup or separate domain, as you will create an additional layer of security—this way, if attackers compromise your ISA server, they will not immediately have access to your domain.


Installing ISA Server 2004 Standard Edition

Before installing ISA Server 2004, familiarize yourself by reading the Release Notes and Getting Started Guide located on the installation media.

  1. Insert the ISA Server 2004 CD and click Install ISA Server 2004 on the Microsoft ISA Server 2004 Setup page shown in Figure 2-1.

    Note

    If Autorun is disabled, double-click the file Isaautorun.exe to launch the ISA Server 2004 Setup program.

  2. On the Welcome To The Installation Wizard For Microsoft ISA Server 2004 page, click Next.

  3. On the License Agreement page, read the End User License Agreement (EULA), select I Accept The Terms In The License Agreement, and then click Next.

  4. On the Customer Information page, enter your name and the name of your organization in the User Name and Organization fields. Enter your serial number in the Product Serial Number field, and click Next.

  5. On the Setup Type page, select Typical. (See Table 2-1 for a description of the other available options.) Click Change if you would like to change the location of the program files on the hard disk, and click Next.

    Note

    The ISA Server 2004 software is installed on the C drive by default.

  6. On the Internal Network page, click Add.

  7. Specify the address ranges for your internal network. You can add the addresses manually or click Select Network Adapter, where you can choose to define the internal network addresses based on private network addresses or your Windows Routing Table as illustrated in Figure 2-2. After making your selection, click OK.

  8. Click OK in the dialog box informing you that the internal network was defined, based on the Windows Routing Table.

  9. Click OK in the Internal Network Address Ranges dialog box.

  10. Click Next on the Internal Network page.

  11. On the Firewall Client Connection Settings page, click Next.

    Note

    If you are running ISA Server 2000, and have ISA Server 2000 firewall clients installed, you might need to select the Allow Computers Running Earlier Versions Of Firewall Client Software To Connect check box. This option allows you to continue using the ISA Server 2000 firewall client software as you migrate to ISA Server 2004. You should discontinue allowing backward compatibility once you have upgraded, as the ISA Server 2004 firewall client allows for encrypted communications.

  12. On the Services page, the SNMP Service and IIS Admin Service are stopped during installation. Click Next to continue.

  13. On the Ready To Install The Program page, click Install.

  14. On the Installation Wizard Completed page, select the Invoke ISA Server Management When The Wizard Closes check box, and click Finish.

  15. When the ISA Server Management console is opened for the first time, a Protect The ISA Server Computer Web page might remind you to secure your ISA server. If this appears, read it, and then close the page.

  16. If the Microsoft ISA Server dialog box informs you that you must restart the server, click Yes.

Image from book
Figure 2-1: The setup splash screen contains useful links to explore in addition to the link to start your ISA Server installation.
Table 2-1: ISA Server 2004 Setup Types
Setup Option | Description
Full Installation | All components are installed.
Typical Installation | All components except SMTP Message Screener and Firewall Client Share are installed.
Custom Installation | You can select which components to install.
Image from book
Figure 2-2: You have flexibility in how you define your internal network addresses in ISA Server 2004.
Note

You must install the SMTP service on the ISA Server 2004 firewall computer before you install the Message Screener.

Installing the Firewall Client Installation Share and Message Screener

To install the Firewall Client Installation Share or the Message Screener on your ISA server, follow these instructions:

  1. On Microsoft Windows Server 2003 computers, click Start, click Control Panel, and then double-click Add Or Remove Programs.

  2. Click Microsoft ISA Server 2004, and then click Change/Remove. On Windows 2000 computers, click Change.

  3. On the Welcome page, click Next.

  4. On the Program Maintenance page, select Modify, and then click Next.

  5. On the Custom Setup page, under Click On An Icon In The List Below, choose the options you wish to install:

    1. Firewall Client Installation Option: To create a shared folder containing all files necessary to install the Firewall Client software, in the Firewall Client Installation Share drop-down list, click This Feature Will Be Installed On A Local Hard Drive.

      Note

      If not installed during the initial installation, the Firewall Client Share can be added after the installation without modifying your existing ISA configuration.

    2. Message Screener: To screen e-mail messages as they come into your internal network, in the Message Screener drop-down list, click This Feature Will Be Installed On A Local Hard Drive. You must install SMTP on the machine prior to installing this option. This option can be installed not only on an ISA Server 2004 machine, but also on a computer that is running IIS 5.0 or IIS 6.0, or a server that is running Microsoft Exchange.

    For more information about how to install and configure the ISA Server 2004 Message Screener, see Microsoft Knowledge Base article 838246, "How to Install the ISA Server 2004 Message Screener on a Remote Computer" at http://support.microsoft.com/?id=838246.

  6. Click Next. Then, click Install to begin the installation.

  7. When the installation has finished, Click Finish.


Installing ISA Server 2004 Standard Edition with a Single Network Adapter

The installation procedures for installing ISA Server 2004 with a single network adapter are identical to the steps outlined for installing ISA Server 2004 Standard Edition, except for the following steps:

  • On the Custom Setup page, choose not to install the Firewall Client Share, because a single NIC configuration does not support firewall or SecureNAT clients.

  • When specifying the internal network addresses during the setup, include all of your address ranges except for 0.0.0.0, 255.255.255.255, and the address range from 127.0.0.0 to 127.255.255.255.

    Note

    With only a single network adapter, all your address ranges constitute the internal network.

  • After the installation has completed, open the ISA Management console and apply the Single Network Adapter network template.

    For more information about network templates, see Chapter 9 , "Configuring Multinetworking."

  • On the Internal Network page, choose to add only those network addresses that are defined by the Windows Routing Table by selecting the single network adapter. To keep the attack surface smaller, clear the Add The Following Private Ranges check box.

Functionality Available with ISA Server Configured with a Single Network Adapter

ISA Server 2000 had an installation mode known as Caching-Only Mode, which hearkens back to ISA Server's genesis as a pure proxy server in the Proxy 2.0 product. ISA Server 2004 doesn't have a built-in caching-only mode, but does support a single network adapter configuration. The scenario of a single network adapter is useful when you want to provide only Web caching services, but not if you want to use the firewall and VPN functionality. Although ISA Server 2004 supports this configuration, you should be aware that it limits the product's functionality; the following components are not available when ISA Server is installed with a single network adapter:

  • All forms of virtual private networking (VPNs)

  • Firewall or SecureNAT clients

  • Multinetwork firewall policy

  • IP packet filtering (it is available only for the ISA Server's Local Host network)

  • Server publishing (Web publishing is available)

  • Application-level filtering (excluding application-level filtering for HTTP)

  • Any protocol except for FTP, HTTP, and HTTPS


Patching ISA Server 2004 Standard Edition

ISA Server, like any product, will have updates and patches made available as the product matures. To ensure the security of your product, you should test and then apply these patches as they become available. Follow these general steps to apply updates:

  1. Check the Microsoft ISA Server Download site at http://www.microsoft.com/isaserver/downloads/2004.asp.

  2. Download the patches and read the documentation that is made available with the download.

  3. Before you patch the server, ensure that you follow the appropriate process to inform users, or provide alternative access to required networks.

  4. If the patch will stop firewall functionality, physically disconnect the ISA server from untrusted networks.

  5. Apply the patch according to the instructions.


Installing ISA Server 2004 Standard Edition Unattended

You can use the Microsoft ISA Server unattended configuration file that comes with ISA Server 2004 to automate its installation. At a high level, there are two steps to automate the installation of ISA Server:

  1. Configure the Msisaund.ini configuration file.

  2. Run the unattended installation from the command line.

Follow these steps to conduct an unattended installation:

  1. From the ISA Server 2004 CD, open the Fpc folder to locate the Msisaund.ini file.

  2. Copy the Msisaund.ini file to your computer, and then modify it to reflect your settings. Remove the semicolon before the entry you wish to customize, and configure the value. See Table 2-2 for more information on the settings that you can configure.

    Note

    If you do not specify a value, Setup uses the default value.

  3. At a command prompt, or within a script, run Setup in Quiet Mode and specify the following path to the Msisaund.ini file:

    "PathToISASetup\FPC\setup.exe" /v /
Qb FULLPATHANSWERFILE="\PathToCutomizedMsIsaUnd\MsIsaUnd.ini\"
Table 2-2: Unattended Installation Options in the Microsoft ISA Unattended Installation Configuration File (Msisaund.ini)

Entry

Description

PIDKEY

Specifies the product key. This is the 25-digit number located on the back of the ISA Server CD case.

SUPPORT_EARLIER_CLIENTS = {0|1}

If set to 1, allows firewall clients running earlier versions of the Firewall Client software to connect to ISA Server.

INTERNALNETRANGES

Specifies the range of addresses in the internal network. Msisaund.ini must specify at least one IP address. Otherwise, Setup fails. The syntax is:

  • N From1-To1,From2-To2,… FromN-ToN, where N is the number of ranges, and FromI to ToI are the starting and ending addresses in each range.

INSTALLDIR={install_directory}

Specifies the installation directory for ISA Server. If not specified, it defaults to the first disk drive with enough space. The syntax is:

  • Drive:\Folder

The default folder is:

  • %Program Files%\Microsoft ISA Server

COMPANYNAME=Company_Name

Specifies the name of the company installing the product.

DONOTDELLOGS = {0|1}

If set to 1, log files on the computer are not deleted. The default is 0.

DONOTDELCACHE = {0|1}

If set to 1, cache files on the computer are not deleted. The default is 0.

ADDLOCAL= {MSFirewall_Management}, {MSFirewall_Services}, {Message_Screener}, {Publish_Share_Directory}, {MSDE}

Specifies a list of components (delimited by commas) that should be installed on the computer. To install all the components, set ADDLOCAL=ALL.

REMOVE={MSFirewall_Management}, {MSFirewall_Services}, {Message_Screener}, {Publish_Share_Directory}, {MSDE}

Specifies a list of components (delimited by commas) that should be removed from the computer. To remove all the components, set REMOVE=ALL.

IMPORT_CONFIG_FILE ={Config_file_path}

Specifies a configuration file to import.

For example, if you were installing ISA Server 2004 Standard Edition from a CD in the D drive, and had customized the unattended configuration file and saved it to the C drive, your command line would look like this:

"D:\FPC\setup.exe" /v /Qb FULLPATHANSWERFILE="\C:\MsIsaUnd.ini\"

ISA Server Setup Command-Line Parameters

You can perform both an installation and uninstall using the ISA Server command-line tool as shown here:

PathToISASetup\Setup.exe [/[X|R]] /V" /
q[b|n] FULLPATHANSWERFILE=\"PathToINIFile\MSISAUND.INI\""

See the parameters in the following list:

  • PathToISASetup: The path to the ISA Server 2004 installation files. The path can be the root folder of the ISA Server CD or a shared folder on your network that contains the ISA Server files.

  • /Q [b|n]: Performs quiet unattended setup. If you specify b, a progress bar indicates the setup process. If you specify n, no dialog boxes are displayed.

  • /R: Performs unattended reinstallation.

  • /X: Performs unattended uninstallation.

  • /V: Passes parameters to the MsiExec (Windows Installer) service

  • PathToINIFile: The path to the folder containing the unattended installation information.

Troubleshooting Setup

Be aware of the following conditions and issues to avoid anPd overcome setup issues:

  • Run Setup on the server with either a local or domain administrator account. You can use a secondary logon (RunAs) to perform an installation.

  • You can't conduct an unattended installation on a computer with ISA Server 2000 already installed.

  • The INTERNALNETRANGES property in Msisaund.ini must specify at least one IP address range that includes one of the IP addresses of your ISA Server computer or your setup will fail.

  • Notice that there is a backslash before the path to the Msisaund.ini file in the command line. Be sure to provide the leading and trailing backslashes, and use quotation marks, or your installation will probably fail.

  • Microsoft SQL Server Desktop Engine (MSDE) will not install correctly if you are logged on with Terminal Services in Application mode. You can use a Terminal Services session in Administration mode (in Windows 2000) or Remote Desktop (in Windows Server 2003) and execute the command, or use Sysinternals's PSExec.exe tool, available from http://www.sysinternals.com.


Uninstalling ISA Server 2004 Standard Edition

ISA Server 2004 Standard Edition can be removed through Add or Remove Programs in Control Panel or by using the installation media.

  1. Click Start, select Control Panel, and click Change Or Remove Programs.

  2. Click Change/Remove for Microsoft ISA Server 2004 as shown in Figure 2-3.

  3. On the Welcome To The Installation Wizard For Microsoft ISA Server 2004 page, click Next.

  4. On the Program Maintenance page, select Remove, and then click Next.

  5. On the Generated Files Removal page, specify whether to leave the ISA log files or cache files by selecting the appropriate check boxes, and click Next.

  6. On the Remove The Program page, click Remove.

  7. On the Installation Wizard Completed page, click Finish.

Image from book
Figure 2-3: The Change/Remove option for ISA Server 2004 in the Add/Remove Programs interface.


Installing ISA Server Administration Tools

To manage ISA Server 2004, you might wish to install the ISA Server Administration Tools on your laptop or desktop.

Caution

You cannot install the ISA Server 2004 Administration Tools on a computer that is also running the ISA Server 2000 Administration Tools. When the ISA Server 2004 installation takes place, it removes the ISA Server 2000 version. You cannot run the ISA Server 2000 and ISA Server 2004 Management consoles on the same machine at the same time.

Follow these steps to install the ISA Server Administration Tools:

Installing ISA Server Administration Tools on a workstation

  1. Connect to the ISA Server 2004 installation directory, and run Setup.exe from the Fpc folder or insert the ISA Server CD into the computer. After the Microsoft ISA Server Setup launches, click Install ISA Server 2004.

  2. On the Welcome To The Installation Wizard For Microsoft ISA Server 2004 page, click Next.

  3. On the License Agreement page, select I Accept The Terms In The License Agreement, and click Next.

  4. On the Customer Information page, enter your name and the name of your organization in the User Name and Organization fields. Enter your serial number in the Product Serial Number field, and click Next.

  5. On the Setup Type page, select Custom. (See Table 2-1 for a description of the other options available.) Click Change if you would like to change the location of the program files on the hard disk, and click Next.

    Note

    If you are installing the ISA Server Management console onto a workstation, you receive a message stating that only the Management tools can be installed. Click OK.

  6. Select only ISA Server Management, and then click Next.

  7. Review your settings, and then click Install.

  8. When the installation completes, click Finish.

Installing ISA Server Administration Tools on the ISA Server

You need to configure your ISA server's system policies so that your computer is allowed to perform remote management.

For more information on system policies, see the section " Know Your System Policies ," later in this chapter.

  1. From the ISA Server Management console on the server, click Firewall Policy, then on the Tasks tab, click Show System Policy Rules.

  2. Double-click the Allow Remote Management From Selected Computers Using MMC system policy, and ensure that the Enable check box is selected.

  3. Click the From tab, select Remote Management Computers, and then click Edit.

  4. In the Remote Management Computers Properties dialog box, click Add to choose to add your computer, a range of addresses, or an entire subnet.

    Note

    To reduce your attack surface, specify individual computers that have reserved IP addresses. If you travel or cannot reserve an IP address, you might need to add different subnets.

  5. Click OK to close the Rule Element dialog box, then click OK to close the Remote Management Computers Properties dialog box.

  6. At the ISA Server Management console, click Apply. Click OK again after the changes have been applied.

    Note

    You can also configure the ISA server to allow administration through a Terminal Services connection. To perform these steps, configure the machine to support a Remote Desktop connection (see Windows Server 2003 Help for instructions), and then follow the steps for configuring the Remote Management From Selected Computers Using MMC given earlier, but select the Allow Remote Management From Selected Computers Using Terminal Services system policy rule instead.

Connecting to Remote ISA Server Using ISA Management Console

You can manage more than one ISA server in a single console by using the Connect To Local Or Remote ISA Server task. To connect to a local ISA server or add a remote ISA server, follow these steps:

  1. Click Microsoft Internet Security And Acceleration Server 2004 in the left (content) pane, and then click Connect To Local Or Remote ISA Server in the right (tasks) pane.

  2. In the Connect To dialog box, you have the option to connect to the local computer or the remote computer. If connecting to the local computer, click OK. If connecting to the remote computer, click Another Computer (Remote Management); type the name of the remote ISA server or click Browse to search for the remote ISA server; specify the user credentials by using the credentials of the logged on user or typing the user name, password, and domain; and finally click OK.

The ISA server now appears in the left (content) pane.


Renaming an ISA Server 2004 Server

Renaming your ISA server is now a supported process, as follows:

  1. On the ISA Server 2004 computer, click Start, right-click My Computer, and then click Properties.

  2. In the System Properties dialog box, click the Computer Name tab.

  3. On the Computer Name tab, click Change.

  4. In the Computer Name Changes dialog box, enter the new name in the Computer Name field, and click OK.

  5. Click OK in the Computer Name Changes dialog box informing you that you must restart the computer before the changes take effect.

  6. In the System Properties dialog box, click OK.

  7. In the System Settings Change dialog box, click Yes to restart the computer.

Note

Be aware of other systems that may refer to the ISA Server name. For example, you may need to change the ISA Server name on manually configured firewall clients, or change the name of the ISA server in any scripts you created.


Joining an ISA Server to a Domain

The following steps define how to join a server running the Windows 2000 Server platform to a domain.

  1. On the ISA Server 2004 computer, click Start, right-click My Computer, and then click Properties.

  2. Click the Computer Name tab and click Change.

  3. Click Domain, type in your domain name, and click OK.

  4. When presented with an authentication dialog box, provide an account and password with Domain Admin privileges to join the server to the domain. You have to reboot the server to complete joining the domain.

For more detailed step-by-step explanations of server administration, check out the Microsoft Windows 2000 Administrator's Pocket Consultant or the Microsoft Windows Server 2003 Administrator's Pocket Consultant, both Microsoft Press books authored by William R. Stanek.


Troubleshooting ISA Server Installations

If you have issues when attempting to install ISA Server, refer to these resources.

See Chapter 5 , "Upgrading from Microsoft ISA Server 2000," for detailed information that you need to know to upgrade from ISA Server 2000 to ISA Server 2004.

Problems Installing ISA Server on a Domain Controller

First, it is not a good practice to have your ISA server on a domain controller. However, in some cases (most specifically one-server shops that use Small Business Server), it cannot be avoided. ISA Server can have some issues installing on a domain controller. One workaround is to demote the domain controller (first ensuring you have another domain controller in your environment), install ISA Server, and then promote the server to domain controller status again. Check to see that Authenticated Users is a member of the Pre-Windows 2000 Compatible Access Properties and the user installing ISA Server has permission to change the Network Configuration Operators local domain group.

Read through the instructions for demoting a domain controller located at http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/.mspx.

Examine the Setup Log Files

The ISA Server 2004 installation creates three log files by default, as shown in Table 2-3.

Table 2-3: ISA Server 2004 Installation Log Files Open table as spreadsheet
Log File | Description
%Windir%\Temp\ISAWRAP_number.log | The setup wrapper log file records general information about the success or failure of the firewall and MSDE installation.
%Windir%\Temp\ISAFWSV_number.log | The Firewall service setup log file records events and errors related to the configuration of the ISA Server 2004 firewall service.
%Windir%\Temp\ISAMSDE_number.log | The ISA Server 2004 database setup log file records events and errors related to MSDE.
Note

ISA Server 2004 uses the same log file (for example, ISAxxxx_number.log) for all installation attempts. However, every time you remove ISA Server 2004, two ISAWRAP_number.log files are created with different numbers.

To view these log files, follow these steps:

  1. In Windows Explorer, locate and open the %Windir%\Temp folder.

  2. In the %Windir%\Temp folder, locate any one of the following ISA 2004 Setup log files:

    • ISAWRAP_number.log

    • ISAFWSV_number.log

    • ISAMSDE_number.log

  3. Right-click ISAWRAP_number.log, and then select Open With.

  4. In the Open With dialog box, select Notepad, and then click OK.

  5. Repeat steps 3 and 4 to view the remaining log files.

If you can't connect to the Internet or to the ISA server, you need to configure your networks (see later in this chapter and Chapter 9) and your system policies (see the "Know Your System Policies" section later in this chapter) and set up firewall policies (see Chapter 8, "Configuring ISA Server Firewall Policy").


What to Expect After Installation

As part of Microsoft's Trustworthy Computing Initiative, ISA Server 2004 is secure by design, secure by default, and should be secure in deployment. Out of the box, you will not have connectivity to the Internet, but must take action to configure your ISA server to provide the connectivity that is appropriate for your environment.

Caution

Be aware that the default installation of ISA Server 2004 allows access to certain domains to help manage ISA Server through the Allowed Sites configuration group in the system policy. By default, the ISA Server computer can access the following domains:

  • *.microsoft.com

  • *.windows.com

  • *.windowsupdate.com

See Microsoft Knowledge Base article 867687 to learn more about the reasons behind this configuration and how to modify it.

Know Your System Policies

ISA Server 2004 introduces a new term: system policy. This policy is configured from within the Firewall Policy node, and defines how your ISA server (the computer system) behaves in relation to the rest of the network. For example, you will use system policies to allow remote administration of the ISA server from other computers on your network.

Tip

Many people familiar with ISA Server 2000 create firewall policies to enable the ISA server to communicate with other systems. Be sure to familiarize yourself with the system policies before creating any firewall policies.

Your ISA server will have system policies that allow certain types of internal traffic to your ISA server, and the network relationship between the internal network (all IP addresses that fall within the internal IP address range defined in the Networks node) and the external network (all IP address ranges that are not explicitly defined in the Networks node) is set to perform NAT on traffic, rather than to route it.

To view and configure system policies, follow these steps:

  1. In the ISA Server Management console, expand the ISA Server node, then click the Firewall Policy node. The Firewall Policy tab is displayed in the center pane.

  2. In the right pane, click the Tasks tab, then in the System Policy Tasks section click Show System Policy Rules. The system policies are then displayed in the center Firewall Policy pane as shown in Figure 2-4.

  3. Select the system policy you wish to manage by double-clicking it to activate the System Policy Editor, as shown in Figure 2-5. On the General tab, you can choose to enable the policy and certain features. There is also another tab—either To or From—that allows you to choose the destination or sources to which the policy applies.

Image from book
Figure 2-4: When you click Show System Policy Rules on the Tasks tab, system policies appear in the center Firewall Policy pane.
Image from book
Figure 2-5: The System Policy Editor allows you to configure system policies from a single interface.


Configuring ISA Server

To configure ISA Server, follow the steps on the Getting Started page that appears in the center pane when you've selected the ISA server in the left pane, as shown in Figure 2-6. We provide references to other chapters in this book that discuss those steps in detail.

Image from book
Figure 2-6: The Getting Started pane guides you through the options available for configuring ISA Server.

The first step is to assign administrative roles and configure the means by which you will administer your ISA Server environment. You can choose to install the ISA Server Remote Console (MMC), or you might decide to connect to the ISA server using Terminal Services. We describe the actions needed to configure all these scenarios later in this chapter. After you've completed preparing ISA Server for administration, you can then undertake these Getting Started activities:

  1. Configure your networks, as shown in Chapter 9.

  2. Create your firewall policy rules to allow internal machines to connect externally, or to allow external machines to gain access to selected internal resources, like Web servers. See Chapter 8 for more information.

  3. Define how you wish ISA Server to cache Web content, as described in the "Configuring the ISA Server Cache" section later in this chapter.

  4. Set up your VPN settings as described in Chapter 11, "Securing Virtual Private Network Access."

  5. Once you've implemented ISA Server, you can use the monitoring functions, which we cover in Chapter 9.

Assigning ISA Server Administrative Roles

ISA Server uses role-based administration, which can utilize Active Directory or Windows users and groups. Three roles are built into ISA Server 2004:

  • ISA Server Basic Monitoring This role allows users (or groups) to monitor, but not to configure, ISA Server components. For example, this role can view dashboard alerts, connectivity, sessions, and services, as well as acknowledge alerts.

  • ISA Server Extended Monitoring This role can perform all activities that the Basic Monitoring role can perform, with the addition of viewing log information, creating alert definitions, creating reports, stopping and starting sessions and services, and viewing firewall policy. This role also has the ability to import and export secret configuration information.

  • ISA Server Full Administrator This role can perform all activities of the Basic Monitoring and Extended Monitoring roles, but can also configure firewall policy, cache settings, and VPN settings.

To assign ISA Administrative roles, follow these steps:

  1. Open the ISA Server Management console, then click the ISA server you wish to configure.

  2. In the right pane, click the Tasks tab, then click Define Administrative Roles.

  3. The ISA Server Administration Delegation Wizard starts, which guides you through the process of defining administrative roles.

Configuring the ISA Server Cache

By default, the ISA Server Cache is disabled. You can enable caching, and then configure what type of content will be cached, for how long, and how your ISA server will serve the cached content to its clients.

Enabling and Disabling ISA Server Caching

To enable the caching functionality, follow these steps:

  1. Expand the ISA Server Management console for the ISA server you wish to configure, then expand the Configuration node so that the Cache node is visible, as shown in Figure 2-7.

  2. Right-click the Cache node and select Define Cache Drives, or click Define Cache Drives on the Tasks tab in the right pane.

  3. In the Define Cache Drives dialog box, select the local drive that will host the cache (you cannot configure a network drive to hold the cache), type in the amount of disk space you wish to devote to the cache using MB in the Maximum Cache Size (MB) field, and then click Set, as shown in Figure 2-8.

    Note

    The cache can only be hosted on an NTFS partition, and should not be on the same partition as your operating system files or database files, if possible. Having the cache on a different partition enhances performance and stability.

  4. Click OK, and then click Apply to commit the configuration.

  5. If prompted, choose whether to immediately restart ISA Server, and then click OK. Click OK again when the changes have been applied.

  6. If you ever wish to disable caching, click the Cache node, and then click Disable Caching on the Tasks tab. Click Yes when prompted, and then click Apply. Follow the prompts that appear. This action resets the cache drives to zero space allocated to caching.

Image from book
Figure 2-7: The ISA Server Cache node is located on the Configuration menu.
Image from book
Figure 2-8: Define the amount of space for your cache in megabytes.

Configuring the Cache Properties

The Cache Settings dialog box has two configurable tabs (unless you have not yet applied ISA Server Service Pack 1, in which case it shows three). Open the dialog box (see Figure 2-9) by right-clicking the Cache node in the ISA Server Management console and then selecting Properties, or by clicking Configure Cache Settings on the Tasks tab in the right pane.

Image from book
Figure 2-9: To configure the cache properties, use the Cache Settings dialog box.
Note

If you are using a pre—Service Pack 1 installation of ISA Server 2004 Standard Edition, you will see an additional tab, Active Caching. This setting was removed from the final version of ISA Server 2004 Standard Edition, but the tab remained, and was removed with Service Pack 1.

Table 2-4 describes the different cache properties for each of the tabs in the Cache Settings dialog box.

Table 2-4: Caching Configuration Properties
Tab | Option | Description
General | N/A | This tab displays the total cache size of all servers in the array.
Active Caching | Enable Active Caching | When checked, this option enables the most currently accessed content in the cache to be automatically updated during low-use periods on the server. This setting is a holdover from ISA Server 2000, and does not work in ISA Server 2004. When you apply Service Pack 1, this tab is removed.
Advanced | Cache Objects That Have An Unspecified Last Modification Time | Objects that don't have a header that contains dates and times usually aren't cached. This option allows such objects to be cached.
 | Cache Objects Even If They Do Not Have An HTTP Status Code Of 200 | ISA Server doesn't, by default, cache any content that doesn't have a success code of 200. Checking this option allows ISA Server to cache error messages (which have other status codes, such as 401 Access Denied).
 | Maximum Size Of URL Cached In Memory | This limits the size of the URL string that is cached in memory.
 | If Website Of Expired Object Cannot Be Reached | When an expired object's Web site can't be reached, you can choose to either return an error message or set parameters that allow you to return the expired content.
 | Percentage Of Free Memory To Use for Caching | Cache content is stored in RAM to improve performance. By default, 10 percent of the memory is allocated for this purpose. Increasing the amount of RAM here will increase performance to gain objects from the cache.

Configuring Cache Rules

Cache rules are new to ISA Server 2004, and allow you to determine the type of content that your cache will store from different locations (by means of network object), how long that content is kept, and how it is served to clients.

To configure a cache rule, follow these instructions:

  1. In the Server Management console, navigate to the Cache node in the Configuration node.

  2. Click the Cache Rules tab in the center pane, and then click Create A Cache Rule on the Tasks tab in the right pane. The Welcome To The New Cache Rule Wizard page appears. Type in a name for the cache rule as shown in Figure 2-10, and then click Next.

  3. On the Cache Rule Destination page, click Add, select the network entities from which you wish to cache content (see Figure 2-11), click Add, and—when you've added all the network entities—click Close. Click Next.

  4. On the Content Retrieval page, you select the way in which objects in the cache will be delivered to the requesting clients. The three available options are to retrieve the requested option from the cache under these conditions: if any "valid version" of the object is in the cache; if any version of the object exists in the cache (for example, past its time-to-live, and so on); or to retrieve objects only from the cache, and never go to the site directly. Choose the appropriate option, and then click Next.

  5. On the Cache Content page, you determine what content will be stored in the cache. You can choose to never store content, or to choose content based on headers in addition to three other options:

    • Dynamic Content Most Web search or query results are usually valid only for highly individualized queries and return a Uniform Resource Locator (URL) that contains a question mark. Selecting this check box allows such pages to be cached.

    • Content For Offline Browsing This option allows you to keep offline content (which is specified with 302 and 307 response codes) stored in the cache.

    • Content Requiring User Authentication For Retrieval This option allows information that requires authentication to be stored in the cache, which can be a security risk.

  6. On the Cache Advanced Configuration page, you can select whether to cache secure Web content (Cache SSL Responses) and to cache objects based on their size in kilobytes, megabytes, or gigabytes (Do Not Store Objects Larger Than…). Configure the options as desired, and then click Next.

  7. On the HTTP Caching page, select the Enable HTTP Caching check box to cache Web content, and then set the Time-To-Live (TTL) settings, which determine how long the content will be stored. Click Next.

  8. On the FTP Caching page, select the Enable FTP Caching check box to cache FTP objects, and then set the TTL in Seconds, Minutes, Hours, Days, or Weeks. Click Next.

  9. On the Completing The New Cache Rule Wizard page, review your selections, and click Finish to complete the creation of the rule.

  10. Click Apply to commit the cache rule to the ISA Server. Then, click OK.

    Tip

    To edit an existing cache rule, select the cache rule, and then in the Tasks tab of the right Cache pane, click Edit Selected Rule.
Image from book
Figure 2-10: Using a descriptive name on the Welcome To The New Cache Rule Wizard page helps you manage jobs.
Image from book
Figure 2-11: You can create new network entities, like Domain Name Sets, from within the Add Network Entities dialog box.

Scheduling Content Download Jobs

Content download jobs allow you to configure the ISA server to download certain Web content on a schedule, allowing you to manage your bandwidth by downloading large amounts of data when the network connections are not heavily utilized.

To configure content download jobs, follow these steps:

  1. In the ISA Server Management console, navigate to the Cache node in the Configuration node.

  2. Click the Content Download Jobs tab in the center pane, and then in the Tasks tab in the right pane, click Schedule A Content Download Job. The New Content Download Job Wizard starts.

    Note

    If an Enable Schedule Content Download Jobs dialog box appears, click Yes, then click Apply and click OK to commit the changes. Configuring the content download jobs option has three prerequisites: that the Local Host network listens for Web Proxy client requests, the system policy rules are configured to allow content download, and the ISA Server Job Scheduler service is running. When you create the first scheduled download job, click Yes at the prompt for ISA Server to configure all these prerequisites for you.

  3. On the Welcome To The Content Download Job Wizard page, type the name of the new content download job, and then click Next.

  4. On the Download Frequency page, select whether you wish the job to run once after the job is defined or on a schedule, or whether you will have it run on a daily or weekly basis. Click Next. If you've chosen to schedule the download job, specify the time for the job to run, then click Next.

  5. On the Content Download page, configure the URL from which the ISA server will download content, as shown in Figure 2-12. If you do not wish to download content from outside the domain (for example, if you are downloading from www.contoso.com, and the page contains a link to www.northwindtraders.com), select the Do Not Follow Link Outside The Specified URL Domain Name check box. You can also specify the number of linked pages you wish to traverse, the maximum number of objects retrieved, and the number of TCP connections that will be used. If you choose to traverse beyond a depth of three links, many jobs can take a long time. Click Next when you've specified these settings.

  6. On the Content Caching page (see Figure 2-13), configure the content that will be cached and the amount of time it will be stored. Choose the desired settings, and then click Next.

  7. On the Completing The Scheduled Content Download Job Wizard page, review the settings you've chosen, then click Finish.

Image from book
Figure 2-12: Specify the URL (Web link) from which a content download job will pull content.
Image from book
Figure 2-13: Specify the contents of the cache, and the TTL for the objects pulled down by the content download job.

Managing Existing Content Download Jobs You can configure and manage existing content download jobs by using the Tasks tab in the right pane. To manage the jobs, select the job in the center pane, and then select one of the following links:

Content Download Tasks

  • Schedule A Content Download Job (described earlier)

  • Edit The Selected Job

  • Delete The Selected Jobs

  • Start Selected Jobs Now

  • Stop Running Jobs

  • Enable The Selected Jobs

  • Disable The Selected Jobs

For additional references about installing ISA Server 2004 Standard Edition, refer to the "Additional Resources" appendix at the end of the book.

Related Tasks

  • Configure Cache Settings

  • Export Content Download Job Configuration

  • Import Content Download Job Configuration


Chapter 3: Installing and Configuring Microsoft ISA Server 2004 Enterprise Edition

Microsoft ISA Server 2004 Enterprise Edition introduces several new concepts, like the Configuration Storage Server (CSS) and Active Directory Application Mode (ADAM). A proper understanding of these new concepts is necessary for a successful deployment, and for this reason we felt a separate chapter should be dedicated to the installation and configuration of ISA Server 2004 Enterprise Edition. In this chapter, we provide best practices for properly installing ISA Server 2004 Enterprise Edition.

Before You Begin

As with any type of software installation, ensure you have adequately planned and reviewed a prerequisite checklist. Before installing ISA Server Enterprise Edition, be certain to read the product requirements from Chapter 1, "Microsoft ISA Server 2004 Administration Fundamentals," and the "Before You Begin" section in Chapter 2, "Installing and Configuring Microsoft ISA Server Standard Edition," a checklist to ensure, for example, that your server has all critical updates applied, proper TCP/IP settings and network adapter configurations set, and unnecessary services disabled.

  • Network adapters If you wish to use the network load balancing feature of ISA Server Enterprise Edition, you will need at least one additional network adapter to support intra-array communication.

    Note

    With Microsoft Windows Server 2003 Service Pack 1 and later, the requirement of a dedicated network adapter for intra-array communication is no longer necessary, but recommended for enhanced security.

  • Deployment scenarios ISA Server Enterprise Edition can be installed in several scenarios, including workgroup, branch office, and in an Active Directory directory service domain. Prior to installing Enterprise Edition, sufficient planning is necessary to confirm your deployment strategy.

Note

The ISA Server Guidance Web site has an entire section devoted to planning an ISA Server Enterprise Edition deployment at http://www.microsoft.com/isaserver/techinfo/guidance/2004/planning.asp.


Where Not to Install

ISA Server 2004 Enterprise Edition and the CSS can only be installed on the Microsoft Windows Server 2003 operating systems.

Note

The Message Screener, firewall client share, and ISA Management console can be installed on a Microsoft Windows 2000 server.

Although it is possible to install the CSS on a domain controller, we advise against it, as we discuss in the "Where Not to Install ISA Server" section in Chapter 2.


Installing Configuration Storage Server

Before you can complete an installation of ISA Server 2004 Enterprise Edition, you must install the CSS. The CSS is a database that contains the configuration information for your ISA Server Enterprise environment, and is designed to improve performance and enhance the resiliency of your network by functioning in multimaster mode and allowing the replication of configuration data across the environment.

Note

Because ISA Server is a firewall, and for enhanced security can be installed in its own workgroup or forest, Enterprise Edition no longer requires Active Directory to maintain configuration storage information.

To install your CSS, follow these instructions.

Note

The user account used to install the CSS automatically becomes an ISA Server Enterprise Administrator (not a domain Enterprise Administrator).

  1. Insert the ISA Server 2004 CD and click the Install ISA Server 2004 icon on the Microsoft Internet Security And Acceleration Server 2004 page.

    Note

    If Autorun is disabled, double-click ISAautorun.exe to launch the ISA Server 2004 Setup program.

  2. On the Welcome To The Installation Wizard For Microsoft ISA Server 2004 page, click Next.

  3. On the License Agreement page, click I Accept The Terms In The License Agreement, and click Next.

  4. On the Customer Information page, enter your name and the name of your organization in the User Name and Organization text boxes. Enter your serial number in the Product Serial Number text boxes, and click Next.

  5. On the Setup Scenarios page, click Install Configuration Storage Server, and click Next.

  6. On the Component Selection page, click Next.

    Note

    The ISA Server Management console and CSS components are installed by default.

  7. On the Enterprise Installation Options page, click either Create A New ISA Server Enterprise or Create A Replica Of The Enterprise Configuration, and click Next.

    Note

    If you already have a CSS installed, choose Create A Replica Of The Enterprise Configuration. Enter the fully qualified domain name (FQDN) of the existing CSS. Prior to creating a replica, the CSS you are defining must belong to the Replicate Configuration Storage Servers computers set. Array or Enterprise Administrator privileges are required.

  8. On the New Enterprise Warning page, read the warning, then click Next.

  9. On the Create New Enterprise page, type the name of your enterprise in the Enterprise Name box, type an optional description in the Description box, and click Next.

    Note

    The default name of your enterprise is Enterprise. You can change this name if you desire.

  10. On the Enterprise Deployment Environment page, specify whether installing ISA in a domain or in a domain with trusts, or in a workgroup or domains without trusts as shown in Figure 3-1, and click Next.

    Note

    A server certificate is required when installing in a workgroup or domains without trusts. Refer to the section entitled "Installing a Certificate for Workgroup Authentication," later in this chapter.

  11. On the Services Account page, select the account under which the CSS service will run, and click Next. This step may not appear, depending on the option you select.

    Note

    If you are installing the CSS on a domain controller, read the section entitled "Installing CSS on a Domain Controller," later in this chapter, to understand the specific requirements for doing so.

  12. On the Ready To Install The Program page, click Install.

  13. On the Installation Wizard Completed page, click Finish.

Image from book
Figure 3-1: Select the environment into which you will install the CSS.

Ensuring Connectivity to CSS

Maintaining connectivity between the ISA server and the CSS is very important. Two tools are provided by Microsoft to ensure connectivity to your CSS:

  • Adamsetup.exe, the ADAM installation executable found on the ISA Server 2004 Enterprise Edition CD.

  • Ldp.exe, a resource kit utility used for connecting to a Lightweight Directory Access Protocol (LDAP) directory service.

The procedure is as follows:

  1. Locate the ISA 2004 Enterprise Edition CD and browse to the \Fpc\Program Files\Microsoft ISA Server\Adam folder, and double-click Adamsetup.exe. Follow the prompts that appear to install ADAM.

    To learn more about ADAM, see http://www.microsoft.com/windowsserver2003/adam . For procedures on how to install ADAM, refer to the "Additional Resources" appendix of this book.

  2. After installing ADAM, browse to the %Windir%\Adam folder, and double-click Ldp.exe.

  3. On the Connection menu, click Connect.

  4. In the Connect dialog box, in the Server field, type the FQDN of your CSS server, change the port value from 389 to 2171 when using Windows Authentication or 2172 when using authentication with Secure Sockets Layer (SSL) and then click OK.

  5. On the Connection menu, select Bind. Type the domain name, user, and password in the appropriate fields and click OK.

    Note

    Select the Domain check box if you want to use Windows authentication, and clear the Domain check box if you want to use authentication with SSL.

  6. If you do not receive an error message, the connection to either port 2171 or 2172 on the CSS was successful.

    Note

    Port 2172 is the port used by the MS Firewall Storage protocol, an inbound LDAP-based protocol used by array members to communicate with the CSS. You can also use the command telnet hostname 2172 to check that name resolution, basic network connectivity, and availability of the ADAM service are working on the CSS server.

Creating an ISA Server Array

Prior to installing ISA Server 2004 Enterprise Edition, you can choose to create an ISA Server array. The array will be empty, but as you install ISA services on new servers, you can add them to the array.

To create an ISA Server array, follow these steps:

  1. Open the ISA Server Management console. In the scope pane, click Arrays.

  2. In the task pane, on the Tasks tab, click Create New Array.

  3. On the Welcome To The New Array Wizard page, type the name for the new array, and then click Next.

  4. On the Array DNS Name page, type the array's DNS name to be used by firewall clients and Web clients when connecting to the array. Click Next to continue.

  5. On the Assign Enterprise Policy page, select an enterprise policy to assign to the array from the drop-down list, and click Next.

  6. On the Array Policy Rule Types page, you can select the Deny Access Rules check box, the Allow Access Rules check box, or Publishing Rules (Deny Or Allow) check box to specify what types of rules can be created in the array. Click Next.

  7. On the Completing The New Array Wizard page, review the configuration information, and then click Finish.

  8. After the array is created, click OK. In the details pane, click Apply to complete the change, and then click OK again.


Installing ISA Server 2004 Enterprise Edition

To install ISA Server 2004 Enterprise Edition, look through the steps described in the "Before You Begin" section earlier, and then follow these directions:

This section assumes that you are installing ISA Server as a member of an Active Directory domain. For instructions on how to install ISA Server Enterprise Edition into a workgroup, see the steps in the next section.

  1. Insert the ISA Server 2004 CD and click Install ISA Server 2004 on the Microsoft Internet Security And Acceleration Server 2004 page.

    Note

    If Autorun is disabled, double-click ISAautorun.exe to launch the ISA Server 2004 Setup program.

  2. On the Welcome To The Installation Wizard For Microsoft ISA Server 2004 page, click Next.

  3. On the License Agreement page, click I Accept The Terms In The License Agreement, and click Next.

  4. On the Customer Information page, enter your name and the name of your organization in the User Name and Organization text boxes. Enter your serial number in the Product Serial Number text boxes, and click Next.

  5. On the Setup Scenarios page, click Install ISA Server Services, Install Configuration Storage Server, Install Both ISA Server Services And Configuration Storage Server, or Install ISA Server Management, as illustrated in Figure 3-2, and click Next.

    Note

    Depending on the installation option you choose, the following instructions may vary slightly. These instructions assume that you select the Install ISA Server Services option, having already installed the CSS.

  6. On the Component Selection page click Change if you would like to change the location of the program files on the hard disk, and click Next.

    Note

    The ISA Server 2004 software is installed on the %SystemDrive% by default.

  7. On the Locate Configuration Storage Server page, type the name of your CSS server, or click Browse to find the CSS using the Select Computers page. If you click Browse, click OK when finished. Specify the connection credentials, and click Next.

    Note

    If unable to connect to the CSS, the installation prompts you with an error. You must ensure connectivity to the CSS to continue and finish the install. See the section entitled "Ensuring Connectivity to CSS" earlier in the chapter.

  8. On the Array Membership page, select to create a new array or join an existing array, and click Next.

  9. On the Create A New Array page, type a name for the array in the Array text box and type a description in the Description text box, then click Next.

  10. On the Configuration Storage Server Authentication Options page, select Windows Authentication or Authentication Over SSL Encrypted Channel, and click Next.

    Note

    If you select SSL encrypted channel, you must use an existing trusted root CA certificate or install a trusted root CA certificate.

  11. On the Internal Network page, click Add.

  12. On the Addresses page, you can choose to add IP addresses ranges manually, by adding an adapter, or by selecting among the private IP ranges. You can also add Enterprise Networks if you had previously defined them before starting the installation as shown in Figure 3-3. Click OK, and then click Next.

  13. On the Select Enterprise Policy page, from the Enterprise Policy drop-down list, select the enterprise policy to apply to the array, and click Next.

    Note

    Default Policy is selected automatically.

  14. On the Firewall Client Connection Settings page, if you have ISA Server 2000 firewall clients in the environment, you might need to provide backward compatibility. To do so, select the Allow Non-Encrypted Firewall Client Connections check box. This configuration means that you won't necessarily be taking advantage of the encryption provided by the new firewall client. Click Next.

  15. On the Services Warning page, the SNMP service, FTP Publishing service, Network News Transfer Protocol (NNTP), IIS Admin Service, and World Wide Web Publishing service will be restarted during installation. Click Next to continue.

  16. On the Ready To Install The Program page, click Install.

  17. On the Installation Wizard Completed page, select the Invoke ISA Server Management When The Wizard Closes check box, and click Finish.

Image from book
Figure 3-2: Select the components you wish to install on the Setup Scenarios page.
Image from book
Figure 3-3: Enter the IP address ranges or Enterprise Networks that define your network.

Installing Firewall Share and Message Screener

The procedures in the section entitled "Installing the Firewall Client Installation Share and Message Screener" in Chapter 2 are identical for ISA Server Standard Edition and Enterprise Edition, except whereas ISA Server Standard Edition can be installed on a Windows 2000 server, ISA Server Enterprise Edition is only supported on Windows Server 2003. The dependency on an SMTP virtual server remains before you can install the Message Screener.

Adding Servers to the ISA Server Array

After establishing a new array as described in the earlier section, "Creating an ISA Server Array," or completing the ISA installation as described earlier in this chapter in the section entitled "Installing ISA Server 2004 Enterprise Edition," you can add additional servers by altering the following steps during an installation:

  1. On the Array Membership page, click Join An Existing Array, then click Next.

  2. On the Join An Existing Array page, type the name of the ISA array or click Browse to select the array from the list, and click Next.


Installing CSS on a Domain Controller

Installing ISA Server Enterprise Edition on a domain controller places your firewall on a directory server (which is not a good plan); however, installing only the CSS on a domain controller is beneficial in many situations (for example, branch office deployment with limited server capacity). Under these circumstances, follow the steps described in the section entitled "Installing Configuration Storage Server," but modify the following steps:

  • Account credentials A typical installation would configure the CSS to run under the context of the Network Service account. On a domain controller, this is not a viable option. The preferred method is to configure an account on the domain controller that is not a member of the Domain Admins group.

To specify an account not in the Domain Admins group during the installation of the CSS, complete these steps:

  1. On the Configuration Storage Server Service Account page, create a domain user account you will use for the CSS server, and type the user credentials as shown in Figure 3-4.

  2. Open the \Program Files\Microsoft ISA Server\ADAMData folder, locate the DNSDomain.bat file (where DNSDomain is the FQDN of your domain), and execute from the command line.

    Note

    This batch file is created when the user under which ADAM runs doesn't have the required right in Active Directory. The purpose of the batch file is for registering the Service Principle Name (SPN) of the array member for authentication to the CSS server.

  3. On the domain controller that contains the CSS, run the ADSI Edit tool by clicking Start, Run, typing ADSIEdit.msc, and clicking OK. Locate the CN=CSS object, and provide the user account for which you created the permission to Create All Child Objects. Close ADSI Edit.

    Note

    If ADSI is not already installed, install it by opening the Support\Tools folder on the Windows Server 2003 CD, double-clicking Suptools.msi, clicking Install, and then following the steps in the Windows Support Tools Setup Wizard.

  4. Using the Active Directory Users And Computers or the Group Policy Management console, open the Default Domain Controller GPO for editing, expand Computer Configuration, Windows Settings, Security Settings, and Local Policies, and then click the User Rights Assignments node. In the rightmost pane, double-click the Generate Security Audits right, add the user account you created, and then click OK. Close the Group Policy Object Editor.

Image from book
Figure 3-4: Specify a user account when installing CSS on a domain controller, and give it a long and complex password.
Note

You must repeat steps 2 and 3 for any replica CSS servers you install.


Installing a CSS from Media

Installing a CSS from media is advantageous when you have limited bandwidth between your corporate and branch offices to support complete replication changes between your ISA servers at those locations. The replica installation can be completed through employing the following steps:

  1. On the existing CSS, create a backup file (.bkf) using Windows Backup to back up only the contents of the ADAMData folder (%Windir%\Program Files\Microsoft ISA Server\ADAMData).

  2. Begin the installation of the CSS as described in the section entitled "InstallingConfiguration Storage Server," earlier in this chapter.

  3. On the Enterprise Installation Options page, select Create A Replica Of The Enterprise Configuration, and click Next.

  4. On the Locate Configuration Storage Server page, type the FQDN of the CSS you want to replicate, and click Next.

  5. On the ISA Server Configuration Replicate Source page, choose the option to replicate from a Windows backup file, select the backup file created in Step 1 as your replication source, and then click Next to continue with the remaining steps to complete the installation of your CSS.


Installing Enterprise Edition Unattended

You can use one of the Microsoft ISA Server unattended configuration files that come with ISA Server 2004 to automate its installation. There are two steps to automate the installation of ISA Server:

Configure one of five configuration files located in FPC folder on the ISA Server CD

  • UninstallServer.ini: Uninstall a server.

  • InstallJoinedServer.ini: Install a computer running ISA Server services, and join it to a specific array.

  • InstallNewArrayAndServer.ini: Install a computer running ISA Server services, and create a new array named ARRAY_NAME.

  • InstallNewManagementServer.ini: Install a Configuration Storage Server.

  • InstallStandaloneServer.ini: Install ISA Server services and Configuration Storage Server.

Run the unattended installation from the command line

Follow these steps to conduct an unattended installation:

  1. On the ISA Server 2004 CD, open the Fpc folder to locate one of the five answer files.

  2. Modify the answer file to reflect your settings. Remove the semicolon before the entry you wish to customize, and configure the value. See the ISA Server Help file for more information on the settings that you can configure. After modifying the file, save it to a location on your computer.

    Note

    If you do not specify a value, Setup uses the default value.

  3. At a command prompt, or within a script, run Setup in Quiet Mode and specify the path to the answer file as shown here:

    "PathToISASetup\setup.exe" /v /Q[b|n]
 FULLPATHANSWERFILE="\PathToINIFile\INI_filename\"

    For example, if you were installing ISA Server Enterprise Edition from a CD in the D drive, and had customized the unattended configuration file, and saved it to the C drive, your command line would look like this:

    "D:\setup.exe" /v /Qb
 FULLPATHANSWERFILE="\C:\InstallJoinedServer.ini\"


ISA Server Setup Command-Line Parameters

You can perform an installation, modify, repair, and uninstall using the ISA Server command-line tool as shown here:

PathToISASetup\Setup.exe [/[X|R]] /V" /q[b|n]
FULLPATHANSWERFILE=\"PathToINIFile\INI_filename\""

The parameters are listed here:

  • PathToISASetup: The path to the ISA Server 2004 installation files. The path can be the root folder of the ISA Server CD or a shared folder on your network that contains the ISA Server files.

  • /R: Performs unattended reinstallation.

  • /X: Performs unattended uninstallation.

  • /V: Passes parameters to the Windows Installer engine, which enables the /q commands and the Answer File to be read. You will not require this option with a /X command.

  • INI_filename: The path to the answer file.

  • /Q [b|n]: Performs quiet unattended setup. If you specify b, a progress bar indicates the setup process. If you specify n, no dialog boxes are displayed.

  • PathToINIFile: The path to the folder containing the unattended installation information.

To modify the components installed in an unattended setup, type:

PathToISASetup\Setup.exe ADDLOCAL=NewFeature or REMOVE=FeatureToRemove

To repair an installation in an unattended setup, type:

PathToISASetup\Setup.exe REINSTALL=ALL

Troubleshooting Setup

Be aware of the following in order to avoid and overcome setup problems:

  • You must run Setup in the context of a server administrator.

  • You can't conduct an unattended installation on a computer with ISA Server 2000 already installed.

  • Notice that there is a backslash before the path to the answer file in the preceding command line. Be sure to provide the leading and trailing backslashes, and use quotation marks, or your installation probably will fail.

  • MSDE will not install correctly if you are connected to the ISA server using Terminal Services Application mode. You can use a Remote Desktop session and execute the command, or execute the command using Sysinternals's PSExec.exe tool, available free from http://www.sysinternals.com. See http://support.microsoft.com/kb/830629/ for more information.


Installing ISA Server 2004 Enterprise Edition into a Workgroup

To provide an environment in which your ISA servers are not part of your domain, you can choose to install ISA Server into a workgroup. Because ISA Server requires secure communication between machines, you need to take certain steps to ensure that the traffic and the authentication between the machines are protected.

Because there are no shared domain accounts in a workgroup, there are some caveats of which you should be aware:

  • You need to create a server certificate, which provides the ability for each server to authenticate to others. Procedures available later in this chapter in the section entitled "Installing a Certificate for Workgroup Authentication" explain this process.

  • The Firewall Client depends on domain user rights to provide access; if there aren't any domain user accounts, the Firewall Client won't work.

  • If you're using an array (in which several ISA computers share information), you have to create accounts with exactly the same user names and passwords on each machine. These are known as mirrored (or shadow) accounts, and they are necessary to allow for array management.

  • You can't use Windows Authentication for centralized user authentication, but must rely on another method, such as RADIUS.

  • If you're installing a CSS in a workgroup, you won't be able to create another CSS as a replica.

    When you do install ISA Server into a workgroup, you can do so in three different supported scenarios:

    1. Workgroup scenario, in which you're installing an array that is protecting a single group of computers, such as a Web farm, and in which the CSS is installed in a domain.

    2. Workgroup enterprise scenario, in which both the ISA servers and the CSS are in a workgroup environment.

    3. Back-to-back scenario, in which the back-end ISA server is part of a domain, and the front-end server is part of a workgroup.

In the following sections, follow the checklists for installing ISA Server in each scenario. Because many of the procedures are repeated, they are all documented after the checklists. Refer to the appropriate procedures as needed.

Workgroup Scenario

To install ISA Server into a workgroup, you should follow these steps:

  1. Install a certificate on the CSS—for instructions on doing this, refer to the section entitled "Installing a Certificate for Workgroup Authentication," later in this chapter.

    Note

    Step 1 can also be completed during the installation of your CSS server.

  2. Install the CSS into the domain using certificate authentication using the certificate created for the first step—see the section entitled "Installing Configuration Storage Server," earlier in this chapter.

  3. Install the first array at your primary site—for instructions on doing this, see the section entitled "Creating an ISA Server Array," earlier in this chapter.

  4. Install ISA Server on the first workgroup computer, using a local user name and password, which will function as a mirrored account on your other ISA servers (and which requires you to create the same user name and password on all ISA servers).

  5. On the Install Server Certificate page, follow the steps provided in the section entitled "Installing a Root Certificate from a Local Certificate Authority," later in this chapter.

Workgroup Enterprise Scenario

In this configuration, both the ISA Server array and the CSS are installed into the workgroup, which creates an isolated enterprise. The difference between this configuration and the workgroup scenario is that the CSS server is not part of the domain, but of the same workgroup as the ISA Server array. To install this configuration, follow these steps:

  1. Install a certificate on the CSS—for instructions on doing this, refer to the section entitled "Installing a Certificate for Workgroup Authentication," later in this chapter.

    Note

    Step 1 can also be completed during the installation of your CSS server.

  2. Install the CSS into the workgroup using certificate authentication (for instructions on this, see the section entitled "Installing Configuration Storage Server," earlier in this chapter). When prompted on the Install Server Certificate page, select Certificate Authentication and locate the Server Certificate created for this purpose.

  3. Install ISA Server on the first workgroup computer using a local user name and password, which will function as a mirrored account on your other ISA servers (and which requires you to create the same user name and password on all ISA servers).

  4. On the Install Server Certificate page, follow the steps provided in the section entitled "Installing a Root Certificate from a Local Certificate Authority," later in this chapter.

Back-to-Back Scenario

This configuration has two (or more) ISA Server arrays: one belongs to a corporate domain (we call this the back array), and the other (called the front or edge) array is in a workgroup as shown in Figure 3-5.

Image from book
Figure 3-5: A back-to-back scenario.

Install this configuration following these steps:

  1. Install a certificate on the CSS—for instructions on this, refer to the section entitled "Installing a Certificate for Workgroup Authentication," later in this chapter.

    Step 1 can also be completed during the installation of your CSS server.

  2. Install the CSS in the primary site—see the section entitled "Installing Configuration Storage Server," earlier in this chapter.

  3. Install the first array in the primary site—see the section entitled "Creating an ISA Server Array," earlier in this chapter.

  4. Create a network in the primary site that contains the IP address scheme of the front array, and then create another network containing the IP address scheme of the perimeter network.

    Note

    For procedures on creating a network, see Chapter 7, "Configuring Access Rule Elements."

  5. Create a network rule to establish a relationship between the internal network at the primary site and perimeter network. Use a NAT relationship if you are using server publishing to accept connections to the CSS, or use a route relationship if creating an access rule for connecting to the CSS.

  6. Configure the default gateway address on the internal adapter of the front array to the IP address assigned to the external network adapter of the back array as shown in Figure 3-6.

  7. Allow access to the CSS.

  8. Install the root certificate using the procedure given in the section entitled "Installing a Root Certificate from a Local Certificate Authority," later in this chapter.

    Note

    Step 8 can also be completed during the installation of your array member.

  9. Install ISA Server on the first workgroup computer, using the mirrored account (the same local user name and password) as on your other ISA servers.

Image from book
Figure 3-6: In a back-to-back configuration, configure the gateway address of the internal network adapter of the Front array to that of the External network adapter of the Back array server.

Installing a Certificate for Workgroup Authentication

Installing a certificate for workgroup authentication is a multistep process. The following steps must be completed to provide workgroup authentication with your ISA servers and CSS:

  1. Establish a Public Key Infrastructure (PKI).

    Note

    If you're not familiar with this process, see the guidance available at http://www.microsoft.com/windowsserver2003/technologies/pki. The remaining steps are described in more detail later in this chapter.

  2. Obtain a server certificate.

  3. Export a server certificate and install the server certificate using the CSS setup or using ISACertTools.exe for your ISA Server Enterprise Edition CD.

  4. Install a root certificate.

Note

For detailed procedures on each of these steps focused on certificate administration, see the Microsoft IIS 5.0 Administrator's Pocket Consultant or IIS 6.0 Administrator's Pocket Consultant, both authored by William R. Stanek and published by Microsoft Press.

Obtaining a Server Certificate To obtain a server certificate, complete the following steps:

  1. Open Microsoft Internet Explorer.

  2. On the menu bar, select Tools, and then select Internet Options.

  3. Click the Security tab, click Trusted Sites, and then click Sites.

  4. In the Trusted Sites dialog box, in the Add This Web Site To The Zone field, type the URL of the certificate server Web site name, and click Add. Click OK twice to close all dialog boxes.

  5. Type the following URL in the browser: http://IP_address_of_certificate_authority_server/certsrv.

  6. Click Request A Certificate.

  7. Click Advanced Certificate Request.

  8. Click Create And Submit A Request To This CA.

  9. Type the name for the certificate.

  10. Complete the form and from the drop-down list, select Server Authentication Certificate.

  11. Click Mark Keys As Exportable.

  12. Click Store Certificate In The Local Computer Certificate Store, click Submit, and then click Yes after reviewing the warning dialog box.

  13. From the server where the certificate was requested, type the following URL in the browser: http://IP_address_of_certificate_authority_server/certsrv. Click View Status Of A Pending Request.

  14. Click Install This Certificate.

Exporting a Server Certificate

To export a server certificate, follow these steps:

  1. Open the Internet Services Manager console, right-click the applicable Web site, and select Properties.

  2. Click the Directory Security tab, and click View Certificate.

  3. Click the Details tab, click Copy To File to start the Certificate Export Wizard, and click Next.

  4. Click Yes if you want to export the certificate with the private key; otherwise click No and then click Next to continue.

  5. Click Next to accept the default file format.

  6. If you selected Yes in Step 4, type and confirm the password, and then click Next.

  7. Type the name of the file to be exported. Click Next to continue.

  8. Click Finish to complete the wizard, and then click OK to confirm the successful export of the certificate.

Installing a Root Certificate from a Local Certificate Authority

After obtaining a certificate and exporting a certificate from a local certificate authority, the next step is to install a root certificate on the ISA server.

To install a root certificate from a local certificate authority, follow these steps:

  1. Open Internet Explorer.

  2. On the menu bar, select Tools, and then select Internet Options.

  3. Click the Security tab, and then click Custom Level.

  4. In the Security Settings dialog box, in the Reset Custom Settings area, on the Reset To drop-down list, select Medium. Click OK.

    Note

    To install a certificate, you must set the security settings to Medium or lower temporarily, or else you need to add the server to the Trusted Sites zone temporarily. Be certain to return your Internet security settings to the most secure configuration after you are finished.

  5. Click OK to close the Internet Options dialog box.

  6. Type the following URL in the browser: http://IP_address_of_certificate_authority_server/certsrv.

  7. Click Download A CA Certificate, Certificate Chain, Or CRL.

  8. Click Install This CA Certificate Chain, and click Yes to proceed.

After installing the root certificate, you should verify that the installation was completed properly. To do so, use the Certificates MMC to check that the root certificate is listed.

Renaming the CSS

Renaming the CSS is a supported process in ISA Server Enterprise Edition, but one in which you should be careful to follow the steps presented here to prevent problems. If you encounter an issue, use a script in the installation folder of the ISA Enterprise Edition CD called ChangeStorageServer.vbs, which restores connectivity to your CSS.

To rename a CSS, follow these steps:

  1. On the computer running the ISA Server Management console, open the HOSTS file in the %Windir%\System32\Drivers\Etc folder.

  2. On a new line within the HOSTS file, type the current IP address of the CSS, followed by at least one space, and then the new name to be given to the CSS. Save the HOSTS file.

  3. Open the ISA Server Management console, click the Monitoring node in the scope pane, and then click the Configuration tab in the details pane to confirm that all array members are currently using their primary CSS.

  4. In the scope pane, select the Arrays node. For each array, in the details pane, right-click the array name, and then select Properties.

  5. In the details pane, click Apply to apply the changes, and then click OK.

  6. In the scope pane, click the Monitoring node, then in the details pane, click the Configuration tab to verify all array members are updated with the change.

  7. Rename the CSS and restart your server.

  8. On the computer running the ISA Server Management console, remove the entry you added to the HOSTS file.

  9. Open the ISA Server Management console, click the Arrays node in the scope pane, right-click the array name in the details pane, and select Properties.

  10. On the Configuration Storage tab, type the new name in the Configuration Storage Server (Enter the FQDN) text box, and then click OK.

    Note

    The new setting can take up to 30 minutes to be recognized by all array members. To shorten this time, a script called SetCSSDelayTimes.vbs can be used. This script is found at the ISA Server Coding Corner on the Web.

  11. In the scope pane, select the Monitoring node, and in the details pane, click the Configuration tab to confirm the new name has been applied.

Image from book
Figure 3-7: Specifying an alternate CSS server

Specifying an Alternative CSS Server

You can optionally configure an alternative CSS server in your environment by following these steps:

  1. Open the ISA Server Management console, and click the Arrays node in the scope pane.

  2. In the details pane, right-click the applicable array and select Properties.

  3. Click the Configuration Storage tab.

  4. In the Alternate Configuration Storage Server (Optional) text box, type the FQDN of an alternate CSS server, and click OK.

    Note

    If the server is unable to resolve the FQDN of the alternate CSS, an error appears.

  5. Click Apply to commit your changes, and then click OK.


Uninstalling ISA Server 2004 Enterprise Edition

ISA Server 2004 Enterprise Edition can be removed through Add/Remove Programs in Control Panel or by using the installation media as follows:

  1. Insert the ISA Server 2004 CD and click Install ISA Server 2004 on the Microsoft Internet Security And Acceleration Server 2004 page.

  2. On the Welcome To The Installation Wizard For Microsoft ISA Server 2004 page, click Next.

  3. On the Program Maintenance page, select Remove, and click Next.

  4. On the Local Configuration Storage Server page, type the name of your CSS server, specify whether to use the credentials of the logged on user or another user, and click Next.

  5. On the Generated Files Removal Page, specify whether to leave the ISA log files or cache files by selecting the appropriate check boxes, and click Next.

  6. On the Remove The Program page, click Remove.

  7. On the Installation Wizard Completed page, click Finish.


Troubleshooting Installation

In this section, we discuss two areas where many administrators need to troubleshoot their ISA Server installation.

Upgrading from ISA Server 2000

See Chapter 5, "Upgrading from Microsoft ISA Server 2000," for detailed information that you will need to upgrade from ISA Server 2000 to ISA Server 2004.

Examining the Setup Log Files

The ISA Server 2004 installation creates three log files by default, as shown in Table 3-1.

Table 3-1: ISA Server 2004 Installation Log Files
Log File | Description
%Windir%\Temp\ISAWRAP_number.log | The setup wrapper log file records general information about the success or failure of the firewall and Microsoft SQL Server Desktop Engine (MSDE) installation.
%Windir%\Temp\ISAFWSV_number.log | The Firewall service setup log file records events and error srelated to the configuration of the ISA 2004 Firewall service.
%Windir%\Temp\ISAMSDE_number.log | The ISA 2004 database setup log file records events and errors related to MSDE.
Note

ISA Server 2004 uses the same log file (for example, ISAxxxx_number.log) for all installation attempts. However, every time you remove ISA Server 2004, two ISAWRAP_number.log files are created with different numbers.

To view these log files, follow these steps:

  1. In Windows Explorer, locate and open the %Windir%\Temp folder.

  2. In the %Windir%\Temp folder, locate any one of the following ISA 2004 Setup log files:

    • ISAWRAP_number.log

    • ISAFWSV_number.log

    • ISAMSDE_number.log

  3. Right-click ISAWRAP_number.log, and then click Open (if Open is not available, click Open With).

  4. In the Open With dialog box, click Notepad, and then click OK.

  5. Repeat Steps 3 and 4 to view the remaining log files.


Configuring ISA Server Enterprise Edition

To configure your ISA server, follow the steps on the Getting Started page that appears in the center pane when you've selected the ISA server in the left pane as shown in Figure 3-8. We provide references to other chapters in this book that discuss those steps in detail.

Image from book
Figure 3-8: The Getting Started pane guides you through the options available for configuring your ISA server.

The first step is to assign administrative roles and configure the means by which you will administer your ISA Server environment. You can choose to install the ISA Server Remote Console (MMC), or you can decide to connect to the ISA server using Terminal Services. We describe the actions needed to configure all these scenarios later in this chapter. After you've completed preparing your ISA server for administration, you can then undertake these Getting Started activities.

Click the Enterprise node in the scope pane of the ISA Server Management console, and then you will see the following described in the details pane to help you prepare your server:

  1. Define enterprise networks, as covered in Chapter 9, "Configuring Multinetworking."

  2. Define enterprise policies and array settings, as described in Chapter 14, "Enforcing Enterprise and Array Policies."

Click an array name in the scope pane, and then you will see the following described in the details pane to help you prepare your server:

  1. Configure your networks, as covered in Chapter 9.

  2. Create your firewall policy rules to allow internal machines to connect externally, or to allow external machines to gain access to selected internal resources, like Web servers. See Chapter 8, "Configuring ISA Firewall Policy," for more information.

  3. Define how you wish ISA Server to cache Web content, as described in the "Configuring the Cache Properties" section in Chapter 2.

  4. Set up your VPN settings as described in Chapter 11, "Securing Virtual Private Network Access."

Once you've implemented your ISA Server, you can use the monitoring functions, which we cover in Chapter 6, "Monitoring and Reporting."

Assigning ISA Administrative Roles

ISA Server uses role-based administration, which can utilize Active Directory or Windows users and groups. ISA Server Enterprise Edition provides enterprise-level roles and array-level roles. These roles are built into ISA Server 2004 Enterprise Edition:

Enterprise Administrator Roles

  • ISA Server Enterprise Administrator This role allows for unlimited access to the enterprise and array configurations, and includes the capabilities of the ISA Server Enterprise Auditor.

  • ISA Server Enterprise Auditor This role allows for viewing the enterprise and array configurations only.

Array Administrator Roles

  • ISA Server Array Monitoring Auditor This role allows for viewing and monitoring of the ISA server, but does not allow for any configuration modifications to monitoring functionality.

  • ISA Server Array Auditor This role allows for viewing of firewall policy, creating reports, session and service management. It includes the capabilities from the ISA Server Array Monitoring Auditor.

  • ISA Server Array Administrator This role can perform any ISA Server task, including firewall policy management, creating reports, and alerts. It also includes the capabilities from the ISA Server Array Monitoring Auditor and the ISA Server Array Auditor.

To assign ISA enterprise-level administrative roles, follow these steps:

  1. Open the ISA Server Management console, then select the Enterprise node in the scope pane.

  2. In the task pane, click the Tasks tab, and then click Assign Administrative Roles.

  3. On the Assign Roles tab, click Add, type the group or user name, and then, in the Role drop-down list, select the role you want to assign.

  4. Click OK twice to close the dialog boxes and finish the role assignment.

  5. Click Apply to successfully apply your changes, and then click OK.

To assign ISA array-level administrative roles, follow these steps:

  1. In the scope pane, click the applicable array name you wish to configure.

  2. In the task pane, click the Tasks tab, and then click Assign Administrative Roles.

  3. On the Assign Roles tab, click Add, type the group or user name, and then, in the Role drop-down list, select the role you want to assign.

  4. Click OK twice to close the dialog boxes and finish the role assignment.

  5. Click Apply to successfully apply your changes, and then click OK.


Remote Administration

Remote administration is possible at the enterprise level and array level. Two computer sets are available with the installation, but by default they do not contain any ISA servers.

To manage any array server in the enterprise, you need to add the computers to be used for remote ISA Server administration to the Enterprise Remote Management Computers computer set as described next. You should be logged on as an Enterprise Administrator to complete the following steps.

  1. In the scope pane of the ISA Server Management console, expand the Enterprise node, expand Enterprise Policies, and click the policy you want to configure.

  2. In the task pane, click the Toolbox tab, click Network Objects, and expand Computer Sets.

  3. Right-click Enterprise Remote Management Computers and select Properties.

  4. On the General tab, click Add, and click Computer.

  5. In the New Computer Rule Element dialog box, type the name and IP address of the computer you are adding, and then click OK.

  6. Click OK again to close the dialog box.

  7. Click Apply to successfully apply your changes, and then click OK.

For managing any ISA server at the array level only, follow the procedure just described, but use the Remote Management Computers computer set. This allows you to manage any ISA Server array from the ISA server, but you will only be able to monitor the array that owns the computer set.

After adding your ISA server to the appropriate computer set, ensuring that remote management is enabled in the system policy, and enabling Remote Desktop on the CSS, you can use your familiar remote administration tools, Terminal Services, and the ISA Management console to establish a remote connection.

If using the ISA Management console, keep in mind that you can connect to only one CSS at a time. If you use the Enterprise Connection Wizard to establish a second connection to another CSS, your first connection is dropped.


Chapter 4: Installing and Configuring Microsoft ISA Server 2004 Clients

Overview

Microsoft ISA Server 2004 clients represent different ways the computers in your environment can connect to resources on and through the ISA server. This chapter focuses on installing and configuring each of the three possible ISA Server client types and provides additional procedures that explain the following subjects:

  • Automating the installation of the clients

  • Configuring multiple client types on the same workstation

  • Identifying the dependencies these clients have on infrastructure services


Overview of ISA Server Client Types

ISA Server 2004 clients are determined by how the computer requesting external resources connects to and through the ISA Server firewall. These three clients can be used individually or in conjunction with one another:

  • SecureNAT Any computer that is configured to route requests to the ISA server by making it the default gateway, or by setting up routes in a complex network that has other routers that lead to the ISA server.

  • Web proxy Requires configuring any Conseil Européen pour la Recherche Nucléaire (CERN)—compliant client (which includes all major Web browsers) to direct HTTP, HTTPS, and FTP download requests to the Firewall service on ISA Server.

  • Firewall client This software can be installed on Microsoft Windows 98 and Microsoft Windows NT 4.0 operating systems and above. It directs requests to the Firewall service on ISA Server, and can support many protocols.

Table 4-1 shows these clients and their capabilities.

Table 4-1: ISA Server 2004 Clients and Their Functionality
 | Web Proxy | Firewall Client | SecureNAT
Supported protocols | HTTP, HTTPS, FTP, and Gopher | Limited by protocol rules | Limited by protocol rules; can't support secondary connections without use of application filters
Installation and configuration requirements | No installation required; must configure browsers or Web-based applications | Must install client on Windows and configure it | No installation; might require some client configuration (gateway)
Operating system (OS)/application requirements | Any OS with a CERN-compatible Web application | Only Windows operating systems (OSs) are supported | No requirements
User authentication | Yes | Yes | For VPN clients only
Advantages | Simple, with many options for automating configuration | Provides access to all protocols; ;supports authentication | Easiest configuration in a simple network
Disadvantages | Limited only to Web protocols | Must install software on client | Complex networks require additional configuration; limited support of complex protocols without a filter, and no support for authentication

Choosing the Right Client

Choose the client you require for your environment based on the needs of your organization. Figure 4-1 illustrates the strengths and weaknesses of the different clients.

  • Use the SecureNAT client if you don't need authentication of users (and the resulting ability to track users in reports), and want the least amount of configuration possible.

  • Use the Web Proxy client if you only require HTTP, HTTPS, and FTP traffic.

  • Use the Firewall client if you need to authenticate users and require support for many different, or complex, protocols.

Image from book
Figure 4-1: This chart shows how the different ISA Server clients compare based on different requirements.

You are not tied to just a single client, however. You can use all three clients together on a single machine, should you desire. See Table 4-2 for a reference showing which clients are most suitable for specific requirements.

Table 4-2: Preferred Clients for Specific Requirements
Requirement | Preferred Client
Avoid installing software | SecureNAT
Forward caching (caching only) | SecureNAT or Web proxy
Authenticated clients | Firewall client or Web proxy
Publish servers | SecureNAT
Non-Windows OS | SecureNAT or Web proxy
Note

ISA Server handles all HTTP requests, regardless of the client type, as though they are Web Proxy clients.


Working with the SecureNAT Client

If ease of configuration is your primary goal, SecureNAT clients require only that you configure the gateway on the clients to route to the ISA server. SecureNAT clients support almost any type of browser or OS.

Planning for SecureNAT implementations requires you to understand how the default gateways are configured on your clients. If you're using Dynamic Host Configuration Protocol (DHCP), you can automatically configure the default gateway. A SecureNAT client might also be a Web proxy client.

Note

If you wish to control access to sites and content based on users or groups, you must use either Web proxy or Firewall clients, which support sending user authentication. SecureNAT does not provide user authentication. You can, however, restrict access based on machine IP addresses.

Installation

The installation of the SecureNAT client doesn't require you to run an executable; instead, simply configure the default gateway on the local workstation to point to the ISA server's internal IP address (or to the IP address of the local router, which has a route to the internal adapter of the ISA Server). See the following procedures on how to configure the network adapter properties.

To configure the network adapter on a Windows computer with a manually configured IP address, complete the following steps:

  1. Open Network And Dial-Up Connections (also known simply as Network Connections). The exact steps to open Network Connections vary according to the client OS, but the interface generally can be found within Control Panel.

  2. Select the network adapter installed on the workstation, right-click it, and select Properties.

  3. Click Internet Protocol (TCP/IP) and click Properties.

  4. In the Default Gateway field, type the IP address of the internal network adapter on the ISA server (or the IP address of the local router, which has a route to the internal adapter of the ISA Server) and click OK twice to close all windows.

In addition to configuring the default gateway, you should also configure the IP address and subnet mask fields. Remember that Steps 1–4 in the preceding procedure are for client workstations with a static IP address defined. The following steps should be used for DHCP-assigned addresses.

If all the workstations are dynamically assigned IP addresses from a DHCP server, you can configure each workstation as a SecureNAT client by configuring the scope option 003 Router. To define the router scope option on a Windows-based DHCP server, follow these steps:

  1. Open the DHCP console by clicking the Start, selecting Programs, Administrative Tools, and then DHCP.

  2. In the left pane, click the plus sign (+) next to the DHCP server name object.

  3. Click the plus sign (+) next to the appropriate scope and then click ScopeOptions. If each scope uses the same default gateway address, you don't have to add the router option to each scope individually. You can configure a server option to apply the router option once across all scopes configured on the DHCP server. (Configuring server options follows the same procedure as configuring Scope Options, except that, in the left pane, you view the Server Options properties instead of the Scope Options properties.) Right-click Scope Options and select Configure Options. On the General tab, select the 003 Router check box, which activates additional fields within the window.

  4. In the IP Address field, type the IP address of the ISA server's internal network adapter (or the IP address of the local router, which has a route to the internal adapter of the ISA server). As an option, you can type the ISA server's server name and click Resolve to have the IP Address field populated automatically. Click Add to add the IP address. Click OK to close.

    Note

    If you do provide the server name and click Resolve, ensure that the IP address is correct (that is, the ISA server's internal interface) before clicking Add.

Simple Network versus Complex Network

Whereas simple networks (namely, networks in which no routing takes place) clients only need their default gateway configured to point to the ISA server's internal IP address, for complex or routed networks, you need to create a path to the ISA server's internal IP address. The client always needs its default gateway set to the IP address of a router connected to the same local area network. The router then needs to be configured to pass traffic to the ISA server, or the next closest router to the ISA server as shown in Figure 4-2. Client A is on a separate subnet than the ISA server, and so the client's default gateway must be set to the IP Address of the router (10.0.0.254). The router then forwards the client traffic on to the ISA server at 192.168.1.254. Client B, which is on the same subnet as the ISA server, only needs its default gateway set to the internal interface of the ISA server.

Image from book
Figure 4-2: This diagram shows how complex networks route Secure NAT client traffic.

Special Considerations for VPN Networks

VPN clients configured as SecureNAT clients use the VPN credentials to authenticate. When clients are configured as Firewall clients, they use the logged-on user credentials instead. By default, when a rule allowing access from the VPN clients' network to the internal network exists, VPN clients access the internal interface of the ISA server (port 8080 for Web proxy clients, and 1745 for Firewall clients).

See Chapter 11 , "Securing Virtual Private Network Access," for more information about how VPN clients are configured.

Configuration

The beauty of SecureNAT clients is that little configuration beyond the default gateway must take place on the client. If, however, the IP address of the ISA server's internal interface changes, be sure to update the default gateway and routes. To check your IP address configuration (including the default gateway), use the IPCONFIG command-line utility. To check your computer's connection to the ISA Server, use the TRACERT or PATHPING command-line utilities.

For more information on the command-line utilities mentioned above, see the Windows Help file.

Customers often find that they are unable to connect to a resource externally once ISA Server is in place. Because SecureNAT clients rely on DNS to provide name resolution, if you're having problems with connectivity, check your DNS settings first. A best practice is to configure a splits DNS environment, which consists of having a DNS server on an internal or perimeter network, which then forwards resolution to an external DNS server.

For more information about this subject, see Dr. Tom Shinder's excellent article, "You Need to Create a Split DNS!" at http://www.isaserver.org/tutorials/You_Need_to_Create_a_Split_DNS.html.


Working with the Web Proxy Client

The Web proxy client works with any HTTP 1.1 CERN-compatible browser, and allows access to HTTP, HTTPS, FTP, and Gopher. Your clients' browsers must be configured to point to the Web proxy. You can set up this configuration through the use of an automatic configuration script, Group Policy settings in Active Directory domain environments, using logon scripts, or manually. The Web proxy service works with non-Windows 32-bit clients.

The Web proxy client supports user authentication, which provides the ability to restrict access by a client's NT user account.

Note that only a limited range of protocols is supported using the Web proxy alone; if clients require access to other Winsock applications, install the Firewall client.

To work with Web proxy, you must take several steps, which we discuss next:

  • Enable Web proxy for networks.

  • Configure the Web proxy settings on clients.

  • Set up automated configuration, if desired.

Installation

You don't have to install any software to enable Web proxy clients. Rather, you need to have a few prerequisites in place on your ISA Server and on your clients. The clients are the easy part: you simply need browsers and applications that are HTTP 1.1 CERN–compatible (which includes most common browsers on the market today, including Microsoft Internet Explorer 5 and above, Mozilla's Firefox, Netscape, and Opera). The next step is to simply configure the browsers' proxy settings (which we cover in the next section).

Enabling Web Proxy

On ISA Server, you need to enable the Web proxy clients for the networks you want to support. Normally this would only be internal and perimeter networks.

To enable Web proxy clients on selected networks, follow these steps:

  1. Open the ISA Server Management console, expand the Configuration node, and then click the Networks node.

  2. In the details pane, click the Networks tab and select the network for which you're enabling Web proxy clients. In the task pane, click the Tasks tab, then click Edit Selected Network (or you may simply right-click the network in the details view, then select Properties).

  3. Click the Web Proxy tab, then select the Enable Web Proxy Clients check box as shown in Figure 4-3. Selecting this check box allows you to configure the port(s) that clients will use to connect to ISA Server for HTTP and HTTPS traffic. Select the appropriate check box to enable HTTP or enable SSL, then type the appropriate port number in the field. To enable HTTPS/SSL traffic, you need to have a certificate available (for more information on how to issue certificates, see the Windows Help file).

  4. To configure the type of authentication allowed for Web connections, click Authentication to open the Authentication dialog box, as shown in Figure 4-4. You can choose to use a single authentication method or a combination of methods. When you are done configuring your authentication methods, click OK.

  5. On the Web Proxy tab, click Advanced, which opens the Advanced Settings dialog box. Here you can limit the number of connections allowed to your ISA server, and you can configure the Connection Timeout setting, which is set to a default of 120 seconds. Click OK when you are done configuring these settings.

Image from book
Figure 4-3: You can configure the Web Proxy properties on the ISA server by selecting the properties of the network.
Image from book
Figure 4-4: You can configure the Web Proxy authentication properties to control how clients identify themselves to the ISA server.

Configuration

You can configure your Web proxy clients in several different ways: manually, through a configuration script on the ISA server, through settings included in the distribution of the Firewall client, or through a Group Policy object (GPO) in an Active Directory domain.

Manual Configuration of Internet Explorer Clients

Configure Internet Explorer 6 clients by following these steps:

  1. Open Internet Explorer, click the Tools menu, then click Internet Options.

  2. Click the Connections tab, then click LAN Settings. The Local Area Network (LAN) Settings dialog box opens.

  3. In the Proxy Server area, select the Use A Proxy Server For Your LAN check box. Note that the settings will not apply to your dial-up or VPN connections.

  4. In the Address field, type the name of the ISA server, and in the Port field, type the port number that the clients will use to connect to ISA Server.

  5. If you have configured ISA Server with a configuration script, you can configure the client to automatically detect this information. Follow these steps:

    1. In the Automatic Configuration section of the Local Area Network (LAN) Settings dialog box, select the Automatically Detect Settings and Use Automatic Configuration Script check boxes.

    2. In the Address field, type the URL for the ISA server (or another location, if you have configured it differently).

Automatic Configuration Using Group Policy

You may also use GPOs to configure Internet Explorer settings on your clients. Follow these steps to create a GPO:

  1. Using your Active Directory Users And Computers console, or the Group Policy Management console (see Windows Server Help for more information about these consoles), create or open the GPO you will use to manage clients.

  2. In the Group Policy Object Editor snap-in, navigate to the User Configuration, then Windows Settings, then Internet Explorer Maintenance. Click the Connection node.

  3. In the right pane, you can configure Automatic Configuration by double-clicking Automatic Browser Configuration.

  4. To configure the settings for Internet Explorer to connect to your ISA server, double-click Proxy Settings.

  5. Save the GPO, and ensure that it is applied to the appropriate clients.

Troubleshooting

One common issue in which ISA Server ignores Web Proxy client requests occurs if you have removed and readded an IP address, or added or enabled a network adapter on the ISA Server computer. One quick workaround to address this problem is to restart the Firewall service on the ISA Server (go to the Services console, right-click Microsoft Firewall service, and then select Restart). However, to prevent this from occurring in the future, you can modify the registry by following these steps:

  1. Open the Registry Editor (Regedit.exe).

  2. Navigate to the HKEY_LOCAL_MACHINE\System\CurrentControlSet \Services\FwSrv\Parameters key.

  3. Double-click SocketsInAcceptReuseList. If the DWORD entry does not exist, create it.

  4. Set the value to be 0, and then restart the Microsoft Firewall service.

Another common problem is that you are consistently prompted for credentials when using a Web Proxy client. If you are trying to authenticate to a site that uses Kerberos authentication, then you will simply need to re-enter your credentials, as the ISA Server 2004 Web proxy client doesn't support Kerberos pass-through authentication. See http://support.microsoft.com/kb/840613 for more information.

See the "Additional Resources" appendix for more information on troubleshooting.


Working with the Firewall Client

The Firewall client requires that a software package be installed on the clients. However, if you're using Active Directory, you can easily install the software using Group Policy Software Distribution. Minor client education and support are required.

Only Windows 32-bit operating systems are supported (Windows 98 with Internet Explorer 5 installed, Windows Me, Windows NT 4.0, Windows 2000, Windows XP, or Windows Server 2003), which means that Macintosh, Linux, or legacy Windows computers can't use this client.

Note

The Firewall client connects to the TCP and UDP ports 1745 on the ISA server.

Another common problem that clients have is that they are unable to connect because the client's connection to the ISA server is lost. You will receive a "The Page Cannot Be Displayed" error in Internet Explorer, and a "The Proxy Server You Have Configured Could Not Be Found" error message in Mozilla Firefox. You can test connectivity by using the Ping command-line utility.

See Windows Help for more information about the Ping command.

Yet another problem is that the port number that is being used by the ISA server is incorrect, which may result in "The Page Cannot Be Displayed" errors on Internet Explorer or "The Operation Timed Out When Attempting To Contact Web-site" errors on Mozilla Firefox. Verify that the port number in the proxy settings is correct.

The Firewall client allows the use of all Winsock protocols, and you can manage it from the ISA server. You can configure the client from the server, and it refreshes on restart and once every subsequent six-hour period.

To work with the Firewall client, you must follow these steps:

  • Make the Firewall client share available.

  • Install the Firewall client.

  • Configure the Firewall client.

Make the Firewall Client Share Available

You can install the Firewall client on the ISA server or on another server. To reduce the attack surface of your ISA server, we recommend installing the Firewall client share (Mspclnt) on another server, and removing the File and Print Sharing options from your ISA server's internal interfaces.

To install the Firewall client share on a computer that does not already have ISA Server 2004 installed, follow these steps:

  1. Run the ISA Server 2004 setup. On the Welcome page, click Next to begin the installation.

  2. On the License Agreement page, read the EULA, select the I Accept The Terms Of The License Agreement check box, and then click Next.

  3. On the Customer Information page, type your information into the appropriate fields, then click Next.

  4. On the Setup Type page, select the Custom option, then click Next.

  5. In the Custom Settings dialog box, ensure that only the Firewall Client Installation Share is available by selecting the Firewall Client Installation Share, and then selecting This Feature Will Be Installed On Local Hard Drive. Select the Firewall Services, ISA Server Management, and Message Screener options, and select This Feature Will Not Be Available. Click Next.

    Note

    Be sure that if you are installing the Firewall Client Installation Share on the ISA server, you do not make the other required services unavailable.

  6. Click Install. The share is then created and enabled.

Note

If you install the Firewall Client Installation Share on an ISA server, a system policy rule called Allow Access To Firewall Client Share To Trusted Computers is enabled.

Install the Firewall Client

After making the Firewall client available on your network, the next step is to install the client on computers. An administrator on the machine must install the application, or elevated privileges for the Microsoft Installer (MSI) must be enabled.

For more information about the AlwaysInstallElevated registry setting, see http://support.microsoft.com/kb/259459 in the Microsoft Knowledge Base.

There are several ways to accomplish the installation: manually, silently by using Group Policy, or through a software distribution tool, such as Microsoft Systems Management Server (SMS). We discuss these methods in the next section.

Warning

You must uninstall previous versions of the Firewall client before trying to install the current version of the software. If you try to install the Firewall client on a computer running the ISA Server 2000 Firewall client, you receive a message that states, "Firewall Client for ISA Server 2004 cannot be installed over a previous version of the Firewall Client software. You must remove the older version of the Firewall Client software before installing the latest version."

Installing the Firewall Client Manually

To install the Firewall client, connect to the Universal Naming Convention (UNC) path to the Firewall Client Installation Share (e.g., \\YourISAServer\mspclnt) and then run Setup, following the instructions on the screen.

Silent/Unattended Install

To perform an unattended installation of the Firewall client, you can use a command-line installation as shown here:

Path\Setup.exe /v "[SERVER_NAME_OR_IP=ISA_Server_Name]
[ENABLE_AUTO_DETECT={1|0}] [REFRESH_WEB_PROXY={1|0}]/qn "

The command line begins with the path to the setup file, which in our example will be \\ISA2004\MSPclnt, and then provides some commands that tell the client whether to enable autodetection of the client, and whether the Firewall client will contain the Web proxy configuration information.

C:\>\\ISA2004\MSPclnt\Setup.exe /v "SERVER_NAME_OR_IP=ISA2004
ENABLE_AUTO_DETECT=1 REFRESH_WEB_PROXY=1 /qn "

The /qn option tells the Windows Installer service (msiexec) to run the installation in "quiet" mode with "no" interface. If you would like users to be able to see progress, use a /qb command, which shows basic dialog boxes as the installation takes place.

Group Policy-Based Install

You can install the Firewall client using Group Policy, as you can with all other MSI- based installations. Follow these steps to create a Group Policy-based installation.

  1. Using your Active Directory Users And Computers console, or the Group Policy Management console (see Windows Server Help for more information about these items), create or open the GPO you will use to manage clients.

  2. In the Group Policy Object Editor snap-in, navigate to either Computer Configuration or User Configuration, then expand the Software Settings node.

    Note

    If you choose the Computer Configuration, the application does not install until the computer reboots. If you choose User Configuration, the software installs at the next logon.

  3. Right-click the Software Installation node, click New, then click Package.

  4. In the File Name box, type the path to the MSI installation package on the Firewall Client Installation Share (for example, \\ISA2004\Mspclnt\MS_FWC.MSI). Click Open.

  5. The Deploy Software dialog box opens; click opensclickAssigned, then click OK.

    Note

    The Published and Advanced options are only available when you create a Software Package in the User Configuration of Group Policy. We advise against publishing this package, as it requires users to install the software from the Add/Remove Programs dialog box. The Assigned option requires no action on the part of the customer.

  6. Close the Group Policy Object Editor and the Active Directory Users And Computers console, or the Group Policy Management console.

SMS-Based Install

If you have SMS available, you can deploy the Firewall client using the SMS software distribution functionality.

Note

We assume that you have an understanding of how to perform SMS tasks, such as creating collections, programs, and advertisements. See the SMS documentation for more information about these actions; if necessary.

Follow these steps to distribute the Firewall client using SMS:

  1. Create a package using the Firewall Client Installation Share. Configure programs that change the way in which the application installs as needed.

  2. Create a collection that targets the machines on which the Firewall client will be installed.

  3. Create an advertisement that schedules when the Firewall client will be installed.

Applying Service Packs

You can find the most current service packs from the ISA Server Web site at http://www.microsoft.com/isaserver/downloads. When a service pack is installed, it often requires that the Firewall client be updated as well (as in the case of ISA Server Standard Edition Service Pack 1). To reinstall the Firewall client, run the Firewall client setup with a "family SUV" script extension, as shown here:

\\YourISAServerName\mspclnt\setup.exe /FamSUV /
v"SERVER_NAME_OR_IP=ISA2004-SE"

This command line completely reinstalls the client, overwriting all files and registry entries.

Checking Firewall Client Version Settings To determine your Firewall client version settings, open the Firewall client by double-clicking the notification area icon, or the Control Panel icon, then clicking Help. The version number is displayed in the HTML document that is displayed.

Warning

You should avoid installing the firewall client in situations where the server requires a limited services being available, such as on a server running ISA Server, or on servers that have published content.

Configure the Firewall Client

The Firewall client can be configured from two locations, which have different capabilities:

  • On the ISA server

  • On the client

Firewall Client Support on the ISA Server

In ISA Server you can configure firewall client settings in the Network Properties dialog box, where you also configure Web proxy settings. You must enable Firewall client support to allow ISA to support these clients.

Enabling Firewall Client Support To enable and configure Firewall client support on the ISA server, follow these steps:

  1. Open the ISA Server Management console, expand the Configuration node, and then click the Networks node.

  2. In the details pane, click the Networks tab, and select the network for which you're enabling Firewall clients. In the task pane, click the Tasks tab, then click Edit Selected Network (or you can simply right-click the network in the details view, then select Properties).

  3. Click the Firewall Client tab, then select the Enable Firewall Client Support For This Network check box as shown in Figure 4-5.

  4. In the Firewall Client Configuration area, type the fully qualified domain name (FQDN) into the ISA Server Name Or IP Address field.

    Caution

    By default, the friendly (NetBIOS) name of the ISA Server is in this box. Using the FQDN helps overcome some name resolution issues.

  5. In the Web Browser Configuration On The Firewall Client Computer area, you can configure the settings that the Firewall clients will use. See the earlier section on configuring Web proxy for information about what these settings do.

  6. Click OK to close the NetworkName Properties dialog box.

Image from book
Figure 4-5: Firewall client support must be enabled on the ISA server in the Networks interface.

Defining Firewall Client Settings In the ISA Server Management console, you can define the Firewall client settings by following these steps:

Enabling Support for Legacy Firewall Clients

  1. Open the ISA Server Management console, expand the Configuration node, and then click the General node.

  2. In the details pane, click Define Firewall Client Settings. You will see the Firewall Client Settings dialog box, as shown in Figure 4-6.

  3. On the Connection tab, you can select the Allow Non-Encrypted Firewall Client Connections check box to allow backward compatibility with ISA Server 2000 and Proxy Server 2.0 clients. Click OK.

Image from book
Figure 4-6: You can manage Connection settings for Firewall clients from the ISA Server Management console.
Note

Don't select this check box unless it is absolutely necessary. Best practices call for using encrypted Firewall client connections.

Configuring Application Settings To configure the application settings, follow these instructions:

  1. Open the ISA Server Management console, expand the Configuration node, and then click the General node.

  2. In the details pane, click Define Firewall Client Settings, then click the Application Settings tab, which opens the dialog box shown in Figure 4-7. To create a new application setting, click New.

  3. In the Application field, type the name of the application.

  4. From the Key drop-down list, select the key you wish.

  5. In the Value field, type or choose the appropriate value for the key, then click OK.

Image from book
Figure 4-7: You can manage how ISA Server processes application traffic using the Application Settings tab.

Configuring Direct Access to Certain Web Sites Because all Web traffic directed to ISA Server is automatically routed to the Web proxy filter, at times you might need to bypass the Web proxy filter and act as a SecureNAT or Firewall client. Follow these steps to configure direct access to certain Web sites:

  1. Open the ISA Server Management console, expand the Configuration node, and then click the Networks node.

  2. In the details pane, click the Networks tab, and select the network for which you're enabling Web proxy clients. In the task pane, click the Tasks tab, then click Edit Selected Network (or you can simply right-click the network in the details view, then select Properties).

  3. Click the Web Browser tab, then click Add.

  4. Enter the IP address range or domain or computer name you wish to access directly, then click OK.

  5. Click OK to close the NetworkName Properties dialog box.

Excluding Domains from Firewall Client Connections If you have an internal domain to which you wish clients to connect directly without going through ISA Server, you can configure those clients in the Domains tab as described here:

  1. Open the ISA Server Management console, expand the Configuration node, and then click the Networks node.

  2. In the details pane, click the Networks tab, and select the network. In the task pane, click the Tasks tab, then click Edit Selected Network (or you can simply right-click the network in the details view, then select Properties).

  3. Click the Domains tab, then click Add.

  4. Enter a domain name (the domain name can be preceded by an asterisk to include all computers in that DNS domain) or the FQDN of a single computer, then click OK.

  5. Click OK to close the NetworkName Properties dialog box.

Configuring the Firewall Client on the Local Computer

There are many ways to configure the local firewall client. We discuss how to use the firewall client graphical user interface (GUI) and how to manually configure the four configuration files (LocalLAT.txt, Common.ini, Management.ini, and Application.ini).

Note

By default only the Common.ini and Managament.ini files exist.

These files (with the exception of the LocalLAT.txt file, which is only in the All Users profile) are found in two places on local computers:

  • Settings that apply to all users %Systemdrive%\Documents and Settings\All Users\Application Data\Microsoft\Firewall Client 2004\

  • Settings that apply to the logged-on user %Systemdrive%\Documents and Settings\%Username%\Local Settings\Application Data\Microsoft\Firewall Client 2004\

The logged-on user settings override the settings located in the All Users profile. For a flowchart showing the way in which ISA Server processes configuration settings for the firewall client, see Figure 4-8.

Image from book
Figure 4-8: The ISA Server Firewall client processes configuration settings for the client applying the most unique settings first, then moving to the more general. Settings most specific to the user have higher priority.

Firewall GUI Settings When the firewall client is installed on the local computer, an icon appears in the notification area, as shown in Figure 4-9. To manage the Firewall client, double-click this icon or go to Control Panel and double-click the Firewall client icon. In some cases these settings modify the local configuration files, but in most cases the settings are taken from ISA Server maintained in memory.

Image from book
Figure 4-9: The Firewall client icon—which you can double-click to bring up configuration options—appears in the notification area and in Control Panel.

The GUI is fairly basic, with two tabs—General and Web Browser—as shown in Figure 4-10.

Image from book
Figure 4-10: You can configure the Firewall client from this dialog box.

The General tab allows you to enable and disable the Firewall client (for when you're traveling and need to connect directly to another network). On this tab you can choose Automatically Detect ISA Server (which uses Web Proxy AutoDiscovery Protocol [WPAD] entries) or Manually Select ISA Server. The Web Browser tab allows you to choose Enable Web Browser Automatic Configuration, which sets the Web proxy settings as they are configured on the ISA server. To set the browser information in Internet Explorer, click Configure Now.

The LocalLAT.txt file Alhough it is not installed by default, the Firewall client can use a file called LocalLAT.txt—created at %systemdrive%\Documents and Settings\All Users\Application Data\Microsoft\Firewall Client 2004—to determine what IP addresses are part of its internal network. To configure the file, enter IP address ranges as shown here:

192.168.0.0      192.168.0.255

If you wish to specify a single IP address, type the IP address twice, as shown here:

10.15.233.14      10.15.233.14

In this way you can supplement for a single client the default methods it uses (its routing table and ISA Server settings) to determine its local network.

The Common.ini Configuration File This file contains the settings that are configured on the General tab of the Firewall Client Settings dialog box. Most specifically, it determines the name of the ISA server, whether the client is disabled, and whether autodetection is enabled. An example of the entries in the Common.ini list is shown here:

[Common]
ServerName=ISA2004-SE
Disable=0
Autodetection=1

The Management.ini Configuration File The Management.ini file contains the settings determining whether the Firewall client shows up in the navigation area or whether the Web proxy settings are determined by the Firewall client. An example of the entries in this list is shown here:

[TrayIcon]
TrayIconVisualState=0
[WebBrowser]
EnableWebProxyAutoConfig=1

The Application.ini Configuration File The Application.ini file is probably the most widely modified configuration file. You can alter configuration options on the firewall itself for all clients (as described in the "Configuring Application Settings" section earlier), you can also modify the Application.ini file on local clients to provide unique methods of dealing with specific types of files and traffic. For more information about how to configure the Application.ini file, see the Advanced Firewall Client Configuration File Settings topic in the ISA Help file.

Using Infrastructure Servers to Automate Client Settings

Maintaining the settings for clients can be automated through the use of your DHCP and DNS servers. As you have already seen, you can enable automatic discovery in the Web proxy or the firewall client. The Web proxy uses the WPAD; the Firewall client uses the Winsock Proxy AutoDetect Protocol (WSPAD). You must configure DHCP or DNS with WPAD entries to support these requests.

Configuring DNS

To configure DNS with a WPAD entry, follow these steps:

  1. On the DNS server, click Start, Administrative Tools, DNS.

  2. Expand the DNS server name, and then expand Forward Lookup Zones. .Right-click the zone name, then select New Alias.

  3. In the New Resource Record dialog box, type WPAD in the Alias box.

  4. In the Fully Qualified Domain Name For Target Host field, type the FQDN name for your ISA server or array (for example, ISA2004.contoso.com).

  5. Click OK, and then close the DNS console.

DHCP Services

To configure DHCP with a WPAD entry, follow these steps:

  1. On the DHCP server, click Start, Administrative Tools, DHCP.

  2. Expand the DHCP server node, right-click the DHCP server name, then select Set Predefined Options.

  3. In the Predefined Options And Values dialog box, click Add. The Option Type dialog box opens.

  4. In the Name box, type WPAD.

  5. From the Data Type drop-down list, select String.

  6. In the Code text box, type 252.

  7. In the Description text box, type WPAD for ISA Automatic Discovery, then click OK.

  8. In the Value area of the Predefined Options And Values dialog box, type http://YourISAServerName:80/wpad.dat.

Note

For DHCP Automatic Discovery to work, the user must have administrative rights on the machine.

Troubleshooting

Cannot Connect to the Firewall Client Installation Share

Be certain that you are installing the software with an account that has permissions to the share, and also be sure that you have enabled the Allow Access To Firewall Client Share To Trusted Computers system policy, if the Firewall Client Installation Share is installed on an ISA server.

Client Dependencies on Infrastructure

Most issues that have to do with the firewall client relate to name resolution. If your firewall client can't find or connect to the ISA server, there's no way the ISA server can provide services.

Be certain that you are using a DNS server that can resolve both internal and external addresses. Preferably, you should use a split DNS structure, where you have an internal DNS server to resolve internal names, which then forwards traffic to an external DNS server for external name resolution.

For additional references about ISA Server clients, refer to the "Additional Resources" appendix at the end of the book.


Chapter 5: Upgrading from Microsoft ISA Server 2000

Overview

This chapter focuses on upgrading from Microsoft ISA Server 2000 to Microsoft ISA Server 2004. In this chapter, we describe the following scenarios:

  • An in-place upgrade of ISA Server

  • Migrating ISA Server 2000 to a new installation of ISA Server 2004

  • Migrating Routing and Remote Access (RRAS) configuration from ISA Server 2000 to ISA Server 2004

  • Upgrading from ISA Server 2004 Standard Edition to ISA Server Enterprise Edition

  • There are some procedures that are unique to Enterprise Edition:

  • Upgrading to a Configuration Storage Server (CSS)

  • Upgrading an array

Table 5-1 shows the all supported upgrade paths for ISA Server.

Table 5-1: Supported Upgrade Paths for ISA Server Versions
 | 2000 Standard Edition | 2000 Enterprise Edition | 2004 Standard Edition | 2004 Enterprise Edition
2000 Standard Edition | N/A | Yes | Yes | No
2000 Enterprise Edition | No | N/A | No | Yes
2004 Standard Edition | No | No | N/A | Yes
2004 Enterprise Edition | No | No | No | N/A

See the Microsoft ISA Server 2000 Administrator's Pocket Consultant for more information about upgrading from Proxy 2.0 to ISA Server 2000 Standard Edition, and from ISA Server 2000 Standard Edition to ISA Server 2000 Enterprise Edition.


Changes When Migrating from 2000 to 2004

There is not enough room in this chapter to outline all detailed changes made in ISA Server 2000 and 2004, but you can find a comprehensive treatment of the material on your ISA media. We strongly recommend reviewing this information by inserting the ISA Server installation CDs, and clicking the Read Migration Guide link.

The Migration Guide is a file in the root of both the ISA Server 2004 Standard Edition and ISA Server 2004 Enterprise Edition installation CDs called Isa2000Migrate.htm. Reading this document saves you a lot of time searching for items that have been renamed or changed.

Here are a select few of the many changes you will encounter when upgrading to ISA Server 2004:

  • Report jobs aren't migrated Because of changes in the reporting structure, reports configured on ISA Server 2000 can't be migrated. You will need to recreate report jobs.

  • Active caching is no longer available This feature was removed from ISA Server 2004.

  • Bandwidth rules aren't supported This feature is also no longer available in ISA Server 2004, even though (until Service Pack 1 is applied) the tab still appears in the interface.

  • Any system access control lists (SACLs) configured are reset to defaults You will need to reconfigure these SACLs.

  • Log configuration settings are returned to defaults Because of advances made in logging functionality, you must reconfigure log configuration settings.

  • Packet filters can't be directly configured You can take advantage of the much richer multinetworking functionality in ISA Server 2004—when you migrate, ISA Server 2000 packet filters are transformed into access rules.

  • Protocol rules and site and content rules replaced with access rules ISA Server 2004 reinterprets protocol rules and site and content rules as access rules, sometimes combining them into a single access rule.

  • Policy elements change Client address sets become computer sets. Destination sets become domain name sets, URL sets, or computer sets, depending on the configuration.

Again, reading through the Migration Guide, available on the ISA Server installation CDs, provides more comprehensive information on what the differences are and how ISA Server 2000 components and functions translate into ISA Server 2004 Enterprise Edition.


Performing an In-Place Upgrade

When upgrading ISA Server 2000 to ISA Server 2004, an in-place upgrade is the most straightforward method. If you are upgrading Enterprise Edition, there are some additional steps required, which we outline in the section entitled "Upgrading ISA Server Enterprise Edition" later in this chapter.

Best Practices

Before making any changes to your ISA Server environment, make a backup of your existing environment. A good utility to create a complete backup that can be restored to the same computer or another ISA Server 2000 computer is found at Jim Harrison's ISATools.org site at http://www.isatools.org/ISAExportImport.zip.
Caution

Your ISA server will be offline for the time it takes to complete the installation. When performing an upgrade, you should always disconnect the ISA server from the Internet and other untrusted networks to protect your computer while it is installing.

To upgrade ISA Server 2000 Standard Edition, ensure that Service Pack 1 or higher is installed, then follow these steps:

  1. Insert the ISA Server 2004 Standard Edition disk, or connect to the media and double-click the ISAautorun.exe file. The Microsoft ISA Server 2004 Setup splash screen will appear, as shown in Figure 5-1.

  2. Click Install ISA Server 2004. The Welcome To The Upgrade Wizard For ISA Server 2004 page shows the components that will be upgraded. Review the list, and then click Next.

  3. On the License Agreement page, read the EULA, select I Accept The Terms In The License Agreement, and then click Next.

  4. On the Customer Information page, enter your user name, organization, and serial number in the appropriate text boxes, then click Next.

  5. On the Destination Folder page, click Change and specify a new path if you so desire. Otherwise, click Next.

  6. On the Export Microsoft ISA Server 2000 Configuration page, click Export to back up your configuration settings. The Welcome To The ISA Server Migration Tool page appears. Click Next.

  7. On the Select The Default Firewall Policy page, you choose between two options, as shown in Figure 5-2:

    • Do Not Allow Clients On The Internal Network Access To The ISA Server 2004 Computer You can use this option if the clients on the internal network don't need to access any resources on the ISA server itself, such as file or print sharing.

    • Allow Clients On The Internal Network To Access The ISA Server 2004 Computer Use this option if clients need to access the ISA server.

    Note

    These options configure the system policies that control access to the LocalHost network. The LocalHost network controls access to the ISA server itself. To maintain the most secure environment possible, it's best to block unnecessary traffic to the ISA server.

  8. Click an option, and then click Next. On the Create Migration File page, click Create to export the migration information, wait for the progress bar to complete, then click Next.

  9. On the Completing The Migration File Creation page, click Finish.

    Note

    The Export Wizard provides a very helpful file called ISA2k_config.log that will be stored in the %SystemRoot%\ISA2k_Upgrade folder. This document reveals the items that will not be migrated into the new system. Pay close attention to these items, and address the issues accordingly. For more information, see the ISA Server Migration Guide on your ISA CD.

  10. On the Export Microsoft ISA Server 2000 Configuration page, click Next. If the Next button is unavailable, you need to click Create The Migration Data.

  11. Read the conditions explained on the ISA Server 2000 Generated Files page, then click Next.

    Important

    Remember that it's very important to protect your ISA server when upgrading, as the upgrade stops the services that protect your server. Disconnect the ISA server from all networks, even internal networks, because of the possibility of an unknown worm or virus presence on the network. While disconnecting, do it in such a way as to keep the network cards in the Connected state. This can be done by leaving the network cable plugged into the switch, and then using the switch management tool to block traffic going to the ISA server. Alternatively, you can disconnect all other connections from the hub or switch.

  12. On the Ready To Install The Program page, click Install. The installation begins. Watch the Status progress bar to monitor the installation.

  13. On the Installation Wizard Completed page, click Finish. When you are prompted to restart the server, click Yes.

  14. After the server reboots, and you log in, you will see the Protect The ISA Server Computer Web page, which you should read carefully.

  15. Ensure that the Firewall service is started by opening the ISA Server Management console, expanding your ISA Server's node, clicking the Monitoring node, and then looking in the Details pane at the Services area. If the Firewall status reads Started, you may reconnect the ISA server to your networks.

Image from book
Figure 5-1: From this screen you can read supporting documentation, run the Migration Wizard, or start the installation of ISA Server.
Image from book
Figure 5-2: This dialog box sets the level of protection for ISA Server.


Migrating an ISA Server 2000 Configuration to a Clean ISA Server 2004 Server

When you choose to take an existing ISA Server 2000 configuration and move it to new servers, follow these steps:

  1. Export the ISA Server 2000 configuration.

  2. Install ISA Server 2004.

  3. Import the ISA Server 2000 configuration to the ISA Server 2004 server.

Exporting the ISA Server 2000 Configuration

To export the ISA Server configuration from ISA Server 2000 to ISA Server 2004, follow these steps:

Note

You must run this utility under the context of an Administrator. You may log on to the server with an Administrative account only for the time it takes to install the ISA Server software, or log on under the context of a user account, and use Secondary Logon (RunAs) to run the program under the context of an Administrative account. For more information, see Windows Help.

  1. Insert the ISA Server 2004 CD, and then wait for the Microsoft ISA Server 2004 Setup screen to appear. Click Run Migration Wizard.

    Note

    If the Server Setup screen does not appear, navigate to the CD and run the Isaautorun.exe file.

  2. The Welcome To The ISA Server Migration Tool page appears. Click Next.

  3. On the File Location page, enter the location and filename for the file you wish to export. This is the name of the Extensible Markup Language (XML) document that contains the ISA Server 2000 configuration information. Click Next.

  4. On the Select The Default Firewall Policy page, you choose between two options:

    • Do Not Allow Clients On The Internal Network Access To The ISA Server 2004 Computer You can use this option if the clients on the internal network don't need to access any resources on the ISA server itself, such as file or print sharing.

    • Allow Clients On The Internal Network To Access The ISA Server 2004 Computer Use this option if clients need to access the ISA server.

    Note

    These options configure the system policies that control access to the LocalHost network, which is the default setting in ISA Server 2000. The LocalHost network controls access to the ISA server itself. To provide the most secure environment possible, it's best to block unnecessary traffic to the ISA server.

  5. Click an option, and then click Next. On the Create Migration File page, click Create, wait for the migration to complete, and then click Next.

  6. On the Completing The Migration File Creation page, make a note of the location of the exported file (and the log file detailing items not migrated), and then click Finish.

Installing ISA Server 2004

Follow the procedures described in Chapters 2 and 3 to install ISA Server 2004 Standard Edition or Enterprise Edition.

Importing the ISA Server Configuration

To import a configuration, follow these steps:

  1. In the ISA Server Management console, select the ISA server in the Console tree.

  2. In the Task pane, click the Tasks tab, and click Import From An Exported ISA Server Configuration File.

  3. In the Import Configuration dialog box, navigate to the XML file you exported from your ISA Server 2000 computer. Select the ISA Server Import Options to match those you chose when exporting the file.

    Note

    A message might appear directing you to clear a check box if the information was not exported into the configuration file.

  4. Watch the progress bar. When it is completed, click OK.

  5. Click Apply to commit the changes.

  6. When prompted to choose between Save The Changes, But Don't Restart The Services and Save The Changes And Restart The Services, select the option you wish, then click OK.

  7. The Apply New Configuration progress bar appears. When it completes, click OK.

Migrating RRAS Configuration

In ISA Server 2000, RRAS is used to configure and allow VPN connections. In fact, any VPN installation can be ported to ISA Server 2004, even without ISA Server 2000 installed. To migrate a portion of those settings, perform one of the following two sets of instructions:

  • Option 1 Install ISA Server 2004 on the computer. The settings will be migrated automatically (with the qualifications listed in Table 5-2).

  • Option 2 Use the Migration Wizard, as described previously.

Table 5-2: RRAS Settings Migrated During an ISA Server 2000 Upgrade
Feature | Condition
VPN Client Connections | The number of VPN clients allowed to connect to the ISA server will be set to the larger of the number of Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol (L2TP) ports. An exception is when IP addresses are statically assigned, and the number of IP addresses is smaller than the number of PPTP or L2TP ports—in this case the number of connections is limited to the number of statically assigned IP addresses.
Preshared Keys | To protect the security of the information, preshared keys are not exported from RRAS or for site-to-site connections.
DNS and Windows Internet Naming Service (WINS) IP Addresses | If the server has an invalid IP addresses for the DNS and WINS servers, the IP addresses won't be migrated; the IP addresses from the DHCP server (if one is installed) will be used instead.
PPTP or L2TP Preferred On Site-to-Site Connections | When RRAS is migrated to ISA Server 2004, it uses the tunneling protocol (either PPTP or L2TP) that was configured first on that connection.
RRAS Credentials On Site-to-Site Connections | Site-to-site RRAS credentials are not exported for security reasons. You must reconfigure them.

Table 5-2 shows the state of migrated VPN settings.


Upgrading ISA Server Enterprise Edition

Upgrading from ISA Server 2000 Enterprise Edition to ISA Server 2004 Enterprise Edition requires two basic steps:

  • Migrate the Enterprise settings from Active Directory to CSS.

  • Upgrade the ISA Server 2000 Enterprise Edition computers to ISA Server 2004 Enterprise Edition.

Whereas ISA Server 2000 Standard Edition stores its information in the local machine registry, and ISA Server 2000 Enterprise Edition stores its information in Active Directory, ISA Server 2004 Enterprise Edition stores its information in something known as the Configuration Storage Server (CSS). The CSS uses an application-specific version of Active Directory (known as Active Directory Application Mode or ADAM) to store the ISA configuration information, and the CSS server needs to be available to all ISA servers. We can upgrade the ISA Server 2000 Enterprise Edition computers to ISA Server 2004 Enterprise Edition either by doing an in-place upgrade or installing a new ISA Server 2004 instance and migrating the data.

As shown in Table 5-3, Microsoft supports upgrading from the previous versions of ISA Server to ISA Server 2004 Enterprise Edition.

Table 5-3: Upgrade Paths Supported for ISA Server 2004 Enterprise Edition
Version | Supported Upgrade Methods
ISA Server 2000 Standard Edition | No support available
ISA Server 2000 Enterprise Edition and Standard Edition | Exporting from ISA Server 2000 Enterprise Edition, and importing into ISA Server 2004 Enterprise Edition

To upgrade, you should follow these steps:

  1. Migrate the settings from the previous version of ISA Server using the ISA Server Migration Wizard.

  2. Install CSS on a server that is not a member of an ISA Server 2000 Enterprise Edition array.

  3. Import the configuration to the CSS.

  4. Install ISA Server 2004 on the ISA server.

Exporting the ISA Server 2000 Enterprise Edition Configuration

To obtain the information from the ISA Server 2000 Enterprise Edition environment, you can use the ISA Server Migration Wizard following these steps:

  1. On an ISA Server 2000 Enterprise Edition computer, insert the ISA Server 2004 Enterprise Edition installation CD, or connect to the installation media.

  2. Click Run Migration Wizard.

  3. The Welcome To The ISA Server Migration Tool page appears. Click Next.

  4. On the File Location page, type in the path and filename for the XML file you wish to export, then click Next.

    Note

    You might want to save this file to a secure network drive so that you can access it later for importation into the CSS.

  5. On the Create Migration File page, click Create to export the migration information, wait for the progress bar to complete, then click Next.

  6. On the Completing The Migration File Creation page, make a note of the location of the Export File Name and then click Finish.

Note

The Export Wizard provides a very helpful configuration log file that will be located in the same directory as the file you exported. This document reveals the items that will not be migrated into the new system. Pay close attention to these items, and address the issues accordingly. For more information, see the ISA Server Migration Guide on your ISA CD.

Installing CSS

When you first install the CSS, place it on a computer that is not part of a current ISA Server 2000 Enterprise Edition array. Follow these steps to install the CSS:

  1. Insert or connect to the ISA Server installation media, then double-click the IsaAutoRun.exe file.

  2. On the Welcome To The Installation Wizard For Microsoft ISA Server 2004 page, click Next.

  3. On the License Agreement page, read the EULA, select I Accept The Terms In This License Agreement, and then click Next.

  4. Complete the Customer Information fields, then click Next.

  5. On the Setup Scenarios page, select Install Configuration Storage Server as shown in Figure 5-3, then click Next.

  6. On the Component Selection page, the ISA Server Management and the Configuration Storage Server features should be set to install as shown in Figure 5-4. Click Next.

  7. On the Enterprise Installation Options page, select Create A New ISA Server Enterprise, then click Next. You will be creating a new instance of CSS. Read the information on the New Enterprise Warning page, then click Next.

  8. On the Create New Enterprise page, type the name of your enterprise and a description in the appropriate boxes, then click Next.

  9. On the Enterprise Deployment Environment page, select whether you will install the CSS server into a domain or a workgroup.

    If you choose to install into a workgroup, see the procedures in Chapter 3 , "Configuring and Installing Microsoft ISA Server," for more information.

  10. If you are installing on a domain controller, the Configuration Storage Server Service Account page appears. Type the account name and password for the account that will be used to run the CSS service, as shown in Figure 5-5.

    If you are installing into a workgroup, you need to configure shadow accounts. See Chapter 3 for more information.

  11. On the Ready To Install The Program page, click Install. The Installing Microsoft ISA Server 2004 page appears. When the progress bar completes, click Next.

  12. The Installation Wizard Completed page appears. If you wish to open the ISA Server Management console, select the Invoke ISA Server Management When The Wizard Closes check box. Click Finish to close the window.

    For more detailed instructions on how to install and configure the CSS, see Chapter 3.

Image from book
Figure 5-3: Choose to install the CSS.
Image from book
Figure 5-4: Select the components required to install and manage the CSS.
Image from book
Figure 5-5: Configure the CSS Service account information.

Importing the Configuration to the ISA Server 2004 Enterprise Edition Computer

You exported the information from your ISA Server 2000 Enterprise Edition array into an XML file. Follow these steps to import the enterprise configuration into the ISA Server 2004 Enterprise Edition environment.

  1. In case of problems, back up the ISA Server 2004 environment using your preferred backup media.

  2. Install any certificates that might be necessary for ISA Server, including those that might be required to communicate with other ISA servers in a workgroup.

  3. In the ISA Server Management console, select the Microsoft Internet Security and Acceleration Server 2004 node at the top of the console tree.

  4. On the Tasks tab, click Import (Restore) Configuration.

  5. On the Welcome To The Import Wizard page, click Next.

  6. On the Select The Import File page, as shown in Figure 5-6, click Browse, navigate to the configuration file you wish to import, and then click Open. Click Next.

  7. On the Import Action page, select either Import or Overwrite (Restore). Import merges the configuration information with the existing configuration. Overwrite (Restore) replaces existing settings with the settings in the imported configuration file. Click Next.

  8. On the Import Preferences page, select whether you wish to import server-specific or user permission settings, then click Next.

    Note

    Obviously, if you did not export user permissions, you cannot import them.

  9. If you configured a password when exporting your configuration, you will see the Enter Password page. Type the password you created when exporting your information, then click Next. If you did not enter a password, you won't see this page.

  10. On the Completing The Import Wizard page, read the summary and click Finish. The configuration will be imported into your array. If you chose to overwrite existing settings, you'll see a dialog box confirming that you wish to take this step. If you're sure, click OK.

  11. A progress bar shows the import process. After setup completes, click OK. Click Apply. If you have any issues, click the Details tab, and resolve the described problem.

    Caution

    Be aware that some changes might have occurred. Always check your rules after import to ensure they still meet your standards.
Image from book
Figure 5-6: You can import the settings from the ISA Server 2000 configuration when upgrading to ISA Server 2004.

Installing ISA Server 2004 on the ISA Server

You can do an in-place installation of ISA Server 2004 Enterprise Edition, or you can configure a clean installation of ISA Server 2004 Enterprise Edition and import the configuration from ISA Server 2000 Enterprise Edition. Follow this procedure to conduct an in-place upgrade of your ISA server.

Note

If you are upgrading an entire array, you need to ensure that your CSS is installed on a machine that was not part of the original ISA Server 2000 Enterprise Edition array.

In-Place Upgrade of ISA Server 2000 Enterprise Edition

To conduct an in-place upgrade of ISA Server 2000 Enterprise Edition, follow these steps:

  1. Insert the ISA Server 2004 Enterprise Edition CD, or connect to the media and double-click the ISAautorun.exe file. The Microsoft ISA Server 2004 Setup splash screen appears.

  2. Click Install ISA Server 2004. The Welcome To The Installation Wizard For ISA Server 2004 page shows the components that will be upgraded. Review the list, and then click Next.

  3. On the License Agreement page, read the EULA, select I Accept The Terms In The License Agreement, and then click Next.

  4. On the Customer Information page, enter your user name, organization, and serial number in the appropriate boxes, and then click Next.

  5. On the Destination Folder page, click Change and specify a new path if you so desire. Otherwise, click Next.

  6. On the Locate Configuration Storage Server page, enter the Fully Qualified Domain Name (FQDN) of the CSS, log on with or configure an account that has access to the CSS, then click Next.

    Note

    If you receive a message stating that "The Selected Storage Server Does Not Contain The Migrated Array For The Current ISA Server 2000 Computer," click Yes if you wish to continue and lose some server-specific settings. Otherwise, click No, and import the appropriate array configuration to the CSS.

  7. On the Join Existing Array page, type the name of or browse to the array you wish to join, then click Next.

  8. On the Configuration Storage Server Authentication Options page, select the option that you will use to authenticate your ISA server to the CSS from one of the following:

    • Windows Authentication Use a domain or local service account to authenticate. If you use a local account, you need to configure the same user and password on all other participating ISA servers.

    • Authentication Over SSL Encrypted Channel Use this option to provide authentication for computers in workgroups or separate domains.

  9. On the Internal Network page, configure the appropriate networks, and then click Next.

  10. On the Services Warning page, review the information, and then click Next.

  11. Read the conditions explained on the ISA Server 2000 Generated Files page, and then click Next.

    Important

    It's essential to disconnect your ISA server from untrusted networks before upgrading, as the upgrade stops the services that protect your server.

  12. On the Ready To Install The Program page, click Install. The installation begins. Watch the Status progress bar to monitor the installation.

  13. On the Installation Wizard Completed page, click Finish. When you are prompted to restart the server, click Yes.

  14. After the server reboots, and you log on, you see the Protect The ISA Server Computer Web page.


Upgrading From ISA Server 2004 Standard Edition to Enterprise Edition

When you need to move from your ISA Server 2004 Standard Edition environment, you can upgrade to ISA Server Enterprise Edition by following the steps given here. Many of these steps have already been covered in this chapter, and we refer you to the section names.

  1. Export your array information from the ISA Server 2004 Standard Edition computer into an XML file by following these steps:

    1. In the ISA Server Management console, select the ISA Server from which you wish to export configuration information.

    2. In the Task pane, click Export ISA Server Configuration To A File.

    3. In the Export Configuration dialog box, type the name of the file you wish to create in the File Name box, then select the Export User Permission Settings and Export Confidential Information (Encryption Will Be Used) check boxes.

    4. Click Export to create the file. You will see a progress bar, as shown in Figure 5-7. When prompted for a password, create one that has at least eight characters.

    5. Uninstall ISA Server 2004 from the machine through the Add/Remove Programs Wizard. Any service packs you installed are removed when you uninstall ISA Server.

      Note

      Be certain to disconnect your ISA server from any networks before uninstalling ISA Server Standard Edition, as you will not be protected in the time between ISA Server Standard Edition removal and ISA Server Enterprise Edition installation.

  2. Install the Configuration Storage Server (CSS) option as described in the section entitled "Upgrading ISA Server Enterprise Edition," earlier in this chapter, with the following exceptions:

    1. When prompted on the Setup Scenarios page, you can select Install Both ISA Server Services And Configuration Storage Server if you are installing this into a new enterprise. If you wish to store the CSS on a separate machine, install the two components separately.

    2. When presented with the Internal Network page, add the IP address ranges from your internal network card.

  3. Import the array information from the configuration file you created in step 1 as described in the section "Importing the Configuration to the ISA Server 2004 Enterprise Edition Computer" earlier in this chapter.

  4. Install the remaining ISA servers into the array.

Image from book
Figure 5-7: Export the configuration of an ISA Server 2004 machine before upgrading to Enterprise Edition.


Troubleshooting ISA Server Upgrades

You might run into several common problems when upgrading ISA Server. We outline a few common problems and their solutions here, but be sure to check out the "Additional Resources" appendix for other resources you can use to troubleshoot ISA Server migrations.

For common questions and answers see the ISA Server 2004 FAQ for Installing and Upgrading at http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/faqinstallupgrade.mspx.

Missing Components

One of the most common issues relates to changes between ISA Server 2000 and ISA Server 2004. You might be missing certain functionality, like Bandwidth Throttling or Windows Media Live Stream Splitting, or you might be missing policy elements you knew before, like destination sets, which are now called URL sets. Your best bet is to read the Migration Guide on your ISA CD, and visit the ISA Support Site at http://support.microsoft.com/ph/2108/en-us/.

ISA Server Migration Wizard Command Lines

You might need to export certain items from your ISA server. The ISA Server Migration Tool (located in the Tools folder on your ISA Server CD) can be run from a command line with these behaviors:

  • d:\tools\ISA2KExport.exe without parameters runs the Upgrade UWizard.

  • d:\tools\ISA2KExport.exe [/?] [/q] [/c] [/s] [/p:password] [/r:ipranges] [/m:<mode>]

  • [/a:<array_guid>] /o:filename.xml

  • [/q]:For quiet mode, no message box will be displayed.

  • [/c]:In quiet mode, continue in spite of item that can't be migrated.

  • [/r]:Defines the 3-leg perimeter network.

    • ipranges- x.x.x.x-y.y.y.y,z.z.z.z-w.w.w.w

  • [/p:password]:Password to encrypt confidential information (at least eight characters).

  • [/m:<mode>]:Selects export mode. Available modes: SRV- server settings, PWD-array secure items, VPN- RRAS setting.

  • [/a:<array_guid>]:Sets the array storage name in the XML file. Used only with /m flag.

  • [/o:filename.xml]:Output filename. This requires the extension .xml.

Example:

     d:\tools\ISA2KExport.exe /q /c /s /o:file.xml
/r:169.0.0.0-170.0.0.0

Configuration Import Errors

When you import configuration files from other ISA servers, you sometimes receive a cryptic message. More often than not, the problem is that you have a mismatch— you're importing the file at the wrong level. For example, when you try to import a configuration file created by the Migration Wizard on an ISA Server 2000 Enterprise Edition machine into an ISA Server 2004 Enterprise Policy or Array, you receive this message:

Error 0xc00403a4. The exported enterprise XML file does not include data for the importing object. The file cannot be imported into this object. The error occurred on object "Default Policy" of class "Policy" in the scope of enterprise policy "Default Policy".

To resolve the problem, import the file into the enterprise (at the top node of the console tree).

When you migrate settings from the ISA Server 2000 Enterprise Edition, you might also encounter this error message:

Error 0xc0040341 An XML DOM document object that was exported without the fpcExportImportServerSpecific flag set cannot be imported with the fpcExportImportServerSpecific flag set.

This message indicates that you chose the Import Server-Specific Information option in the Import Wizard, but did not export this information from the ISA Server 2000 Enterprise Edition installation. To resolve the issue, re-export the data from the ISA Server 2000 Enterprise Edition machine.

For other references, see the "Additional Resources" appendix.


Chapter 6: Monitoring and Reporting

Effective administration of Microsoft ISA Server 2004 requires the ability to monitor activities related to ISA Server services, user sessions, triggered alerts, and events. Reporting allows administrators to use of the information that ISA Server captures to help audit the computing environment and to make appropriate business decisions. In this chapter we examine each of ISA Server's monitoring and reporting capabilities. In addition, Chapter 18, "Configuring ISA Server with Microsoft Operations Manager 2005," focuses on extending your monitoring reach with the help of Microsoft Operations Manager 2005 and the ISA Server 2004 Management Pack.

Monitoring Components

ISA Server 2004 provides extensive monitoring above and beyond that found in previous versions of the software, as listed in Table 6-1.

Table 6-1: Monitoring Components
Monitoring Component | Description
Dashboard | Summarizes information about connectivity, alerts, services, sessions, reports, and system health in a single view
Alerts | Provides an overview of preconfigured or custom alerts, indicating events that took place
Sessions | Shows the number and state of sessions connected to the ISA server
Services | Shows the status of ISA Server services
Configuration Status | Shows the configuration version on each array member, and compares that to the version of the Configuration Storage Server (CSS) to which the current ISA server is connected; only available in Enterprise Edition
Reports | Shows the reports configured by administrators to show activities
Logging | Shows the traffic passing through ISA Server

ISA Server also records information in Events, which are logged in the Application Log in the ISA server's Event Viewer. You can configure Alerts to record information in this log. ISA Server Enterprise Edition also records CSS-related events in the ADAM (YourADAMInstanceName) log. For more information, see the ISA Server Help file.


Dashboard

The dashboard is a completely new feature in ISA Server 2004. You can see up-to-the minute statistics on each of the components discussed in Table 6-1. The dashboard can be customized to reflect the data on which you want to focus, and each of the areas on the dashboard can be minimized to give you more viewing space if needed. The topics discussed throughout this chapter allow the dashboard to accurately reflect the current situation on your ISA server.

In the dashboard, the System Performance area shows the Allowed Packets/Sec and Dropped Packets/Sec readings. You can also view the performance statistics on the ISA server by viewing the ISA Server Performance Monitor, which you can view by clicking Start, All Programs, Microsoft ISA Server, and then ISA Server Performance Monitor.

Configuring Refresh Rate Settings

If you are responsible for administering ISA Server 2004, the dashboard is where you will spend a lot of your time when you are not configuring new rules and policies. When working from the Monitoring node, refresh rate settings can be configured on any of the tabs in the details pane. To set the refresh rate, follow these steps:

  1. In the console tree, click the Monitoring node.

  2. Open the ISA Server Management console.

  3. Click the applicable tab in the details pane that you would like to configure. In this example, you configure the refresh settings for the Dashboard tab.

  4. In the task pane, under Automatic Refresh Rate, select from None, Low, Medium, and High.

    Note

    The default refresh rate setting is Medium, which refreshes data every 60 seconds. A Low refresh rate setting refreshes data every 120 seconds, and a High refresh rate setting refreshes data every 30 seconds. If you choose None, you must manually refresh the data.


Alerts

Alerts give you a way to proactively assess the security of the ISA server. The preconfigured alerts that ship with ISA Server 2004 offer information on a variety of events such as IP Spoofing, Slow or No Connectivity, DNS Intrusion, and Service Shutdown.

Viewing Predefined Alerts

ISA Server 2004 includes 56 predefined alerts. To view a predefined alert, follow these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Alerts tab.

  4. In the task pane, click Configure Alert Definitions.

  5. In the Alert Properties dialog box, you will see each of the predefined alerts. On this page, you can add an alert, edit an alert, or remove an alert.

Creating an Alert

Although many predefined alerts exist by default in ISA Server 2004, there might be times when you would like to customize your own alert and create a new one. To create an alert, complete the following steps:

Open the ISA Server Management Console

  1. In the console tree, click the Monitoring node.

  2. In the details pane, click the Alerts tab.

  3. In the task pane, click Configure Alert Definitions.

  4. In the Alert Properties dialog box, click Add.

  5. On the Welcome To The New Alert Wizard page, type a name for the new alert, and then click Next.

  6. On the Events And Conditions page, select an event and condition that will trigger the alert you are creating. In the Event drop-down list box, select the event you would like to establish, such as DNS Intrusion. If applicable, select a condition from the Additional Condition drop-down list, and then click Next.

    Note

    If you specify an event and a condition, both must be met before the alert is triggered. Also, if you are trying to create an alert that has already been defined, you receive an error that the alert already exists.

  7. In Enterprise Edition, on the Server page, select whether you want any server or a specific server to trigger the alert, and then click Next.

  8. On the Category And Severity page, from the Category drop-down list box, select the category to which you wish to assign this alert. From the Severity drop-down list box, select the severity for the alert. Click Next to continue.

  9. On the Actions page, you select the actions that should occur when the alert is triggered. The five actions alerts can trigger are as follows:

    • Send An E-Mail Message

    • Run A Program

    • Report The Event To The Windows Event Log

    • Stop Selected ISA Server Services

    • Start Selected ISA Server Services

Note

You must select at least one action or the New Alert Wizard won't continue. You can select more than one action to transpire in the event of the alert.

The remaining wizard steps vary depending on the actions you selected. The following sections provide continuing instructions for configuring each of the possible actions.

Sending an E-Mail Message

To inform you when an alert takes place on the ISA Server computer, you might configure an alert to send an e-mail to the address of your choosing by following these steps:

  1. On the Actions page, select the Send An E-Mail Message check box, and click Next.

  2. On the Sending E-mail Messages page, you must specify the SMTP server and e-mail addresses as shown in Figure 6-1. In the SMTP text box, type the name of your SMTP server. In the From text box, type the e-mail address of the mailbox that the e-mail should come from. In the To and CC text boxes, type the email addresses of the mailboxes to receive the e-mail when the alert is triggered. Click Next to continue.

    Note

    The SMTP server could be either a server already available on your internal network or an external SMTP server that supports relaying. An internal SMTP server will make configuration much easier. If you're using an external server that supports relaying, ensure that ISA Server rules allow outgoing SMTP traffic from the LocalHost network. Although this is outside the scope of this book, ensure that you don't have an open relay, which would allow spammers to use your SMTP server to send unauthorized messages. Do be sure to contact your e-mail server administrator to ensure appropriate authentication is used.

  3. On the Completing The New Alert Configuration Wizard page, review the summary of information, and then click Finish.

  4. Click OK to close the Alert Properties dialog box.

  5. In the details pane, click Apply to save the changes, and then click OK.

Image from book
Figure 6-1: To receive alerts by e-mail, the SMTP server information must be entered and verified.
Note

Configuring an alert action to send an e-mail message allows you to be notified of alert events even when away from the office.

Running a Program

You can configure an alert to start and run a program of your choosing by completing the following steps:

  1. On the Actions page, select the Run A Program check box, and click Next.

  2. On the Running A Program page, in the Program text box, type the name of the executable that should be run, as shown in Figure 6-2. In the Use This Account section, select Local System Account, or User Name to choose a user name defined on your network. If you select User Name, you can either type the name or browse to find the name in the selected directory database. To complete this stage of the wizard, you'll also be required to type in the password for the user name and then confirm the password. Click Next to continue.

    Note

    For the ISA server to query Active Directory directory service, ensure that the System Policies allow the ISA server access to Active Directory. For more information about how to configure System Policy, see the ISA Server Help file.

  3. On the Completing The New Alert Configuration Wizard page, review the summary of information, and then click Finish.

  4. Click OK to close the Alert Properties dialog box.

  5. In the details pane, click Apply to save the changes, and then click OK.

Image from book
Figure 6-2: If you would like to execute a program after an alert is triggered, the program and an account with sufficient access needs to be configured.

Reporting the Event to the Windows Event Log

To keep all reporting consistent for your ISA server, you might want ISA Server to log its alerts into a centralized tracking location: the Windows Event Log.

  1. On the Actions page, select the Report The Event To The Windows Event Log check box, and click Next.

  2. On the Completing The New Alert Configuration Wizard page, review the summary of information, and then click Finish.

  3. Click OK to close the Alert Properties dialog box.

  4. In the details pane, click Apply to save the changes, and then click OK.

Stopping Selected ISA Server Services

There will be times when you want to start or stop an ISA Server service. To do so, follow these steps:

  1. On the Actions page, select the Stop Selected ISA Server Services check box, and click Next.

  2. On the Stopping Services page, you can stop the following ISA services:

    • Microsoft Firewall

    • Microsoft ISA Server Job Scheduler

    You can select the ISA services individually or choose to select all or clear all check boxes. Click Next to continue.

  3. On the Completing The New Alert Configuration Wizard page, review the summary of information, and then click Finish.

  4. Click OK to close the Alert Properties dialog box.

  5. In the details pane, click Apply to save the changes, and then click OK.

Starting Selected ISA Server Services

  1. On the Actions page, select the Start Selected ISA Server Services check box, and click Next.;

  2. On the Starting Services page, select the check boxes for the applicable ISA services as shown in Figure 6-3, and click Next.

  3. On the Completing The New Alert Configuration Wizard page, review the summary of information, and then click Finish.

  4. Click OK to close the Alert Properties dialog box.

  5. In the details pane, click Apply to save the changes, and then click OK.

Image from book
Figure 6-3: You can configure an alert to start one or all ISA Server services.

Configuring an Alert

After you've walked through the wizard to create a new alert, you can configure additional alert properties. In the task pane, click Configure Alert Definitions, select an alert, click Edit, and then you'll see the three tabs detailed in Table 6-2.

Table 6-2: Alert Configuration Options
Tab Name | Tab Description
General | Provides name, description, drop-down lists for Category and Severity, and a check box to enable or disable the alert.
Events | Provides the event and description of the event used in triggering the alert. Displays additional conditions if applicable. Contains the specific settings for defining how many times the event should occur before triggering the alert, along with how to handle recurring actions.
Actions | Provides check boxes for the five actions that can be used in notification when an alert is triggered.

On the General tab you can enable or disable the alert. When you disable an alert, in the Alert Properties dialog box, the check box for the alert is empty. By default, the following six alerts are disabled:

  • Cached Object Discarded

  • Event Log Failure

  • Network Configuration Changed

  • Quarantined VPN Clients Network Changes

  • Server Publishing Is Not Applicable

  • SMTP Filter Event

The Events tab is important because it contains properties you can't configure using the Creating A New Alert Wizard. On the Events tab, you can configure the following items:

  • Number Of Occurrences Identifies the number of times the event must occur before the alert triggers.

  • Number Of Events Per Second Indicates the number of events that must occur per second before the alert triggers.

  • Each Subsequent Time The Thresholds Are Met, Trigger The Alert: Immediately, Only If The Alert Was Manually Reset, or If Time Since Last Execution Is More Than XX Number Of Minutes Allows you to choose the way in which ISA Server will handle alerts if events after the first alert occur.

On the Actions tab you can modify the five types of actions that are executed when an alert is triggered.

Note

By default, all predefined alerts are configured to report to the Windows Event Log.

Viewing Alerts

After you create a new alert, the next step is to verify that the alert is working properly.

To view when an alert has been triggered, complete the following steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click Alerts, and view the alerts that have been triggered. Multiple alerts of the same type are rolled up and can be viewed in detail by clicking the plus (+) sign to expand the alerts.

The information you require to determine how to assess the situation is provided in the ISA Server Help files under the topic of Alerts. If the information provided by the alert doesn't assist in determining the exact cause, because all predefined alerts write to the Windows Event Log, you can open Event Viewer, locate the specific Event ID and description, and use Microsoft's Knowledge Base to find more information.

Resetting and Acknowledging Alerts

After locating and investigating the root cause of the alerts that have been triggered, your next step is to reset or acknowledge the alert. Resetting an alert removes it from the Alerts pane, and clears ISA Server's "memory" of the event or events—all alerts are reset when the ISA server is rebooted. Acknowledging an alert removes it from the Dashboard view, and changes the alert status—this option is most helpful when more than one administrator manages ISA Server. One administrator can acknowledge the alert so that others know that the alert occurred, but that someone else has claimed ownership and is working on the issue.

To reset an alert, follow these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Alerts tab, and then either select the grouping of alerts or select an individual alert.

  4. In the task pane, under Alert Tasks, click Reset Selected Alerts.

  5. When prompted by the Confirm Alert Notification Reset warning, click Yes. The alert should disappear from the details pane.

To acknowledge an alert, follow these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Alerts tab, and then either select the grouping of alerts or select an individual alert.

  4. In the task pane, under Alert Tasks, click Acknowledge Selected Alerts.

  5. In the details pane, the Status column changes from New to Acknowledged.


Services

Four services, or specialized processes, provide ISA Server functions:

  • Microsoft ISA Server Control (Mspadmin.exe) Controls the restarting of other services when needed and the generation of alerts and running actions, and works with the ISA Server Storage service to update the configuration to all array members.

  • Microsoft Firewall (Wpsrv.exe) Supports requests from firewall clients and SecureNAT clients and Web proxy clients routed to the proxy filter. When this service is stopped, ISA Server enters lockdown mode, which is enforced by the Firewall Engine service.

  • Microsoft ISA Job Scheduler (W3Prefetch.exe) Downloads cache content from Web servers, and schedules report jobs.

  • ISA Server Storage (Isastg.exe) Responsible for managing read and write access to the local configuration store.

  • Firewall Engine (Fweng.exe) A kernel-mode driver (really, a packet filter driver) that manages firewall traffic by making packet filtering and address translation decisions. This service enforces lockdown mode.

Caution

If the Firewall Engine service stops, no protection exists, and everything is allowed! Be very careful of stopping this service, and set an alert to monitor this condition.

  • Microsoft Data Engine Service (Mssqlserver.exe) Controls the SQL Server database to which ISA Server logs are stored by default.

  • Network Load Balancing (NLB) Integration When NLB integration is enabled, you will see information showing the NLB service for each server in the array on the Monitoring tab of the ISA Server Management console.

  • Remote Access Service When virtual private network (VPN) client access or a site-to-site network is enabled, you will be able to see the Remote Access service on the Monitoring tab of the ISA Server Management console.

Starting and Stopping ISA Services

The best way to stop, start, or restart services is to open the Services console (either through Administrative Tools, Computer Management, or by typing services.msc from a command line), choose the service, and click the Start, Stop, or Restart buttons. Outside of this conventional method of starting and stopping services, you can perform service administration from within the ISA Management console by completing the following steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Services tab, and then select the service you would like to start or stop.

  4. In the task pane, under Service Tasks, click Stop Selected Service.

    Note

    You can also right-click the applicable service and select Stop or Start. In the task pane, the options available to you differ depending on whether the service currently is running or stopped. Another option would be to start and stop services from the command line using "net start servicename" or "net stop servicename" where servicename is the short name of the service. For the NLB service, you can also use advanced functions such as drainstop, suspend, and resume. See the ISA Server Help file for more information.


Sessions

A connection to the ISA server from a particular client is known as a session. ISA Server lets you quickly see the users with active sessions and the type of connection or connections that client is making.

Monitoring Sessions

As soon as you make Internet access available to the end users in your organization, you'll find that you need to know which users are connected to your ISA server, and whether they're connected as firewall clients, SecureNAT clients, Web proxy clients, or all three.

To view active sessions, follow these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Sessions tab. All active sessions appear in the details pane.

There are six descriptive columns shown for active sessions by default, with a total of eight available columns, which are described in Table 6-3. You can add, remove, or move any of the columns by right-clicking a column and selecting the action you wish to perform. Table 6-3 illustrates the type of information you can gather from the Sessions tab.

Table 6-3: Session Information
Title | Description
Activation | Provides the date and time the session was activated.
Session Type | Identifies the session type: firewall, Web proxy, SecureNAT, VPN client, or VPN remote site.
Client IP | Displays the authenticated computer's IP address.
Source Network | Identifies the source network from which the connection is being made.
Client Username | Displays the authenticated user name if it's available, based on the type of connection.
Client Host Name | Displays the host name of the client computer, if available; this option is available when using the Firewall client.
Server Name | Identifies the specified ISA server (not shown by default).
Application Name | Identifies the application name; this is not shown by default, and is available only when the client uses a Firewall or Web proxy client. If the session is a VPN client, this section shows the VPN protocol used (PPTP or L2TP/IPSec).

Filtering Sessions

The ability to filter data is a time saver whether you are responsible for a single ISA server or thousands. In ISA Server 2004, filtering has been included so that you can isolate the data being presented to you within the Sessions tab and Logging tab. The following steps show you how to filter sessions:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Sessions tab.

  4. In the task pane, under Session Tasks, click Edit Filter.

  5. In the Edit Filter dialog box, select appropriate choices in the Filter By and Condition drop-down lists, type the value, and click Add To List as shown in Figure 6-4. You can insert additional filters if needed.

  6. Click Start Query to filter the sessions.

    The filter remains in place after stopping to monitor sessions. To restore the defaults, you must right-click the filter and then click Edit Filter. On the Edit Filter dialog, select each filter condition, and then click Remove. Finally, click Start Query.

Image from book
Figure 6-4: You have a lot of control over the types of filters you would like to configure, which can even be saved for future use.

Creating Connectivity Verifiers

ISA Server can use several methods (Ping, TCP Connect, or an HTTP request, for example) to verify connectivity from the ISA Server computer to any computer or URL on any network. This helps you to monitor certain functions from the ISA Server console.

From the dashboard view, there is a connectivity area that displays the status of groups like Active Directory, DNS, DHCP, Web (Internet), and so on. By default, the status of these groups is Not Configured because connectivity verifiers are required to establish checks from the ISA server to a select server on the network. The following steps show how to create a connectivity verifier so that when viewing the dashboard, you can see the actual status of your DNS server or Web servers, for example.

To create a connectivity verifier, follow these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Connectivity tab.

  4. In the task pane, under Connectivity Tasks, click Create New Connectivity Verifier.

  5. On the Welcome To The New Connectivity Verifier page, type a name for the connectivity verifier, and click Next.

  6. On the Connectivity Verifier Details page, you choose the server to monitor, the group to assign the verifier, and the verification method, as shown in Figure 6-5. In the Monitor Connectivity To This Server Or URL text box, type the server name or URL address of a Web site you wish to verify. In the Group Type Used To Categorize This Connectivity Verifier drop-down list, select the applicable group type. For the verification method, select either Send An HTTP "GET" Request, Send A Ping Request, or Establish A TCP Connection To Port, and then click Next.

  7. On the Completing The New Connectivity Verifier Wizard page, review the summary of information, and then click Finish.

  8. In the details pane, click Apply to save the changes, and then click OK.

Image from book
Figure 6-5: Creating a connectivity verifier to ensure communications on your network.

Disconnecting a Session

Disconnecting an active session becomes more important when you're changing rules and policies. For example, you reconfigure an access rule to remove a set of users and groups for outbound Internet access. Later that day, you notice that users in the group you removed can still access the Internet. If any of the users in the group have an active session on the ISA server when you make a policy change, they are allowed to remain on the Internet until they end their session. You can disconnect those users' sessions so that Internet access will immediately be denied by following these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Sessions tab, and select the session you wish to end.

  4. In the task pane, click Disconnect Session.

    Note

    If the session represents a VPN tunnel, you will have the added option to disconnect the VPN tunnel.

Exporting and Importing Filter Definitions

If you filter session activity on a regular basis, you can create a filter definition to assist with the repetitive work. To export and import filter definitions, complete the following steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Sessions tab.

  4. In the task pane, under Sessions Tasks, click either Export Filter Definitions (to save the filter settings to a file) or Import Filter Definitions (to load filter settings from a file), browse to the location of the existing .xml file if importing, and then click Load.


Events

You accomplish event monitoring in ISA Server through Event Viewer, a built-in administrative tool. In this section we explore first how to monitor and then how to analyze events. To open Event Viewer, select Event Viewer from the Administrative Tools menu.

Monitoring Events

You can start and stop ISA Server services through the ISA Management console, the Services Microsoft Management console (MMC), or from a command line. Each time a service status changes, an event is created. All ISA Server events are written to the Application log in Event Viewer. As a network administrator, whether you're determining the cause of a problem or merely checking on past server activity, Event Viewer is your primary resource.

In the earlier section in this chapter entitled "Alerts" we took an in-depth look at the role of alerts in ISA Server. All 56 alerts are preconfigured to write an event to the Application log. Because of the variety of events maintained in Event Viewer, it's nearly impossible to gain knowledge of each type of ISA Server event. For many network administrators, knowing the meaning of every event isn't as important as knowing where to find the information to resolve the event. Microsoft has collected lists of events for each of the ISA services and has made those events available in ISA Server Help. To locate more information within ISA Server Help, type Event Messages into the search field.

Analyzing Events

In the Microsoft Support Center, located at http://support.microsoft.com, you can perform searches against an indexed catalog of support articles related to ISA Server. As most event descriptions seem cryptic, your search results against the Microsoft Knowledge Base will help discover support articles that provide more detailed explanations of the problem, cause, and resolution.

A great way to stay informed of events is to implement an event monitoring solution such as Microsoft Operations Manager 2005 (MOM), which makes available a management pack specifically for ISA Server. For more information on MOM, see Chapter 18.


Logs

ISA Server creates logs to gather all activity that takes place with the firewall service, Web proxy service, and SMTP message screener. These logs are the source of the reports generated in the next section entitled "Reports," and you can use them for further analysis and troubleshooting. Table 6-4 illustrates the log types available in ISA Server and points out the supported log formats for each.

Table 6-4: ISA Server Log Types Open table as spreadsheet
Log Type | Description | Supported Log Formats
Firewall Logging | Log details from the Microsoft Firewall service. | SQL, MSDE, File
Web Proxy Logging | Log details from the Web proxy service. | SQL, MSDE, File
SMTP Message Screener Logging | Log details from the SMTP Message Screener. | File

Configuring Logging to an SQL Server Database

Logging to a database adds extra flexibility, especially for administrators managing ISA Server in a large enterprise environment. If you centrally store all the log file data from one or more ISA servers into a single database, such as Microsoft SQL Server, you greatly improve your ability to quickly query information you need to discover.

If you log to a separate SQL Server computer, the ISA Server performance will degrade, as every request must be logged, so plan your network capacity accordingly. The internal network adapter might become congested, and in high-traffic situations the ISA server can stop logging, and therefore will stop servicing clients.

Use MSDE to log with ISA Server to maximize performance. If you do connect to an SQL Server computer, be sure that network capacity between the ISA server and SQL Server computer is 100 Mbps for up to three array members, and 1 GB for more than four array members.

To configure logging to a SQL database, follow these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Logging tab.

  4. In the task pane, under Logging Tasks, click Configure Firewall Logging. Whether you are configuring firewall logging, Web proxy logging, or SMTP message screener logging, the following steps are consistent and Figure 6-6 is identical.

  5. In the Firewall Logging Properties dialog box, on the Log tab, select SQL Database as shown in Figure 6-6.

    Note

    The ODBC logging option is only available with ISA Server 2004 Standard Edition; Enterprise Edition replaces ODBC with the improved SQL logging layer. The ODBC option will most likely not be available in future versions of ISA Server.

  6. In the ODBC Data Source Name (DSN) DSNtext box, type the name of the DSN.

  7. In the Table Name text box, type the name of your table.

  8. Click Set Account, type the user name and password of an account with permissions to write to the database, and click OK.

    Note

    If your logging configuration isn't working, check your System Policies. You may need to update the Remote Logging configuration group in the System Policy.

  9. Click Apply to save the changes, and then click OK.

    This process covers only the simplest configuration—if you run into any problems, see the additional configuration and troubleshooting articles referenced in the appendix at the end of this book.

Image from book
Figure 6-6: Logging to an SQL database requires a predefined ODBC Data Source Name (DSN), a data table, and an account with appropriate permissions.

Configuring Logging to MSDE

New to ISA Server 2004 logging is the ability to log to the Microsoft Desktop Engine (MSDE 2000). Firewall and Web proxy logging use this logging configuration by default. It is beneficial for those who prefer not to log to a file, but who do not have a SQL server available for this purpose. MSDE databases can grow no larger than 2 GB in size. If the log data begins to exceed 2 GB, ISA Server automatically creates a new database.

Of course, ISA Server creates a new database file every day in any case. ISA Server's log viewer can see data from more than one database, but if you pull information using third-party tools, you'll need to address consolidating data from multiple logs.

To log to an MSDE database, complete the following steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Logging tab.

  4. In the task pane, under Logging Tasks, click Configure Firewall Logging.

  5. In the Firewall Logging Properties dialog box, on the Log tab, select MSDE Database, and then click OK.

  6. Click Apply to save the changes, and then click OK.

    If you try to connect to the MSDE instance on the ISA Server computer from a remote Enterprise Manager console, you won't have any luck because only local connections are allowed. You can only connect from the Enterprise Manager installed on the ISA Server computer itself.

Configuring Logging to a File

Logging to a file carries similar characteristics to logging to a MSDE database. A log file cannot exceed 2 GB in size, and if the 2 GB limit is reached, ISA Server creates a new log file.

Note

Regardless of size, ISA Server creates a new log file daily.

The SMTP Message Screener logs can only be stored in the file format.

To configure logging to a file, complete these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Logging tab.

  4. In the task pane, under Logging Tasks, click Configure Firewall Logging.

  5. In the Firewall Logging Properties dialog box, on the Log tab, select File, select the logging format you desire, and then click OK.

    Note

    The WC3 Extended Log File Format logs only the data that's available, uses tabs as delimiters, and uses Greenwich Mean Time (GMT) for the time format. ISA Server File Format logs all information, uses a dash as a placeholder to indicate when data is unselected, uses commas as delimiters, and uses the local time of the server. In Enterprise Edition you also have the options of logging in GMT.

  6. Click Apply to save the changes, and then click OK.

    Note

    For the MSDE and File options you can select options (such as changing the log file location or changing the log fields) and configure the log file storage limits.

Filtering Logging

Log information quickly grows when using the log viewer, so to more efficiently analyze the data, you can filter the data specifically using several different conditions. To filter logging data in the viewer, follow these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Logging tab.

  4. In the task pane, under Logging Tasks, click Edit Filter.

  5. In the Edit Filter dialog box, select the appropriate items from the Filter By and Condition drop-down lists, type the value, and click Add To List. You can insert additional filters if needed.

  6. Click Start Query to filter the logs.

    Note

    The Online Log Viewer, in which the log time is set to Live, is available in all logging modes. The Offline Log Viewer is supported only in the MSDE and Enterprise Edition SQL modes.


Reports

One of the most common requests made to firewall administrators is to deliver reports: reports of Web usage by employees, of traffic through the firewall, and so on. ISA Server can provide an almost unlimited amount of information about ISA Server activity if you interrogate its logs. In this section we examine how to set up and access preconfigured ISA Server reports.

Report Types

There are five categories of reports, each of which provides in-depth information on various aspects of ISA Server. Table 6-5 defines the five unique report categories mentioned under the Customized Reports section of the task pane.

Table 6-5: Built-In Report Categories and Descriptions
Report Category | Description
Summary Content | Includes statistics on ISA Server usage including protocols, top users, top Web sites, cache performance, traffic, and daily traffic
Web Usage Content | Includes statistics on top Web users, Web sites, HTTP responses, object types, Web browsers, operating systems, and protocols
Application Usage Content | Includes statistics from top application users, top applications, operating system, and top destinations
Traffic and Utilization Content | Includes statistics on traffic, connections, daily traffic, protocols, cache performance, processing time, and errors
Security Content | Includes statistics on authorization failures and dropped packets

Generating a Report

You can generate reports in ISA Server by following these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Reports tab.

  4. In the task pane, under Reports Tasks, click Generate A New Report.

  5. On the Welcome To The New Report Wizard page, type a name for the new report, and click Next.

  6. On the Report Content page, select the content to include in the report. The following options are checked by default:

    • Summary

    • Web Usage

    • Application Usage

    • Traffic And Utilization

    • Security

    To continue click Next.

  7. On the Report Period page, from the Start Date drop-down calendar, select a start date. From the Finish Date drop-down calendar, select a finish date, and then click Next.

  8. On the Report Publishing page, you have the option to publish the report in HTML format to a location on your network. This option is not required to continue with the wizard. To configure, select the Publish Reports To A Directory check box as shown in Figure 6-7. In the Published Reports Directory text box, type the UNC path (\\servername\sharename) to where you would like the report stored. If the user account you are using doesn't have write access to the network share, select the Publish Using This Account check box, click Set Account, and type the user name and password of an account that does. Click OK, and then click Next.

  9. On the Send E-Mail Notification page, you have the option to send an e-mail to a recipient after a report has been created. This option is also not required to continue with the wizard. To configure, select the Send E-Mail Notification For Completed Reports check box as shown in Figure 6-8. In the SMTP Server text box, type the name of an internal or external SMTP server. In the From, To, and CC text boxes, type the applicable e-mail addresses. In the Message text box, you can specify an optional message for the recipient of the e-mail. Click Test to verify that sending the e-mail works, and then click Next.

    Note

    If you select the option to publish a report, you can choose to include the link to that location in an e-mail.

  10. On the Completing The New Report Wizard page, review the summary of information, and then click Finish.

Image from book
Figure 6-7: You can publish reports to a network share for increased visibility and ease of access.
Image from book
Figure 6-8: E-mail notifications can be sent to notify you when reports have been generated.

Creating a Report Job

Report jobs are beneficial when you have reports that you would like to have generated on a recurring schedule. For reports to be automatically created with report jobs, the Microsoft ISA Server Job Scheduler service must be running. To configure a report job, follow these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Reports tab.

  4. In the task pane, under Reports Tasks, click Create And Configure Report Jobs.

  5. In the Report Jobs Properties dialog box, click Add.

  6. On the Welcome To The New Report Job Wizard page, type the name to assign to the report job, and then click Next.

  7. On the Report Content page, select the content to include in the report. The following options are selected by default:

    • Summary

    • Web Usage

    • Application Usage

    • Traffic And Utilization

    • Security

    To continue, click Next.

  8. On the Report Job Schedule page, you can specify the frequency by selecting the report job to run daily, weekly, or monthly as shown in Figure 6-9. Click Next to continue.

    Note

    Report Jobs are generated at 1:00 AM by default. By contrast, Log Summaries (described later) generate at 12:30 AM by default.

  9. On the Report Publishing page, you have the option to publish the report in HTML format to a location on your network. This option is not required to continue with the wizard. To configure this option, select the Publish Reports To A Directory check box. In the Published Reports Directory text box, type the UNC path (\\servername\sharename) to where you would like the report stored. If the user account you are using doesn't have write access to the network share, select the Publish Using This Account check box, click Set Account, and type the user name and password of an account that does. Click OK, and then click Next.

  10. On the Send E-Mail Notification page, you have the option to send an e-mail to a recipient after a report has been created. This option is also not required to continue with the wizard. To configure this option, select the Send E-Mail Notification For Completed Reports check box. In the SMTP Server text box, type the name of an internal or external SMTP server. In the From, To, and CC text boxes, type the applicable e-mail addresses. In the Message text box, you can specify an optional message for the recipient of the e-mail. Click Test to verify that sending of the e-mail works, and then click Next.

  11. On the Completing The New Report Job Wizard page, review the summary of information, and then click Finish.

Image from book
Figure 6-9: You can determine the frequency with which the report job will run.

Publishing a Report

Publishing a report is a useful feature for storing reports on a frequently used network share for yourself or others to view.

To publish a report, complete the following steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Reports tab, and then select the applicable report to publish.

  4. In the task pane, under Reports Tasks, click Publish Selected Report.

  5. In the Browse For Folder window, locate and select the folder where you want the report to be published, and click OK.

Viewing a Report

You will regularly want to view the reports that you have created on the ISA server. There are multiple ways to view a report, as shown in the following steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Reports tab, and then select the applicable report to view.

  4. In the task pane, under Reports Tasks, click View Selected Report to open the Report.htm file in your browser.

  5. Close the browser when you are finished viewing the report.

Note

Many of the tasks in ISA Server 2004 can be completed by right-clicking the object you are working with; for example, you can right-click the applicable report in the details pane, and select View. Also, if you published a report, you can browse to the folder and open the Report.htm file directly.

Customizing a Report

The report content in ISA Server 2004 can be customized based on your preferences. To customize report content, follow these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Reports tab.

  4. In the task pane, under Customize Reports, you will find five links to choose from:

    • Customize Summary Content Allows you to change the way in which you select and sort data for the Summary reports, showing a view of data (like Top Protocols, Top Users, Top Sites, and Cache Hit Ratio) at a high level—for example, if you're more interested in the number of users that contact your site than in the total amount of data requested, you will choose to sort Top Sites by Users rather than Total Bytes.

    • Customize Web Usage Content Allows you to select and configure the sort order for information specific to Web Usage (like Top Protocols, Top Sites, Top Users, Object Types, Browsers, and Operating Systems)—for example, you can choose to expand the number of Web Browsers captured from the default of five to ten, and sort by the Operating System.

    • Customize Application Usage Content Allows you to select and configure the sort order for Application Usage Content showing the applications (like Outlook, etc.) that are used by the largest number of users or by the total number of requests. This report allows you to also sort information based on the Top Protocols, Top Users, Client Applications, Destinations, and Operating Systems.

    • Customize Traffic And Utilization Content Allows you to see the types of protocols (like HTTP, POP3, etc.), the amount of traffic cache content and the like—you can customize the number of Top Protocols, and the Cache Hit Ratio's sort order.

    • Customize Security Content Opens the Security Content Properties dialog box that allows you to configure the number of clients for dropped packets and the number of users for authorization failures.

  5. Click Apply to save the changes, and then click OK.

Configuring Log Summaries

Log summaries are derived from the Microsoft Firewall Service and Web Proxy logs to provide consolidated information from multiple logs for a particular ISA Server computer. Summaries are maintained in a database in the ISASummaries folder under the ISA Server installation directory (by default C:\Program Files\Microsoft ISA Server\). To change the time these summaries are saved, the number of summaries retained, or where they're stored, complete the following steps:

  1. Open the ISA Server Management console.

  2. In the console tree, click the Monitoring node.

  3. In the details pane, click the Reports tab.

  4. In the task pane, under Related Tasks, click Configure Log Summary.

  5. In the Log Summary Properties dialog box shown in Figure 6-10, you can modify several options:

    • Enable or disable daily and monthly summaries

    • Change the Log Summary generation time which is by default at 12:30 AM (as opposed to Report generation, which takes place by default at 1:00 AM)

    • Change the location of saved summaries

    • Change the number of saved summaries

  6. Once you have made your modifications, if any, click OK.

Image from book
Figure 6-10: Log summaries are essential to gathering reporting data.


Performance Monitor

ISA Server 2004 utilizes the System Monitor in either the Windows 2000 or Windows 2003 Performance Monitor console. A default monitor specifically for ISA Server is installed with the product, or if you are familiar with Performance Monitor, you can load and view a number of specific objects and counters to gather the data you need.

Using Performance Monitor on Your ISA Server

The ISA Server Performance Monitor is located by clicking Start, pointing to All Programs, Microsoft ISA Server, and finally selecting ISA Server Performance Monitor. As shown in Figure 6-11, a standard set of objects and counters are loaded.

Image from book
Figure 6-11: The default performance console is configured to capture several key objects and their most useful counters.

The five primary performance objects are detailed in Table 6-6.

Table 6-6: Performance Objects
Performance Objects | Description
ISA Server Cache | Includes counters to monitor cache-related items like Total Bytes Retrieved From Disk, or Total URLs Retrieved From Disk
ISA Server Firewall Packet Engine | Includes counters to monitor the items related to the firewall engine, such as the number of Active Connections and Dropped Packets/Sec
ISA Server Firewall Service | Includes counters to monitor firewall client connections, like Active Sessions, Bytes Written/Sec and Kernel Mode Data Pumps
ISA Server H.323 Filter Objects | Includes counters showing Active H.323 Calls and Total H.323 Calls
ISA Server Web Proxy | Includes counters to monitor Web proxy client connections

A detailed explanation of the counters available for the objects just discussed is found in the ISA Server Help file searching with the key words of "Performance Counters."


Chapter 7: Configuring Toolbox Elements

Overview

The ability of Microsoft ISA Server to function as a very strong and granular firewall relies a lot on the ease and clarity with which you can identify different "elements" within your network: you can designate a single computer, groups of computers, a single Uniform Resource Locator (URL), or a set of URLs to either allow or block traffic. You can use these elements to define how different computers (whether internal or external) communicate with one another. In short, the ISA Server toolbox elements are the building blocks that you use to determine how network traffic will flow.

How are toolbox elements used? ISA Server 2004 manages traffic flow to specified information on designated networks at scheduled times (see Chapter 8, "Configuring ISA Firewall Policy," for a detailed explanation). Figure 7-1 helps to show the overall process of how ISA Server processes traffic, and illustrates how the toolbox elements we describe in this chapter work in access rules.

Image from book
Figure 7-1: This diagram shows the way in which ISA Server manages traffic in Access, Server Publishing, and Web rules.

Toolbox elements define the type of content and network traffic that ISA Server allows for certain network objects to particular locations for specified users. These elements can be found by opening the ISA Server Management console tree, navigating to the ISA server, and clicking the Firewall Policy node (in Enterprise Edition, you will also see the ISA Server Name), then clicking the Toolbox tab in the task pane as shown in Figure 7-2.

Image from book
Figure 7-2: This view shows the toolbox elements available. This screen shows an ISA Server Enterprise Edition installation—the Standard Edition installation is similar, but does not include the Enterprise node.

In ISA Server 2004 Enterprise Edition, you can create enterprise-level toolbox elements in addition to the server-level elements. Simply navigate to the Enterprise node, click the Enterprise Policies node, then click the Toolbox tab in the task pane.

Table 7-1 briefly describes these elements—the remainder of the chapter describes the elements in more detail, and explains how to configure each type.

Table 7-1: Access Rule Elements
Access Rule Element | Purpose
Protocols | Define the protocol (for example, Transmission Control Protocol [TCP], User Datagram Protocol (UDP), Internet Protocol (IP), or Internet Control Message Protocol [ICMP]), direction, port range, number, or properties that characterize certain types of network traffic.
Users | Define users from Windows or SecurID namespaces, or a Remote Authentication Dial-In User Service (RADIUS) server to provide authentication based on user ID.
Content types | Define different types of content in FTP or HTTP traffic, which can be based on either Multipurpose Internet Mail Extensions (MIME) type (for example, application/octet-stream) or filename extension (for example, .exe).
Schedules | Define the times (specified in hours) when ISA Server can allow or deny activities.
Network objects | Define either the source or destination of network traffic. There are nine network objects: a network, a set, a computer, a computer set, an address range, a subnet, a URL set, a domain name set, and a Web listener.


Protocols

The term protocol comes from the Greek word proto-koleon—this originally described a sheet of paper pasted to the front of a manuscript that summarized the manuscript's contents. In our world, protocols consist of different rules used by networked devices to send and receive information. The headers, like the sheet of paper, advertise the type of content the packet holds, and the appropriate audience and rules to use when "reading" it. ISA Server comes with many predefined protocols and allows you to create your own protocols by defining the type of packet (TCP, UDP, ICMP, and so on), its direction, port range, and so forth.

Note

At the Network and Transport layers, the IP protocol and port number being used to make a connection to a server loosely defines the protocol. For example, TCP port 25 is used by the SMTP service—this port is what ISA Server uses to recognize that the traffic is SMTP. For protocols that have Application filters in ISA Server, this port number is used by the application filter to identify and then further inspect the traffic at the Application layer. You can configure ISA Server's Application Filter to associate with a custom ISA Server–defined protocol, which allows the filter to inspect traffic even when that traffic is not on standard ports.

Identifying Predefined Protocols

ISA Server provides a list of predefined protocols that are categorized by their function. To open the Toolbox, open the ISA Server Management console, expand your ISA server, click the Firewall Policy node (in Enterprise Edition, you will also see the ISA Server Name), then click the Toolbox tab in the task pane. When you then click the Protocols link, you will see the various categories described in Table 7-2.

Table 7-2: Server Protocol Categories
Protocol Category | Description
Common Protocols | Policies include these protocols more than any others. The most common protocols—including Post Office Protocol 3 (POP3), Simple Mail Transfer Protocol (SMTP), HTTP, HTTPS, and others—also appear in other categories.
Infrastructure | These protocols are used by infrastructure servers, such as name servers (domain name system [DNS]), IP Addressing (DHCP), and Active Directory (LDAP). You will also find SNMP and Ping (ICMP) protocols here.
Mail | These protocols are used by mail servers, such as SMTP, Internet Message Access Protocol 4 (IMAP4), and POP3, and news servers (Network News Transfer Protocol [NNTP]).
Instant Messaging | These protocols are required for instant messaging programs, including MSN Messenger, ICQ, NetMeeting (H.323), and others.
Remote Terminal | These protocols are used to allow remote device management and remote terminal connections, and include Remote Desktop (RDP), Telnet, Citrix (ICA), and others.
Streaming Media | These protocols, including Microsoft Media Streaming (MMS), Real-Time Streaming Protocol (RTSP), and more, are used for streaming media.
VPN and IPSec | These protocols, such as different IPSec protocols (Encapsulating Security Protocol [ESP], Network Address Translation-Traversal [NAT-T]), IKE Client, IKE Server, Layer Two Tunneling Protocol (L2TP), PPTP, and more, are used to establish and protect VPN connections.
Web | These protocols, such as HTTP, HTTPS, FTP, and others, are used to access Web sites. These protocols are only available when creating and configuring Web publishing rules.
User-Defined | When you define new protocols in ISA Server, they appear in this category.
Authentication | These protocols, such as Kerberos, RADIUS, and RSA SecurID, are used for authentication.
Server Protocols | These protocols include the server protocols used in server publishing rules, such as POP3 server for e-mail, Microsoft SQL Server, FTP server, remote procedure call (RPC) server, and more.
All Protocols | Cleverly named, this category shows you all predefined and user-defined protocols in a single list.

Creating a Protocol

You will, from time to time, need to create custom protocols that allow traffic for network devices. To create a custom protocol, follow these steps:

  1. Open the ISA Server Management console, then in the console tree, click the Firewall Policy node.

  2. In the task pane, click the Toolbox tab, and then click Protocols.

  3. Click New, and then click Protocol.

    Note

    You can also create a new RPC protocol using these steps—then follow the on-screen instructions for the Welcome To The New RPC Protocol Definition Wizard.

  4. On the Welcome To The New Protocol Definition Wizard page, type a name to assign to the new protocol, then click Next.

  5. On the Primary Connection Information page, click New.

  6. In the New/Edit Protocol Connection dialog box shown in Figure 7-3, specify the protocol type and direction (inbound or outbound), and port range. Click OK, and then click Next.

    Note

    The "direction" of traffic identifies which way the initial packet is sent. Incoming implies that a remote client will be making a connection to the ISA server. Outgoing implies that a client on the LAN will be making a connection to a remote host on the external network.

    Regardless of the direction you select, response traffic will be allowed, so there is no need to define and use a protocol to handle return traffic.

  7. On the Secondary Connections page, select Yes or No to indicate whether you wish to define secondary connections (which allow other designated ports to be opened after the establishment of the session by the protocol you're configuring). Click Next.

  8. On the Completing The New Protocol Definition Wizard page, review your settings, and then click Finish.

  9. Click Apply to save the changes, and then click OK to close the Apply Network Configuration dialog box.

Image from book
Figure 7-3: You can create a new protocol by configuring the information about its connection, including the protocol type, direction, and port range or properties.


User Sets

When creating policies, you might wish to allow or deny traffic based on a user account. Although the title of this category is user sets, you can define not only individual Windows, RADIUS, or SecurID users, but groups of Windows users. You can also choose to allow all RADIUS or SecurID users in a namespace.

Creating a User Set

Two predefined user sets exist in the Toolbox category: All Authenticated Users and All Users. All Authenticated Users are those user accounts authenticated by an Active Directory domain controller, a RADIUS server, or a SecurID authenticator. In addition, you can define your own user sets that target users and groups.

To create a user set, follow these instructions:

  1. In the ISA Server Management console tree, click Firewall Policy.

  2. On the Toolbox tab in the task pane, click Users, then click New.

  3. On the Welcome To The New User Sets Wizard page, type a name for the new user set, then click Next.

  4. On the Users page, click Add, then select the namespace—Windows Users And Groups, RADIUS, or SecurID—and identify the User, Group, or Entire Namespace from each namespace as appropriate. Click Next after you identify all users and groups.

  5. On the Completing The New User Set Wizard page, review your settings, then click Finish.

  6. Click Apply, then click OK to commit the changes.


Content Types

You might wish to allow or deny certain types of content from entering into or running within your network. With traditional Layer 4 (or "stateful") firewalls, if you allowed Web traffic into your environment, you couldn't inspect the content of the Web pages. ISA Server recognizes MIME extensions that designate types of application content for unencrypted Web traffic (HTTP) and tunneled FTP. You can therefore deny or allow only designated content, such as preventing the use of Microsoft Access databases or RealAudio content.

Content types don't apply to other protocols, including secure Web traffic (HTTPS).

Content types can include both MIME types (like application/winhlp for Windows Help files) and file extensions (like .hlp for the same Windows Help files). In HTTP requests, MIME type is always used first; if the type isn't available, file extensions are used. FTP always uses file extensions.

To ensure you are targeting the right content, designate both the MIME type and file extensions in your content type.

ISA Server comes with 11 predefined content types. For more information about those types see the ISA Server Help file.

Creating a Content Type

You can also create content types to designate certain types of application characteristics. Follow these instructions:

  1. In the ISA Server Management console tree, click Firewall Policy.

  2. On the Toolbox tab in the task pane, click Content Types, then click New. You will see and configure the New Content Type Set dialog box shown in Figure 7-4.

  3. In the Name text box, type a descriptive name.

  4. In the Description text box, enter a description of the item.

  5. In the Available Types drop-down list box, you can either choose from the existing list of types provided, or type a MIME type or a file extension. You can use one wildcard with each MIME extension if you choose (for example, typing model/* to indicate all MIME types that begin with model).

    Note

    You cannot use wildcards with file extensions.

  6. Click Add to populate the Selected Types list. Should you wish to remove a type, select that type in the Selected Types list and click Remove.

  7. Click OK to finish creating a new content type.

  8. Click Apply to commit the new content type to the ISA Server configuration, and then click OK.

Image from book
Figure 7-4: Defining a new content type—like this example where we're defining Pointcast news data—allows you to control traffic based on application type, which is defined by MIME types or file extensions.


Schedules

You might want activities to take place only at certain times or to restrict access to the Internet during nonworking hours. ISA Server schedules allow you to configure time in one-hour increments, which you can then use to configure access rules. There are two default schedules:

  • Weekends Defines all hours on Saturday and Sunday

  • Work Hours Defines the hours between 9:00 AM and 5:00 PM Monday through Friday

Creating a Schedule

To create a schedule, follow these steps:

  1. In the ISA Server Management console tree, click Firewall Policy.

  2. On the Toolbox tab in the task pane, click Schedules, and then click New to open the New Schedule dialog box.

  3. Type a name and description in the appropriate text boxes.

  4. Configure the schedule by selecting the times indicated, then selecting either Active or Inactive, as shown in Figure 7-5.

Image from book
Figure 7-5: This schedule defines active times as being from 9—00 PM to 6—00 AM on weekdays.


Network Objects

Network objects describe the locations from which traffic originates (source) and to which it travels (destination). These locations can be any one of ten types—networks, enterprise networks (only in Enterprise Edition), network sets, computers, computer sets, address ranges, subnets, URL sets, domain name sets, and Web listeners—all of which are described in more detail next.

Note

To view all the network objects in the ISA Server Management console tree, click Firewall Policy. On the Toolbox tab in the task pane, click Network Objects. All of the network objects are discussed below.

Networks

A network is one or more IP addresses that designate network devices. Several preconfigured networks exist:

  • Local host This represents the ISA server itself, and includes the IP addresses bound to the ISA server and 127.0.0.1. There is also an Enterprise local host, which identifies each ISA server in an array along with its unique local host addresses.

  • Internal All IP addresses associated with the internal network adapter. See how to configure this network in the section entitled "Configuring the Internal Network Object" later in this chapter.

  • External All IP addresses that are not defined, or "everything else." You cannot configure or customize this network.

  • VPN Clients and Quarantined VPN Clients networks These two networks are automatically populated when a VPN client or gateway connects to the ISA server; the quarantined VPN clients network is populated only when VPN quarantine is enabled and systems meet the quarantine criteria.

Note

ISA Server Enterprise Edition has what are known as enterprise networks. These networks are configured at the enterprise—rather than the array—level. You can follow the same procedures for creating and editing enterprise networks, but will manage them in the ISA Server Management console by navigating to the Enterprise node, then selecting the Enterprise Networks node.

Creating a New Network Object

To create a new network, follow these steps:

  1. In the Network Objects section in the task pane, click New, and then click Network.

  2. On the Welcome To The New Network Wizard page, type a new network name and click Next.

  3. On the Network Type page, select one of four network types, and then click Next:

    • Internal Network Contains computers that exist in an environment where they are not exposed to External networks.

    • Perimeter Network Contains computers that host services published to untrusted networks.

    • VPN Site-To-Site Network Establishes a link with another network through a VPN link.

    • External Network Contains computers from untrusted networks, usually on the Internet.

    Note

    The internal, perimeter, and external networks have the same interface to define networks—as a best practice, be sure to include the type of network you're creating in the name. The VPN site-to-site network option requires that you set up the VPN connections at both sites. See Chapter 11, "Securing Virtual Private Network Access," for information on configuring this option. All other network configurations are covered here.

  4. On the Network Addresses page, choose to define the network using one or more of the following three methods, and then click Next.

    • Add Range Add a range of IP addresses you assign.

    • Add Adapter Choose one of the ISA server's network adapters, and use its routing table to configure the network.

    • Add Private Add one or more of the four private network ranges. As a best practice, avoid adding all of these ranges.

    Note

    In the Enterprise Edition, when working in the Array Firewall policies, you will also see an Add Network button that allows you to choose an enterprise network.

  5. On the Completing The New Network Wizard page, review your settings, then click Finish.

  6. Click Apply to save the changes, and then click OK to close the Apply Network Configuration dialog box.

Network Sets

When you wish to control a collection of networks, you can group them together into a network set. The following preconfigured network sets exist:

  • All Networks (and Local Host) Includes all possible networks, including the Local Host network defining the ISA server itself.

  • All Protected Networks Includes all networks except for the external network.

Configuring the Internal Network Object

The internal network represents the machines that ISA Server is protecting inside your network—this is the default protected network. To configure the Internal Network object, follow these steps:

  1. In the ISA Server Management console, expand the Configuration node for your array, and then click the Networks node.

  2. In the Details pane, click the Networks tab, right-click the internal network, and select Properties.

  3. In the Internal Properties dialog box, you can configure the IP addresses and domains that comprise the internal network. Make the updates you require, click OK, and then click Apply.

Note

For more information on configuring the internal network, see Chapter 4, "Installing and Configuring Microsoft ISA Server 2004 Clients," and Chapter 9, "Configuring Multinetworking."

Creating a Network Set Object

To create a network set, follow these steps:

  1. In the Network Objects section in the task pane, click New, and then click Network Set.

  2. On the Welcome To The New Network Set Wizard page, type a new network set name, then click Next.

  3. On the Network Selection page, shown in Figure 7-6, select either Includes All Selected Networks or Includes All Networks Except The Selected Networks, then select the check boxes for the appropriate networks. Click Next.

  4. On the Completing The New Network Set Wizard page, review your settings, then click Finish.

  5. Click Apply to save the changes, and then click OK to close the Apply Network Configuration dialog box.

Image from book
Figure 7-6: You select the networks you wish to include or exclude from your network set on the Network Selection page.

Computers

A single IP address designating a network device is known as a computer. It can also indicate a device such as a modem, another firewall, and so on.

Creating a Computer Object

To create a computer object, follow these steps:

  1. In the Network Objects section in the task pane, click New, and then click Computer.

  2. In the New Computer Rule Element dialog box, type in the name and (optionally) a description of the computer.

  3. Either click Browse to locate the IP address of the computer or type in the IP address as shown in Figure 7-7.

  4. Click OK to close the New Computer Rule Element dialog box.

  5. Click Apply to save the changes, and then click OK to close the Apply Network Configuration dialog box.

Image from book
Figure 7-7: You can define any device with an IP address as a computer object—in this case we are defining a wireless access point.

Address Ranges

Address ranges consist of a range of IP addresses, and can be used in access rules or computer sets.

Creating an Address Range Object

To create an address range object, follow these steps:

  1. In the Network Objects section in the task pane, click New, and then click Address Range.

  2. In the New Address Range Rule Element dialog box, type in the name and (optionally) a description of the address range.

  3. Type in the start and end IP addresses within the range, and then click OK to close the New Address Range Rule Element dialog box.

  4. Click Apply to save the changes, and then click OK to close the Apply Network Configuration dialog box.

Subnets

Subnets designate a subnet based on the network and its default gateway in a classless interdomain routing (CIDR) format. Subnets can help define a network that might not be directly included in the internal network. One example is a network that exists behind a router on the internal network and needs to be controlled differently, even though existing rules may match traffic for that network. The use of subnets helps avoid the type of problem that occurs when you include a network range that is not directly attached to the network interface card (NIC) in the internal network. You can also create a separate network object with addresses that are not in the internal network because you wish to administer them separately. Without the use of subnets, you could cause ISA Server to generate spoofing errors and block traffic.

Creating a Subnet Object

To create a subnet object, follow these steps:

  1. In the Network Objects section in the task pane, click New, and then click Subnet.

  2. In the New Subnet Rule Element dialog box, type in the name and (optionally) a description of the subnet.

  3. In the Network Address text box, type in the network ID for the subnet, then indicate the network (subnet) mask either by typing the number of bits, or typing the decimal representation in the Network Mask text box as shown in Figure 7-8.

  4. Click OK to close the New Subnet Rule Element dialog box.

  5. Click Apply to save the changes, and then click OK to close the Apply Network Configuration dialog box.

Image from book
Figure 7-8: You can specify the subnet mask in the Network Mask text box.

Computer Sets

A computer set is a collection of computers, address ranges, or subnets. Several preconfigured computer sets exist: Anywhere, IPsec Remote Gateways, and Remote Management Computers. With ISA Server Enterprise Edition, you will also see Enterprise Remote Management Computers, Replicate Configuration Storage Servers, Array Servers, and Managed ISA Server Computers.

Creating a Computer Set Object

To create a new computer set object, follow these steps:

  1. In the Network Objects section in the task pane, click New, and then click Computer Set.

  2. In the New Computer Set Rule Element dialog box, type in the name and (optionally) a description of the computer rule.

  3. Click Add, which allows you to create a combination of computers, address ranges, or subnets you've configured.

  4. Click OK to close the New Computer Set Element dialog box.

  5. Click Apply to save the changes, and then click OK to close the Apply Network Configuration dialog box.

URL Sets

URL sets designate several URLs, which are also known as Web addresses. You can include several different Web site addresses and use wildcards. If, for example, you wanted to allow only the Web addresses related to Contoso's support Web site, you would need to create a URL set that indicates that path, along with a wildcard, as in this example:

  • http://www.contoso.com/support/*

URL sets apply only to HTTP traffic, and depend on a correctly configured DNS infrastructure. You can use URL sets only with Web rules.

Creating a URL Set Object

To create a URL set object, follow these steps:

  1. In the Network Objects section in the task pane, click New, and then click URL Set.

  2. In the New URL Set Rule Element dialog box, type in the name and (optionally) a description of the URL set.

  3. Click New to create a new URL entry, as shown in Figure 7-9.

  4. Click OK to close the New URL Set Rule Element dialog box.

  5. Click Apply to save the changes, and then click OK to close the Apply Network Configuration dialog box.

Image from book
Figure 7-9: You can create a URL set, which consists of one or more URLs, using wildcards.

Domain Name Sets

Domain name sets identify one or more fully qualified domain names (FQDNs). Two preconfigured domain name sets exist, which can be configured or deleted:

  • Microsoft Error Reporting Sites Allows the error reporting functionality in Microsoft products to report issues to the *.watson.microsoft.com site.

  • System Policy Allowed Sites Allows access to the following Microsoft sites: *.microsoft.com, *.windows.com, and *.windowsupdate.com.

Creating a Domain Name Set Object

To create a domain name set object, follow these steps:

  1. In the Network Objects section in the task pane, click New, and then click Domain Name Set.

  2. In the New Domain Name Set Rule Element dialog box, type in the name and (optionally) a description of the domain name set.

  3. Click New to create a new domain name entry, as shown in Figure 7-10.

  4. Click OK to close the New Domain Name Set Element dialog box.

  5. Click Apply to save the changes, and then click OK to close the Apply Network Configuration dialog box.

Image from book
Figure 7-10: Domain name sets allow you to block or allow sites based on DNS domain names.

Web Listeners

Unlike the other network objects, Web listeners don't designate a location, but rather identify the IP addresses and ports on which the ISA server listens for Web requests. You can create one or more Web listeners, which you then configure to publish Web servers to other networks. If, for example, you wanted to publish your Windows SharePoint Server (WSS) Configuration page, you would need to define a Web listener to listen for Web traffic coming into the particular IP address and port number that was assigned at the time of the WSS installation.

Creating and Configuring a Web Listener Object

To create a Web listener, follow these steps:

  1. In the Network Objects section in the task pane, click New, and then click Web Listener.

  2. On the Welcome To The New Web Listener Wizard page, type a new Web listener name, then click Next.

  3. On the IP Addresses page, select the networks on which the listener will monitor Web requests. Figure 7-11 shows a view of the predefined network and Figure 7-12 shows the dialog box that appears when clicking a particular Address button when highlighting the external network. When you've completed this step, click Next.

  4. On the Port Specification page, select the HTTP or SSL listeners check boxes, configure the port to match those ports for which you want to monitor Web traffic, and then click Next.

    Note

    If you choose SSL, you need to choose a certificate, which must already be installed on the ISA server.

  5. On the Completing The New Web Listener Wizard page, review your settings, and then click Finish.

  6. Click Apply to save the changes, and then click OK to close the Apply Network Configuration dialog box.

    Note

    Once you create the Web listener, you can select it in the Toolbox, right-click and select Properties to configure it with authentication methods or control the maximum timeout and number of connections.
Image from book
Figure 7-11: You can choose from a predefined network.
Image from book
Figure 7-12: The External Network Listener IP Selection dialog box provides granular control of the IP addresses used by the external Web listener.


Chapter 8: Configuring Microsoft ISA Server Firewall Policy

In this chapter, we focus on the Microsoft ISA Server firewall policy, specifically the system policy, firewall policy, and access rules. We explain how policies are processed and how you can easily export and import your policy configurations. The second half of the chapter focuses on publishing, allowing external sources to access your internal network resources securely and safely.

Understanding How ISA Server Processes Traffic

ISA Server inspects traffic by referring to three sets of rules in the order shown in Figure 8-1.

Image from book
Figure 8-1: ISA Server processes network rules, system policy rules, and then firewall policy rules when inspecting network traffic. After the rules are processed, the network rules determine whether to route or NAT the traffic. Finally client-specific rules are processed.

  • Network rules Define whether traffic between networks is set to Route or Network Address Translation (NAT)—if ISA Server doesn't have an explicit relationship defined, then it drops traffic between the networks.

    Note

    See Chapter 9, "Configuring Multinetworking," for more information on networks and network rules.

  • System policy rules Include 30 predefined rules that allow use of common services necessary for your network infrastructure to function. System policy rules define how traffic flows from the ISA Server (which has its own network called LocalHost) to other networks.

  • Firewall policy rules Include three types of rules (access, Web publishing, and server publishing) that define what traffic flows from one network to others. One default rule (called Last Default Rule) exists, which denies all traffic from all networks to all networks for all users at all times for all content types.


System Policy

The system policies operate in the same manner as firewall rules. These 30 predefined rules define how traffic flows between the ISA Server computer itself and other networks. To view the system policy rules, follow these steps:

  1. Open the ISA Server Management console, expand the ISA server name, then click to the Firewall Policy node.

  2. In the task pane, click the Tasks tab. Under System Policy Tasks, click Show System Policy Rules. The system policies will appear in the details pane.

Table 8-1 shows all the system policies. The Default/Recommendation column shows the default settings, and provides recommendations for configuring policies in certain usage scenarios.

Table 8-1: ISA Server 2004 System Policy Rules Open table as spreadsheet
Name | Recommendation | Default State | Order | Action | Protocols | From/Listener | To | Condition
Allow access to directory services for authentication purposes | If your ISA server isn't installed in a domain, disable this rule. | Enabled | 1 | Allow | LDAP LDAP (UDP) LDAP GC (global catalog) LDAPS LDAPS GC (global catalog) | Local Host | Internal | All Users
Allow remote management from selected computers using Microsoft Management Console (MMC) | If you will not use the ISA Server Management console from remote machines, disable this rule | Enabled | 2 | Allow | Microsoft Firewall Control NetBIOS datagram NetBIOS Name Service NetBIOS Session RPC (all interfaces) | Remote Management Computers | Local Host | All Users
Allow remote management from selected computers using Terminal Server | If you don’t want to allow Terminal Service/Remote Desktop access to the ISA server, disable this system policy. | Enabled | 3 | Allow | RDP (Terminal Services) | Remote Management Computers | Local Host | All Users
Allow remote logging to trusted servers using NetBIOS | If you wish to allow the ISA server to log on to trusted machines (say to a central SQL Server database), then enable this rule. | Disabled | 4 | Allow | NetBIOS Datagram NetBIOS Name Service NetBIOS Session | Local Host | Internal | All Users
Allow RADIUS authentication from ISA Server to trusted RADIUS servers | If you will not use RADIUS authentication, disable this rule. | Enabled | 5 | Allow | RADIUS RADIUS Accounting | Local Host | Internal | All Users
Allow Kerberos authentication from ISA Server to trusted servers | If you do not wish to support Kerberos authentication, then disable this rule. | Enabled | 6 | Allow | Kerberos-Sec (TCP) Kerberos-Sec (UDP) | Local Host | Internal | All Users
Allow DNS from ISA Server to selected servers | ISA Server requires domain name system (DNS) for name resolution. Do not disable this rule. You can create computer sets to restrict access to the DNS servers, however. | Enabled | 7 | Allow | DNS | Local Host | All Networks (and Local Host) | All Users
Allow DHCP requests from ISA Server to all networks | If your ISA server will not use DHCP to obtain Internet Protocol (IP) addresses, disable this rule. Recommended to always use static address for internal network adapter. If you do require Dynamic Host Configuration Protocol (DHCP), limit traffic by setting the networks that require it on the To tab. | Enabled | 8 | Allow | DHCP (request) | Local Host | Anywhere | All Users
Allow DHCP replies from DHCP servers to ISA Server | See Rule 8. | Enabled | 9 | Allow | DHCP (reply) | Internal | Local Host | All Users
Allow ICMP (Ping) requests from selected computers to ISA Server | If you do not wish to allow Remote Management Computers to ping the ISA Server, then disable this rule. | Enabled | 10 | Allow | Ping | Remote Management Computers | Local Host | All Users
Allow ICMP requests from ISA Server to selected servers | Leave this rule enabled to allow ISA Server to determine connectivity with other computers. | Enabled | 11 | Allow | ICMP Information Request ICMP Timestamp Ping | Local Host | All Networks (and Local Host Network) | All Users
All virtual private network (VPN) client traffic to ISA Server | Unless you enable an ISA Server client VPN (which automatically enables this rule), leave this rule disabled. | Disabled | 12 | Allow | PPTP | External | Local Host | All Users
Allow VPN site-to-site traffic to ISA Server | Unless you enable an ISA Server Site-To-Site VPN (which automatically enables this rule), leave this rule disabled. | Disabled | 13 | Allow | None | External IPSec Remote Gateways | Local Host | All Users
Allow VPN site-to-site traffic from ISA Server | See Rule 13 | Disabled | 14 | Allow | None | Local Host | External IPSec Remote Gateways | All Users
Allow Microsoft CIFS from ISA Server to trusted servers | If you are using authentication with Active Directory directory service, and/or need to access file shares on the internal network, leave this rule enabled. You can also limit exposure by creating a computer set with the domain controllers (DCs) and replace the internal network with your DC Computer Set. | Enabled | 15 | Allow | Microsoft CIFS (TCP, port 445) Microsoft CIFS (UDP, port 445) | Local Host | Internal | All Users
Allow remote SQL logging from ISA Server to selected servers | If you want to allow logging to SQL Server computers on other machines, enable this rule. | Disabled | 16 | Allow | Microsoft SQL (TCP) Microsoft SQL (UDP) | Local Host | Internal | All Users
Allow HTTP/HTTPS requests from ISA Server to specified sites | This allows access to Microsoft.com sites (defined in the System Policy Allowed Sites Domain Name Set). If you do not want the ISA server to contact the Windows Update or Microsoft.com diagnostic sites directly, disable this rule. This allows access to sites defined in the System Policy Allowed Sites Domain Name set, which by default includes certain Microsoft defined sites (such as Microsoft.com and Windowsupdate.com) | Enabled | 17 | Allow | HTTP HTTPS | Local Host | System Policy Allowed Sites | All Users
Allow HTTP/HTTPS requests from ISA Server to selected servers for connectivity verifiers | If you create a connectivity verifier (in the Monitoring node on the Connectivity tab) for Web sites, a prompt allows you to enable this rule. Take caution enabling this rule as it might affect the functionality of new connectivity verifiers. | Disabled | 18 | Allow | HTTP HTTPS | Local Host | All Networks (and Local Host Network) | All Users
Allow access from trusted computers to the Firewall Client installation share on ISA Server | If you install the Firewall Client Share on the ISA server, this rule becomes enabled. | Disabled | 19 | Allow | Microsoft CIFS (TCP) Microsoft CIFS (UDP) NetBIOS Datagram NetBIOS Name Service NetBIOS Session | Internal | Local Host | All Users
Allow remote performance monitoring of ISA Server from trusted servers | If you will conduct performance monitoring of the ISA server, enable this rule and ensure that the computer performing the monitoring is in the Remote Management Computer Set. | Disabled | 20 | Allow | NetBIOS Datagram NetBIOS Name Service NetBIOS Session | Remote Management Computers | Local Host | All Users
Allow NetBIOS from ISA Server to trusted servers | If you do not need to connect to file shares on the internal network, disable this rule. | Enabled | 21 | Allow | NetBIOS Datagram NetBIOS Name Service NetBIOS Session | Local Host | Internal | All Users
Allow RPC from ISA Server to trusted servers |  | Enabled | 22 | Allow | RPC (all interfaces) | Local Host | Internal | All Users
Allow HTTP/HTTPS from ISA Server to specified Microsoft error reporting sites | This rule allows the ISA firewall to send error reports to Microsoft. | Enabled | 23 | Allow | HTTP HTTPS | Local Host | Microsoft Error Reporting sites | All Users
Allow SecurID authentication from ISA Server to trusted servers | This rule should be enabled only if SecurID authentication is enabled, otherwise it should remain disabled. | Disabled | 24 | Allow | SecurID | Local Host | Internal | All Users
Allow remote monitoring from ISA Server to trusted servers, using Microsoft Operations Manager Agent | Enable this rule if you use Microsoft Operations Manager to monitor the ISA firewall. | Disabled | 25 | Allow | Microsoft Operations Manager Agent | Local Host | Internal | All Users
Allow all HTTP traffic from ISA Server to all networks (for CRL downloads) | This rule should be enabled if you want the ISA firewall to access certificate revocation lists (CRLs), required if the ISA server terminates any SSL connections. | Disabled | 26 | Allow | HTTP | Local Host | All Networks (and Local Host) | All Users
Allow NTP from ISA Server to trusted NTP servers | You should change this rule by allowing contact with a trusted Network Time Protocol (NTP) server in your organization. The Internal entry allows it to contact any server within the Internal network. | Enabled | 27 | Allow | NTP (UDP) | Local Host | Internal | All Users
Allow SMTP from ISA Server to trusted servers | If you don't plan on using Simple Mail Transfer Protocol (SMTP) to send alerts, you should disable this rule. If you do plan on sending SMTP alerts, then you should replace the Internal Destination with a specific computer that will accept the SMTP messages from the ISA Server firewall. | Enabled | 28 | Allow | SMPT | Local Host | Internal | All Users
Allow HTTP from ISA Server to selected computers for Content Download Jobs | This rule is automatically enabled when Content Download Jobs are enabled. | Enabled | 29 | Allow | HTTP | Local Host | All Networks (and Local Host) | System and Network Service
Allow Microsoft Firewall Control communication to selected computers | Unless you plan on using the remote MMC, you should disable this rule. | Enabled | 30 | Allow | All outbound traffic | Local Host | Remote ManagementComputers | All Users

Editing the System Policy

System policy rules can be edited using the System Policy Editor. By default, system policy rules are not shown in the details pane along with the firewall policy rules. To access the System Policy Editor and edit the system policy, follow these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, expand the server name, and click Firewall Policy.

  3. In the task pane, under System Policy Tasks, click Edit System Policy.

  4. The System Policy Editor, shown in Figure 8-2, allows you to modify the configuration groups, enable or disable the configuration groups or individual services, and control how the traffic flows between the networks.

  5. For example, to disable the DNS service, in the Network Services configuration group select DNS. On the General tab, select the Enable check box to disable the communication between ISA Server and trusted DNS servers.

  6. To modify the networks to which traffic can be routed, click the To tab illustrated in Figure 8-3. Click Add, Edit, or Remove to change the network entities. Click OK after completing your changes.

  7. In the details pane, click Apply to save the changes and update the configuration.

  8. Click OK to complete the change.

Image from book
Figure 8-2: The System Policy Editor in ISA Server 2004.
Image from book
Figure 8-3: Each policy has a General tab that illustrates the properties, and either a From or To tab that controls the source or destination to which the policy applies.

Exporting and Importing System Policy

Exporting and importing functions in ISA Server 2004 gives you the ability to save your ISA configuration to an XML file. This is useful if you need to back up your configuration at a later date, or would like to apply your configuration of one ISA server to another ISA server. Although exporting the firewall policy rules will be more commonplace, you can also export and import the system policy rules.

To export the system policy, follow these steps:

  1. In the console tree, expand the server name, and click Firewall Policy.

  2. In the task pane, click the Tasks tab. Under System Policy Tasks, click Export System Policy.

  3. On the Export Configuration dialog box, browse to the location to where you would like to save the export file, type a filename to be given to the export file in the File Name text box, and then click Export.

  4. In the Exporting System Policy Rules dialog box, click OK.

To import the system policy, follow these steps:

  1. In the console tree, expand the server name, and click Firewall Policy.

  2. In the task pane, click the Tasks tab. Under System Policy Tasks, click Import System Policy.

  3. In the Import Configuration dialog box, browse to the location on the disk where you saved the export XML file, select the export file to insert it into the File Name text box, and click Import.

  4. In the Importing System Policy Rules dialog box, click OK.

  5. In the details pane, click Apply to save the changes, and then click OK.


An Overview of Firewall Policy

Firewall policies govern how source and destination networks communicate with each other. The components involved include network rules, access rules, and publishing rules (server and Web). As mentioned earlier, ISA Server processes network rules first, then goes on to evaluate access or publishing rules.

Network rules define how networks communicate with one another. Networks can have three types of relationships:

  • No relationship, in which case all traffic is dropped

  • NAT, which hides the IP addresses on one network from the other

  • Route, which requires either all private or public address ranges, and maintains the original source IP address

Tip

If you have a NAT relationship between networks, then ISA Server uses access rules to manage traffic from protected networks (internal) to external (untrusted) networks, and publishing rules to manage traffic from untrusted (external) to protected networks. If you have a route relationship between networks, ISA Server can use access rules for traffic flowing both ways between sites.

Best Practices

When configuring your rules, keep the following guidelines in mind. Certain simple elements can be processed quickly, and should be set at the top of the rule list; this strategy helps to eliminate unnecessary processing of traffic that can be eliminated quickly. See Table 8-2 for a description of the amount of processing required by different components.

Table 8-2: Performance Impact of Rule Components
Processing Requirements | Description | Location in Rule List
Light | Protocol definitions Schedules All IP address—based network elements (computers, computer sets, networks, and network sets) Source port information | Top
Heavy | Domain name sets and URL sets Users Content type | Bottom
Heavy | Rules that use SMTP filter, HTTP filter, or FTP filter | Bottom

In general, follow this order for ordering your rules:

  1. Global deny rules

  2. Global allow rules

  3. Rules for specific computers

  4. Rules for specific users, URLs, and MIME types, and also publishing rules

  5. Other allow rules

    Note

    For more detailed information on how to improve the performance of your firewall policies, see the excellent and rich "Best Practices Firewall Policy for ISA Server 2004" whitepaper at http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/firewall_policy.mspx.

Lockdown Mode

One common concern that people express is how well their network is protected before the ISA Server Firewall Service starts, when it shuts down, or if it fails. Never fear! ISA Server provides excellent protection! Where ISA Server 2000 allowed all traffic to pass through the firewall if the firewall service wasn't started, ISA Server 2004 is more secure—in these scenarios, the ISA Server packet filter driver (FWENG) manages traffic in lockdown mode, which allows only certain types of traffic.

Note

For detailed information regarding what is allowed, see the Microsoft Knowledge Base article, "Lockdown Mode of Operation in ISA Server 2004" at http://support.microsoft.com/?scid=838711.

Exporting and Importing Firewall Policy

ISA Server allows you to back up and share firewall policy information in an XML format.

To export the firewall policy, follow these steps:

  1. In the console tree, expand the server name, and click Firewall Policy.

  2. In the task pane, click the Tasks tab. Under Related Tasks, click Export Firewall Policy.

  3. In the Export Configuration dialog box, browse to the location to where you would like to save the export file, and type a filename to be given to the export file in the File Name text box. If you would like to export confidential information like user credential passwords, RADIUS shared secrets, or preshared IPSec keys, select the Export Confidential Information (Encryption Will Be Used) check box, as shown in Figure 8-4; otherwise click Export.

  4. In the Set Password dialog box, you must specify a password with at least eight characters to be used when later importing the file. Type the password and confirm the password, and then click OK.

    Note

    All of the confidential information included in the export file is encrypted. This step only appears if you choose to export the confidential information.

  5. In the Export Firewall Policy Rules dialog box, click OK.

Image from book
Figure 8-4: If you select this option, be sure to protect the exported file, as it contains confidential information.

To import the firewall policy, follow these steps:

  1. In the console tree, expand the server name, and click Firewall Policy.

  2. In the task pane, click the Tasks tab. Under Related Tasks, click Import Firewall Policy.

  3. In the Import Configuration dialog box, browse to the location on the disk where you saved the export XML file, and select the export file to insert it into the File Name text box. If you would like to import cache drive settings and SSL certificates, select the Import Cache Drive Settings And SSL Certificates check box, and then click Import.

  4. In the Type Password To Open File dialog box, type the name of the password associated with the export file, and click OK.

  5. In the Importing Firewall Policy Rules dialog box, click OK.

  6. In the details pane, click Apply to save the changes, and then click OK.

Configuring FTP Filtering

When you want to manage FTP connections based on individual rules, do so from within access or publishing rules that include the FTP protocol. These rules take advantage of the FTP Application filter, which manages FTP traffic from SecureNAT clients by opening the secondary ports required for FTP dynamically and performing address translation. Follow these steps to configure FTP filtering:

  1. In the ISA Server Management console tree, expand the server name, and click Firewall Policy.

  2. In the details pane, right-click the access or publishing rule you will use to configure FTP, then select Configure FTP.

    Note

    To publish an FTP server, follow the steps described in the section "Creating a Server Publishing Rule" later in the chapter.

  3. The only option you have available to configure is whether FTP uploads should be blocked, as shown in Figure 8-5. Select the Read Only check box if you wish to block uploads.

Image from book
Figure 8-5: The Read Only check box allows downloads without allowing uploads, reducing the possibility of systems or data being compromised.
Note

For more information on how the FTP Access filter works, see the FTP Access filter section in the ISA Server Help file.

Configuring HTTP Filtering

ISA Server 2004 can perform granular inspection of HTTP traffic using the HTTP filter. Whereas ISA Server 2000 Feature Pack 1 offered functionality to filter HTTP traffic using URLscan, it would apply to all traffic. The HTTP filter can be applied to individual rules, which, for example, lets you allow certain HTTP methods for one group of users, and deny them for another.

To configure HTTP filtering, follow these instructions:

  1. In the ISA Server Management console tree, expand the server name, and click Firewall Policy.

  2. In the details pane, right-click the access or publishing rule you will use to configure HTTP, then select Configure HTTP from the shortcut menu. You will see the Configure HTTP Policy For Rule dialog box, as shown in Figure 8-6.

Image from book
Figure 8-6: Use the HTTP filter for fine control of HTTP traffic on a per-rule basis.

See Table 8-3 for a description of each of the items in the Configure HTTP Policy For Rule dialog box.

Table 8-3: HTTP Security Filter Settings
Tab | Area | Option | Description
General | Request Headers | Maximum Headers Length (Bytes) | This setting is global to every rule that uses the HTTP filter, and provides the ability to limit the size of HTTP headers to prevent buffer overflow attacks. Type the number of bytes in this text box. Values between 10,000 and 33,000 are common.
General | Request Payload | Allow Any Payload Length or Minimum Payload Length (Bytes) | To allow any payload size, select the check box. If cleared, you can block Web content based on payload size by typing in the upper limit in bytes.
General | URL Protection | Maximum URL Length (Bytes) | Type the longest length in bytes you wish for a URL.
General | URL Protection | Maximum Query Length (Bytes) | Type the longest length in bytes you wish for a query.
General | URL Protection | Verify Normalization | This check box verifies the escaped characters (like %20 for a space) to prevent double encoding attacks. If you use this option with a Microsoft SharePoint server, you will have problems with your libraries.
General | URL Protection | Block High Bit Characters | Blocks "high bit" characters (or characters in the upper ASCII range, greater than 128). This prevents some attacks, but can also cause some Web applications that rely on these characters to fail.
General | Executables | Block Responses Containing Windows Executable Content | Select this check box to prevent HTTP responses that contain executable files.
Methods | Specify the Action Taken For HTTP Methods | Allow All Methods, Allow Only Specified Methods, or Block Specified Methods | These options allow you to configure what HTTP methods (for example, GET, PUT, HEAD, POST, and so on) are allowed or blocked. Use the Add, Edit, and Remove buttons to define and edit methods.
Extensions | Specify The Action Taken On File Extensions | Allow All Extensions, Allow Only Specified Extensions, or Block Specified Extensions | These options allow you to configure what HTTP requests with defined file extensions (like .exe, .vbs, .asp) are allowed or blocked. Use the Add, Edit, and Remove buttons to define and edit the extensions.
Extensions | Specify The Action Taken On File Extensions | Block Requests Containing Ambiguous Extensions | This option blocks any extensions that can't be determined
Headers |  | Allow All Headers Except The Following | This section allows you to specify the request or response headers that will be blocked. Use the Add, Edit, and Remove buttons on the right to take corresponding actions on these headers.
Headers | Server Header | Send Original Header, Strip Header From Response, or Modify/Change To | These options allow you to change the server header (which describes the type of Web server you're using, like IIS or A pache), You can send the original, remove the header, or spoof a server header.
Headers | Via Header | Send Default Header, Modify Header In Request And Response/Change To | These options allow you to change the Via Header (which identifies the proxy server to downstream clients) by selecting the Modify Header In Request option, and typing in a spoofed header.
Signatures |  | Block Content Containing These Signatures | You can add, edit, or remove signatures (that is, text strings you specify that can be found in the Request URL, Request Headers, Request Body, Response Headers, or Response Body).
Signatures |  | Show Only Enabled Search Strings | Select this check box when you wish to show only the search strings for which the filter is currently searching.
Note

Before configuring these settings, be sure to consult with your Web administrators. Changing these settings (such as Maximum Query Length) can have an adverse effect on some Web applications.

For more information on configuring the HTTP Security filter, see the MSDN article entitled, "HTTP Filtering In ISA Server 2004" at http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/httpfiltering.mspx and Chapter 10 of Tom and Deb Shinder's Configuring ISA Server 2004.

Configuring RPC Filtering

In ISA Server 2000, the RPC filter applied to all traffic. ISA Server 2004 provides perrule RPC filtering, allowing a great deal more control over RPC traffic. You can configure RPC filtering in both the system policy and with individual access rules. ISA Server 2004 allows you to Enforce Strict RPC Compliance, which provides the highest level of security by preventing Distributed Component Object Model (DCOM) traffic.

There are three ways in which you might need to configure RPC filtering: in the system policy, on an access rule, and when allowing remote Microsoft Outlook clients to connect to a Microsoft Exchange server.

Configuring RPC in System Policy

To configure RPC on the system policy, follow these steps:

  1. In the ISA Server Management console tree, expand the server name, and click Firewall Policy.

  2. In the task pane, click the Task tab, then click Edit System Policy.

  3. In the Configuration Groups list, in the Authentication Services group, select Active Directory, as shown in Figure 8-7.

  4. To enable RPC filtering, select the Enable check box on the General tab.

  5. To prevent DCOM and other RPC-type protocols from running (which will protect you against certain attacks), select the Enforce Strict RPC Compliance check box.

  6. Click OK, then click Apply to commit the changes to ISA Server. Click OK to confirm the changes.

Image from book
Figure 8-7: This policy defines how the ISA server processes RPC traffic.
Note

Many applications require DCOM traffic, so you might need to clear the Enforce Strict RPC Compliance check box. One common situation requires that you temporarily disable RPC filtering when requesting a certificate using the Certificates snap-in in the MMC. See "'The Certificate Request Failed Because Of One Of The Following Conditions' Error Message When You Request a Certificate in ISA Server 2004" Knowledge Base article at http://support.microsoft.com/?scid=833704 for more information on this condition.

Configuring RPC on an Access Rule

To configure the RPC filter on an access rule (which must have RPC protocols selected), follow these steps:

  1. In the ISA Server Management console tree, expand the server name, and click Firewall Policy.

  2. In the details pane, right-click on the access or publishing rule you will use to configure RPC, then select Configure RPC Protocol from the shortcut menu. The Configure RPC Protocol Policy dialog box appears, as shown in Figure 8-8.

  3. Because the RPC filter is enabled when the RPC protocol is selected, the RPC filter manages RPC traffic. The only option you have available to configure is to select the Enforce Strict RPC Compliance check box (see the earlier discussion).

  4. Click OK, then click Apply to commit the changes to ISA Server.

Image from book
Figure 8-8: This dialog box allows you to configure how ISA Server manages RPC traffic for this particular rule.

Configuring RPC with Outlook Clients

To learn how to configure RPC for Outlook, see Chapter 16, "Configuring Microsoft ISA Server with Microsoft Exchange Server 2003."


Access Rules

Access rules describe how a source network (the network from which traffic originates) accesses resources on a destination network (the network on which the target resources reside). Access rules apply primarily to networks that are protected by the ISA Server gaining access to untrusted networks, like a corporate network gaining access to Internet resources.

When a client wishes to access a resource, ISA Server first evaluates network rules to determine what type of connection, if any, exists between networks. If a connection exists, access rules are processed (system policies first, then firewall policies). The request checks the policies to answer the following questions in order:

  1. Is the protocol allowed?

  2. Is the source address and port (defined by a computer, computer set, subnet, or network) allowed?

  3. Does the schedule allow this client access at this time?

  4. Is the destination address (defined by IP addresses, domain names, URL sets, and so on) allowed?

  5. Is the user authenticated and allowed to access this destination?

  6. Is the content of the traffic allowed?

    If the answer to all these questions is "Yes," then the client on the source network can access the resources on the destination network. If the answer to any of the questions is "No," the request is denied (even if a subsequent publishing rule allows the request).

Creating an Access Rule

To create a new access rule, follow these steps.

  1. In the console tree, expand the server name, and click Firewall Policy.

  2. In the task pane, click the Tasks tab. Under Firewall Policy Tasks, click Create New Access Rule.

  3. On the Welcome To The New Access Rule Wizard page, type a name for the new access rule, and click Next.

  4. On the Rule Action page, select either Allow or Deny to specify whether the action of this rule is to allow or deny access, and click Next.

  5. On the Protocols page (shown in Figure 8-9), from the This Rule Applies To drop-down list, choose one of the following:

    • All Outbound Traffic—Implies all allowed traffic. If you choose this option, click Next to continue.

    • Selected Protocols—If you choose this option, click Add. On the Add Protocols page, select the protocols you wish to add to the access rule, click Add again, and then click Next to continue.

    • All Outbound Traffic Except Selected—If you choose this option, you will complete the same steps as above, but the protocols added will be treated as exceptions when the access rule is processed. Add the necessary protocols, and click Next to continue.

    On the Protocols page, you can also click Ports to limit traffic from clients originating within a range of source ports. By default, traffic from any allowed source port is accepted.

  6. On the Access Rule Sources page, click Add. In the Add Network Entities dialog box, select the networks to include in the rule (for example, Internal), click Add, and then click Close. Click Next to continue.

  7. On the Access Rule Destinations page, click Add. In the Add Network Entities dialog box, click the networks to include in the rule (for example, External), click Add, and then click Close. Click Next to continue.

  8. On the User Sets page, the default setting is for the rule to apply requests from the All Users user set. If you would like to modify the default, you can click All Users, click Remove, and then click Add to include new user sets. Click Add, in the Add Users dialog box click the user set to include in the rule, click Add again, and then click Close. Click Next to continue.

  9. On the Completing The New Access Rule Wizard page, review the summary of information, and then click Finish.

  10. Click Apply to save your changes, and then click OK.

Image from book
Figure 8-9: You can determine to which protocols the rule applies on this page.

Disabling an Access Rule

Within the ISA Server Management console, you can choose to disable individual access rules or multiple access rules by using the Shift and Control keys on your keyboard and selecting each of the rules you would like to disable. The Last Default Rule that is configured with the installation of ISA Server 2004 cannot be disabled or deleted. You can see this when you have context on the default rule in the details pane by viewing the available tasks under Firewall Policy Tasks in the task pane. Notice that the task to disable or delete the selected rule is missing, but if you select a user-defined access rule, the two tasks appear.

Any type of rule can be disabled, whether it be an access rule, Web publishing rule, or server publishing rule. All are treated the same within the console.

To disable a user-defined access rule, follow these steps:

  1. In the console tree, expand the server name, and click Firewall Policy.

  2. In the details pane, select the access rule that you would like to disable.

  3. In the task pane, click the Tasks tab. Under Firewall Policy Tasks, click Disable Selected Rules.

  4. In the details pane, the icon for the access rule immediately changes to reflect a red downward arrow inside a circle as shown in Figure 8-10.

  5. Click Apply to save your changes and update the configuration, and then click OK.

    Note

    To re-enable the access rule, select the specified rule in the details pane, and then in the tasks pane, click Enable Selected Rules.
Image from book
Figure 8-10: Notice how the icon has changed to reflect the disabled access rule.

Deleting an Access Rule

The access rules on your ISA server can be deleted. If you have ISA Server up and running in a production network, it is good practice to disable the access rules prior to deletion to provide yourself with an easy back-out solution in case the rule was providing access to certain protocols that you weren't aware were in use.

Any type of rule can be deleted, except the Last Default Rule created by the installation of ISA Server. This includes access rules, Web publishing rules, and server publishing rules.

To delete an access rule, complete the following steps:

  1. In the console tree, expand the server name, and click Firewall Policy.

  2. In the details pane, select the access rule that you would like to delete.

  3. In the task pane, click the Tasks tab. Under Firewall Policy Tasks, click Delete Selected Rules.

  4. In the Confirm Delete dialog box, click Yes to delete the access rule.

  5. Click Apply to save your changes and update the configuration, and then click OK.

Changing the Order of an Access Rule

Once you have more than one user-defined access rule, a new task becomes available to you in the task pane: the ability to move the selected rule either up or down in the Order column. This is a new concept in ISA Server 2004, because in ISA Server 2000, ordering of site and content rules and protocol rules was not necessary.

To change the order of an access rule, follow these steps:

  1. In the console tree, expand the server name, and click Firewall Policy.

  2. In the details pane, select the access rule that you would like to move up or down.

  3. In the task pane, click the Tasks tab. Under Firewall Policy Tasks, click Move Selected Rules Up.

    Note

    The interface within the console understands, based on the position of the access rule, whether the rule can be moved up or down. It changes the title of the task appropriately or shows both tasks within the task menu. For example, if the rule you selected is in the first position, the task displays Move Selected Rules Down.

  4. The access rule then moves up to the new position in the order. In the details pane, click Apply to save your changes and update your configuration, and then click OK.


Web Publishing

Web publishing makes Web servers on ISA protected networks available to other networks, most often for clients on the Internet. ISA Server mediates all requests for internal Web servers, providing the ability to preauthenticate users, preventing them from even contacting the internal Web server if they can't be verified. It also allows for reverse caching of content, reducing the amount of traffic required on the network. You can use it to host several Web sites using a single IP address, and to redirect Web sites to different internal Web sites through path redirection.

We provide instructions for how to publish Web servers and secure Web servers. For more information about the features and functions of Web publishing, see the ISA Server Help file, http://www.isaserver.org, and Tom and Deb Shinder's Configuring ISA Server 2004.

Publishing a Web Server

To publish a Web server, follow these steps:

  1. In the console tree, expand the server name, and click Firewall Policy.

  2. In the task pane, click the Tasks tab. Under Firewall Policy Tasks, click Publish A Web Server.

  3. On the Welcome To The New Web Publishing Rule Wizard page, type a name for the Web publishing rule, and click Next to continue.

  4. On the Select Rule Action page, select either Allow or Deny to specify the action you want the rule to take when the conditions are met and processed, and click Next.

  5. On the Define Website To Publish page shown in Figure 8-11, provide the internal server name that is hosting the Web site and the level of access that is available (full access or limited access). The following options are available:

    • Computer Name Or IP Address—Type either the FQDN or IP address of the internal Web server in this text box. Optionally, you can click Browse to type and confirm the name of the server, then click OK.

    • Forward The Original Host Header Instead Of The Actual One (Specified Above)—Select this check box if you don't want the ISA server to replace the host header originally sent by the client with the name or IP of the computer above.

    • Path—Type /* to include all files and folders on the Web site, or type folder/* to limit access to a specified folder on the Web site. You can also specify the exact filename to control access to the published resource even further.

    You will notice as you fill in the appropriate text boxes that the Site text box displays the URL of the Web site to be published. Click Next to continue.

  6. On the Public Name Details page, specify how users outside your company network will access the published Web site.

    • In the Accept Requests For drop-down list, select either Any Domain Name or This Domain Name (Type Below). If you select Any Domain Name, the Public Name dialog box disappears from the page.

    • In the Public Name dialog box, type the URL that is publicly accessible, such as www.microsoft.com.

    • In the Path (Optional) dialog box, type the external path to be accepted, for example /* to include all folders and files typed after www.microsoft.com by the Internet user.

    You will notice as you fill in the appropriate text boxes that the Site text box displays the URL of the Web site to be published. Click Next to continue.

  7. On the Select Web Listener page, use the Web Listener drop-down list to choose an existing listener. If no Web listener exists, click New to launch the Welcome To The New Web Listener Wizard. The steps to create the Web Listener are defined in Chapter 7, "Configuring Access Rule Elements." Once a Web listener is selected, its properties appear for you to review before continuing. Click Next to proceed.

  8. On the User Sets page, the default setting is for the rule to apply requests from the All Users user set. If you would like to modify the default, you can click All Users, click Remove, and then click Add to include new user sets. Click Add, in the Add Users dialog box click the user set to include in the rule, click Add again, and then click Close. Click Next to continue.

  9. On the Completing The New Web Publishing Rule Wizard page, review the summary of information and then click Finish.

  10. In the details pane, click Apply to save your configuration, and then click OK.

Image from book
Figure 8-11: The Define Website To Publish page is very important to configure correctly.

Modifying an Existing Web Publishing Rule

After you have defined a Web publishing rule, you can edit the rule by completing the following steps:

  1. In the details pane, click the Web publishing rule you would like to edit.

  2. In the task pane, click the Tasks tab. Under Firewall Policy Tasks, click Edit Selected Rule.

    The Edit Selected Rule task launches the Properties dialog box for the given Web publishing rule, as shown in Figure 8-12.

    There are 12 tabs available, with some containing options that were not available to you when you created the Web publishing rule. Table 8-4 outlines the options available for you on each tab.

  3. Click OK when you have made the changes to the Web publishing rule. If you did make changes, you have to apply them by clicking Apply in the details pane.

Image from book
Figure 8-12: From the rule's Properties dialog box you can configure additional information, like Link Translation.
Table 8-4: Property Settings for a Web Publishing Rule
Tab Name | Tab Options/Descriptions
General | Specify the name of the rule, provide an optional description, or specify a location to disable the selected rule.
Action | Specify action to take on the rule (either Allow or Deny); and an option to log requests matching the rule that is selected by default.
From | Configure the source locations from which Web traffic will originate.
To | Configure the published server name, how host headers are routed, and how the firewall sends requests to the published server.
Traffic | Open the Configure HTTP dialog box to manage the HTTP Security filter, and configure redirection so that HTTP users are notified they must use HTTPS.
Listener | Create or configure the ISA Server 2004 Web listener used for the rule.
Public Name | Configure the Web site and IP addresses used to connect to the published server sites.
Paths | Add, edit, or remove requested paths. You can translate external paths to different internal paths here.
Bridging | Configure the port and protocol used to move HTTP, HTTPS, and FTP traffic from the ISA server to the internal server.
Users | Configure the users to which the rule applies, and choose whether to forward basic authentication credentials.
Schedule | Set the schedule when the rule is in effect.
Link Translation | Configure how Link Translation is used for this rule.

Publishing a Secure Web Server

The following procedures detail how to publish a secured Web server using the SSL protocol. To publish a secure Web server, you must perform the following steps:

  1. Import a certificate to be used by the client, ISA server, and Web server.

  2. Publish the server using the Publish A Secure Web Server Wizard in the ISA Server Management console.

These two procedures are discussed in the following sections.

Importing Certificates

You need to follow these steps to import the Web site certificate required for HTTPS communications:

  1. Export the certificate from the Web site. Be sure that you export the private key, password protect the file, and safeguard it.

    1. At the Run command, type mmc.

    2. In the MMC window, from the File menu (or the Console menu in Microsoft Windows 2000), select Add/Remove Snap-In. Click Add, select Certificates, and then click Add.

    3. On the Certificates Snap-In page, select Computer Account, then click Next.

    4. On the Select Computer page, ensure that Local Computer is selected, and then click Finish.

    5. In the Add Standalone Snap-In dialog box, click Close. In the Add/ Remove Snap-In dialog box, click Close, and then click OK.

    6. In the console tree, expand the Certificates node, expand the Personal node, and then click the Certificates container.

    7. In the right pane, right-click the Web site certificate, select All Tasks, then click Export. The Welcome To The Certificate Export Wizard page appears. Click Next.

    8. On the Export Private Key page, select Yes, Export The Private Key, and then click Next.

    9. On the Export File Format page, select Personal Information Exchange — PKCS #12 (.PFX), select the Enable Strong Protection check box as shown in Figure 8-13, and then click Next.

    10. On the Password page, type in and confirm a password to protect the file.

    11. On the File To Export page, type in the path and location to which you will save the certificate. Be sure to remember this location, as you will need to copy the file to the ISA Server computer from here.

    12. On the Completing The Certificate Export Wizard page, review your information and click Finish.

      Note

      For more information on how to back up certificates, see "How to Back Up a Server Certificate in Internet Information Services 5.0" at http://support.microsoft.com?scid=232136. The same process is valid for Microsoft Internet Information Services (IIS) 6.0 if your Web server is running Microsoft Windows Server 2003.

  2. Copy the certificate file from the Web computer to the ISA server.

  3. Import the Web site certificate to the ISA server.

    1. Add the Certificates MMC, as previously described.

    2. Right-click the Certificates container (under the Certificates | Personal path), select All Tasks, and then click Import. The Welcome To The Certificate Import Wizard page appears. Click Next.

    3. On the File To Import page, browse to or type in the path and name of the certificate you will install, and then click Next.

      Note

      If you browse in the Open dialog box, you might need to change the Files Of Type option to the Personal Information Exchange (*.Pfx, *P12) type to see the certificate on the file system.

    4. On the Password page, type the password, and then click Next.

    5. On the Certificate Store page, select Place All Certificates In The Following Store, and ensure that the Certificate Store is set to Personal. Click Next.

    6. On the Completing The Certificate Import Wizard page, review your chosen options, then click Finish. A dialog box that states "The import was successful" should appear. Click OK.

    7. Right-click the certificate, select Properties, and ensure that the Certificate Purposes section lists only the purposes for which you will use the certificate on ISA Server. Click OK.

    8. Move the certificate into the Trusted Root Certification Authorities Certificates container, and close any remaining open windows.

Image from book
Figure 8-13: Don't select the Delete The Private Key If The Export Is Successful check box, as it will remove the private key (which is necessary) from the Web server.

You are now ready to move on to the next step.

Running the Publish Secure Web Server Wizard

To initiate the Publish Secure Web Server Wizard, complete the following steps:

  1. In the console tree, expand the server name, and click Firewall Policy.

  2. In the task pane, click the Tasks tab. Under Firewall Policy Tasks, click Publish A Secure Web Server.

  3. On the Welcome To The SSL Web Publishing Rule Wizard page, type a name to associate with the rule, and click Next.

  4. On the Publishing Mode page shown in Figure 8-14, select either SSL Bridging or SSL Tunneling, and click Next to continue.

    Note

    An image is provided to illustrate the difference between bridging and tunneling SSL requests. Additionally, the following pages in the wizard differ based on your selection.

    If you selected SSL Bridging, follow the remaining steps; otherwise skip to Step 13.

  5. On the Select Rule Action page, select either Allow or Deny to specify the action you want the rule to take when the conditions are met and processed, and click Next.

  6. On the Bridging Mode page shown in Figure 8-15, choose from the following options:

    • Secure Connection To Clients

    • Secure Connection To Web Server

    • Secure Connection To Clients And Web Server

    Click Next to continue.

    Note

    The image changes with each selection, providing a graphical representation of the option you are choosing.

  7. On the Define Website To Publish page, provide the internal server name that is hosting the Web site and the level of access that is available (full access or limited access). The following options are available to you:

    • Computer Name Or IP Address—Type either the FQDN or IP address of the internal Web server in this text box. Optionally, you can click Browse to type and confirm the name of the server, then click OK.

    • Forward The Original Host Header Instead Of The Actual One (Specified Above)—Select this check box if you don't want the ISA server to replace the host header originally sent by the client with the name or IP of the computer above. Host headers are used to distinguish multiple websites hosted on a single Web server with a single IP address. Select this check box only if you have configured your Web server to respond to the original host headers being typed into the address bar of client Web browsers.

    • Path—Type /* to include all files and folders on the Web site, or type folder/* to limit access to a specified folder on the Web site. You can also specify the exact filename to control access to the published resource even further.

    You will notice as you fill in the appropriate text boxes, the Site text box displays the URL of the Web site to be published. Click Next to continue.

  8. On the Public Name Details page, specify how users outside your company network will access the published Web site.

    • In the Accept Requests For drop-down list, select either Any Domain Name or This Domain Name (Type Below). If you select Any Domain Name, the Public Name text box disappears from the page.

    • In the Public Name text box, type the URL that is publicly accessible, such as www.contoso.com.

    • In the Path (Optional) text box, type the external path to be accepted (for example, /*) to include all folders and files typed after www.contoso.com by the Internet user.

    You will notice as you fill in the appropriate text boxes, the Site text box displays the URL of the Web site to be published as illustrated in Figure 8-16. Click Next to continue.

  9. On the Select Web Listener page, select an existing listener from the Web Listener drop-down list. If no Web listener exists, click New to launch the Welcome To The New Web Listener Wizard. The steps to create the Web listener are defined in Chapter 7. Once a Web listener is selected, its properties appear for you to review before continuing. Click Next to proceed.

  10. On the User Sets page, the default setting is for the rule to apply requests from the All Users user set. If you would like to modify the default, you can select All Users, click Remove, and then click Add to include new user sets. Click Add, in the Add Users dialog box, select the user set to include in the rule, click Add again, and then click Close. Click Next to continue.

  11. On the Completing The New SSL Web Publishing Rule Wizard page, review the summary of information and then click Finish.

  12. In the details pane, click Apply to save your configuration, and then click OK. You do not need to follow the next steps.

  13. If you selected SSL Tunneling in step 4, on the Select Server page, type the IP address of the server you are publishing, and click Next.

  14. On the IP Addresses page, select each of the networks that contain IP addresses that should be listening for requests intended for the published server, as shown in Figure 8-17.

    Additionally, after selecting a network, you can click Address to launch the Network Listener IP Selection dialog box shown in Figure 8-18. Your options include the following:

    • All IP Addresses On The ISA Server Computer That Are In The Selected Network.

    • Default IP Address(es) For Network Adapter(s) On This Network.

    • Specified IP Addresses On The ISA Server Computer In The Selected Network. If you select this option, you will see Available IP addresses on the left, and you can click Add to include the selected IP address to the Selected IP Addresses area on the right.

    Click OK to close the dialog box, and then click Next to continue the wizard.

  15. On the Completing The New SSL Web Publishing Rule Wizard page, review the summary of information, and click Finish.

  16. In the details pane, click Apply to save your changes, and then click OK

Image from book
Figure 8-14: The images and descriptions of SSL Bridging and SSL Tunneling add a nice touch to this wizard.
Image from book
Figure 8-15: Bridging mode options define what type of protocol (HTTP or HTTPS) access you will support to the ISA server and how you will send the traffic to the published secure Web server.
Image from book
Figure 8-16: The Public Name setting is what Internet clients would type in their browsers to access this Web site.
Image from book
Figure 8-17: You can choose from any existing networks to define which IP address ranges will listen for requests for the published Web server.
Image from book
Figure 8-18: You have a lot of control over which IP addresses from the selected networks will listen for requests directed to the published Web server.


Server Publishing

Server publishing makes an internal server service on a given computer and port number accessible to users on the Internet. Your ISA server acts as a reverse proxy server for this service and Internet users can access it by connecting to your ISA server's IP address and the port you specified. ISA Server then forwards these requests to the server being published. You can publish just about any server, including SQL Server computers, mail servers, DNS servers, and so on.

Creating a Server Publishing Rule

To create a server publishing rule, follow these steps:

  1. In the console tree, expand the server name, and click Firewall Policy.

  2. In the task pane, click the Tasks tab. Under Firewall Policy Tasks, click Create New Server Publishing Rule.

  3. On the Welcome To The New Server Publishing Rule Wizard page, type a name to associate with the rule, and click Next to continue.

  4. On the Select Server page, type the IP address of the server you are publishing, and click Next.

  5. On the Select Protocol page, from the Select Protocol drop-down list as shown in Figure 8-19, choose from 24 predefined protocols like DNS, POP3, FTP, SMTP, and so on. If you don't see the protocol listed that you want to publish, click New to launch the Welcome To The New Protocol Definition Wizard, which is detailed in Chapter 7. To override the default ports defined in the protocol definitions, click Ports. On the Ports page, you specify how the firewall ports, published server ports, and source ports should be handled by the rule. You can choose to leave the default ports or specify new ports that override the port information included in the protocol definitions. Click OK to close and click Next to continue.

  6. On the IP Addresses page, select each of the networks that contain IP addresses that should be listening for requests that are intended for the published server. Additionally, after selecting a network, you can click Address to launch the Network Listener IP Selection dialog box. Your options include the following:

    • All IP Addresses On The ISA Server Computer That Are In The Selected Network.

    • The Default IP Address On The ISA Server Computer In The Selected Network.

    • Specified IP Addresses On The ISA Server Computer In The Selected Network—If you select this option, you will see Available IP addresses on the left, and you can click Add to include the selected IP address in the Selected IP Addresses area on the right.

    Click OK to close the dialog box, and then click Next to continue the wizard.

  7. On the Completing The New Server Publishing Rule Wizard page, review the summary of information, and click Finish.

  8. In the details pane, click Apply to save your configuration, and then click OK.

    Note

    FTP servers are one of the types of servers most commonly published using this technique, along with e-mail servers and SQL servers. To complete the configuration of the FTP server publishing rule, you must configure the FTP Access filter as described in the earlier "Configuring FTP Filtering" section.
Image from book
Figure 8-19: You can choose from one of 24 different pre-created protocols, or define your own.

Publishing a Mail Server

To publish a mail server, follow these steps:

  1. In the console tree, expand the server name, and click Firewall Policy.

  2. In the task pane, click the Tasks tab. Under Firewall Policy Tasks, click Publish A Mail Server.

  3. On the Welcome To The New Mail Server Publishing Rule Wizard page, type a name for the publishing rule, and click Next to continue.

  4. On the Select Access Type page, select one of the following options:

    • Web Client Access: Outlook Web Access (OWA), Outlook Mobile Access, Exchange Server ActiveSync

    • Client Access: RPC, IMAP, POP3, SMTP

    • Server-to-Server Communication: SMTP, NNTP

    Click Next to continue.

    Note

    Depending on your selection in Step 4, the next page in the wizard, the Select Services page, differs. The remaining steps in this procedure walk you through each of the options.

Web Client Access: Outlook Web Access (OWA), Outlook Mobile Access, Exchange Server ActiveSync

  1. On the Select Services page shown in Figure 8-20, select the protocols you would like to publish. Options include Outlook Web Access, Outlook Mobile Access, and Exchange ActiveSync. By default, the Enable High Bit Characters Used By Non-English Character Sets check box is selected. Click Next to continue.

  2. On the Bridging Mode page, choose from the following options:

    • Secure Connection To Clients

    • Secure Connection To Clients And Mail Server

    • Standard Connections Only

    Note

    The image changes with each selection, providing a graphical representation of the option you are choosing.

    Click Next to continue.

  3. On the Specify The Web Mail Server page, type the name or IP address of the Web mail server to publish, or click Browse to type and confirm the server. If you click Browse, after typing the server name, you need to click OK to return to the Specify The Web Mail Server page. Click Next to continue.

  4. On the Public Name Details page, specify how users outside your company network will access the published Web mail server.

    • In the Accept Requests For drop-down list, select either Any Domain Name or This Domain Name (Type Below). If you select Any Domain Name, the Public Name text box disappears from the page.

    • In the Public Name text box, type the URL that is publicly accessible, such as www.contoso.com.

    Click Next to continue.

  5. On the Select Web Listener page, select an existing listener from the Web Listener drop-down list. If no Web listener exists, click New to launch the Welcome To The New Web Listener Wizard. The steps to create the Web Listener are defined in Chapter 7. Once a Web listener is selected, its properties appear for you to review before continuing. Click Next to proceed.

  6. On the User Sets page, the default setting is for the rule to apply requests from the All Users user set. If you would like to modify the default, you can click All Users, click Remove, and then click Add to include new user sets. Click Add, in the Add Users dialog box, select the user set to include in the rule, click Add again, and then click Close. Click Next to continue.

  7. On the Completing The New Mail Server Publishing Rule Wizard page, review the summary of information and then click Finish.

  8. In the details pane, click Apply to save your configuration, and then click OK.

Image from book
Figure 8-20: The view of the Select Services page publishing Outlook Web Access, Outlook Mobile Access, or Exchange ActiveSync.

Client Access: RPC, IMAP, POP3, SMTP

  1. On the Select Services page shown in Figure 8-21, select the protocols you would like to publish. Options include Outlook (RPC), POP3, IMAP4, and SMTP. Click Next to continue.

  2. On the Select Server page, type the IP address of the server you are publishing, and click Next.

  3. On the IP Addresses page, select each of the networks that contain IP addresses that should be listenig for requests intended for the published server. Additionally, after selecting a network, you can click Address to launch the Network Listener IP Selection dialog box. Your options include the following:

    • All IP Addresses On The ISA Server Computer That Are In The Selected Network.

    • The Default IP Address On The ISA Server Computer In The Selected Network.

    • Specified IP Addresses On The ISA Server Computer In The Selected Network. If you select this option, you will see Available IP addresses on the left, and you can click Add to include the selected IP address in the Selected IP Addresses area on the right.

    Click OK to close the dialog box, and then click Next to continue the wizard.

  4. On the Completing The New Mail Server Publishing Rule Wizard page, review the summary of information, and click Finish.

  5. In the details pane, click Apply to save your changes, and then click OK.

Image from book
Figure 8-21: The view of the Select Services page publishing Outlook (RPC), POP3, IMAP4, and SMTP.

Server-to-Server Communication: SMTP, NNTP

Note

To complete the configuration of the SMTP server publishing rule, you must configure the SMTP Access filter.

On the Select Services page shown in Figure 8-22, select the protocols you would like to publish. Options include Simple Mail Transfer Protocol (SMTP) and Network News Transfer Protocol (NNTP).

Image from book
Figure 8-22: The view of the Select Services page publishing SMTP and NNTP.

The remaining steps are identical to Steps 6 through 9 in the preceding list.

Note

For more information on how to securely publish Exchange using ISA Server, see Chapter 16.


Troubleshooting Firewall Policy

Firewall policies are the heart and soul of ISA Server's functionality, and some scenarios can become fairly complex. Be sure to review the Microsoft Knowledge Base (http://support.microsoft.com) for issues that relate to your particular scenario. See http://www.isaserver.org and the ISA Server newsgroups (listed at http://www.microsoft.com/isaserver/community) for tutorials and a great forum where many people share stories of how to set up access rules, publish servers, and overcome environmental and technical challenges.

Here are a few key points to remember and good resources to use when troubleshooting.

  • When you make changes to firewall policies, current sessions aren't affected. You need to either disconnect the sessions or restart the firewall service for these sessions to enlist the new policies.

  • Be sure that you understand the difference between system policies, access rules, and publishing rules. Remember that traffic is processed first at the network, then system policies, then access or publishing rules.

  • For ISA Server 2000 users, don't forget to click Apply after making changes. ISA needs to commit the changes to the register (in Standard Edition) or the CSS (in Enterprise Edition).

  • Remember that if you have a NAT relationship between networks, access rules can only apply from the source (protected) to destination (untrusted) networks. Publishing rules are necessary to allow traffic in the other direction. When the network relationship is set to Route, access rules can apply both ways.


Chapter 9: Configuring Multinetworking

Overview

This chapter introduces a brand new concept in Microsoft ISA Server 2004: multinetworking. Multinetworking is a way to define many different types of networks (such as internal, perimeter, external, and so on), control the access between those networks, and truly segment the traffic on the networks you manage in the way that you want. In Microsoft ISA Server 2000, you might recall that there was a Local Address Table (LAT) that defined your internal network segments. Anything not in the LAT was considered external. The multinetworking functionality of ISA Server 2004 completely alters the way you, as an ISA administrator, will set up and configure your firewall.

The basic premise is that you first need to define your networks. You can then group those networks into network sets. Lastly, you define how the networks communicate with one another using network rules. Each of the networks you create is isolated from the others, so the communication is dependent on your configuration of the firewall access policy. This chapter focuses on the following topics:

  • Network templates

  • Networks

  • Network sets

  • Network rules

  • Web and firewall chaining


Working with Network Templates

Network templates are new in ISA Server 2004. Network templates of five very common network topologies are available from within the ISA Server Management console. You can configure your ISA server to run with a single network adapter, sit on the network edge, or establish a perimeter network simply by choosing a template and walking through the steps in this section.

The five network templates are outlined in Table 9-1.

Table 9-1: Explanation of Network Templates
Network Template | Description
Edge Firewall | In this scenario, ISA Server acts as a firewall to prevent unauthorized access to the network, and also acts as a secure gateway for users to access content on the Internet.
3-Leg Perimeter | In this scenario, ISA Server is connected to your internal network, external network, and perimeter network.
Front Firewall | In this scenario, ISA Server is complementing an existing back-end firewall. The front-end firewall connects to the external and perimeter networks.
Back Firewall | In this scenario, ISA Server is complementing an existing front-end firewall. The back-end firewall connects to the perimeter and internal networks.
Single Network Adapter Configuration | In this scenario, ISA Server is acting as a proxy and Web caching server. This option does not take advantage of ISA Server's firewall capabilities.

Creating an Edge Firewall

An edge firewall configuration is one of the primary deployment scenarios for ISA Server. You are placing the ISA server between your internal network and the outside world to provide both firewall and proxy capabilities.

To create an edge firewall, follow these steps:

  1. In the console tree, expand the server name, expand Configuration, and click Networks.

  2. In the task pane, click the Templates tab.

  3. Click Edge Firewall.

  4. On the Welcome To The Network Template Wizard page, read the text to ensure you have selected the template that you would like to apply to your ISA server, and click Next.

  5. On the Export The ISA Server Configuration page, you are advised to export your ISA Server configuration for backup purposes. If you choose to do so, click Export, determine the disk location, type a name for the export file, specify optional parameters to include user permissions and confidential data (such as user passwords and certificates), and click Export, and then click OK. When the export is complete, you are returned to this page in the wizard. Click Next to continue.

    Note

    If you choose to export confidential information, you are prompted to set a password with a minimum of eight characters. The password is needed if you choose to import the file.

  6. On the Internal Network IP Addresses page, choose to define the network using one or more of the following three methods, and then click Next.

    • Add Add a range of Internet Protocol (IP) addresses you assign.

    • Add Adapter Choose one of the ISA Server computer's network adapters, and use its routing table to configure the network.

    • Add Private Add one or more of three private network ranges. As a best practice, avoid adding all of these ranges.

  7. On the Select A Firewall Policy page, choose one of firewall policies (shown in Figure 9-1 and explained here) to apply to your networks. Then, click Next.

    Note

    Adding private address ranges that aren't used in your network increases the number of potential computers that can exist inside your protected networks. By limiting the range of the internal network, you reduce your attack surface.

    • Block All Blocks all network traffic utilizing the Default Rule installed with ISA Server. Use this option when you want to define your own policies and access rules.

    • Block Internet Access, Allow Access To ISP Network Services Blocks all network traffic except for protocol access to DNS and VPN services that might be provided by your ISP. This option creates one new access rule.

    • Allow Limited Web Access Only allows access to HTTP, HTTPS, and FTP protocols while blocking all other network traffic. This option creates two new access rules.

    • Allow Limited Web Access And Access To ISP Network Services Only allows access to HTTP, HTTPS, FTP for Web access, and access for Domain Name System (DNS) and virtual private network (VPN) protocols for services that might be provided by your ISP. This option creates three new access rules.

    • Allow Unrestricted Access Allows all network traffic across all protocols. This option creates two new access rules.

  8. On the Completing The Network Template Wizard page, review the summary of information, and click Finish.

  9. In the details pane, you will see an illustration of the edge firewall network topology under the Networks tab. To update your configuration, click Apply, and then click OK.

    In the Apply New Configuration dialog box, you will notice a note at the bottom stating that if your VPN configuration was affected by this change that it can take several minutes before the changes are enacted.

Image from book
Figure 9-1: There are several different types of firewall policies for you to choose from when configuring your ISA server using network templates.

Creating a 3-Leg Perimeter

A 3-leg perimeter firewall is configured with three network adapters. Each network adapter connects to a unique network: the internal network, the external network, and the perimeter network.

To create a 3-leg perimeter firewall, complete the following steps:

  1. In the console tree, expand the server name, expand Configuration, and click Networks.

  2. In the task pane, click the Templates tab.

  3. Click 3-Leg Perimeter.

  4. On the Welcome To The Network Template Wizard page, read the text to ensure you have selected the template that you would like to apply to your ISA server, and click Next.

  5. On the Export The ISA Server Configuration page, you are advised to export your ISA server configuration for backup purposes. If you choose to do so, click Export, determine the disk location, type a name for the export file, specify optional parameters to include user permissions and confidential data (such as user passwords and certificates), and click Export, and then click OK.When the export is complete, you are returned to this page in the wizard.Click Next to continue.

  6. On the Internal Network IP Addresses page, choose to define the internal network using one or more of the following three methods, and then click Next.

    • Add Add a range of IP addresses you assign.

    • Add Adapter Choose one of the ISA Server computer's network adapters, and use its routing table to configure the network.

    • Add Private Add one or more of three private network ranges. As a best practice, avoid adding all of these ranges.

  7. On the Perimeter Network IP Addresses page, choose to define your perimeter network using the same options available in Step 6, and then click Next.

  8. On the Select A Firewall Policy page, choose one of the following firewall policies to apply to your networks, and then click Next.

    Note

    Refer to Step 7 in the section "Creating an Edge Firewall," earlier in this chapter, to reference the description of the common firewall policies used by each of the network templates. This procedure is defining the unique firewall policies not yet explained.

    • Block Internet Access, All Access To Network Services On The Perimeter Network Blocks all network traffic except for protocol access to DNS and VPN on your perimeter network. This option creates one new access rule.

    • Allow Limited Web Access, Allow Access To Network Services On The Perimeter Network Only allows access to HTTP, HTTPS, FTP for Web access, and access for DNS and VPN protocols for access to your perimeter network. This option is recommended when your network services reside in the perimeter network. This option creates three new access rules.

  9. On the Completing The Network Template Wizard page, review the summary of information, and click Finish.

  10. In the details pane, you will see an illustration of the 3-leg perimeter network topology under the Networks tab. To update your configuration, click Apply, and then click OK.

Creating a Front Firewall

A front firewall configuration is a back-to-back firewall topology where ISA Server is connecting to the Internet edge. The ISA server connects to the external network and the perimeter network.

To create a front firewall, follow these steps:

  1. In the console tree, expand the server name, expand Configuration, and click Networks.

  2. In the task pane, click the Templates tab.

  3. Click Front Firewall.

  4. On the Welcome To The Network Template Wizard page, read the text to ensure you have selected the template that you would like to apply to your ISA server, and click Next.

  5. On the Export The ISA Server Configuration page, you are advised to export your ISA server configuration for backup purposes. If you choose to do so, click Export, determine the disk location, type a name for the export file, specify optional parameters to include user permissions and confidential data (such as user passwords and certificates), click Export, and then click OK. When the export is complete, you are returned to this page in the wizard. Click Next to continue.

  6. On the Perimeter Network IP Addresses page, choose to define the perimeter network using one or more of the following three methods, and then click Next.

    • Add Add a range of IP addresses you assign.

    • Add Adapter Choose one of the ISA Server computer's network adapters, and use its routing table to configure the network.

    • Add Private Add one or more of three private network ranges. As a best practice, avoid adding all of these ranges.

  7. On the Select A Firewall Policy page, select the firewall policy to apply to your ISA server, and then click Next. Your options include the following:

    • Block All Prevents all traffic from passing through ISA Server.

    • Block Internet Access, Allow Access To ISP Network Services Only allows DNS communications from the perimeter and VPN client networks to External network.

    • Allow Limited Web Access, Allow Access To Network Services On Perimeter Network Only allows access to HTTP, HTTPS, FTP for Web access, and access for DNS and VPN protocols for access to your perimeter network. This option is recommended when your network services reside in the perimeter network. This option creates three new access rules.

    • Allow Limited Web Access And Access To ISP Network Services Only allows access to HTTP, HTTPS, FTP for Web access, and access for DNS and VPN protocols for access to the External network. This option is recommended when your network services reside on the ISP's servers. This option creates three new access rules.

    • Allow Unrestricted Access Allows access from all Protected networks to the External network.

  8. On the Completing The Network Template Wizard page, review the summary of information, and click Finish.

  9. In the details pane, you will see an illustration of the front firewall network topology under the Networks tab. To update your configuration, click Apply, and then click OK.

Creating a Back Firewall

A back firewall configuration is a back-to-back firewall topology where ISA Server is providing additional firewall capabilities to the existing front-end firewall. This is common when the front-end firewall provides only stateful packet inspection, and the ISA server on the back end complements the front-end firewall by providing application-level packet inspection. The ISA server in this scenario connects to the internal network and the perimeter network.

To create a back firewall, follow these steps:

  1. In the console tree, expand the server name, expand Configuration, and click Networks.

  2. In the task pane, click the Templates tab.

  3. Click Back Firewall.

  4. On the Welcome To The Network Template Wizard page, read the text to ensure you have selected the template that you would like to apply to your ISA server, and click Next.

  5. On the Export The ISA Server Configuration page, you are advised to export your ISA server configuration for backup purposes. If you choose to do so, click Export, determine the disk location, type a name for the export file, specify optional parameters to include user permissions and confidential data (such as user passwords and certificates), and click Export, and then click OK.When the export is complete, you are returned to this page in the wizard.Click Next to continue.

  6. On the Internal Network IP Addresses page, choose to define the internal network using one or more of the following three methods, and then click Next.

    • Add Add a range of IP addresses you assign.

    • Add Adapter Choose one of the ISA Server computer's network adapters, and use its routing table to configure the network.

    • Add Private Add one or more of three private network ranges. As a best practice, avoid adding all of these ranges.

  7. On the Select A Firewall Policy page, choose one of the following firewall policies to apply to your networks. Click Next to continue.

    • Block All Prevents all traffic from passing through ISA Server.

    • Block Internet Access, All Access To Network Services On The Perimeter Network Blocks all network traffic except for protocol access to DNS and VPN on your perimeter network. This option creates one new access rule.

    • Block Internet Access, Allow Access To ISP Network Services Only allows DNS communications from the perimeter and VPN client networks to External network.

    • Allow Limited Web Access Only allows access to HTTP, HTTPS, and FTP protocols while blocking all other network traffic. This option creates two new access rules.

    • Allow Limited Web Access, Allow Access To Network Services On Perimeter Network Only allows access to HTTP, HTTPS, FTP for Web access, and access for DNS and VPN protocols for access to your perimeter network. This option is recommended when your network services reside in the perimeter network. This option creates three new access rules.

    • Allow Limited Web Access And Access To ISP Network Services Only allows access to HTTP, HTTPS, FTP for Web access, and access for DNS and VPN protocols for access to the External network. This option is recommended when your network services reside on the ISP's servers. This option creates three new access rules.

    • Allow Unrestricted Access Allows access from all Protected networks to the External network.

  8. On the Completing The Network Template Wizard page, review the summary of information, and click Finish.

  9. In the details pane, you will an illustration of the back firewall network topology under the Networks tab. To update your configuration, click Apply, and then click OK.

Creating a Single Network Adapter Configuration

ISA Server 2000 didn't support using a single network adapter configuration. This is now fully supported and provides an option if you are looking to deploy ISA Server only as a proxy and Web caching server. If you do choose this option, understand that you lose the following functionalities:

  • Application-level filtering

  • IP packet filtering

  • Use of firewall and SecureNAT clients

  • VPN functions

  • Server publishing

  • Multinetwork firewall policy

To create a single network adapter configuration, complete the following steps:

  1. In the console tree, expand the server name, expand Configuration, and click Networks.

  2. In the task pane, click the Templates tab.

  3. Click Single Network Adapter.

  4. On the Welcome To The Network Template Wizard page, read the text to ensure you have selected the template that you would like to apply to your ISA server, and click Next.

  5. On the Export The ISA Server Configuration page, you are advised to export your ISA server configuration for backup purposes. If you choose to do so, click Export, determine the disk location, type a name for the export file, specify optional parameters to include user permissions and confidential data (such as user passwords and certificates), and click Export, and then click OK. When the export is complete, you are returned to this page in the wizard.. Click Next to continue.

  6. On the Internal Network IP Addresses page, choose to define the internal network using one or more of the following three methods, and then click Next.

    • Add Add a range of IP addresses you assign.

    • Add Adapter Choose one of the ISA Server computer's network adapters, and use its routing table to configure the network.

    • Add Private Add one or more of three private network ranges. As a best practice, avoid adding all of these ranges.

  7. On the Select A Firewall Policy page, choose the following firewall policy to apply to your networks. Click Next to continue.

    • Apply Default Web Proxying And Caching Configuration Only select this option when your ISA server is configured with a single network adapter. This policy denies access to all networks with a single default rule.

  8. On the Completing The Network Template Wizard page, review the summary of information, and click Finish.

  9. In the details pane, you will see an illustration of the single network adapter configuration topology under the Networks tab. To update your configuration, click Apply, and then click OK.


Configuring Networks

A network is one or more IP addresses that designate network devices. Several preconfigured networks exist. Each of the following networks is created on the ISA server with the installation.

  • Internal All IP addresses associated with the internal network adapter.

  • External All IP addresses that are not defined, or "everything else." You cannot configure or customize this network.

  • Local Host This represents the ISA server itself, and includes the IP addresses bound to the ISA server, and 127.0.0.1. There is also an Enterprise Local Host, which identifies each ISA server in an array along with its unique Local Host addresses.

  • VPN Clients and Quarantined VPN Clients networks These two networks are automatically populated when a VPN client or gateway connects to the ISA server; the Quarantined VPN Clients network is populated only when VPN Quarantine is enabled and systems meet the quarantine criteria.

Note

ISA Server Enterprise Edition has what are known as enterprise networks. These networks are configured at the enterprise—rather than the array—level. You can follow the same procedures for creating and editing enterprise networks, but will manage them in the ISA Server Management console by navigating to the Enterprise node, then selecting the Enterprise Networks node.

Creating a new network object

To create a network, follow these steps:

  1. In the console tree, expand the server name, expand Configuration, and click Networks.

  2. In the task pane, click the Tasks tab. Under Network Tasks, click Create A New Network.

  3. On the Welcome To The New Network Wizard page, type a name for the new network you are creating, and click Next to continue.

  4. On the Network Type page, select one of four network types:

    • Internal Network Contains computers that exist in an environment where they are not exposed to external networks.

    • Perimeter Network Contains computers that host services published to untrusted networks.

    • VPN Site-To-Site Network Establishes a link with another network through a VPN link.

    • External Network Contains computers from untrusted networks, usually on the Internet.

    Note

    The internal, perimeter, and external networks have the same interface to define networks. As a best practice, be sure to include the type of network you're creating in the name. The VPN Site-To-Site Network option requires that you set up the VPN connections at both sites. See Chapter 11, "Securing Virtual Private Network Access," for information on configuring this option. All other network configurations are covered here.

  5. On the Network Addresses page, choose to define the network using one or more of the following three methods, and then click Next.

    • Add Range Add a range of IP addresses you assign.

    • Add Adapter Choose one of the ISA Server computer's network adapters, and use its routing table to configure the network.

    • Add Private Add one or more of three private network ranges. As a best practice, avoid adding all of these ranges.

    Note

    In the Enterprise Edition, when working in the Array Firewall Policies, you will also see an Add Network button that allows you to choose an enterprise network.

  6. On the Completing The New Network Wizard page, review your settings, then click Finish.

  7. Click Apply to save the changes, and then click OK to close the Apply Network Configuration dialog box.

Exporting and Importing Networks

As you make policy changes on your ISA server, you should regularly export the configuration to back up specific settings, so that if you want to restore your firewall configuration, you can import the export file you created prior to making the change.

To export one or more networks, follow these steps:

  1. In the console tree, expand the server name, expand Configuration, and click Networks.

  2. In the task pane, click the Tasks tab. Under Related Tasks, click Export Existing Networks.

  3. In the Export Configuration window, browse to the location to where you would like to save the export file, and type a filename to be given to the export file in the File Name text box. If you would like to export confidential information like user credential passwords, RADIUS shared secrets, or preshared IPSec keys, select the Export Confidential Information (Encryption Will Be Used) check box; otherwise click Export.

  4. In the Set Password window, you must specify a password with at least eight characters to be used when later importing the file. Type the password, confirm the password, and then click OK.

    Note

    All of the confidential information included in the export file is encrypted. This step only appears if you choose to export the confidential information.

  5. In the Exporting Networks window, click OK.

To import the firewall policy, follow these steps:

  1. In the console tree, expand the server name, expand Configuration, and click Networks.

  2. In the task pane, click the Tasks tab. Under Related Tasks, click Import Networks.

  3. In the Import Configuration window, browse to the location on the disk where you saved the export XML file and select the export file to insert it into the File Name text box. If you would like to import cache drive settings and SSL certificates, select the Import Cache Drive Settings And SSL Certificates check box, and then click Import.

  4. In the Type Password To Open File window, type the name of the password associated with the export file, and click OK.

  5. In the Importing Networks window, click OK.

  6. In the details pane, click Apply to save the changes, and then click OK.

Troubleshooting Exporting and Importing Network Sets

When you export and import network sets, remember the node at which you exported the configuration. Many times administrators find that an import failed (or worse, corrupted an existing configuration) because the XML file is imported at the wrong level. If you export the entire configuration, you will be exporting the certificates that provide authentication. The export should be password-protected to reduce the risk of this information being obtained by an untrusted party.


Configuring Network Sets

Network sets are the grouping of defined networks on your ISA server. Rules can be applied against network sets to either include one or more networks or exclude one or more networks, depending on how you have chosen to configure the rule. This section focuses on the default network sets created with the installation of ISA Server and how you can create network sets as you continue to realize the capabilities of multinetworking.

Network Sets

When you wish to control a collection of networks, you can group them together into a network set. For example, if you have several different VPNs defined, and you wish to control all networks, you can create a network set. Several preconfigured network sets exist:

  • All Networks (And Local Host) Includes all possible networks, including the Local Host network defining the ISA server itself.

  • All Protected Networks Includes all networks except for the external network.

Creating a Network Set Object

To create a network set, follow these steps:

  1. In the console tree, expand the server name, expand Configuration, and click Networks.

  2. In the details pane, click the Network Sets tab.

  3. In the task pane, click the Tasks tab. Under Network Sets Tasks, click Create A New Network Set.

  4. On the Welcome To The New Network Set Wizard page, type a new network set name, then click Next.

  5. On the Network Selection page, select either Includes All Selected Networks or Includes All Networks Except The Selected Networks, then select the appropriate networks.

  6. On the Completing The New Network Set Wizard page, review your settings, then click Finish.

  7. Click Apply to save the changes, and then click OK to close the Apply Network Configuration dialog box.


Configuring Network Rules

Network rules determine if network connectivity exists between two networks and how that connectivity is established between those two networks. Network rules allow connectivity between two networks using Network Address Translation (NAT) or routing. When connectivity uses NAT, ISA Server replaces the client IP address on the source network with its own IP address. When connectivity uses routing, requests from the client on the source network are routed directly with the IP address being maintained from the client to the server. When you configure multiple network rules, the first rule that matches the request is applied. Several preconfigured network sets exist:

  • Local Host Access Defines a route relationship between the ISA server and all networks to which it is connected.

  • VPN Clients to Internal Network Defines a route relationship between the internal network and VPN Clients and VPN Quarantined Clients networks.

  • Internet Access Defines a NAT relationship between the internal network and external network.

Creating a Network Rule

To create a network rule, follow these steps:

  1. In the console tree, expand the server name, expand Configuration, and then click Networks.

  2. In the details pane, click the Network Rules tab.

  3. In the task pane, click the Tasks tab. Under Network Rule Tasks, click Create A New Network Rule.

  4. On the Welcome To The New Network Rule Wizard page, type a name for the network rule, and click Next to continue.

  5. On the Network Traffic Sources page, specify the source networks, the networks that will be originating the traffic. Click Add. In the Add Network Entities dialog box, select a network, click Add, and then click Close when you have added all of the networks you would like to include. Click Next.

  6. On the Network Traffic Destinations page, specify the destination networks, the networks to receive the traffic. Follow the same procedures as outlined in Step 5. Click Next to continue with the wizard.

  7. On the Network Relationship page, choose how you want the traffic to be sent between the two networks. Your choices include Network Address Translation (NAT) or Route, as shown in Figure 9-2. Click Next.

  8. On the Completing The New Network Rule Wizard page, review the summary of information, and click Finish.

  9. In the details pane, click Apply to save your changes, and click OK.

Image from book
Figure 9-2: A network rule can enforce the relationship between any two networks to use NAT or routing.


Web Chaining

Web chaining is the ability to proxy and forward Web proxy client requests to an upstream ISA server or alternate location. When you configure Web chaining, you are instructing the ISA server to proxy the request to the specified upstream server, rather than retrieving the request itself from the remote Web server.

By default, there is a Web chaining rule named Last Default Rule that is configured to send the request directly to the specified destination. You can create new rules to proxy requests to an upstream server, or forward requests to an alternate location like a hosted site on the internal network.

Creating a Web Chaining Rule

To create a Web chaining rule, complete the following steps:

  1. In the console tree, expand the server name, expand Configuration, and then click Networks.

  2. In the details pane, click the Web Chaining tab.

  3. In the task pane, click the Tasks tab. Under Web Chaining Tasks, click Create New Web Chaining Rule.

  4. On the Welcome To The New Web Chaining Rule Wizard page, type a name for the Web chaining rule and click Next to continue.

  5. On the Web Chaining Rule Destination page, specify the destination networks. Click Add. In the Add Network Entities dialog box, select a network, click Add, and then click Close when you have added all of the networks you would like to include. Click Next.

  6. On the Request Action page, shown in Figure 9-3, specify how the client requests are processed, and then click Next. Your options include the following:

    • Retrieve Requests Directly From The Specified Destination This is the default setting that prompts the Web chaining rule to go directly the requested destination.

    • Redirect Requests To A Specified Upstream Server Select this option to send the request to another ISA server upstream. You can select the Allow Delegation Of Basic Authentication Credentials check box to ensure the upstream proxy server successfully processes the clients' credentials.

      Note

      If you select this option, only the specified credentials are used, masking all client requests when authenticating to the upstream server; this condition is rarely useful. The default behavior, when the check box is not selected, is that the upstream server might require authentication, possibly in addition to the downstream server having already authenticated the client. In this case, the client will again respond to the upstream server and authenticate to it as well, using the logged-on user's credentials. This might result in the user providing credentials a second time.

    • Redirect Requests To You can redirect the requests to a hosted site on your network by specifying the URL for the site, and the port on which the site listens, whether that port is a secured port or not.

    Note

    There is also a Use Automatic Dial-Up check box. We discuss this topic in Chapter 10, "Configuring Security Policies."

  7. On the Completing The New Web Chaining Rule Wizard page, review the summary of information, and click Finish.

  8. In the details pane, click Apply to save your configuration, and then click OK.

Image from book
Figure 9-3: You have several options when defining how client requests should be proxied or forwarded to an upstream server when dealing with Web chaining.

Modifying a Web Chaining Rule

There are some additional options that can be configured by editing a Web chaining rule. For example, you can define SSL bridging and how both HTTP and SSL requests are redirected.

To edit a Web chaining rule, follow these steps:

  1. In the console tree, expand the server name, expand Configuration, and then click Networks.

  2. In the details pane, click the Web Chaining tab, and select the existing Web chaining rule you would like to edit.

  3. In the task pane, click the Tasks tab. Under Web Chaining Tasks, click Edit Selected Rule.

The Edit Selected Rule task launches the Properties dialog box for the given Web chaining rule. There are four tabs available. Table 9-2 outlines the options on each tab.

Table 9-2: Property Settings for a Web Chaining Rule
Tab Name | Tab Options/Descriptions
General | Specify the name of the rule, and provide an optional description or location to disable the selected rule.
Action | Specify how the requests should be processed, and determine if automatic dial-up should be enforced when the client request matches the rule.
To | Define the destination networks and how traffic will be handled when intended for these networks.
Bridging | Specify how the requests should be redirected to the upstream server, as either HTTP or SSL requests. If using SSL, specify the certificate to use and whether you prefer 128-bit encryption.
Note

You can also access the Bridging tab by selecting Define SSL Bridging For Selected Rule under Web Chaining Tasks in the task pane.


Firewall Chaining

Whereas Web chaining specifically addresses requests to upstream servers from Web proxy clients, firewall chaining defines how requests from both firewall clients and SecureNAT clients to upstream servers should be handled.

To configure firewall chaining, follow these steps:

  1. In the console tree, expand the server name, expand Configuration, and then click Networks.

  2. In the details pane, click the Web Chaining tab.

  3. In the task pane, click the Tasks tab. Under Related Tasks, click Define Firewall Chaining Properties.

  4. On the Firewall Chaining Properties dialog box, as shown in Figure 9-4, you can specify how requests are forwarded to the upstream server.

    • Use The Primary Connection This option uses the ISA Server computer's primary connection to retrieve the requested data.

    • Chain To This Computer Connect to a specified ISA Server computer (to prevent name resolution problems and speed performance, enter an IP address rather than a host name). You can also specify an account used to authenticate with the specified ISA Server computer.

  5. Click OK when you have made the changes to the Web chaining rule. If you did make changes, you have to apply the changes by clicking Apply in the details pane.

Image from book
Figure 9-4: This Properties dialog box lets you configure how requests are routed to the upstream server.


Chapter 10: Microsoft ISA Server Security and Administration

The focus on this chapter is the General node in the ISA Server Management console. This includes the ISA Server Administration and Additional Security Policy sections in the details pane of the console. Although a few of the topics like firewall chaining and administration delegation have been discussed in various chapters, we touch on each task in this chapter, provide the explanations and procedures to support each task, and provide cross-references to places in the other chapters when appropriate.

ISA Server Administration

In this section of the chapter, we illustrate how to configure the following items:

  • Administrator delegation

  • Firewall chaining

  • Dial-up preferences

  • Certificate revocation

  • Firewall client settings

  • ISA Server computer details

  • Link translation

Delegating Administration

The Administration Delegation Wizard in ISA Server 2004 gives you the ability to delegate certain administrative tasks and responsibilities to other administrators on your support staff. It contains three built-in roles from which you can choose:

  • ISA Server Basic Monitoring

  • ISA Server Extended Monitoring

  • ISA Server Full Administrator

In Chapter 2, "Installing and Configuring Microsoft ISA Server 2004 Standard Edition," we explained the purpose of each of these roles in the section entitled "Assigning ISA Server Administrative Roles." In this section, we walk you through how to perform delegation tasks using the Administration Delegation Wizard.

To delegate ISA Server functions to your ISA Server administrators, follow these steps:

  1. Open the ISA Server Management console. In the console tree, expand the server name, expand the Configuration node, and then click General.

  2. In the details pane, under ISA Server Administration, click Administration Delegation.

  3. On the Welcome To The ISA Server Administration Delegation Wizard page, read about the purpose of the wizard, and then click Next.

  4. On the Delegate Control page, specify the users and groups that will be assigned roles. Click Add to open the Administration Delegation dialog box, as shown in Figure 10-1. Either type the name of the user or group in the Group (Recommended) Or User text box, or click Browse to choose the user or group. Click the Role drop-down list to select one of the three defined ISA Server roles. Click OK and then click Next to continue.

    Note

    The wizard can also be used to edit or remove delegated access by selecting the user or group, and clicking Edit or Remove.

  5. On the Completing The Administration Delegation Wizard page, review the summary of information, and click Finish.

  6. In the details pane, click Apply to save your changes, and then click OK.

Image from book
Figure 10-1: Role-based delegation allows you to assign roles to administrators of your ISA Server environment.

Configuring Firewall Chaining

Firewall chaining is the ability to redirect firewall client or SecureNAT client requests to an upstream ISA Server computer. Details on how to configure firewall chaining are given in Chapter 9, "Configuring Multinetworking," in the section entitled "Firewall Chaining."

Configuring Dial-Up Preferences

Dial-up connections, although not as common today as 5 to 10 years ago, are still the only way some companies can obtain Internet connectivity. To properly configure your ISA Server 2004 computer to use a dial-up connection, complete the following two steps:

  1. Create a dial-up or VPN connection using the Network Connections program in the Control Panel on your ISA server.

    For instructions on creating a new network connection, see the Windows Server 2003 Help File, or the Microsoft Windows Server 2003 Administrator Pocket Consultant written by William Stanek and published by Microsoft Press.

  2. Specify the dial-up preferences to use the connection created in Step 1, as discussed in this section.

To specify the dial-up preferences, follow these steps:

  1. Open the ISA Server Management console. In the console tree, expand the server name, expand the Configuration node, and click General.

  2. In the details pane, under ISA Server Administration, click Specify Dial-Up Preferences.

  3. In the Dialing Configuration dialog box shown in Figure 10-2, specify the dialup preferences as explained below, and then click OK.

    • I Will Dial The Connection Myself Requires you, as the ISA server administrator, to initiate the connection before your users on the protected networks can access the Internet.

    • Allow Automatic Dialing To This Network Allows the ISA server to dial the connection when users on the protected networks request access to the Internet. You must then specify a network in the drop-down list.

    • Configure This Dial-Up Connection As The Default Gateway Check box to configure the ISA server to use the default gateway settings of the VPN server instead of the default gateway settings defined within its Internet Protocol (IP) stack.

    • Use The Following Dial-Up Connection Allows you to select the dial-up connection created earlier. Click Select to choose the connection to use.

    • Use This Account Allows you to define the credentials assigned to you by your Internet service provider (ISP). Click Set Account to type the user name and the password.

Image from book
Figure 10-2: You can configure how ISA Server should use your dial-up or VPN connection to the ISP.

Certificate Revocation

The purpose of certificate revocation is to verify whether the incoming certificates are no longer valid by checking them against the certificate revocation list (CRL) and denying access to any certificates listed. To configure certificate revocation, follow these steps:

  1. Open the ISA Server Management console. In the console tree, expand the server name, expand the Configuration node, and click General.

  2. In the details pane, under ISA Server Administration, click Specify Certificate Revocation.

  3. In the Certificate Validation dialog box, shown in Figure 10-3, select the appropriate check boxes to determine how ISA Server verifies client certificates.

    • Verify That Incoming Client Certificates Are Not Revoked ISA Server checks the CRL and denies access to any incoming client whose certificate appears to be revoked.

    • Verify That Incoming Server Certificates Are Not Revoked In A Forward Scenario Ensures that ISA Server checks for revoked certificates when acting as a Web proxy.

    • Verify That Incoming Server Certificates Are Not Revoked In A Reverse Scenario Ensures that ISA Server checks for revoked certificates when publishing Web servers.

  4. Click OK.

Image from book
Figure 10-3: You can determine how incoming client certificates are verified in multiple scenarios.

Defining Firewall Client Settings

You can configure settings for how the firewall clients installed in your environment interact with ISA Server. To configure these settings, follow these steps:

  1. Open the ISA Server Management console. In the console tree, expand the server name, expand the Configuration node, and click General.

  2. In the details pane, under ISA Server Administration, click Define Firewall Client Settings.

  3. In the Firewall Client Settings dialog box are two tabs, Connection and Application Settings. The configurable settings are described in Table 10-1.

  4. Click OK when you have finished.

Table 10-1: Configuring Firewall Client Settings
Tab Name | Explanation
Connection | ISA Server 2004 provides encryption between the firewall clients and ISA Server. For earlier versions of the firewall client, the encryption is not supported. To allow earlier versions of the firewall client to connect to the ISA Server unencrypted, select the Allow Non-Encrypted Firewall Client Connections check box.
Application Settings | Shows the application settings that are configured in the server-side copy of the client configuration file. For further details, see the ISA Server Help file.

For more detailed information about firewall settings and how to configure them, see Chapter 4 , "Installing and Configuring Microsoft ISA Server 2004 Clients."

Viewing ISA Server Details

ISA Server details can be presented on one property page from within the ISA Server 2004 Management console. The summarization of items like your ISA Server computer name, version, product ID, and installation directory provides quick access to information about your ISA Server installation.

To view your ISA Server details, follow these steps:

  1. Open the ISA Server Management console. In the console tree, expand the server name, expand the Configuration node, and click General.

  2. In the details pane, under ISA Server Administration, click View ISA Server Computer Details.

  3. In the Server Name Properties dialog box, you can quickly see settings like Full Computer Name, ISA Server Version, Product ID, Created, and Installation Directory, as shown in Figure 10-4. This information is helpful when you need to check your ISA Server version to determine what service pack level you might be on.

    Note

    ISA Server Standard Edition Service Pack 1 alters the ISA Server version to 4.0.2161.50.

  4. Click OK when you have finished.

Image from book
Figure 10-4: Viewing the ISA Server computer details provides you with a quick reference to common ISA Server information.

Configuring Link Translation

The link translation feature is designed to allow for situations where internally published sites may have different links inside the network from those outside the network. Link translation is required only for absolute Uniform Resource Locators (URLs). Absolute URLs in a Web page would look like this:

<A HREF = "http://www.contoso.com/sites/one.htm">Page Title</A>

A relative link would look like this:

<A HREF = "/sites/one.htm">Page Title</A>

Relative links do not need to be translated, because they do not contain the server name. The client's browser always retrieves relative links from the server to which it is currently connected. Absolute links do have a server name, however, and may require translation if the server name is different internally and externally. The translation must occur, whether the server being linked to is the same server that hosts the original page or a different server. In such cases the administrator can manually specify links that are not being translated because of the above-listed problems.

Some default behaviors are available with link translation (as defined by the Default Link Translation Library). For example, ISA Server will automatically translate all links where the link contains a host header matching the server name or IP used in the publishing rule. ISA Server also will translate Web sites being published on a non-standard port, like 8171 on the ISA server, and 80 on the internal network. Link translation will translate requests from the internal Web server to 8171 on the ISA server.

Note

Remember that you can enable link translation for individual Web publishing rules (see Chapter 8, "Configuring Microsoft ISA Server Firewall Policy," for more details). The settings described next apply to all Web publishing rules using link translation.

To configure the content for all Web publishing rules that have link translation enabled, follow these instructions:

  1. Open the ISA Server Management console. In the console tree, expand the server name, expand the Configuration node, and click General.

  2. In the details pane, under ISA Server Administration, click Configure Link Translation.

  3. In the Link Translation dialog box, the Content Types tab allows you to specify what type of content should be translated and applied to the Web publishing rules. Select the content types to apply as a global setting across all defined Web publishing rules, and then click OK.

    Note

    By default, the only content type selected is the HTML Documents check box.

  4. In the details pane, click Apply to save your changes, and then click OK.

To configure the specific translations that will be made, you'll need to create dictionary entries in the Web publishing rule you created. To configure dictionary entries, follow these steps:

  1. Open the ISA Server Management console. Navigate to the ISA Server array, click the Firewall Policy node, select the Web publishing rule you created, and then click the Edit Selected Rule link in the Task pane.

  2. Click the Link Translation tab, then select the Replace Absolute Links In Web Pages check box.

  3. Click Add. The Add/Edit Dictionary Item dialog box opens.

  4. In the Replace This Text text box, type in the link you wish to be translated, such as InternalNetBIOSName.

  5. In the With This Text text box, type the name that will replace the internal reference, such as www.external.com.

  6. Click OK.

  7. In the details pane, click Apply to save your changes, and then click OK.


Security Policy Administration

This section of the chapter illustrates how to configure the following:

  • RADIUS servers

  • Intrusion detection

  • IP preferences

  • Connection limits

Defining RADIUS Servers

Remote Authentication Dial-In User Service (RADIUS) servers allow you to configure authentication for an ISA server when it is not a member of the client's domain.

For more information about RADIUS in Windows, see http://www.microsoft.com/windowsserver2003/technologies/ias/.

To identify the RADIUS servers used by ISA Server when RADIUS authentication is selected, follow these steps:

  1. Open the ISA Server Management console. In the console tree, expand the server name, expand the Configuration node, and click General.

  2. In the details pane, under Additional Security Policy, click Define RADIUS Servers.

  3. In the RADIUS Servers dialog box, click Add.

  4. In the Add RADIUS Server dialog box, shown in Figure 10-5, you need to provide the following information:

    • Server Name Text box provided for you to type either the server name or IP address of the RADIUS server.

      Note

      If using a server name, ensure a fully qualified domain name (FQDN) is specified and that the ISA server can resolve the server name using Domain Name System (DNS).

    • Server Description Text box provided for you to type a server description (optional).

    • Shared Secret Text box provided for you to configure a shared secret. If you want to configure a shared secret, click Change. In the Shared Secret dialog box, type a new secret, confirm the shared secret, and click OK.

      Note

      The shared secret should be highly complex, and therefore more secure. For example, it should contain more than 24 characters and include both uppercase and lowercase letters, numerals, and special characters (such as $%^&).

    • Port Text box provided for you to specify the port number to be used when communicating with the RADIUS server.

    • Time-Out (Seconds) Text box provided for you to specify the time out value in seconds.

    • Always Use Message Authenticator Check box provided to ensure a message authenticator is used when authenticating a client to the RADIUS server. Not all RADIUS clients support this setting, so verify that your clients are configured correctly.

    Note

    See the ISA Server Help file and your RADIUS server documentation for more information.

  5. In the RADIUS Servers dialog box, once someone has added at least one RADIUS server, you can choose to edit or remove the server, and you can also change the order of the RADIUS servers to determine the order in which the servers are queried. Click OK.

  6. In the details pane, click Apply to save your changes, and then click OK.

Image from book
Figure 10-5: The use of a RADIUS server is beneficial for authentication when the Web client and ISA Server are not in the same domain.

Configuring Intrusion Detection

Intrusion detection and IP preferences are two ways to configure your ISA server to respond to various attacks, whether application-level attacks or port attacks. In the next two sections, we discuss these options.

Although ISA Server always protects against these attacks, you will be informed of them only if intrusion detection is configured to do so. Intrusion detection is now enabled by default in ISA Server 2004, whereas in ISA Server 2000 it shipped disabled out of the box. To select the types of attacks that ISA Server will warn you against, follow these steps:

  1. Open the ISA Server Management console. In the console tree, expand the server name, expand the Configuration node, and click General.

  2. In the details pane, under Additional Security Policy, click Enable Intrusion Detection And DNS Attack Detection.

  3. In the Intrusion Detection dialog box, two tabs have configurable information: Common Attacks and DNS Attacks. On the Common Attacks tab, select the Enable Intrusion Detection check box to enable intrusion detection. To enable detection of particular attacks, select the appropriate check boxes after you understand the meaning of each attack as described in Table 10-2.

    Tip

    For more detailed descriptions of the abovementioned attacks, see the ISA Server Help file.

    ISA Server also includes the ability to track intrusion detection at the application level by using DNS intrusion detection filters. By default, the DNS intrusion detection filters are enabled, regardless of whether you've enabled intrusion detection. To enable detection of particular attacks, click the DNS Attacks tab, and select the appropriate check boxes after you understand the meaning of each attack as described in Table 10-3.

  4. Click OK once you have selected the appropriate attacks to monitor.

  5. In the details pane, click Apply to save your changes, and click OK.

Table 10-2: Intrusion Attacks Explained
Type of Intrusion Attack | Description
Windows Out-Of-Band (WinNuke) | This type of attack is a denial of service (DoS) attack used to make a computer crash or a network interface unavailable (detection enabled by default).
LAND | This type of attack creates a spoofed IP address and source port to match the destination IP address and destination port. This process creates a loop to bring down the affected computer (detection enabled by default).
Ping Of Death | This type of attack causes a buffer overflow in the computer when the computer attempts to respond continually to an extremely large Internet Control Message Protocol (ICMP) echo request packet (detection enabled by default).
IP Half Scan | This type of attack establishes half of the common three-step Transmission Control Protocol/Internet Protocol (TCP/IP) communication session to consume resources on the system that is being attacked (detection enabled by default).
UDP Bomb | This type of attack uses a maliciously configured User Datagram Protocol (UDP) packet to create an operating system failure (detection enabled by default).
Port Scan | This type of probe detects open ports on a computer to identify potential vulnerabilities (detection disabled by default).
Table 10-3: Application-Level DNS Attacks Explained
Type of DNS Intrusion Attacks | Explained
DNS Hostname Overflow | This type of attack is a DNS response to a host name that exceeds a certain fixed length, causing an internal buffer overflow. This overflow allows a remote attacker to execute commands on the targeted computer.
DNS Length Overflow | This type of attack occurs when an IP address contains a length field larger than 4 bytes, causing an internal buffer overflow. This overflow allows a remote attacker to execute commands on the targeted computer.
DNS Zone Transfer | This type of attack occurs when a computer uses a DNS client application to transfer DNS zones from an internal DNS server to an external DNS server, which makes sensitive information about your network vulnerable to interception.

Intrusion Detection Alerts and Actions

ISA Server includes alerts for intrusion detection and DNS intrusion. You can configure each of these alerts to perform a variety of actions when an attack is detected and the alert is triggered:

  • Stop selected services

  • Start select services

  • Send an e-mail message or page

  • Run a previously specified program or script

  • Write an event to the event log

Each of these actions is discussed in detail in Chapter 6, "Monitoring and Reporting," in the section entitled "Alerts." One notable feature available is the Log Dropped Packets check box, which, when selected, logs the packets that the ISA server detects as being part of an attack. Selecting this option helps to identify the types of attacks being performed against your system.

Tip

This option will also show packets dropped when denied by a policy rule when you select the Log Packets That Match This Rule check box in the policy rule.

Defining IP Preferences

The second option for providing improved security is the configuration of IP preferences, which are used to configure how ISA Server handles IP packets.

To configure IP preferences, complete the following steps:

  1. Open the ISA Server Management console. In the console tree, expand the server name, expand the Configuration node, and click General.

  2. In the details pane, under Additional Security Policy, click Define IP Preferences.

  3. In the IP Preferences dialog box are three tabs, which are described in Table 10-4.

  4. Click OK once you have configured the IP preferences.

  5. In the details pane, click Apply to save your changes, and click OK.

Table 10-4: IP Preferences Explained
Tab Name | Explanation | Setting Recommendation
IP Options | Allows you to configure ISA Server to deny packets that have an IP Options flag set in the header, or to drop packets with only specific IP options enabled. | Ensure that the Enable IP Options Filtering check box is selected. Source routing should be disabled because an attacker can use source routing to reach addresses on an internal network that normally are not reachable.
IP Fragments | Allows you to block any packets containing IP fragments. Configurable through a single check box. | To enable, select the Block IP Fragments check box. Enabling this feature can interfere with streaming audio and video, plus L2TP over IPSec connections. You will be presented with a warning dialog box if you select this check box to confirm you want to enable.
IP Routing | Allows you to configure ISA Server to route the original packet from network to network. When disabled, ISA Server only routes the data, not the original packet. | To disable, clear the Enable IP Routing check box. Disabling IP routing provides additional security, but significantly affects the performance of protocols like File Transfer Protocol (FTP) and H.323 that pass large amounts of data through secondary connections. ISA Server's application filters for such applications allow enhanced performance by using kernel mode transfers in these caseswhen IP routing is enabled.

Defining Connection Limits

ISA Server can control the client connections made to it or through it to help prevent malicious traffic, such as worms. The connection limits are configurable for non-TCP connections and TCP connections. Additionally, the connection limits can be checked by access rules, Web publishing rules, and server publishing rules. If a connection limit threshold is exceeded, an alert is triggered, providing you with information of the client IP that triggered the alert. Be cautious of setting this value too low (preventing valid sessions) and too high (missing the opportunity to detect an attack). The default values provided are generally acceptable.

To configure connection limits, complete the following steps:

  1. Open the ISA Server Management console. In the console tree, expand the server name, expand the Configuration node, and click General.

  2. In the details pane, under Additional Security Policy, click Define Connection Limits.

  3. In the Connection Limits dialog box, shown in Figure 10-6, you can determine the connection limits made to or through the ISA server using the following settings:

    • Limit The Number Of Connections Use this check box to enable or disable this functionality.

    • Connections Created Per Second, Per Rule (Non-TCP) Configured to 1,000 by default. This value applies to all non-TCP connections made per second per rule created in the firewall policy.

      Note

      When this value is exceeded, new connections cannot be established, but existing connections remain connected.

    • Connection Limit Per Client (TCP And Non-TCP) Configured to 160 by default. This value applies to a single client.

      Note

      When this value is exceeded, new connections cannot be established, but existing connections remain connected.

    • Custom Connection Limit Allows you to configure a value that would be applied to specific IP addresses of clients. The default value is 1,000,000.

    • Apply The Custom Limit To These IP Addresses You can click Add to select computer sets that should be configured to use the custom connection limits.

  4. Click OK when you have configured the connection limits.

  5. In the details pane, click Apply to save your changes, and click OK.

Image from book
Figure 10-6: Connection limits are important for preventing a worm from bringing down your corporate network, as alerts will be triggered when the values you have set are exceeded.


Chapter 11: Securing Virtual Private Network Access

Virtual private networking allows you to create a protected connection across an untrusted network—most often the Internet—from either a client connecting into a private network, or connecting two separate networks together in a site-to-site configuration. We discuss how to prepare for, configure, and set up virtual private networks (VPNs) in a remote access configuration, and a site-to-site configuration. We then conclude with information about using VPN Quarantine to protect your network from vulnerable machines.

Remote Access Configuration

A remote access configuration allows clients located outside of your protected network to securely connect across the Internet (or other untrusted networks). You can choose to use either the Point-to-Point Tunneling Protocol (PPTP)/Microsoft Point-To-Point Encryption Protocol (MMPE) protocol or the Layer Two Tunneling Protocol (L2TP)/IPSec protocols to connect. For authentication, you can use several protocols, including Password Authentication Protocol (PAP), Shiva Password Authentication Protocol (SPAP), Challenge Handshake Authentication Protocol (CHAP), Microsoft Challenge Handshake Authentication Protocol (MSCHAP), MSCHAPv2, or Extensible Authentication Protocol—Transport Layer Security (EAP-TLS).

Best Practices

The most secure configuration is L2TP/IPSec with EAP-TLS authentication.

To set up VPN for a remote access configuration, you must follow these steps:

  1. Enable VPN client access.

  2. Configure how VPN assigns Internet Protocol (IP) addresses to clients.

  3. Configure VPN authentication.

  4. Configure the user accounts.

  5. Create access rules for VPN clients to access other networks.

  6. Configure the client computers.

We discuss each of the steps in more detail later.

Enabling and Configuring VPN Client Access

When you enable VPN client access, Microsoft ISA Server applies the default settings shown in Table 11-1.

Table 11-1: Default VPN Configuration Settings
Item | Configuration
System Policy | Enable the Allow VPN Client Traffic To ISA Server rule, allowing the enabled tunneling protocols (PPTP and/or L2TP) from the external network to the LocalHost network.
VPN Access Network | ISA Server listens only to the external network for VPN clients by default. You can modify this option in the Select Access Networks Properties dialog box. Note that listeners are on a per-network basis rather than a per-IP address basis.
VPN Protocols | Only PPTP is enabled by default. You can also select the L2TP/IPSec protocol in the VPN Clients Properties dialog box.
Network Rules | The VPN Clients network has a route relationship with the internal network, and a Network Address Translation (NAT) relationship with the external network.
Firewall Access Rules | No firewall access rules exist by default, and must be configured to allow access. If you use a Network template to configure access rules, the VPN Clients To Internal Network access rule is created, which allows computers in the VPN clients network to access the internal network with all protocols.
Remote Access Policy | ISA Server creates a Routing and Remote Access Service (RRAS) policy called the ISA Server Default Policy, which blocks all VPN connections except those specified in the remote access profile. If you choose to directly modify the RRAS policy, research the implications carefully in TechNet and at ISAServer.org.

To enable VPN client access, follow these steps:

  1. In the ISA Server Management console, select the Virtual Private Networks (VPN) node.

  2. Click Enable VPN Client Access in the Tasks pane.

    If you see a dialog box stating that you do not have enough IP addresses available to enable VPN, follow the steps described in the later section, "Defining IP Address Assignments."

  3. Click Apply to commit the changes. Click OK to finish.

After enabling VPN client access, you can configure or modify VPN client access properties by following these steps:

  1. In the ISA Server Management console, select the Virtual Private Networks (VPN) node.

  2. Click Configure VPN Client Access in the Tasks pane. The VPN Clients Properties dialog box appears, as shown in Figure 11-1.

  3. On the General tab, you can choose to clear the Enable VPN Client Access check box to disable VPN client access. When this check box is selected, you can specify the Maximum Number of VPN Clients Allowed setting.

  4. On the Groups tab, click Add to select groups from the local machine, or, if the ISA server is part of a domain, the Active Directory groups that are allowed to access ISA Server using a VPN if the domain is in native mode or at a Windows 2003 functional level.

    Note

    By default, no groups are allowed access to the ISA server.

  5. On the Protocols tab, choose to allow either or both PPTP or L2TP/IPSec tunneling options for your VPN connections.

  6. On the User Mapping tab (shown in Figure 11-2), if you want to allow Remote Authentication Dial-In User Service (RADIUS) or EAP clients, select the User Mapping check box to enable "mapping," or cross-referencing VPN clients connecting from non-Windows namespaces (RADIUS or EAP) to Windows accounts. To supply a default domain to users who don't specify a domain with their user name, type your domain name in the When Username Does Not Contain A Domain, Use This Domain text box.

    Caution

    Be cautious when enabling this feature. Do not select User Mapping when the ISA server is not a member of the Windows domain. You will receive an "Error 619" message when VPN clients try to connect.

  7. Click OK, and then click Apply. Click OK to finish.

Image from book
Figure 11-1: The VPN Clients Properties dialog box allows you to configure remote VPN clients.
Image from book
Figure 11-2: The User Mapping option allows RADIUS and EAP clients to process user-and group-based access rules. If ISA Server is not a member of a domain in which the user accounts for domain mapping rest, your VPN clients cannot connect.

Selecting Access Networks

By default, VPN clients can connect from the external network. However, there are times when you might want VPN clients to connect from other networks, such as when you configure a protected network specifically for wireless users to enable access to the Internet and nothing more. You might wish to allow your corporate clients to connect from this network into the internal network through a VPN.

To define the networks from which VPN clients can connect, follow this procedure:

  1. In the ISA Server Management console, select the Virtual Private Networks (VPN) node.

  2. Click Select Access Networks in the Tasks pane. You will see the Access Networks tab as shown in Figure 11-3.

  3. Select the networks from which you wish VPN clients to connect by selecting the check box next to the network name. This applies to all IP addresses bound to that network's network interface.

    Note

    These settings apply both to remote client connections and site-to-site connections.

  4. Click OK, and then click Apply. Click OK to finish.

Image from book
Figure 11-3: Choose the networks that ISA Server will use to establish VPN connections.

Defining IP Address Assignments

ISA Server must assign your VPN clients IP addresses that allow them to participate on protected networks. You can choose to either assign IP addresses from a static pool or assign them dynamically from an existing DHCP server.

To define the IP address assignments for a VPN, follow these steps:

  1. In the ISA Server Management console, select the Virtual Private Networks (VPN) node.

  2. Click Define Address Assignments in the Tasks pane.

  3. On the Address Assignment tab, choose one of two methods for assigning IP addresses, as shown in Figure 11-4.

  4. If you select Static Address Pool, click Add, designate the IP address range, and then click OK—the IP addresses can't be in use in another ISA Firewall network definition. If you select Dynamic Host Configuration Protocol, a DHCP server (which must already be available on the network) will provide IP addresses for the VPN clients from the specified interface.

    Note

    Unless a DHCP Relay Agent is installed on the ISA server, the DHCP scope settings are not provided to VPN clients by default. Use the Advanced button described later to configure the Domain Name System (DNS) and Windows Internet Name Service (WINS) server entries for VPN clients.

  5. In the Use The Following Network To Obtain DHCP, DNS, And WINS Services drop-down list, select the network that contains your infrastructure servers. The network containing your infrastructure servers is most often the internal network.

  6. To specify DNS and WINS server addresses for your remote VPN clients, click Advanced, and specify the DNS and WINS server IP addresses, then click OK.

  7. Click OK, and then click Apply. Click OK to finish.

Image from book
Figure 11-4: When configuring a VPN, select the source for IP addresses and infrastructure services.

Configuring VPN Authentication

ISA Server uses MSCHAPv2 authentication for VPN clients by default. There are several other options available for authentication. Should you wish to enable smart card or certificate support, or enable L2TP pre-shared key connections you will use this interface.

To configure authentication for VPN, follow these steps:

  1. In the ISA Server Management console, select the Virtual Private Networks (VPN) node.

  2. Click Select Authentication Methods in the Tasks pane.

  3. On the Authentication tab, select the authentication methods you wish to support.

    Best Practices

    Avoid using less secure authentication methods, such as MSCHAP, CHAP, SPAP, or PAP, whenever possible.

  4. If you don't have a public key infrastructure (PKI) that allows you to use EAP certificates, and wish to use L2TP, select the Allow Custom IPSec Policy For L2TP Connection check box, and type in the Pre-Shared Key.

    Important

    Pre-shared keys are much less secure than using a PKI, and should be considered as a temporary measure while setting up a PKI in most cases.

    When using a pre-shared key, you must share the same pre-shared key (thus the clever name) with all L2TP clients when configuring them.
    Best Practices

    Your pre-shared key should be complex, and look like a cat walked across your keyboard—for example, &^ld5*>}>:"uqew()&^&F__ Saex65q7we16

    To use certificates, see the following articles:

    "Description of the IPSec policy created for L2TP/IPSec" at http://support.microsoft.com/kb/248750;

    "HOW TO: Install a Certificate for Use with IP Security" at http://support.microsoft.com/kb/253498.

  5. Click OK, and then click Apply. Click OK to finish.

Configuring RADIUS Authentication

When your ISA Server computer is not a member of your domain (operating in stand-alone or workgroup mode), you can use RADIUS authentication to allow ISA Server to pass domain credentials from VPN clients through a RADIUS server to Active Directory directory service in your domain. If you have several ISA servers, you can also use the RADIUS server's remote access policies instead of configuring these policies on each individual ISA server.

Note

For detailed instructions on how to configure the RADIUS environment—including how to install and configure Internet Authentication Server (IAS), the RADIUS server built into Microsoft Windows 2000 Server and Microsoft Windows Server 2003—see the "ISA Server 2004 VPN Deployment Kit: Configuring Windows Server 2003 RADIUS Support for VPN Clients—Including Support for EAP/TLS Authentication" found in the Guides and Deployment Kits section at http://www.microsoft.com/isaserver/techinfo/guidance/2004/configuration.mspx.

To specify the RADIUS configuration for an ISA Server VPN, follow these instructions:

  1. In the ISA Server Management console, select the Virtual Private Networks (VPN) node.

  2. Click Specify RADIUS Configuration in the Tasks pane.

  3. As shown in Figure 11-5, on the RADIUS tab, select the Use RADIUS For Authentication check box. You can also select the Use RADIUS For Accounting (Logging) check box to specify that your RADIUS server will be the accounting provider.

    Caution

    When you enable this functionality, the RADIUS dialog box explains that user mapping can be used to map RADIUS clients to the Active Directory namespace. If your ISA Server computer is not a member of your domain, and you enable user mapping your VPN clients will not be able to connect. If your clients experience "619" errors, disable user mapping.

  4. Click RADIUS Servers to open the RADIUS Servers dialog box. Click Add to open the Add RADIUS Server dialog box, as shown in Figure 11-6, and then configure the following settings:

    1. In the Server Name text box, enter the IP address or host name of the RADIUS server, and a description of that server in the Server Description text box.

    2. If required, click Change to enter the shared secret used to secure communications between the ISA server and the RADIUS server.

    3. In the Port text box, type the User Datagram Protocol (UDP) port number used for RADIUS authentication. The default is set to 1812.

      Note

      IAS uses Port 1812 for authentication by default. Older RADIUS servers might require port 1645. RADIUS accounting uses the authorization port number plus one (so IAS would use port 1813 for accounting, and older RADIUS servers would use 1646).

    4. In the Time-Out (Seconds) text box, type the number of seconds you wish the server to wait for ISA Server to obtain a response from the RADIUS server before trying another server.

    5. Select the Always Use Message Authenticator check box only if your RADIUS servers can receive message authenticators and are configured to do so. In IAS, if you have the Request Must Contain The Message Authenticator option selected, you must select this option.

      Note

      If you cannot authenticate, check to ensure that you configured the RADIUS server to accept the ISA server as a RADIUS client.

    6. Click OK.

  5. In the RADIUS Servers dialog box, add additional RADIUS servers if necessary. Then, click OK again to return to the Virtual Private Networks (VPN) Properties dialog box.

  6. In the Virtual Private Networks (VPN) Properties dialog box, click OK. When prompted, click OK to confirm that all VPN sessions will be disconnected.

  7. Click Apply. Click OK to finish.

Image from book
Figure 11-5: You can use RADIUS authentication for your VPN clients, which allows authentication with Active Directory if your ISA Server computer is not a member of your domain.
Image from book
Figure 11-6: Configure the RADIUS Server information used for authentication.

Configuring the User Accounts

For your users to connect as VPN clients, their user accounts in Active Directory must have the appropriate permission set. You'll need access to the user's account in Active Directory to configure the Remote Access Permission setting.

Even though you might not be dialing up to your network using a modem, some books and reference guides use the term dial-in permissions instead of Remote Access Permission to describe enabling Remote Access.

To configure user accounts for VPN access, follow these steps:

  1. On your domain controller, from Administrative Tools, open the Active Directory Users And Computers console.

  2. Navigate to the user account, right-click it, and select Properties.

  3. In the User Name Properties dialog box, click the Dial-In tab, as shown in Figure 11-7. Click Allow Access. If your domain is at a functional level of Windows 2000 or Windows Server 2003, you can control these settings through Remote Access Policy in RRAS.

  4. Click OK.

Image from book
Figure 11-7: Enable the user's account in Active Directory to allow access using VPN.

Creating Access Rules for VPN Clients to Access Other Networks

If you haven't used an ISA Server network template, your VPN clients might be able to connect to the ISA server, but they won't be able to access any resources. To allow access to the internal network or other networks, create a firewall policy access rule to allow the VPN client network access to the internal network, or other networks as your needs require.

To create a basic firewall policy access rule allowing VPN clients to access the internal network with all protocols, follow these steps:

  1. In the ISA Server Management console, expand the server name, and select Firewall Policy.

  2. In the Tasks pane, click the Tasks tab. Under Firewall Policy Tasks, click Create New Access Rule.

  3. On the Welcome To The New Access Rule Wizard page, type a name for the new access rule (such as VPN Client to Internal Network Access Rule), and then click Next.

  4. On the Rule Action page, click Allow, and click Next.

  5. On the Protocols page, from the This Rule Applies To drop-down list, choose one of the following: All Outbound Traffic, Selected Protocols, or All Outbound Traffic Except Selected.

  6. On the Protocols page, click Ports. Confirm that traffic from any allowed source port is accepted, and then click OK. Click Next.

  7. On the Access Rule Sources page, click Add. In the Add Network Entities dialog box, expand Networks, click the VPN Clients network, click Add, and then click Close. Click Next to continue.

  8. On the Access Rule Destinations page, click Add. In the Add Network Entities dialog box, expand Networks, click the External network, click Add, and then click Close. Click Next to continue.

  9. On the User Sets page, the default setting is for the rule to apply requests from the All Users user set. Modify the default to only allow Authenticated Users by following these steps:

    1. Click All Users, and then click Remove.

    2. Click Add. In the Add Users dialog box, click All Authenticated Users, click Add again, and then click Close. Click Next to continue.

  10. On the Completing The New Access Rule Wizard page, review the summary of information, and then click Finish.

  11. Click Apply to save your changes, and then click OK.

Note

For more information about configuring access rules, see Chapter 8, "Configuring ISA Firewall Policy."

Configuring the Client Computers

To configure a Microsoft Windows XP VPN client connection, follow these steps:

  1. Open Control Panel and click Network And Internet Connections.

  2. Click Network Connections.

  3. In the Network Tasks pane, click Create A New Connection.

  4. On the Welcome To The Network Connection Wizard page, click Next.

  5. On the Network Connection Type page, click Connect To The Network At My Workplace, as shown in Figure 11-8, and then click Next.

  6. On the Network Connection page, click Virtual Private Network Connection and then click Next.

  7. On the Connection Name page, type a name for the connection and then click Next.

  8. If you have Dial-Up Networks configured, you will see the Public Network page. Select whether you want the VPN connectoid to automatically dial a connection.

  9. On the VPN Server Selection page, type the fully qualified domain name (FQDN) or external IP address of the ISA VPN server and then click Next.

  10. If your computer supports smart cards, the Smart Cards page prompts you to choose whether you wish to use smart cards with the VPN connection. Select Use My Smart Card if you wish to do so, and then click Next.

  11. If the Connection Availability page appears, select whether you wish to make the connection available for Anyone's Use or for My Use Only.

  12. On the Completing The New Connection Wizard page, click Finish to complete.

    Note

    If you've changed your default Windows XP settings, your screens might appear slightly different than those just described.
Image from book
Figure 11-8: Use the Network Connection Wizard to create a connection from your client computer to the VPN on your ISA server.


Site-To-Site Configuration

Connecting two ISA Server computers at different sites using encrypted traffic across an untrusted network to create a VPN connection is known as a site-to-site VPN configuration. This section explains how to create connections between two sites, called the primary site and the secondary site, as shown in Figure 11-9. The names of the ISA servers in each location in this example are P_ISA and S_ISA, respectively.

Image from book
Figure 11-9: Connecting a primary site and a secondary site using ISA Server's site-to-site VPN configuration.

There are two prerequisites for creating a site-to-site VPN configuration:

  • Analyze and select the VPN protocol The type of protocol determines what additional steps you need to take. For example, if you decide to use an L2TP/IPSec VPN protocol, you need to obtain certificates and install those on the ISA server and the clients.

    Note

    To learn specifically how to request a certificate for ISA Server 2004, see http://support.microsoft.com/default.aspx?scid=kb;en-us;M555281.

  • Create the VPN gateway dial-in accounts for authentication Authentication for the site-to-site configuration requires accounts created on each ISA Server computer.

In addition, you need to follow the steps described in this section to create a site-to- site VPN connection for each site:

  1. Create the VPN gateway dial-in accounts.

  2. Create the primary site VPN gateway.

  3. Create a remote (secondary) site network.

  4. Create network rules to the remote site.

  5. Create two access rules: one allowing traffic from the primary to the secondary sites; the other allowing traffic from the secondary to the primary sites.

  6. Configure the secondary site VPN gateway.

  7. Test the VPN connection.

Analyzing and Selecting the VPN Protocol

When two networks connect to each other across the Internet or other untrusted network, they must both use a VPN tunneling protocol to establish a secure connection. ISA Server 2004 supports three VPN tunneling protocols, as described in Table 11-2. Choose the VPN protocol that matches your needs.

Table 11-2: VPN Tunneling Protocols
Protocol | Usage Scenario | Description | Preference
IPSec Tunnel Mode | Use when connecting to non-Microsoft VPN gateways | You will need to configure either pre-shared keys or certificates. | Only if required
PPTP | Use when connecting to ISA Server or RRAS VPN servers | Uses user name and passwords for authentication. | Better
L2TP/IPSec | Use when connecting to ISA Server or RRAS VPN servers | Uses certificates or user name and passwords for authentication. For testing purposes, pre-shared keys can also be used. | Best
Note

When using L2TP/IPSec, best practices call for using certificates rather than pre-shared keys.

Creating the VPN Gateway Dial-In Accounts for Authentication

Your primary site and secondary site gateways require both a demand dial interface and an associated user account to talk with one another. You'll see how to create a demand dial interface in the following procedures, but before you do, you'll need to create an account at each site to authenticate the connection. Figure 11-10 shows how to configure the demand dial interfaces and accounts for the primary and secondary sites.

Image from book
Figure 11-10: When setting up accounts for your VPN gateway, use the name of the remote VPN server's demand dial interface.

Notice that the name of the local account on each ISA server matches the name of the demand dial interface to which it is connecting.

Important

You must use the same name for both! Giving your user account the same name as the demand dial interface tells RRAS to recognize the connection as a VPN router connection instead of a remote-access VPN connection.

Creating the Primary Site VPN Gateway

Create the primary user account and configure the primary machine with this account. (In our example, we are calling this the P_ISA\Primary account.)

Note

We assume that you know how to create a local user account, and don't provide those procedures here—if you want a refresher, see the Windows Server Help file.

Do be sure to open the user account's properties, and set these options.

  • On the Account tab, select the User Cannot Change Password check box.

  • On the Dial-In tab, in the Remote Access Permission (Dial-In Or VPN) area, select Allow Access. You will be unable to connect if the VPN gateway account does not have dial-in permissions.

Best Practices

Use a very complex password for these accounts, such as %A5*j w2l(--d4q>v7+b#^x] `eI7z/>.uoY$,K62=<

To complete the creation of the gateway, you create a remote site network, a network rule, and access rules that allow traffic between the two sites on the network.

Creating a Remote Site Network

To connect to another (secondary) VPN server across the Internet, you must define that remote network in ISA Server. The remote-site network is defined by a range of IP addresses specific to that site.

Important

You must enable VPN client access in order for your site-to- site access to work. See the procedure for enabling VPN client access earlier in this chapter.

To configure a remote-site network, complete the following steps:

  1. In the ISA Server Management console, select the Virtual Private Networks (VPN) node.

  2. In the details pane, click the Remote Sites tab, as shown in Figure 11-11.

  3. On the Tasks tab, click Add Remote Site Network.

    Best Practices

    You can also create a remote site network from the Networks node, but following this procedure reduces the number of steps and potential errors.

  4. On the Welcome To The New Network Wizard page, type the name of the remote site network, and click Next.

  5. On the VPN Protocol page, select one of the VPN protocols shown in Figure 11-12, and click Next.

    Tip

    In ISA Server 2004 Enterprise Edition, you first need to select the ISA Server array member that is the Connection Owner for the VPN site-to-site connection. If you are using Network Load Balancing (NLB), the connection owner is automatically assigned.

  6. If you choose the IP Security Protocol (IPSec) Tunnel Mode option, follow these steps:

    1. On the Connection Settings page, define the IP addresses for the remote and local VPN gateway addresses, and then click Next.

    2. On the IPSec Authentication page, choose to use a certificate or a preshared key to establish authentication, and then click Next.

    Tip

    If ISA Server is installed on a computer running Windows 2000, download and install the IPSecPol tool from http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/ipsecpol-o.asp.
    Caution

    IPSec Tunnel Mode is vulnerable to several attacks. Use L2TP/IPSec with machine certificate authentication whenever possible.

  7. If you choose the Layer Two Tunneling Protocol (L2TP) Over IPSec option, complete the following steps:

    1. On the Remote Site Gateway page, type the host name or IP address of the remote site VPN server, and then click Next.

      Note

      If you select the Layer Two Tunneling Protocol (L2TP) Over IPSec option in ISA Server 2004, Enterprise Edition, the dialog box shown in Figure 11-13 opens and prompts you to configure a user account. Click Help for more information.

    2. On the Remote Authentication page, you can select the Local Site Can Initiate Connections Using These Credentials check box, and then type the User Name, Domain, and Password for the account. Choose this option only if you want the ISA server on which you are working to establish the connection. Click Next.

      Important

      You must use an account that has the same name as the VPN site-to-site connection on the remote server. See the section entitled "Configuring the VPN Gateway Dial-In Accounts for Authentication," earlier in this chapter.
      Note

      If you are running ISA Server 2004, Standard Edition, you will see a Local Authentication page that contains the same information shown in Figure 11-13. Configure a user account and click Next.

    3. On the L2TP/IPSec Authentication page, you can define the Pre-Shared Key used by ISA Server.

      Note

      You cannot use both a certificate and a pre-shared key—ISA Server supports using one or the other.

  8. If you select Point-To-Point Tunneling Protocol (PPTP), follow these steps:

    1. On the Remote Site Gateway page, type the host name or IP address of the remote site VPN server, and then click Next.

      Note

      In Enterprise Edition, you are prompted with a dialog box as shown in Figure 11-13, which prompts you to configure a user account. Click Help for more information.

    2. On the Remote Authentication page, you can select the Local Site Can Initiate Connections Using These Credentials check box, and then type the User Name, Domain, and Password for the account. Select this option only if you want the ISA server on which you are working to establish the connection. Click Next.

    Important

    You must use an account that has the same name as the VPN site-to-site connection on the remote server. See the section entitled "Creating the VPN Gateway Dial-In Accounts for Authentication," earlier in this chapter.
    Note

    If you are running ISA Server 2004, Standard Edition, you see a Local Authentication page that contains the same information shown in Figure 11-13. Configure a user account and click Next.

  9. On the Network Addresses page, click Add to define the range of IP addresses for the remote site network. Click Next.

    Enterprise Edition allows you to define this network by choosing from Enterprise Networks.

  10. On the Completing The New Network Wizard page, review your settings, and then click Finish.

  11. When prompted, click OK to confirm that active VPN sessions will be disconnected.

  12. Click Apply to commit the changes. Click OK to finish.

Image from book
Figure 11-11: The Remote Sites tab allows you to configure site-to-site VPN connections. Use the Tasks pane to perform actions.
Image from book
Figure 11-12: Depending on the VPN protocol you select, you will see different pages, as described next.
Image from book
Figure 11-13: Depending on whether you're using the Enterprise Edition or Standard Edition of ISA Server, you will see this information in either a pop-up dialog box or as a page.

Creating Network Rules to the Remote Site

When you create a site-to-site network, ISA Server creates two system policy rules:

  • Allow VPN Site-To-Site Traffic To ISA Server ISA Server's Local Host network allows all external networks to connect using the specified VPN tunneling protocols.

  • Allow VPN Site-To-Site Traffic From ISA Server ISA Server's Local Host network allows all VPN tunneling protocols to the external network as well as to the IPSec Remote Gateways computer set, which contains the address of the remote tunnel endpoint.

When the new network is created, review and define the network rules between the remote site network and the internal network. If you require two-way communication, you should designate a route relationship rather than NAT.

When using a route relationship, if you are using private addresses on both local area networks (LANs), ensure that the two networks do not have duplicate IP address ranges.

Note

If they share IP address ranges, change the scope in one network so that there are no duplicate IP address ranges. If you define a NAT relationship between networks, communication attempts will fail. It is possible to define a route relationship on one of the networks and a NAT relationship on the other, which will allow communication. What's your best bet? Use a route relationship without duplicate IP address ranges.

To configure the relationships between networks, complete the following steps:

  1. In the ISA Server Management console, expand the server name, expand Configuration, and then click Networks.

  2. In the details pane, click the Network Rules tab.

  3. Right-click the VPN Clients To Internal Network (or other) network rule, and then select Properties.

  4. In the VPN Clients To Internal Network Properties dialog box, click the Network Relationship tab, and then select Network Address Translation (NAT) or Route.

  5. Click OK, and then click Apply. Click OK to finish.

    Note

    For more information about network rules, see the section entitled "Creating a Network Rule" in Chapter 9, "Configuring Multinetworking."

Creating Access Rules

By default, there is no access between the remote site network and the internal network. Create two access rules between the two networks, allowing only the protocols, computer sets, and so on, that are required for your environment.

  • One access rule allows traffic from the internal network to the secondary remote site; in this example, it is the Primary To Secondary Access Rule.

  • The other access rule allows traffic from the secondary remote site network to the internal network; in this example, it is the Secondary To Primary Access Rule.

Figure 11-14 shows the access rules that were created on the P_ISA computer in this example. All outbound traffic is allowed for all users in both cases—your access rules should be more specific based on your traffic requirements analysis and usage scenarios.

Image from book
Figure 11-14: These rules allow all outbound traffic for all users—your access rules should be more specific based on your traffic requirements analysis and usage scenarios.
Note

For more information about configuring access rules, see Chapter 8.

Configuring the Secondary Site VPN Gateway

To configure the secondary site VPN gateway, you follow the same procedures as described earlier in "Creating the Primary Site VPN Gateway," and summarized in this section.

Confirming Connectivity

If your ISA server cannot contact a domain controller, or if it cannot connect to a domain controller with rights to add the ISA server to the Remote Access Servers group, perform any or all of the following actions:

  • Create a local account with the same name as the remote site demand dial interface (in this example, the account is called S_ISA\Secondary).

  • Create a remote site network with the same name as the remote site's demand dial interface (in this example, this is called Primary).

  • Create a network rule that defines the connection between the secondary site and the primary site. The Network Traffic Source is the internal network, and the Network Traffic Destination is the primary network. Unless you want to use NAT to prevent two-way communication or overcome duplicate IP addresses, select the Route relationship between networks.

  • Create two access rules:

    • Allow traffic from the internal network to the primary site.

    • Allow traffic from the primary site to the internal network.

  • Enable VPN client access on the VPN Clients tab on the Virtual Private Network node.

Testing the Site-To-Site VPN Connection

To establish a connection between the two sites, try the following tests:

  1. First, test the VPN Gateway communication by pinging the remote site IP address from one ISA server.

  2. Second, connect from a client on one network to a known server on the remote network. Try the same test from a client in the remote network to a known server on the local network.

Use the monitoring interface to help troubleshoot any connectivity problems.


VPN Quarantine

VPN Network Quarantine allows you to provide VPN clients with staged access into your network. When you enable quarantine mode, ISA Server sends all VPN clients that authenticate successfully and match remote access policies into a special network called the Quarantined VPN Clients. The VPN client runs a Connection Manager (CM) script to verify that it meets with the requirements specified by you, the administrator. If all requirements are met, the client script is verified and accepted, and is then allowed to join the VPN Clients network.

Be aware that using Quarantine on ISA Server out of the box is a time-consuming and highly technical process, as a lot of work remains to be done by the administrator. You must create the scripts, you must use the Connection Manager Administration Kit (CMAK) to create profiles, and then somehow distribute updated profiles to your clients.

Because the setup of this technology is rather involved and goes beyond the scope of this book, we are placing a white paper that details how to configure ISA Server 2004 with Quarantine at www.isamvp.org/APC.

We prefer using a solution created by ISA Server MVP Frederic Esnouf, and briefly describe how to install and configure his solution in the same white paper at www.isamvp.org/APC . You can also visit his Web site ( www.esnouf.net/qss ) for new releases and a lot of good information.

In addition, Windows Vista will provide this functionality when it is used with Vista Server. See http://www.microsoft.com/windowsserver2003/technologies/networking/nap for more information.

Note

For creating a test environment in which to learn how to use Network Quarantine in Windows Server 2003, read "Step-by-Step Guide for Setting Up Network Quarantine and Remote Access Provisioning in a Test Lab" by searching for "Quarantine Remote Access Provisioning Test Lab" on the http://www.microsoft.com/downloads site.


Chapter 12: Scripting with Microsoft ISA Server 2004

Highlights

Microsoft ISA Server 2004 supports programmatic administration using Component Object Model (COM) objects, and the management console is extensible. This chapter doesn't assume any scripting familiarity and guides you through the creation of some scripts that can be used with ISA Server 2004. We focus on the following subjects:

  • Scripting essentials An introduction to scripting with ISA Server 2004

  • Preparing your environment How to create a safe environment in which to develop scripts

  • ShowBasicInfo1.vbs How to create a script showing basic information about your local ISA server

  • ShowBasicInfo2.vbs How to create another script that shows the information using different commands

  • AddComputer.vbs How to create a computer object

  • CreateHTTPAllowRule.vbs How to write a script that creates a Firewall Policy access rule

  • ExportServers.vbs How to create a script that writes all Microsoft Windows Server 2003 servers to a text file

  • ImportServers.vbs How to create a script that reads from a list of servers in a text file, and builds computer objects for each system

  • Next steps How to find more information on script creation and usage in the ISA Server SDK

Important

Do not run any scripts in your production environment unless you know exactly what changes they will make and how to support them.


Overview

Scripting with ISA Server can help you monitor and manage almost any visible component in the ISA Server Management console. Scripting can perform day-to-day administration of ISA Server normally done through the ISA Server Management console. For example, you can use a script to add all servers from Active Directory directory service as a computer rule element in ISA Server.

This chapter guides you through the steps required to create scripts and thereby gives you an introduction to scripting tasks in ISA Server 2004.

Caution

These scripts were created for an ISA Server 2004 Standard Edition environment and may not work on ISA Server 2004 Enterprise Edition. This chapter is designed to introduce you the the tools and concepts necessary to help you create basic scripts for the most widely distributed version of ISA Server. For more information, see the "Additional Resources" appendix.


VBScript Essentials

The basis of scripting requires some familiarity with object-oriented programming (OOP), and terms such as objects, properties, and methods. These elements are the building blocks we use when we want to write a script not only for ISA Server, but for any script. The most essential element is an object, which can have one or more properties and one or more methods. To illustrate how these items relate to something we all know, think of a person (the object in this example). A person can have a first name, last name, and age, which are like properties. If a person needs to change his or her last name, he or she needs a method to do so.

Table 12-1 shows the basic terminology of scripting objects.

Table 12-1: Script Terminology

Name

Description

Example

Variable

A variable is a temporary place to hold data in a program. It is declared with the Dim statement.

Dim objRoot

Object

Objects are reusable software components that contain properties and methods and can be called by applications to perform certain tasks.

Set objRoot = CreateObject("FPC.Root")

Property

A property is either a value or a characteristic that is held by an object.

FPCComputer.Description = "Server"

Method

A method is a command that performs an action.

objFPCComputers.Save

Sub

A sub procedure is a part of code that does not return any value.

Sub WriteIT(value)
  Wscript.Echo value
End Sub

Function

A function procedure is a part of code and can return a value.

Function TrimIT(value)
 TrimIT = Trim(value)
End Function

When writing scripts against ISA Server you need to know what objects, properties, and methods the ISA server exposes and how to access and control them. Information on how to write scripts is included in the SDK for ISA Server 2004. We take a closer look at the ISA Server 2004 SDK as we are writing the scripts.

Tip

You can download the ISA Server 2004 SDK from http://go.microsoft.com/?linkid=2392254. The SDK can be used with both Standard Edition and Enterprise Edition.

Note that the naming convention used in all the samples is built on the object type prefix, and then the name of the COM object. This convention makes it easier to search the SDK for more information. An example of this naming convention would be objRoot, where obj is the prefix for an object and Root is the object itself. Table 12-2 illustrates other commonly used prefixes in VBScript.

Table 12-2: Common Naming Prefixes
Type | Prefix | Example
Boolean | bln | blnFound
Date | dtm | dtmStartTime
Integer | int | intCounter
Object | obj | objRoot
String | str | strComputerName


Preparing Your Environment

The first thing you should do is create a test lab in a virtual environment so that you can make mistakes without damaging your production environment. To complete the scripts described in this chapter, you need a domain controller and an ISA Server 2004 machine configured with two network adapters. Remember to isolate the test lab from your production environment before running any scripts.

Note

See Chapter 19, "Configuring Microsoft ISA Server with Microsoft Virtual Server 2005," for more information about how to use Microsoft Virtual Server to configure a test environment. You can also use Virtual PC to configure a test environment. See the Microsoft Virtual PC site at http://www.microsoft.com/windows/virtualpc/default.mspx for more information. In addition, you can download a 45-day trial version from there.

Installing ISA Server 2004 SDK

Once you have downloaded the ISA Server 2004 SDK from http://go.microsoft.com/?linkid=2392254, you can install it by following these steps:

  1. On the ISA Server 2004 computer, log on as an administrator.

  2. Run ISA2004SDK.exe, and install with the default settings.

  3. The updated version of the ISA Server 2004 SDK will be located in C:\Program Files\Microsoft ISA 2004 SDK\HHelp\Isasdk.chm.

  4. Open a script editor.

Note

You can download all of the sample scripts from this chapter at http://www.isamvp.com/apc.
Tip

You can use the Microsoft Script Editor (MSE), which comes with Microsoft Office 2000 and later versions. To open the MSE, from the Tools menu of any Office application, select Macros, and then select Microsoft Script Editor. One other very useful editor that makes creating and working with scripts easy is PrimalScript, by Sapien Technology. You can download a trial version at http://www.sapien.com. If you don't have either of these tools, you can use Notepad.
Best Practices

Create and test your scripts in a test environment—such as a test workstation, or a Virtual PC image—not on the ISA server itself.


ShowBasicInfo1.vbs

The first script shows some basic information about ISA Server 2004. It is not a complex script, but illustrates some basic coding techniques, including connecting to your ISA server using the COM, along with some basic VBScript functions.

To create an empty VBScript file, follow these steps:

  1. Start your script editing program.

  2. Create a new file.

  3. Set the configuration to use VBScript.

You now have an empty VBScript file. Always start your script by noting information on the script's purpose, any prerequisites or requirements, and the version number. When writing comments in a script you should use a single quote (') as the first character in each line, as shown here:

'====================================================================
' PURPOSE: Shows Basic ISA Server 2004 Information
'
' NAME: ShowBasicInfo1.vbs
'
' RUN: cscript ShowBasicInfo1.vbs
'
' WHERE: Run on an ISA Server 2004, Local on Server
'
' COMMENT: This script was written by Jesper Hanno Hansen.
'
' VERSION: 1.0
'====================================================================

Then the coding can begin. Declare the variable objRoot and set it to the root of the ISA administration object hierarchy, which provides access to all the configuration of the ISA arrays.

Best Practices

Add comments to your script to clarify the meaning of each section of code. Comments are not executed and are preceded by a single quote.

Your code should look like the following example:

' Declare the variable objRoot
Dim objRoot
' Create an objRoot Object to ISA Server 2004 and set it as objRoot
Set objRoot = CreateObject("FPC.Root")

If you are using the PrimalScript editor, when you type a "dot" after objRoot you will see that it exposes the properties and methods the object model offers. Figure 12-1 illustrates this handy function.

Image from book
Figure 12-1: One of the advanced functions of PrimalScript is that it provides the object model in a drop-down menu to speed scripting functions.
Note

For a detailed explanation of the methods and properties to which the root object gives access, see the ISA Server 2004 SDK.

To open the ISA Server 2004 SDK, follow these steps:

  1. Open the Run command.

  2. Type the path to your ISA Server SDK help file. By default, the SDK is stored at C:\Program Files\Microsoft ISA 2004 SDK\Help\Isasdk.chm.

  3. Click OK.

To see the properties of the FPC.Root object, navigate to the correct location in the Isasdk.chm file by performing the following steps:

  1. Expand Administration COM Documentation.

  2. Expand Microsoft Internet Security and Acceleration Server 2004.

  3. Expand Administration Reference.

  4. Expand COM Objects.

  5. Select FPC.

The FPC object provides access to two methods and one property that can be used in ISA Server 2004 Standard Edition, which are shown in Table 12-3.

Table 12-3: FPC Root Object
Type | Name | Description
Method | GetContainingArray | Retrieves the FPCArray Object
Method | GetContainingServer | Retrieves the FPCServer Object
Property | Arrays | An FPCArrays Collection

In this script we want to expose basic information from ISA Server 2004 itself, which requires us to create a reference to the FPCServer object, as it contains the relevant information. To create a reference to the FPCServer object, type the following lines in the script:

' Create an FPCServer Object from the current ISA Server 2004
' this Object gives access to the Properties we want to use.
Dim objFPCServer
Set objFPCServer = objRoot.GetContainingServer

In the SDK, click on the FPCServer to the GetContainingServer in the Method table as shown in Figure 12-2.

Image from book
Figure 12-2: The GetContainingServer Method entry in the SDK provides detailed information regarding the properties and usage of the method.

This shows the methods and properties to which the FPCServer object provides access. Your script could show any of the properties listed under the Properties section in the SDK, such as the following:

  • CreatedTime (Date)

  • FQDN (String)

  • Name (String)

  • ProductVersion (String)

To see the property value—and other valuable information—click the name of the property. For example, the Name property is a string value and it is read only. To continue our example, type the following lines of code in the script:

' Set the dtmCreatedTime to the value of FPCServer.CreatedTime
Dim dtmCreate
dTimedtmCreatedTime = objFPCServer.CreatedTime

' Set the strFQDN to the value of FPCServer.FQDN
Dim strFQDN
strFQDN = objFPCServer.FQDN

' Set the strName to the value of FPCServer.Name
Dim strName
strName = objFPCServer.Name

' Set the strProductVersion to the value of FPCServer.ProductVersion
Dim strProductVersion
strProductVersion = objFPCServer.ProductVersion

The script is almost complete, but to see the values we need some lines to write out the data captured in the variables. To export the data, type the following lines in the script:

'The Wscript.Echo is a VBScript function that writes data to the screen
WScript.Echo "CreatedTime         " & dtmCreatedTime
WScript.Echo "FQDN                " & strFQDN
WScript.Echo "Name                " & strName
WScript.Echo "ProductVersion      " & strProductVersion

Now that we completed the individual parts of the script, let's take a look at the final, complete script:

'====================================================================
'
' PURPOSE: Shows Basic Information on ISA Server 2004
'
' NAME: ShowBasicInfo1.vbs
'
' RUN: cscript ShowBasicInfo1.vbs
'
' WHERE: Run on an ISA Server 2004, Local on Server
'
' COMMENT: This script was written by Jesper Hanno Hansen.
'
' VERSION: 1.0'
'
=====================================================================

' Create a Root Object to ISA Server 2004
Dim objRoot
Set objRoot = CreateObject("FPC.Root")

' Create an FPCServer Object from the current ISA Server 2004
' this Object gives access to the Properties we want to use.
Dim objFPCServer
Set objFPCServer = objRoot.GetContainingServer

' Set the dtmCreatedTime to the value of FPCServer.CreatedTime
Dim dtmCreatedTime
dtmCreatedTime = objFPCServer.CreatedTime

' Set the strFQDN to the value of FPCServer.FQDN
Dim strFQDN
strFQDN = objFPCServer.FQDN

' Set the strName to the value of FPCServer.Name
Dim strName
strName = objFPCServer.Name

' Set the strProductVersion to the value of FPCServer.ProductVersion
Dim strProductVersion
strProductVersion = objFPCServer.ProductVersion

' Using Wscript.Echo to write information to the screen
WScript.Echo "CreatedTime         " & dtmCreatedTime
WScript.Echo "FQDN                " & strFQDN
WScript.Echo "Name                " & strName
WScript.Echo "ProductVersion      " & strProductVersion

Save the script as C:\ISAScripts\ShowBasicInfo1.vbs and run the script by typing cscript C:\IsaScripts\showbasicinfo1.vbs at a command prompt, or use the appropriate Run command from your script editor (like F7 with PrimalScript).

Note

You should now have some basic skills in scripting with ISA Server 2004. The next examples contain less detail and focus more on the scripts themselves.


ShowBasicInfo2.vbs

There are many variations in the types of scripts you can create. For example, ShowBasicInfo2.vbs script provides the same information as ShowBasicInfo1.vbs with fewer steps.

'====================================================================
'
' PURPOSE: Shows Basic Information on ISA Server 2004
'
' NAME: ShowBasicInfo2.vbs
'
' RUN: cscript ShowBasicInfo2.vbs
'
' WHERE: Run on an ISA Server 2004, Local on Server
'
' COMMENT: This script was written by Jesper Hanno Hansen.
'
' VERSION: 1.0
'====================================================================

' Create a Root Object to ISA Server 2004
Dim objRoot
Set objRoot = CreateObject("FPC.Root")

' Using Wscript.Echo to write information to the screen, with direct
' reference to the Objects
WScript.Echo "CreatedTime   " & objRoot.GetContainingServer.CreatedTime
WScript.Echo "FQDN          " & objRoot.GetContainingServer.FQDN
WScript.Echo "Name          " & objRoot.GetContainingServer.Name
WScript.Echo "ProductVersion" & objRoot.GetContainingServer.
                                   ProductVersion


AddComputer.vbs

The AddComputer.vbs script creates a computer rule element in the ISA Server Network Object Toolbox. When creating a computer rule element, some values are required: a name of the object and an IP address. The description is optional, but it can be a good idea to type in a comment describing the role of the computer.

Tip

For more information on the Windows Script SDK, you can download the Windows Script 5.6 Documentation from http://www.microsoft.com/downloads/details.aspx?FamilyID=&DisplayLang=en.

'====================================================================
'
' PURPOSE: Add a Computer Element to ISA Server 2004
'
' NAME: AddComputer.vbs
'
' RUN: cscript AddComputer.vbs <ComputerName> <IP Address> [Description]
'
' WHERE: Run on an ISA Server 2004, Local on Server
'
' COMMENT: This script was written by Jesper Hanno Hansen.
'
' VERSION: 1.0
'====================================================================

' Create an arguments Object to get the parameters from the input
Dim objArguments
Set objArguments = WScript.Arguments

' Count the input parameters, if less than 2, show help
If objArguments.Count < 2 Then
    ShowHelp
Else
    ' There were more than 2 parameters, set the first to the
    ' Computername and the second to the IPAddress.

    Dim strComputer
    strComputer = WScript.Arguments(0)

    Dim strIPAddress
    strIPAddress = WScript.Arguments(1)

    ' Set the remaining input as the description
    Dim strDescription
    For i = 2 To objArguments.Count -1
        strDescription = strDescription & " " & objArguments(i)
    Next

    ' Trim the description to remove the last space
    strDescription = Trim(strDescription)
End If

' Show information on the Computer element that will be created
WScript.Echo "Creating a new Computer element with the following
information"
WScript.Echo ""
WScript.Echo "Computer Name: " & strComputer
WScript.Echo "IP Address: " & strIPAddress
WScript.Echo "Description: " & strDescription

' Calling the Sub to create a new computer element
DoCreateComputer strComputer, strIPAddress, strDescription

Sub DoCreateComputer(ComputerName,ComputerIPAddress,ComputerDescription)
   ' Enabling Error handling
   On Error Resume Next

   ' Create an objRoot Object to ISA Server 2004
   Dim objRoot
   Set objRoot = CreateObject("FPC.Root")
   CheckError

   ' Create an FPCArray Object to retrieve the current ISA Array
   Dim objFPCArray
   Set objFPCArray = objRoot.GetContainingArray
   CheckError

   ' Create an FPCRuleElements Object to get access to FPCComputers
   Dim objFPCRuleElements
   Set objFPCRuleElements = objFPCArray.RuleElements
   CheckError

   ' Create an FPCComputers Object to get access to FPCComputer
   Dim objFPCComputers

   Set objFPCComputers = objFPCRuleElements.Computers
   CheckError

   ' Trying to retrieve the computer from the Computer elements.
   ' If retrieval of the computer succeeds, the computer element
   ' already exists and the script should not do anything with it.
   Dim objComputerExists
   Set objComputerExists = objFPCComputers.Item(ComputerName)

   ' If the error code is 0 = Success, then there is a computer with the
   ' same name.
   If Err.Number = 0 Then
        WScript.Echo "The Computer Element " & ComputerName & _
                     " exist, stopping here"
        WScript.Quit
   Else
        Err.Clear
   End If

   ' Using the Add method from the FPCComputer object
   ' The Add method requires 2 input parameters
   ' Name and IPAddress as strings
   Dim objFPCComputer
   Set objFPCComputer = objFPCComputers.Add(ComputerName,
ComputerIPAddress)
   CheckError

   ' Check if the ComputerDescription is empty, if not we should add
   ' the description to the computer element.
   If ComputerDescription <> "" Then
         objFPCComputer.Description = ComputerDescription
         CheckError
   End If

   ' Show information that the script is going to save the new computer
   ' element, and checking for any error.
   WScript.Echo "Saving Computer element"
   objFPCComputers.Save
   CheckError
   WScript.Echo "Computer element successfully saved"
End Sub

' Used to check if the script is in an error state, if true quit
Sub CheckError
   If Err.Number <> 0 Then
         WScript.Echo ""

         WScript.Echo "Error Number      : " & "0x" & Hex(Err.Number)
         WScript.Echo "Error Description : " & Err.Description
         WScript.Quit
   End If
End Sub

' Used to show help on the screen, if input parameters is less
' than 2
Sub ShowHelp
   WScript.Echo "Please use cscript AddComputer.vbs <ComputerName>" & _
   " <IP Address> [Description]"
   WScript.Echo "For Example:"
   WScript.Echo ""
   WScript.Echo "Cscript AddComputer.vbs Server01.domain.local" & _
   " 192.168.1.2 FTP Server"
   WScript.Echo ""
   WScript.Echo "Where Computername and IP Address is required"
   WScript.Echo "and Description is optional."
   WScript.Quit
End Sub


CreateHTTPAllowRule.vbs

The following script creates a new access rule that allows HTTP traffic from the internal network to the external network. You can use this as the foundation to create scripts that create other access rules with different protocols.

'====================================================================
'
' PURPOSE: Create an HTTP Allow rule on ISA Server 2004
'
' NAME: CreateHTTPAllowRule.vbs
'
' RUN: cscript CreateHTTPAllowRule.vbs
'
' WHERE: Run on an ISA Server 2004, Local on Server
'
' COMMENT: This script was written by Jesper Hanno Hansen.
'
' VERSION: 1.0
'====================================================================
' Set FPCInclude from FPCIncludeStatus
Const FPCInclude = 0

' Set FPCPolicyRuleActionAllow from FPCPolicyRuleActions
Const FPCPolicyRuleActionAllow = 0

' Set FPCSpecifiedProtocols from FpcProtocolSelectionType
Const FPCSpecifiedProtocols = 1

' Create a Root Object to ISA Server 2004
Dim objRoot
Set objRoot = CreateObject("FPC.Root")

' Create an FPCArray Object to retrieve the current ISA Array
Dim objFPCArray
Set objFPCArray = objRoot.GetContainingArray

' Create an FPCArrayPolicy Object to get access to FPCPolicyRules
Dim objFPCArrayPolicy
Set objFPCArrayPolicy = objFPCArray.ArrayPolicy

' Create an FPCPolicyRules Object to get access to FPCPolicyRule
Dim objFPCPolicyRules
Set objFPCPolicyRules = objFPCArrayPolicy.PolicyRules

' Using the AddAccessRule method from the FPCPolicyRules Object
' and returns a reference to it.
' The AddAccessRule method requires one parameter, a Name (String Value)
Dim objFPCPolicyRule
Set objFPCPolicyRule = objFPCPolicyRules.AddAccessRule("Allow HTTP" & _
                     " from Internal to External")

' Set Action Property to Allow from the FPCPolicyRuleActionAllow Constant
objFPCPolicyRule.Action = FPCPolicyRuleActionAllow

' Set Description Property to Allow Internet Access
objFPCPolicyRule.Description = "Allow Internet Access"

' Set Enabled to True so the Rule is Enabled
objFPCPolicyRule.Enabled = True

' Using the Add method from the FPCRef object via the Network
' FPCRefs collection object via FPCSelectionIPs
' The Add method requires 2 input parameters, Name and IncludeStatus
objFPCPolicyRule.SourceSelectionIPs.Networks.Add "Internal", FPCInclude

' Using the Add method from the FPCRef object via the Network
' FPCRefs collection object via FPCSelectionIPs and FPCAccessProperties
' The Add method requires 2 input parameters, Name and IncludeStatus
objFPCPolicyRule.AccessProperties.DestinationSelectionIPs.Networks.add _
"External", FPCInclude

' Using the Add method from the FPCRef object via the FPCProtocolDefinition
' FPCRefs collection object via FPCAccessProperties.

' The Add method requires 2 input parameters, Name and IncludeStatus
objFPCPolicyRule.AccessProperties.SpecifiedProtocols.Add "HTTP",
FPCInclude

' Set ProtocolSelectionMethod to the FPCRefs Object FPCSpecifiedProtocols
'(HTTP)
objFPCPolicyRule.AccessProperties.ProtocolSelectionMethod = _
FPCSpecifiedProtocols

' Using the Add method from the FPCRef object via the FPCUserSet
' FPCRefs collection object via FPCAccessProperties.
' The Add method requires 2 input parameters, Name and IncludeStatus
objFPCPolicyRule.AccessProperties.UserSets.Add "All Users", FPCInclude

' Save all values to the new rule, and committing changes
objFPCPolicyRules.save

' Using Wscript.echo to show information on the screen that the script
' completed
 WScript.Echo "New rule created"


ExportServers.vbs

This script connects to Active Directory and writes all the servers that are running Microsoft Windows Server 2003 to a text file; the next script uses this information as an input to create a computer rule element in ISA Server 2004.

'====================================================================
'
' PURPOSE: Add all the Computers running Windows Server 2003 from
' Active Directory to a text file called c:\ExportedServers.txt
'
' NAME: ExportServers.vbs
'
' RUN: cscript ExportServers.vbs <Domain Controller>
'
' WHERE: Run on a domain member of Active Directory as an administrator
'of the local computer, which must be Windows Server 2003.
'
' COMMENT: The script will only return Windows Server 2003 computers.
'          This script was written by Jesper Hanno Hansen.
'
' VERSION: 1.0
'====================================================================

'Set ForAppending from OpenAsTextStream Method
Const ForAppending = 8

' Create an arguments Object to get the parameters from the input
Dim objArguments
Set objArguments = WScript.Arguments

' Count the input parameters, if less than 1, show help
If objArguments.Count < 1 Then
   ShowHelp
Else
   ' Set the parameter to the Computername
   Dim strServerName
   strServerName = WScript.Arguments(0)
   End If'

' Calling the Sub to connect to Active Directory
FindServers strServerName

WScript.Echo "Please check the file C:\ExportedServers.txt"
WScript.Echo "to verify the data..."

Sub FindServers(Server)
   ' Show information on the screen
   WScript.Echo "Connecting to server: " & strServerName
   WScript.Echo ""

   ' Create a Root Object of the LDAP namespace
   Dim objRootSet objRoot = GetObject("LDAP:")

   ' Declare variables
   Dim objADsPath
   Dim strADsPath

   ' Looping through available ADsPath
   For Each objADsPath In objRoot
         ' Set AdsPathstrADsPath = objADsPath.AdsPath
   Next

   ' Create a Connection Object
   Dim objConnection
   Set objConnection = CreateObject("ADODB.Connection")
   ' Set Provider Property to ADSI OLE DB Provider
   objConnection.Provider = "ADsDSOObject"
   ' Open the Connection to Active Directory
   objConnection.Open "ADs Provider"

      ' Create a RecordSet Object
   Dim objRecordset

   Set objRecordSet = CreateObject("ADODB.Recordset")

   ' Set the Query we will use against Active Directory
   ' Note the filter operatingSystem=Windows Server 2003 define
   ' that the query will return the Windows Server 2003 only
   Dim strQuery
   strQuery = "<" & strADsPath & ">" & _
   ";(&(objectClass=Computer)(operatingSystem=Windows Server 2003))" & _
   ";DNSHostName,description,distinguishedName;SubTree"

   ' Set the RecordSet Object to the result of the executed query
   Set objRecordSet = objConnection.Execute(strQuery)

   ' Declare variables
   Dim strDNSHostname, strDescription, strIPAddress, strDistinguishedName

   ' Loop through the RecordSet, until End Of File
   Do Until objRecordset.EOF
         ' Enable Error Handling
         On Error Resume Next

         ' Set the results to variables
         strDNSHostname = objRecordSet.Fields("dNSHostName")
         WScript.Echo "Found       : " & strDNSHostname
         CheckError
         strDistinguishedName = objRecordset.Fields("distinguishedName")
         CheckError

         ' Since Active Directory does not have the IP Address of a
         ' computer, we will ping the FQDN using a WMI Function and
         ' set the result as strIPAddress
         strIPAddress = GetIPAddress(strDNSHostname)
         CheckError

         ' The Description field in Active Directory is not returned using
         ' our query, so a new connection directly to the DistinguishedName
         ' of the Server is required
         ' Create an ADsGetObject Object to get access to the Description
         ' property
         Set objADsGetObject = GetObject("LDAP://" & strDistinguishedName)
         CheckError

         ' Set Description variable to the value of the Description field
         strDescription = objADsGetObject.Get("Description")

         ' Check if the value is empty, if true clear the error
         If IsNull(strDescription) Then
               Err.Clear
         End If

         ' Show information on the screen
         WScript.Echo "Information : " & strDNSHostname & " " & _
         strIPAddress & " " & strDescription
         Wscript.Echo ""
         ' Send the values to the write sub
         WriteToFile strDNSHostName, strIPAddress, strDescription

         ' Clear the description
         strDescription = Null

         ' Move to the next record in the recordset
         objRecordset.MoveNext
   Loop
End Sub

Sub WriteToFile(strDNSHostName, strIPAddress, strDescription)
   ' Create a FileSystem Object
   Dim objFileSystemObject
   Set objFileSystemObject = CreateObject("Scripting.FileSystemObject")

   ' Create a File Object, and open/create a file named ExportedServers.txt
   ' if the file exists, append data to it, if not create a new file.
   Dim objFile

   Set objFile = objFileSystemObject.OpenTextFile _
                ("C:\ExportedServers.txt", ForAppending,True)
   ' Write the data to the file
   objFile.WriteLine strDNSHostname & "|" & strIPAddress & "|" & _
   strDescription

   ' Close the file again
   objFile.Close
End Sub

Function GetIPAddress(strServer)
   On Error Resume Next

   ' Create a sWbemLocator Object to get access to sWbemService
   Dim objsWbemLocator
   Set objsWbemLocator = CreateObject("WbemScripting.SWbemLocator")
   CheckError

   ' Create a sWbemService object to get access to sWbemObjectSet
   Dim objsWbemService
   Set objsWbemService = objsWbemLocator.ConnectServer(".","root\CIMV2")
   CheckError

   ' Create a sWbemObjectSet using the ExecQuery method of a ping query
   Dim objsWbemObjectSet
   Set objsWbemObjectSet = objsWbemService.ExecQuery("select * from " & _
   "Win32_PingStatus where address = '" & strServer & "'")
   CheckError

   ' Declare
   Dim objsWbemObject

   ' Loop through the query
   For Each objSwbemObject in objsWbemObjectSet
         ' If statuscode is null or <> 0 there was an error, else ok
         If IsNull(objsWbemObject.StatusCode) Or _
                   objsWbemObject.StatusCode <> 0 Then
               GetIPAddress = ""
         Else
               ' Set GetIPAddress to Address of the destination
               GetIPAddress = objsWbemObject.ProtocolAddress
         End If
   Next
End Function

' Used to check if the script is in an error state, if true quit
Sub CheckError
   If Err.Number <> 0 Then
         WScript.Echo ""
         WScript.Echo "Error Number      : " & "0x" & Hex(Err.Number)
         WScript.Echo "Error Description : " & Err.Description
         WScript.Quit
   End If
End Sub

' Used to show help on the screen, if input parameters is less than 1
Sub ShowHelp
   WScript.Echo "Please use cscript ExportServers.vbs <Domain Controller>"
   WScript.Echo "For Example:"
   WScript.Echo ""
   WScript.Echo "cscript ExportServers.vbs Server01.domain.local"
   WScript.Quit
End Sub
Note

This function can also be performed using one of the ds commands included with Windows Server 2003. This will take one line rather than 211. From a command line, type dsquery * -filter "(&(objectCategory=computer)(operatingSystem=Windows Server 2003)) -attr name - l >c:\ExportedServers.txt.


ImportServers.vbs

This script reads a text file (like the one created in the ExportServer.vbs script previously) line by line and adds a computer rule element in ISA Server 2004 for each computer.

'========================================================================
' PURPOSE: Add all the Computers from the text file ExportedServers.txt
'
' NAME: ImportServers.vbs
'
' RUN: cscript ImportServers.vbs <Path to ExportedServers.txt>
'
' WHERE: Run on an ISA Server 2004, Local on Server
'
' COMMENT: The script will add Computer elements for all Computers from the
'          text file created with ExportServers.vbs
'          This script was written by Jesper Hanno Hansen.
'
' VERSION: 1.0
'=========================================================================
' Enabling Error handling
On Error Resume Next

'Set ForReading from OpenAsTextStream Method
Const ForReading = 1

' Create an arguments Object to get the parameters from the input
Dim objArguments
Set objArguments = WScript.Arguments

' Count the input parameters, if less than 1, show help
If objArguments.Count <> 1 Then
   ShowHelp
Else
   ' Set the parameter to the Input File name
   Dim strFileName
   strFileName = WScript.Arguments(0)
End If

' Create a Root Object to ISA Server 2004
Dim objRoot
Set objRoot = CreateObject("FPC.Root")

' Create an FPCArray Object to retrieve the current ISA Array
Dim objFPCArray
Set objFPCArray = objRoot.GetContainingArray
'

 Create an FPCRuleElements Object to get access to FPCComputers
Dim objFPCRuleElements
Set objFPCRuleElements = objFPCArray.RuleElements

' Create an FPCComputers Object to get access to FPCComputer
Dim objFPCComputers
Set objFPCComputers = objFPCRuleElements.Computers

' Calling the Sub to read the file
ReadFromFile strFileName

' Show information that the script is going to save the new computer
' element, and checking for any error.
WScript.Echo "Saving Computer element(s)"
objFPCComputers.Save
CheckError
WScript.Echo "Computer element(s) successfully saved"

Sub ReadFromFile(strFileName)
   ' Create a FileSystem Object
   Dim objFileSystemObject
   Set objFileSystemObject = CreateObject("Scripting.FileSystemObject")

   ' Check if the file exists, if not show error information and quit
   If Not objFileSystemObject.FileExists(strFileName) Then
         WScript.Echo "Could not open the file " & strFileName
         WScript.Quit
   End If

   ' Create a File Object, for reading the file
   Dim objFile
   Set objFile = objFileSystemObject.OpenTextFile(strFileName, ForReading)

   ' Declare strLine
   Dim strLine

   ' Loop through the file context until the end
   Do While objFile.AtEndOfStream <> True
         ' Set strLine to the line
         strLine = objFile.ReadLine

         ' if the line contains | (The separator for Computername,
         ' IPAddress and Description) go on
         If InStr(strLine, "|") Then

               ' Create an Array that contains the line for each |
               arrData = Split(strLine,"|")

               ' Declare the variables
               Dim strDNSName, strIPAddress, strDescription

               ' Set the Array data to the variables
               strDNSName = arrdata(0)
               strIPAddress = arrdata(1)
               strDescription = arrdata(2)

               ' Stop if the IP Address is empty, since this is
               ' a required parameter for adding a computer element
               ' to ISA Server
               If strIPAddress = "" Then
                     ' Show information that this computer could not be
                     ' added
                     WScript.Echo "Could not add the server " & _
                     strDNSName & " because the IP Address is missing..."
               Else
                     ' Show information that we will try to add the
                     ' computer
                     WScript.Echo "Trying to add " & strDNSName & " " & _
                     strIPAddress & " " & strDescription
                     '  Calling the Sub to create a new computer element
                     DoCreateComputer strDNSName, strIPAddress _
                     , strDescription
               End If
         Else
                     ' If the line does not contain a |, skip the line
                     objFile.SkipLine
         End If
   Loop
   ' Close the file
   objFile.Close
End Sub

Sub DoCreateComputer(ComputerName,ComputerIPAddress,ComputerDescription)
   ' Enabling Error handling
   On Error Resume Next

   ' Trying to retrieve the computer from the Computer elements
   ' if it does, the computer element already exists and the script
   ' should not do anything with it.

   Dim objComputerExists
   Set objComputerExists = objFPCComputers.Item(ComputerName)

   ' If the error code is 0 = Success, then there is a computer with the
   ' same name.
   If Err.Number = 0 Then
         WScript.Echo "The Computer Element " & ComputerName & _
         " exist, skipping"
         Exit Sub

   Else
         Err.Clear
   End If

   ' Using the Add method from the FPCComputer object
   ' The Add method requires 2 input parameters
   ' Name and IPAddress as strings
   Dim objFPCComputer
   Set objFPCComputer = objFPCComputers.Add(ComputerName _
   , ComputerIPAddress)
   CheckError

   ' Check if the ComputerDescription is empty, if not we should add
   ' the description to the computer element.
   If ComputerDescription <> "" Then
         objFPCComputer.Description = ComputerDescription
         CheckError
   End If
End Sub

' Used to check if the script is in an error state, if true quit
Sub CheckError
   If Err.Number <> 0 Then
         WScript.Echo ""
         WScript.Echo "Error Number      : " & "0x" & Hex(Err.Number)
         WScript.Echo "Error Description : " & Err.Description
         WScript.Quit
   End If
End Sub

' Used to show help on the screen, if input parameters is less
' than 1
Sub ShowHelp
   WScript.Echo "Please use cscript ImportServers.vbs <Path to ExportedServers.txt>"
   WScript.Echo "For Example:"
   WScript.Echo ""
   WScript.Echo "Cscript ImportServers.vbs C:\ExportedServers.txt"
   WScript.Quit
End Sub


Next Steps

Creating scripts to administer ISA Server 2004 doesn't have to be rocket science because the ISA Server 2004 team has provided an excellent reference in the ISA Server SDK. The best way to improve your skills is to read through the SDK and practice creating scripts in a test environment. Keep in mind that it might take some time to become familiar with this SDK. To see some excellent sample scripts from the ISA Server 2004 team look in the S\Samples\Admin directory on the ISA Server 2004 CD.

You can also find some excellent scripts on the Internet, which you can use as a sample to create your own scripts. To get inspired see http://www.isatools.org, where Jim Harrison frequently posts new scripts.

Tip

For more information on these scripts, see the "Additional Resources" appendix, and http://www.isamvp.org/apc.
Note

For more information on how to script with ISA Server, see http://www.isascripts.org.


Chapter 13: Configuring Arrays Using Centralized Management

As we turn the focus to Microsoft ISA Server 2004 Enterprise Edition, we discuss topics centered on enterprise customers, like arrays, Configuration Storage Server (CSS), Network Load Balancing (NLB), and enterprise policies. In this chapter, we share procedures for centrally managing your arrays, understanding the system policies that provide array communication, and finally, explaining how the policies are stored in Active Directory Application Mode (ADAM) on the CSS.

Working with Arrays and Array Members

Arrays are groups of ISA servers. Each server in the array is known as an array member. Only ISA Server 2004 Enterprise Edition supports the use of arrays. Each array must maintain at least one CSS for storing policies and server information. Because the array information is stored in ADAM on the CSS, you can manage the array from a central location, thereby making changes once that are inherited by all array members.

Prior to creating an array, the following requirements must be met by each array member:

  • The number of network adapters and the names of the networks to which they are connected must be the same.

    Note

    For NLB deployments, best practice is to use a dedicated network adapter for the intra-array address.

  • Application and Web filter configurations must be the same on each computer.

  • In workgroup environments, each array member must have mirrored accounts with the Basic Monitoring role, and the same certificates must be installed.

Creating an Array

Creating an array can be accomplished either during installation or as a postinstallation task. As we discuss in Chapter 14, "Using Enterprise and Array Policies," you have more control over what types of policies can be created at the array level as an array administrator. No longer do array policies only further restrict the policies defined at the enterprise level, as was the case in Microsoft ISA Server 2000. This expanded functionality is evident when creating your array. You specify the Domain Name System (DNS) name of the array, select the enterprise policy to apply, and specify the array policy rule types that are either allowed or disallowed.

To create an array using the ISA Management console, follow these steps:

  1. Open the ISA Server Management console. In the console tree, select Arrays.

  2. In the task pane, under Array Tasks, click Create New Array.

  3. On the Welcome To The New Array Wizard page, type the name for the new array, and then click Next.

  4. On the Array DNS Name page, type the array's DNS name to be used by firewall clients and Web clients when connecting to the array. Click Next to continue.

  5. On the Assign Enterprise Policy page, select an enterprise policy to assign to the array from the drop-down list, and click Next.

  6. On the Array Policy Rule Types page, you can select the Deny Access Rules check box, the Allow Access Rules check box, or Publishing Rules (Deny And Allow) check box to specify what types of rules can be created in the array. Click Next.

  7. On the Completing The New Array Wizard page, review the configuration information, and then click Finish.

  8. After the array is created, click OK. In the details pane, click Apply to complete the change, and then click OK again.

Configuring an Array

An important step after creating the array is to confirm the array properties and complete the configuration.

To configure an array, follow these steps:

  1. In the console tree, select Arrays.

  2. In the details pane, select the array to be configured.

  3. In the task pane, under Array Tasks, click Configure Selected Array.

  4. On the General tab, as shown in Figure 13-1, you see the name of the array, a description, the DNS name of the array, the creation date, and the type of array.

  5. Click the Policy Settings tab shown in Figure 13-2. On this tab you can select from the Enterprise Policy drop-down list the enterprise policy that should be applied to the array. You can also determine what types of access rules can be defined for the array by selecting the respective check boxes:

    • "Deny" Access Rules

    • "Allow" Access Rules

    • Publishing Rules ("Deny" and "Allow")

  6. Click the Configuration Storage tab shown in Figure 13-3. On this tab you define what CSS is used to store the array policy. You can also define an alternate CSS, how often communication occurs, and the type of authentication used by connections made between the ISA server and CSS.

    Note

    For more information on configuring an alternate CSS, see Chapter 3, "Installing and Configuring Microsoft ISA Server 2004 Enterprise Edition."

  7. Click the Intra-Array Credentials tab shown in Figure 13-4. On this tab you define what type of authentication should be used between the array members when performing intra-array communication. The two options are as follows:

    • Authenticate Using The Computer Account Of The Array Member. This is the default selection, although this option is only recommended if all array members belong to an Active Directory domain.

    • Authenticate Using This Account (For Workgroup Configuration Only). This option is recommended only when the array members belong to a workgroup.

  8. Click the Assign Roles tab shown in Figure 13-5. On this tab you define which users and groups can connect to the CSS and monitor the array. Additionally you can add users or mirrored accounts that are allowed to monitor the server array. This is particularly useful when your array members and CSS are not in the same domain or are in a workgroup.

  9. Click OK when you have completed configuring the array.

  10. In the details pane, click Apply to save your changes, and click OK.

Image from book
Figure 13-1: Configure the array name and array DNS name on the General tab.
Image from book
Figure 13-2: Unlike in ISA Server 2000, ISA Server 2004 now provides the capability to "allow" access rules at the array level.
Image from book
Figure 13-3: The CSS stores the array policy information for all array members.
Image from book
Figure 13-4: Choose the appropriate authentication option based on your network configuration— domain members or workgroup mode.
Image from book
Figure 13-5: Assign roles to various users or groups to manage who can connect to the CSS.

Renaming an Array

Renaming an array is a straightforward process. To rename an array, follow these steps:

  1. In the console tree, select Arrays.

  2. In the details pane, right-click the array to be renamed, and select Properties.

  3. On the General tab, type the new name for the array in the Name text box and DNS Name text box, and click OK.

  4. In the details pane, click Apply to save your changes, and then click OK.

Deleting an Array

Proceed cautiously when deleting an array. Before deleting, be sure you are not trying to move the server to another array or uninstall ISA Server from the array member.

To delete an array, complete the following steps:

  1. In the console tree, select Arrays.

  2. In the details pane, select the array you want to delete.

  3. In the task pane, under Array Tasks, click Delete Selected Arrays.

  4. In the Delete Arrays dialog box, click Yes to delete the array, as shown in Figure 13-6.

    Note

    If you are unsure if you want to delete the array, click Help to understand the requirements for doing so.

  5. In the details pane, click Apply to save your changes, and click OK.

Image from book
Figure 13-6: Click Help if you are unsure about deleting the array.

Moving a Server to a Different Array

The method of moving a server to a different array involves repairing your ISA Server installation. Even if the ISA Server installation or the array itself is no longer available, you can simply reinstall ISA Server using the Repair option, and during the repair select New Array To Join. You can also uninstall and reinstall ISA Server, joining the computer to the new array. More information on installing ISA Server is available in Chapter 2, "Installing and Configuring Microsoft ISA Server 2004 Standard Edition," and Chapter 3, "Installing and Configuring Microsoft ISA Server 2004 Enterprise Edition."

Managing an Array

To better manage your array, follow the steps on the Getting Started page that appears in the details pane when you've selected an applicable array under the Arrays node in the console tree, as shown in Figure 13-7. We also provide references below to other chapters in this book that discuss these steps in detail.

Image from book
Figure 13-7: The Getting Started page guides you through the options available for configuring your array.

  1. Configure your networks, as described in Chapter 9, "Configuring Multinetworking."

  2. Create your Firewall Policy rules to allow internal machines to connect externally, or to allow external machines to gain access to selected internal resources, like Web servers. See Chapter 8, "Configuring ISA Firewall Policy," for more information.

  3. Define how you wish ISA Server to cache Web content, as described in Chapter 2.

  4. Set up your virtual private network (VPN) settings as described in Chapter 11, "Securing Virtual Private Network Access."

  5. Once you've implemented your ISA Server, you can use the monitoring functions, covered in Chapter 6, "Monitoring and Reporting."

Array Communication Explained

Array communication is necessary between array members, between array members and the CSS, between CSS, and between managed computers and the array members. The communication is sealed and secured using new protocols introduced in ISA Server 2004. This section explains how array communication works, what system policies exist to ensure communication, and the protocols involved in the communication process. The following illustration shows how array members communicate with the CSS in the enterprise.

Image from book

Array communication occurs over encrypted, authenticated, and sealed (tamperevident) channels using several proprietary protocols. For example, all monitoring communication uses Remote Procedure Calls (RPC).

Policy Rules Used for Array Communication

The system policy contains seven rules by default that assist with array communication, as shown in Table 13-1.

Table 13-1: System Policies Rules Providing Array Level Communication
Rule Name | Rule Number | Purpose | Description
Allow Remote Management From Selected Computers Using MMC | Rule 2 | Managing and monitoring | Allows communication from the Array Servers, Enterprise Remote Management Computers, and Remote Management Computers computer sets to Local Host, using the MS Firewall Control, NetBIOS Data-gram,NetBios Name Service, NetBios Session, and RPC (All Interfaces) protocols.
Allow Remote Management From Selected Computers Using Terminal Server | Rule 3 | Managing and monitoring | Allows communication from the Enterprise Remote Management Computers and Remote Management Computers computer sets to Local Host, using the RDP (Terminal Services) protocol.
Allow ICMP (PING) Requests From Selected Computers To ISA Server | Rule 10 | Managing and monitoring | Allows communication from the Enterprise Remote Management Computers and Remote Management Computers computer sets to Local Host, using Internet Control Message Protocol (ICMP).
Allow Remote Access To Configuration Storage Server | Rule 31 | CSS server communication | Allows access from Local Host to the Enterprise Configuration Storage Server computer set, using the MS Firewall Storage protocol.
Allow Access From Trusted Servers To The Local Configuration Storage Server | Rule 32 | CSS server communication | Allows access to Local Host from the Array Servers, Enterprise Remote Management Computers, Managed ISA Server Computers, Remote Management Computers, and Replicate Configuration Storage Servers computer sets, using Common Internet File Services (CIFS) (TCP and UDP) and MS Firewall Storage protocols.
Allow Replication Between Configuration Storage Servers | Rule 33 | CSS server communication | Allows communication to and from the Replicate Configuration Storage Servers computer set, using MS Firewall Control and RPC protocols.
Allow Intra-Array Communication | Rule 34 | Array member Communication | Allows intra-array communication using MS Firewall Control and RPC protocols to and from the Array Servers computer set.

If you examine the system policy rules closely, you see three protocols that are used for array communication:

  • MS Firewall Control. A Transmission Control Protocol (TCP) protocol used for outbound communication between ISA Server Management and your ISA servers. The protocol is configured for port 3847.

  • MS Firewall Storage. A TCP protocol used for outbound communication between array members and CSSs. The protocol is configured for ports 2171 and 2172.

  • MS Firewall Storage Replication. A TCP protocol used for outbound communication between CSSs. The protocol is configured for port 2173.


Troubleshooting Array Configuration

One common concern in managing arrays is confirming that the array members are in synchronization with each other and that replication is occurring. When you make a change to the array, the array might not function properly until the replication has occurred. This should only be a couple of minutes, but you can check the configuration status of each array member by selecting the Monitoring node of the console tree and clicking the Configuration tab shown in Figure 13-8.

Image from book
Figure 13-8: The Configuration tab is very useful for checking that all array members are in sync.

Specifying a CSS and an Alternate CSS

You can configure the CSS to which the array members will connect and optionally configure an alternate CSS server in your environment to prevent having a single point of failure on your network.

Note

If the CSS fails, then the ISA servers will continue to function based on their cached settings.

To specify the CSS server or alternate CSS server, follow these steps:

  1. Open the ISA Server Management console, and select the Arrays node in the console tree.

  2. In the details pane, right-click the applicable array and select Properties.

  3. Click the Configuration Storage tab.

  4. In the Configuration Storage Server (Enter The FQDN) text box, type the fully qualified domain name (FQDN) of the preferred CSS server.

  5. In the Alternate Configuration Storage Server (Optional) text box, type the FQDN of an alternate CSS server, and click OK.

    Note

    If the ISA Server Management console is unable to resolve the FQDN of the alternate CSS, an error appears.

  6. Click Apply to commit your changes, and then click OK.

For disaster recovery, you may configure a replicate CSS to take over responsibility if the preferred CSS or alternate CSS server is not available. To configure a replica of the CSS, follow the instructions for installing the CSS (as described in Chapter 3), selecting the Create A Replica Of The Enterprise Configuration option, and adding the replica ISA Server computer to the Replicate Configuration Storage Servers computer set. In addition, you can run the ChangeStorageServer.vbs script located in the ISA Server installation folder to configure the replicate CSS to take over responsibility.

Unable to Connect to the CSS

If you don't specify a valid FQDN for the name of the CSS server, you cannot make a connection. This lack of connectivity could be caused by any of the following:

  • Mistyping the name

  • Incorrect DNS entry or HOSTS file entry

  • Incorrect certificate mapping if using a CSS in a workgroup scenario

  • Incorrect Service Principle Name if using a CSS in a domain scenario

To rectify this, start with some basic troubleshooting procedures, like pinging the server name and verifying that the DNS or HOSTS file entries correctly map the CSS computer's Internet Protocol (IP) address to the FQDN.

Note

For more information on troubleshooting common array configuration issues, reference the ISA Server Help file and search for "Troubleshooting Administration."


Chapter 14: Using Enterprise and Array Policies

One of the many reasons Microsoft ISA Server 2004 can easily scale to enterprise size environments is that it can administer and enforce policies centrally. This chapter focuses on the administration and management of enterprise and array policies, which allow you to manage a number of ISA servers from a central console, making the administration of ISA Server easier than ever.

Enterprise and Array Policies Explained

To use enterprise policies and arrays, you must install ISA Server Enterprise Edition. To configure policies, you must have sufficient rights to administer them; normally, you must be a member of the ISA Server Enterprise Administrator group to administer enterprise policies and a member of the ISA Server Array Administrator group to administer array policies. You can create many enterprise policies that are applicable to one or many arrays.

Note

Enterprise and array policies aren't available in ISA Server Standard Edition. For more information about the differences between the versions of ISA Server, see Chapter 1, "Overview of Microsoft ISA Server 2004 Administration."

An array consists of one or several ISA servers that you administer with the same set of policies. An enterprise policy consists of access rules that can be applied to arrays. For a comparison of enterprise and array policies, see Table 14-1.

Table 14-1: Comparing Enterprise and Array Policies
Effective Policy Settings | Enterprise Policy | Array Policy
Applies policies to all arrays in the enterprise | Yes | No
Applies policies to individual members of an array | No | Yes
Can only further restrict an enterprise policy | No | No (this is a major distinction between Microsoft ISA Server 2000 and ISA Server 2004)

Enterprise policies apply to all servers in the targeted array; you can then configure and apply array policies to further augment the ISA Server configuration.

Enterprise and Array Decisions

Enterprise and array policies in ISA Server 2004 work in tandem to provide a client environment that can be effectively controlled and enforced. In ISA Server 2000, the enterprise policy provided the baseline configuration and the array policies only further imposed the restrictions (that is, no allow-based rules, only deny).

You can be as strict or lenient as your business case requires. For example, you could set your enterprise policy to allow outbound File Transfer Protocol (FTP) traffic as a rule applied before the array policy; if your array administrators want to prevent FTP traffic, they could then create a deny rule, which would block access. Alternatively, as an enterprise administrator, you can still control what types of rules can be created by the array administrators. Most administrators choose a hybrid approach in which they create basic restrictions in the enterprise policy—such as restricting access to pornography or gambling sites by denying access to certain Domain Name sets or Uniform Resource Locator (URL) sets—and then allow administrators to further configure settings at the array level.

Configuring Enterprise Policy Settings

There are two categories for applying an enterprise policy at the array level:

  • Enterprise Policy Rules Applied Before Array Firewall Policy This option applies the enterprise policy access rules first before applying any array-level policy rules.

  • Enterprise Policy Rules Applied After Array Firewall Policy This option applies the enterprise policy access rules after applying any pre-array enterprise rules and array-level enterprise rules. By default, all newly created enterprise access rules fall into this category. You can move access rules up or down using a task in the Tasks pane.


Enterprise Policy Administration

This section explains how to perform each of the administrative tasks related to managing an enterprise, focusing special attention on enterprise policies. We start by describing how to create and configure enterprise policies and enterprise access rules. Before we go over the process for deleting policies, we explain how to back up and restore enterprise settings. After a brief discussion of how to administer enterprise-level roles and permissions, you'll learn how to connect to remote ISA Server enterprises or arrays by connecting to configuration storage servers (CSSs).

Note

Remember that you must be a member of the ISA Server Enterprise Administrator group to create and configure enterprise policies. If you are an ISA Server Array Administrator, you can only view enterprise policies.

Creating Enterprise Policies

You'll use enterprise policies when you want to manage all the arrays in your environment from a central location. You can configure access rules through an enterprise policy. To create an enterprise policy, follow these steps:

  1. In the ISA Server Management console tree, expand the Enterprise node, and then select Enterprise Policies.

  2. In the task pane, under Enterprise Policies Tasks, click Create New Enterprise Policy.

  3. On the Welcome To The New Enterprise Policy Wizard page, type a name for the enterprise policy, and click Next.

  4. On the Completing The New Enterprise Policy Wizard page, click Finish.

  5. In the details pane, click Apply to save your changes, and then click OK.

Creating Enterprise Access Rules

After you have created an enterprise policy, you will want to create one or more enterprise access rules. The default enterprise policy named Default Policy cannot be modified, as shown in Figure 14-1.

Image from book
Figure 14-1: The Default Policy and the Default Rule created out of the box cannot be changed.

To create an enterprise access rule for an enterprise policy other than the default policy, complete the following steps:

  1. In the ISA Server Management console tree, expand the Enterprise node, expand Enterprise Policies, and select the policy you want to modify.

  2. In the task pane, under Enterprise Policy Tasks, click Create Enterprise Access Rule.

  3. On the Welcome To The New Access Rule Wizard page, type a name for the rule, and click Next to continue.

  4. On the Rule Action page, select either Allow or Deny to specify whether the action of this rule is to allow or deny access, and click Next.

  5. On the Protocols page, from the This Rule Applies To drop-down list, select one of the following:

    • All Outbound Traffic If you select this option, click Next to continue.

    • Selected Protocols If you select this option, click Add. On the Add Protocols page, select the protocols you wish to add to the access rule, click Add again, and then click Close. Click Next to continue.

    • All Outbound Traffic Except Selected If you select this option, you will complete the same steps as above, but the protocols added will be treated as exceptions when the access rule is processed. Add the necessary protocols, and click Next to continue.

    Tip

    On the Protocols page, you can also select Ports to limit traffic from clients originating within a range of source ports. By default, traffic from any allowed source port is accepted, as shown in Figure 14-2.

  6. On the Access Rule Sources page, click Add. In the Add Network Entities dialog box, select the networks to include in the rule (for example, Local Host), click Add, and then click Close. Click Next to continue.

  7. On the Access Rule Destinations page, click Add. In the Add Network Entities dialog box, click the networks to include in the rule (for example, External), click Add, and then click Close. Click Next to continue.

  8. On the User Sets page, the default setting is for the rule to apply requests from the All Users user set. If you would like to modify the default, you can select All Users, click Remove, and then click Add to include new user sets. Click Add, in the Add Users dialog box select the user set to include in the rule, click Add again, and then click Close. Click Next to continue.

  9. On the Completing The New Access Rule Wizard page, review the summary of information, and then click Finish.

  10. In the details pane, click Apply to save your changes, and then click OK.

Image from book
Figure 14-2: The Ports option gives you granular control over the types of traffic that can originate from source ports. This is a per-rule setting.

Enterprise Administration and Permissions

ISA Server uses role-based administration, which can utilize Active Directory or Windows users and groups. ISA Server Enterprise Edition provides enterprise-level roles and array-level roles. These roles are for enterprise administration:

  • ISA Server Enterprise Administrator Allows unlimited access to the enterprise and array configurations, and includes the capabilities of the ISA Server Enterprise Auditor.

  • ISA Server Enterprise Auditor Allows viewing the enterprise and array configurations only.

The Enterprise Administrator role is the only role with permissions to modify enterprise configurations and policies. The Enterprise Auditor role is used primarily for viewing policies.

Note

See the ISA Server Help file under the section "Enterprise-Level Administrative Roles" for an outline of the permissions each role can perform.

To configure enterprise roles and permissions, follow these steps:

  1. In the ISA Server Management console tree, right-click the Enterprise node and then select Properties.

  2. Click the Assign Roles tab, click Add, type the name of the user or group, and then from the drop-down list, select the role to assign to the specified user or group. Click OK twice to complete the procedure.

  3. In the details pane, click Apply to save your changes, and then click OK.

Note

Users granted permission on the Enterprise node have direct access to the CSS and can monitor all arrays in the enterprise.

To configure enterprise policy permissions, follow the same steps just given, but right-click the applicable enterprise policy to modify the roles.

Note

The Default Policy does not have an Assign Roles tab because it cannot be modified.

Backing Up and Restoring an Enterprise Configuration

Before you make major changes to your enterprise environment, you should back up the enterprise configuration. This backup process saves all enterprise policies, enterprise access rules, array configurations for each array member, certificates, and relationships between arrays and enterprise policies into an .xml file that you can store in a directory of your choosing.

To back up an enterprise configuration, complete the following steps:

  1. In the ISA Server Management console tree, right-click Microsoft Internet Security And Acceleration Server 2004, and then select Export (Back Up).

  2. On the Welcome To The Export Wizard page, click Next to continue.

  3. On the Export Preferences page, there are two check boxes to choose from, as shown in Figure 14-3. To make a complete backup of your enterprise, you should select both check boxes, and click Next to continue.

    • Export Confidential Information Includes user passwords, RADIUS shared secrets, and preshared IPSec keys. The information is encrypted and you have to define a minimum eight-character password before the wizard continues.

    • Export User Permission Settings Includes the role-based permissions you have assigned within the enterprise.

  4. On the Export File Location page, click Browse, select the path where you want the .xml file stored, type a name for the file, click Open, and then click Next.

  5. On the Completing The Export Wizard page, review the summary, and then click Finish.

  6. After the export process has completed, click OK.

Image from book
Figure 14-3: Select both check boxes to ensure that the complete ISA Server configuration is being exported.
Note

You can also use Windows Backup to back up your ISA Server configuration. To do so, back up the ADAM Data folder.

When you are preparing to restore your enterprise configuration, you should confirm that you have access to the password used during the export or backup. You should also be aware that if you are importing the configuration to the same ISA Server computer where the export was run, identical objects will be overwritten. To restore an enterprise configuration, follow these steps:

  1. On the Welcome To The Import Wizard page, click Next to continue.

  2. On the Select The Import File page, click Browse, select the path and .xml file to import, click Open, and then click Next.

  3. In the ISA Server Management console tree, right-click Microsoft Internet Security And Acceleration Server 2004, and then select Import (Restore).

  4. On the Import Action page, select Import to add the information contained in the .xml file to the existing configuration or select Overwrite (Restore) to overwrite all existing configuration information with the information contained in the .xml file. Click Next to continue.

  5. On the Import Preferences page, there are two check boxes to choose from:

    • Import Server-Specific Information Includes cache drives, Secure Sockets Layer (SSL) certificates, and virtual private network (VPN) static address pools. To decrypt, access to the password used during the export is required in the next step.

    • Import User Permission Settings Includes the role-based permissions you have assigned within the enterprise.

  6. To get a complete restore of your enterprise, you should select both check boxes. Click Next to continue.

  7. On the Enter Password page, type the password, and then click Next.

  8. On the Completing The Import Wizard page, review the summary, and then click Finish.

  9. A warning dialog box appears asking you to confirm your decision to overwrite the existing configuration. Click OK as shown in Figure 14-4.

  10. After the import process has completed, click OK.

Image from book
Figure 14-4: Confirm that you want to overwrite the existing configuration before clicking OK.
Note

If you created a backup by using Windows Backup, you should use Windows Backup to restore your ISA Server configuration.

Deleting Enterprise Policies

When you no longer require an enterprise policy, it's best to delete the policy by following these steps:

  1. In the ISA Server Management console tree, expand the Enterprise node, and then select the Enterprise Policies node.

  2. In the details pane, select the enterprise policy you want to delete.

  3. In the task pane, click the Tasks tab. Under Enterprise Policy Tasks, click Delete Selected Enterprise Policy.

    Note

    The Delete option is not available when you have selected the Default Policy.

  4. On the Confirm Delete page, click Yes.

  5. In the details pane, click Apply to save your changes, and click OK.

Connecting to Remote Enterprise and Arrays

The ISA Server Management console gives you the ability to manage any enterprise and array in a network environment by connecting to either local or remote CSSs.

To connect to remote enterprises and arrays, follow these steps:

  1. In the ISA Server Management console tree, right-click Internet Security and Acceleration Server 2004 and then select Connect To Configuration Storage Server.

  2. On the Welcome To The Connection Wizard page, click Next.

  3. On the Configuration Storage Server Location page, specify whether you want to connect to a local CSS or a remote CSS. Click Next.

    Note

    If you choose a remote CSS, as shown in Figure 14-5, you must specify the fully qualified domain name (FQDN) for the server. You should also ensure that the IP address of the remote CSS is in the Remote Management Computers computer set before continuing.

  4. Only if you chose a remote CSS will you see the Configuration Storage Servers Credentials page, shown in Figure 14-6. Specify whether you will use the credentials of the local user or another user for access to the CSS. If you specify another user that is a domain account, you must specify the domain name as well. Click Next.

  5. On the Array Connection Credentials page, specify whether to use the same credentials used to connect to the CSS or different credentials, and then click Next. If you select the same credentials, skip to Step 7.

  6. On the Array Connection Credential Details page, specify whether you will use the credentials of the local user or another user for access to the CSS. If you specify another user that is a domain account, you must specify the domain name as well. Additionally, there is a Check User Credentials check box. Click Next.

  7. On the Completing The Connection Wizard page, review the summary, and click Finish.

  8. If prompted, click OK after the connection has been made to the CSS.

Image from book
Figure 14-5: The IP address of the remote CSS must be in the Remote Management Computers computer set.
Image from book
Figure 14-6: Ensure you have accounts with appropriate credentials or you will have difficulty connecting to a remote CSS.

Settings Contained in the Default Enterprise Policy

The concept of setting the default policy in ISA Server 2000 has been revamped in ISA Server 2004. Out of the box, an enterprise policy named Default Policy is created. The policy contains one rule, named Default Rule, which blocks all traffic from all networks. The Default Policy cannot be modified or removed, nor can access rules be created for it. More information on how ISA Server processes access rules for an enterprise policy and an array policy is discussed in the section entitled, "Rules of Effective Array Policy," later in this chapter.


Array Policy Administration

Administration at the array level varies according to the options you choose for the enterprise policy. An array policy can be used in conjunction with an enterprise policy to further augment the settings imposed on the computers of the array. An array policy manages the way in which both inbound and outbound communication for ISA Server clients works through its ability to create access rules, Web publishing rules, and server publishing rules. If an array policy isn't tied to a user-defined enterprise policy, the array policy rules can allow and deny access based on the needs of the array administrator.

Rules of Effective Array Policy

The method of applying effective array policy in ISA Server 2004 is straightforward and flexible. This method of applying system policy rules, pre-enterprise access rules, array access rules, and post-enterprise access rules, as depicted in Figure 14-7, gives array administrators more control than provided in ISA Server 2000. Because of this, ISA administrators can effectively delegate policy management to the array administrators.

Image from book
Figure 14-7: The flow of effective policies in ISA Server 2004 is much improved.

System policy rules are applied first. Because of this, an array administrator can directly modify the system policy to override a pre-enterprise access rule defined by the enterprise administrator.

Array Administration and Permissions

As discussed in the section entitled, "Enterprise Administration and Permissions," earlier in this chapter, ISA Server 2004 uses role-based administration. The following roles are for array administration:

  • ISA Server Array Monitoring Auditor This role allows for viewing and monitoring of the ISA Server computer, but does not allow for any configuration modifications to monitoring functionality.

  • ISA Server Array Auditor This role allows for viewing of firewall policy, creating reports, session and service management, and includes the capabilities of the ISA Server Array Monitoring Auditor.

  • ISA Server Array Administrator This role can perform any ISA Server task, including firewall policy management, creating reports, and alerts. It also includes the capabilities of the ISA Server Array Monitoring Auditor and the ISA Server Array Auditor.

Note

See the ISA Server Help file under the section "Array-Level Administrative Roles" for an outline of the permissions each role can perform.

To configure array roles and permissions, follow these steps:

  1. In the ISA Server Management console tree, expand the Arrays node, right-click the applicable array policy, and then select Properties.

  2. Click the Assign Roles tab, click Add, type the name of the user or group, and then from the drop-down list, select the role to assign to the specified user or group. Click OK twice to complete.

  3. In the details pane, click Apply to save your changes, and then click OK.

Array Firewall Policy Rule Types

Before you create any array access rules, check the allowed array policy settings configured for the array. The three array policy settings are as follows:

  • "Deny" Access Rules Necessary if the array administrator wants to create access rules denying traffic

  • "Allow" Access Rules Necessary if the array administrator wants to create access rules allowing traffic

  • Publishing Rules ("Deny" Or "Allow") Necessary if the array administrator wants to publish servers (includes both Web and Server publishing)

To check array policy settings, follow these steps:

  1. In the ISA Server Management console tree, select the Arrays node.

  2. In the details pane, right-click the applicable array, and select Properties.

  3. Click the Policy Settings tab. In the Array Firewall Policy Rule Types section, as shown in Figure 14-8, select each check box to give the array administrator granular control over the types of access rules that can be created.

    Note

    By default, all three check boxes are selected, which allows the creation of all access rule types.

  4. Click OK.

Image from book
Figure 14-8: To grant array administrators the ability to create all types of access rules, select all three appropriate check boxes.

If all three of the check boxes are not checked, when you try to create an access rule within the array, you receive an error, as shown in Figure 14-9.

Image from book
Figure 14-9: The ability to create access rules is denied if the policy settings for the array are not configured properly.

Configuring Array Policies

There are a variety of settings that can be configured at the array level. For in-depth information about how to administer individual arrays, see Chapter 13, "Configuring Arrays Using Centralized Management."

Backing Up, Restoring, and Deleting an Array Configuration

Before you make any modifications to an array, you should back it up. If any problems result from your changes, you can then restore the original configuration and avoid the time-consuming processes of diagnosing, fixing, and sometimes even recreating your ISA Server arrays.

The backup or export process for arrays is very similar to the procedures identified in the section entitled, "Backing Up and Restoring an Enterprise Configuration," earlier in this chapter. The difference is that when performing an export or backup, you right-click the applicable array and select Export (Backup). To import, you do the same, except right-click the applicable array and select Import (Restore).


Chapter 15: Working with Enterprise Technologies and Microsoft ISA Server 2004

Overview

If you work in an enterprise (usually defined as a midsized to large company), you'll need to support many clients using a range of different technologies. Don't be thrown off, however, by the term enterprise technology; smaller companies also use such technologies, as is the case with digital certificates, which many small companies employ to secure important company Web sites. The technologies we'll cover in this chapter are Cache Array Routing Protocol (CARP) and Network Load Balancing (NLB).

CARP is a large Internet content cache that is distributed among array members at each site in the organization—Web chaining can connect other arrays to leverage the cache across the enterprise. Network Load Balancing provides redundancy for your Microsoft ISA servers so that, if one is overwhelmed by traffic, or goes down, the others balance the load.

We explain these technologies briefly and then provide steps that outline how to install, configure, and monitor each one.


Cache Array Routing Protocol (CARP)

CARP allows your clients access to a Web cache distributed across multiple ISA servers. For details on how CARP works, see the section "Cache Array Routing Protocol" in the ISA Server 2004 Help documentation. For our purposes, you simply need to know that enabling CARP means you can use the hard disk space available on all the servers in an array to create a single logical (though physically distributed) cache. ISA Server uses CARP to keep track of which servers use what content.

Only ISA Server 2004 Enterprise Edition supports CARP, as ISA Server 2004 Standard Edition doesn't support arrays.

Enabling Caching

CARP is dependent on caching being enabled on at least one member in an array, though for CARP to provide a benefit, you'll need two or more members. To enable caching, you will need to set the cache drive to a value greater than zero by following these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, expand the Arrays node, expand the applicable array, expand Configuration, and then click Cache.

  3. In the details pane, click the Cache Drives tab, and click your ISA server object.

  4. In the task pane, under Cache Drive Tasks, click Define Cache Drives (Enable Caching).

  5. On the Cache Drive tab, in the Maximum Cache Drive (MB) text box, specify a value represented in megabytes, click Set, and then click OK.

  6. Click Apply to save your changes.

  7. In the ISA Server Warning dialog box, shown in Figure 15-1, review your options, click OK, and then click OK after your changes have been incorporated.

Image from book
Figure 15-1: You have the option to apply certain settings immediately by restarting the services, which might affect connected users, or to wait to restart the services at a later time.

Enabling CARP for Web Requests

In Microsoft ISA Server 2000, you could configure ISA Server to process CARP requests for either outgoing or incoming Web requests. This holds true in ISA Server 2004 except that, by default, CARP is not enabled unless you configure caching within an array. Another new distinction is that CARP is now configurable on a per-network basis. The following steps explain how to enable CARP for Web requests:

  1. Open the ISA Server Management console.

  2. In the console tree, expand the Arrays node, expand the applicable array, expand Configuration, and then click Networks.

  3. In the details pane, click the Networks tab, right-click the network on which you would like to enable CARP, and then click Properties.

  4. Click the CARP tab.

  5. Select the Enable CARP On This Network check box as shown in Figure 15-2, and then click OK. Optionally you can add domain name sets within CARP exceptions for those Web sites that require the client IP address to remain the same throughout their session. Configuring CARP exceptions results in CARP remaining enabled for the network, but disabled for specific sites maintained on that network.

  6. Click Apply to save your changes, and then click OK.

Image from book
Figure 15-2: CARP can be configured on a per-network basis in ISA Server 2004 Enterprise Edition.


Configuring and Securing Intra-Array Communication

Intra-array communication is the means by which array members in an NLB deployment communicate.

The Internet Protocol (IP) address assigned to the network adapter on the internal network is also assigned as the intra-array address. If you have more than one ISA server in an array, a dedicated network adapter is required for intra-array communication.

Note

With Windows Server 2003 Service Pack 1, dedicated network adapters are not required for host-to-host communication.

To configure intra-array communication, follow these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, expand the Arrays node, expand the applicable array, expand Configuration, and then click the Servers node.

  3. In the details pane, right-click your ISA server, and then select Properties.

  4. Click the Communication tab.

  5. Under Intra-Array Communication, type the IP address to be assigned for communication between your array members. Click OK.

    Note

    By default, the intra-array IP address is set to the IP address assigned to the array members' network adapter on the internal network.

  6. Click Apply to save your changes, and then click OK.

Configuring the CARP Load Factor

The load factor apprises the ISA Server array members of how much load (that is, how many requests) each member can handle. The default load factor is 100. The value can be configured anywhere between 1 and 2,147,483,647.

To configure the load factor, follow these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, expand the Arrays node, expand the applicable array, expand Configuration, and then click the Servers node.

  3. In the details pane, right-click your ISA server, and then select Properties.

  4. Click the CARP tab.

  5. Specify a value to assign as the load factor for the array member as shown in Figure 15-3, and click OK.

  6. If you changed the default value in Step 4, click Apply to save your changes, and click OK.

Image from book
Figure 15-3: You can change the default load factor of 100 on any array member from the CARP tab.

CARP and Scheduled Content Download Jobs

If you configured a scheduled content download job and CARP is enabled on the Local Host network, CARP distributes its downloaded content across the array for both incoming and outgoing Web requests after the array member has processed. You must disable CARP on the Local Host network if you want to make available scheduled content on all servers in an array (content is duplicated). If CARP is not disabled, it will prevent the content from being duplicated to reduce redundancy.

Note

It is recommended that you enable CARP on the internal network if you have enabled it on the Local Host network so that the ISA server can access the cache from client requests made on the internal network.


Network Load Balancing

Internet connectivity keeps many businesses running. If your company depends on keeping Internet content available to internal or external clients, you'll probably want the redundancy provided by NLB. This technology allows several ISA servers to share a single IP address while maintaining a unique, shared IP address as well. This group of computers is known as a cluster. One important feature of a cluster is that NLB distributes the workload among all participating servers. It also prevents interruption of service by ensuring that, should one server fail, others will seamlessly continue providing service.

Integrated and Nonintegrated Network Load Balancing

ISA Server 2004 offers two modes of NLB:

  • Integrated NLB You use the ISA Management console to configure and manage NLB.

    Integrated NLB is not configured by default. For procedures, see the section " Enabling Network Load Balance Integration " later in this chapter.

  • Nonintegrated NLB You use the Microsoft Windows operating system to configure and manage NLB.

    Note

    You have greater flexibility in configuring NLB if you use the integrated mode offered through ISA Server 2004 Enterprise Edition.

Prerequisites

Before you can install NLB and configure your ISA servers as a cluster, make sure you've met the following prerequisites:

  • Your ISA servers are running Microsoft Windows 2000 Advanced and Datacenter Server or Windows Server 2003, Standard, Enterprise, or Datacenter Edition. Microsoft Windows 2000 Server doesn't support NLB.

  • You've obtained an IP address for the cluster (also known as the cluster IP address) in addition to an IP address assigned to each member of the cluster (known as dedicated IP addresses).

Installing and Configuring Network Load Balancing

Once you've completed the prerequisites for NLB, you'll need to configure the internal network adapters to support your cluster. By default, the Network Load Balancing Service is available, but not enabled, on a Windows 2000 Advanced server. If for some reason the service isn't available, follow these steps to install the service on Windows 2000 Server (the steps to install on Windows Server 2003 are described later in this chapter):

  1. Open Control Panel and double-click Network And Dial-Up Connections.

  2. Right-click the applicable internal network adapter and then click Properties.

  3. Click Install, click Service, and then click Add.

  4. Select Network Load Balancing and then click OK.

    Note

    Remember that if the service isn't available, you're probably running Windows 2000 Server, which doesn't support NLB.

To configure NLB, complete the following steps:

  1. Open Control Panel and double-click Network And Dial-Up Connections.

  2. Right-click the applicable internal network adapter and then click Properties.

  3. Select the Network Load Balancing check box and then click Properties.

  4. On the Cluster Parameters tab, you'll need to provide the information about the cluster shown in Table 15-1.

  5. Click the Host Parameters tab. Provide the information about the host shown in Table 15-2.

  6. Click the Port Rules tab. By default, all TCP or UDP traffic directed to the cluster IP address on ports 0 through 65535 is equally load balanced. You can add, edit, or remove port rules by clicking the appropriate buttons.

  7. Click OK twice and then click Close to complete.

Table 15-1: Configuring the Cluster Parameters Open table as spreadsheet
Cluster Parameters | Explanation
IP Address | This address is the cluster IP address, which must be set identically for all hosts in the cluster. This address is often referred to as the virtual IP address (VIP). This IP address must be configured in the Internet Protocol (TCP/IP) Properties dialog box.
Subnet Mask | This parameter denotes the subnet mask for the cluster IP address.
Full Internet Name | This is the full Internet name that identifies the cluster. This parameter should be the same on all members of the cluster.
Cluster Operation Mode | This parameter specifies whether or not a multicast media access control (MAC) address should be used for cluster operations.
Allow Remote Control | This parameter specifies whether remote control operations are enabled. By default, they're not. If you do enable them, you must also provide a password.
Table 15-2: Configuring the Host Parameters Open table as spreadsheet
Host Parameters | Explanation
Priority (Unique Host Identifier) | Assign a unique priority to each ISA server in the cluster.
IP Address | This IP address is assigned to the internal network interface of the ISA server to individually address each host in the cluster. This IP address must be configured in the Transmission Control Protocol/Internet Protocol (TCP/IP) Properties dialog box.
Subnet Mask | This parameter denotes the subnet mask for the dedicated IP address.
Default State | This parameter controls the starting of NLB and whether the host immediately joins the cluster when the operating system is started.
Retain Suspended State After Computer Restarts | If this is selected, it configures the host to stay in a suspended state if the computer restarts.

To install the Network Load Balancing Service on a Windows Server 2003, Enterprise Edition server, follow these steps:

  1. Open Control Panel, click Network Connections, right-click the applicable internal network adapter, and then click Properties.

  2. Select the Network Load Balancing check box and then click Properties.

    Note

    Remember that NLB isn't available on Windows 2000 Server but it is on Windows 2000 Advanced Server and all versions of Windows Server 2003.

The options to configure NLB on a Windows Server 2003 Enterprise Edition server are identical to the Windows 2000 server steps described previously.

Enabling Network Load Balance Integration

NLB integration mode allows ISA Server to load balance traffic on a per-network basis and is configured using the ISA Server Management console. By default, NLB integration is disabled.

To enable NLB integration, perform the following steps:

  1. Open the ISA Server Management console.

  2. In the console tree, expand the Arrays node, expand the applicable array, expand Configuration, and then click Networks.

  3. In the details pane, click the Networks tab, and select the applicable network to have NLB integration enabled.

  4. In the task pane, under Related Tasks, click Enable Network Load Balancing Integration.

  5. On the Welcome To The Network Load Balancing Integration Wizard page, read about the purpose of the wizard, and click Next.

  6. On the Select Load Balanced Networks page, select the networks you want to use NLB. After selecting the check box for one or more networks, click Set Virtual IP, type the IP address and subnet mask, and click OK. Click Next to continue.

  7. On the Completing The Network Load Balancing Integration Wizard page, review the summary of information, and then click Finish.

  8. In the information dialog box, shown in Figure 15-4, read the purpose of the message and then click OK.

  9. Click Apply to save your changes.

  10. On the ISA Server Warning page, review your options, click OK, and then click OK again after your changes have been incorporated.

Image from book
Figure 15-4: You will be presented with an informative message that is important to follow to properly configure NLB.
Note

When enabling or disabling NLB integration, all array members must be restarted.

Enabling Network Load Balancing for a Network

After NLB integration mode has been enabled, the next step is to enable NLB for a network. Only configure this for networks directly connected to the array. Additionally, the following networks cannot be configured to support NLB:

  • All enterprise-level networks

  • Local Host array-level network

  • Quarantined VPN clients array-level network

  • VPN clients array-level network

To enable NLB for a specific network, follow these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, expand the Arrays node, expand the applicable array, expand Configuration, and then click Networks.

  3. In the details pane, click the Networks tab, right-click the network in which you would like to enable NLB, and select Properties.

  4. Click the NLB tab.

  5. Select the Enable Load Balancing On This Network check box.

Note

You should allow 10 minutes for the change to propagate to the array members configured with NLB.

Additional Configuration for ISA Server and Network Load Balancing

To create the most efficient environment for NLB, be sure you've performed the following actions:

  • Ensure that all SecureNAT clients take advantage of the NLB functionality by setting the default gateway of these clients to the primary (virtual) IP address of the cluster, rather than the dedicated IP address of an individual ISA server.

  • If your server operates with only one network adapter, configure two separate IP addresses. Set the priority of the dedicated IP address to a value lower than that of the primary (virtual) IP address.

  • If your server operates with two network adapters, set the priority of the dedicated IP address to a value lower than that of the primary (virtual) IP address; this configuration sets the priority of the dedicated IP address to be higher than that of the primary IP address.

Note

You can configure the priority of IP addresses by opening your network adapter's properties, selecting the NLB service, and clicking Properties. Click the Host Parameters tab, and set the priority.

Stopping Network Load Balancing

You have options when it comes to stopping NLB on an array member. You can stop the service resulting in all connections to the NLB being dropped, or you can drain and stop the service. Drain-and-stop configures the array member to be removed from the NLB algorithm so that new connections cannot be made. Active connections continue to be serviced until those connections are ended.

To drain and stop the NLB configuration, follow these steps:

  1. Open the ISA Server Management console.

  2. In the console tree, expand the Arrays node, expand the applicable array, and then click Monitoring.

  3. In the details pane, click the Services tab, and click the Network Load Balancing service.

  4. In the task pane, under Services Tasks, click Drain And Stop Selected Service.

  5. In the details pane, you will notice the status of the service change from Configuring to Stopped.

    Note

    If you only want to stop the service, click Stop Selected Service on the task pane.

Server Publishing and Network Load Balancing

When clustering ISA servers, most Web publishing scenarios require that NLB binds only to external network adapters. Server publishing, however, can't support NLB on Windows 2000 Server installations, because server publishing requires NLB to bind to both internal and external network adapters. This creates the potential for traffic sent from published servers to be received by an internal network adapter—the response stalls there.

Tip

If you require NLB and server publishing on Windows 2000, you can either use a hardware-based technology or a software-based solution like Rainfinity's RainWall for ISA Server, which is available at http://www.rainfinity.com/products/rainwall_isa.html.

Windows Server 2003 supports NLB and server publishing through a technology called bidirectional affinity. This feature creates multiple instances of NLB on the server to ensure that the internal and external network adapters send and receive the appropriate traffic.

Using DNS Round Robin

You can also load balance ISA servers by configuring DNS round robin. DNS round robin is just as feasible as NLB, and you can implement it with fewer configurations; however, it's not as efficient as NLB in providing load balancing and fault tolerance. See the Windows Server Help documentation for more information on configuring DNS round robin.


Chapter 16: Configuring Microsoft ISA Server with Microsoft Exchange Server 2003

Overview

One of the primary strengths of Microsoft ISA Server is the ability to securely make Microsoft Exchange servers available to external clients. The procedures in this chapter assume that you already have Microsoft Exchange Server 2003 installed behind Microsoft ISA Server 2004 (Standard Edition or Enterprise Edition), and are using a single-domain environment.

Tip

For more detailed information about any of the steps listed here, as well as some scenarios we do not discuss, see the "ISA Server 2004/ Exchange Server Deployment Kit." This guide provides more than 700 pages of rich details for taking you through the process of configuring most Exchange Server/ISA Server scenarios step by step. You can download the guide from the Exchange Deployment Kit link at http://www.microsoft.com/isaserver/techinfo/guidance/2004/configuration.mspx.

We provide information on how to access Exchange through ISA Server in four ways:

  • Web-based access using Microsoft Outlook Web Access, using forms-based authentication

  • Message application programming interface (MAPI) client access, which allows one to take full advantage of all Microsoft Outlook features, including calendars and new mail notification

  • Secure connectivity for Outlook clients using Remote Procedure Call (RPC) over Secure HTTP (HTTPS)

  • Mail-only access using Post Office Protocol 3 (POP3) or Internet Message Access Protocol 4 (IMAP4) clients


Configuring DNS Resolution

To ensure that your Exchange server will be able to contact external mail servers and vice versa, you must ensure that Domain Name System (DNS) is on your network and can resolve Internet domain names. Use this checklist to verify that resolution is taking place correctly:

  • Assign a public IP address provided by your Internet service provider (ISP), public vendor, or host site to your ISA server's external network adapter.

  • Define your public Mail Exchange (MX) and Host (A) records and map them to the ISA server's external IP address.

  • Verify that your external domain is registered publicly—that is, you can look it up at a site like www.allwhois.com, or perform an Nslookup-type=mx domain command to see the IP addresses registered for your domain.

Note

For detailed steps for configuring a DNS environment for your Exchange and ISA Server environment, see Chapter 4 in the "ISA Server 2004/Exchange Server Deployment Kit," at http://www.microsoft.com/isaserver/techinfo/guidance/2004/configuration.mspx.


Overview of ISA Server 2004 and Exchange Server 2003 Integration

Exchange Server 2003 provides a great range of remote connection and management features. However, there are many attacks and automated scripts in the hands of attackers that attempt to compromise Exchange servers. Outlook Web Access provides an easy-to-configure way to allow your users remote access to their e-mail, but significant security issues can compromise the integrity of your network. When you absolutely need to provide full access for Outlook clients, you must do so in a secure fashion.

This chapter highlights the security issues involved with providing Outlook Web Access or full Outlook client connections over the Internet, and then discusses how ISA Server 2004 can be configured to mitigate these threats. We start with Outlook Web Access as the simplest solution.


Connecting Remote Exchange Clients with Outlook Web Access

Some of your users might be able to get away with using just Outlook Web Access, the great tool that mimics Outlook's interface in a Web browser, in lieu of the traditional Outlook client.

However, there are concerns about Outlook Web Access in regards to security. How might one go about protecting it? Outlook Web Access can use HTTPS—the encrypted, authenticated, and tunneled version of the HTTP protocol—but it lacks any intrusion detection features. More problematically, all versions of Outlook Web Access except 2003 do not include a session timeout feature, so users remain logged into their Outlook Web Access session until they click Logout. Picture the chief financial officer of your company checking his e-mail through Outlook Web Access at an Internet kiosk at the airport. He simply closes the browser when he is finished, but a clever information spy can then reopen the browser after he has walked away, revisit the previous site, and gain access to a very sensitive and important e-mail account. That is certainly a very bad situation, and it has happened before.

To make Outlook Web Access secure, there are four things that you, as an administrator, must configure a firewall to do:

  1. Inspect all Secure Sockets Layer (SSL) traffic at the application layer to make sure the traffic is what it claims to be. This prevents a significant portion of today's attacks.

  2. Maintain wire privacy, as sensitive information is very often transmitted through e-mail.

  3. Enforce the HTTP and HTML standards to make sure that nefarious code doesn't sneak through via weaknesses in these protocols and standards.

  4. Block Uniform Resource Locator (URL)—based attacks by enforcing only known URLs. This protects you against attacks that request unusual actions, have a large number of characters, or are encoded using an alternate character set.

All in all, when you have this quadruple-layered security scenario protecting Outlook Web Access, you can feel reasonably confident that data trusted to its mechanisms is secure.

ISA Server protects your Outlook Web Access front-end server or servers. The ISA server in effect becomes the bastion host, terminating all connections with its Web Proxy feature, decrypting HTTPS to inspect the content of the packets transmitted through the machine, enforcing known-URL access with URLScan, and ultimately reencrypting everything for transmission to the Outlook Web Access server, living safely behind the ISA Server front-line machine.

Publishing Outlook Web Access

To provide your clients access to Exchange Server through a Web interface, follow these instructions:

Obtaining a Certificate for Outlook Web Access

To create a secure Web site, you'll need a certificate, either from an internal certification authority (CA), or from a trusted third party, like VeriSign or Thawte. You'll then need to export it, along with its private key, for importation on the ISA server.

If you have an Enterprise CA set up within your environment, you can request a certificate from it by following these steps:

  1. On your Exchange server, from the Start, Administrative Tools folder, open the Internet Information Services (IIS) Manager.

  2. Navigate to the Web site containing your Exchange Server installation, right-click that site, and select Properties.

  3. Click the Directory Security tab, and then click Server Certificate.

  4. On the Welcome To The Web Server Certificate page, click Next.

  5. On the Server Certificate page, click Create A New Certificate, and then click Next.

  6. On the Delayed Or Immediate request page, select Send The Request Immediately To An Online Certification Authority, and then click Next.

  7. On the Name And Security Settings page, click Next.

  8. On the Organization Information page, enter the name of your company and an organizational unit, if you desire, and then click Next.

  9. On the Your Site's Common Name page, in the Common Name field, type in the public fully qualified domain name (FQDN) of your Exchange server (for example, exchange.contoso.com).

  10. On the Geographic Information page, select your Country/Region, type in your state's full name (for example, Kentucky), and your city name.

    Do not use state abbreviations, like KY, on the Geographic Information page, or your certificate will fail.

  11. On the SSL Port page, leave the default of 443 or type the SSL port you will use, and then click Next.

  12. On the Choose A Certification Authority page, select your CA, and then click Next.

  13. On the Completing The Web Server Certificate Wizard page, click Finish, and then click OK.

    Tip

    See www.verisign.com or www.thawte.com for more information about purchasing trusted third-party certificates.

  14. In Internet Information Services (IIS) Manager, expand the Web site for your Exchange server, and right-click the Exchange virtual directory beneath it, and then select Properties.

  15. Click the Directory Security tab, and then in the Secure Communications area, click Edit.

  16. In the Secure Communications dialog box, select the Require Secure Channel (SSL) check box, and then click OK. Click OK to close the Exchange Properties dialog box.

    Best Practices

    Selecting the Require 128-Bit Encryption check box provides a more secure configuration for Outlook Web Access.

  17. Repeat steps 14 to 16 for the ExchWeb and Public virtual directories.

  18. Click View Certificate.

  19. In the Certificate dialog box, click the Details tab, and then click Copy To File.

  20. On the Welcome To The Certificate Export Wizard page, click Next.

  21. On the Export Private Key page, ensure that Yes, Export The Private Key is selected, and then click Next.

  22. On the Export File Format page, select the Include All Certificates In The Certification Path If Possible check box, and clear the Enable Strong Protection check box. Click Next.

  23. On the Password page, type a strong password. You will need to remember this password to import the certificate on the ISA Server computer. Click Next.

  24. On the File To Export page, type the path and name of the file (for example, c:\ExchCert.pfx), and then click Next.

    Best Practices

    Ensure that your certificate is saved to a secure location, and is removed after you import it to the ISA Server computer.

  25. On the Completing The Certificate Export Wizard page, click Finish.

  26. Click OK, and then close the Internet Information Services (IIS) Manager console.

Creating an Outlook Web Access Publishing Rule

  1. Open the ISA Server Management Console and expand your ISA server or array.

  2. Right-click the Firewall Policy node, and from the New menu, select Mail Server Publishing Rule.

  3. The New Mail Server Publishing Rule Wizard appears. Type a name for the rule, and then click Next.

  4. On the Select Access Type page, select Web Client Access, and then click Next to continue.

  5. On the Select Services page, select Outlook Web Access, and then click Next.

    Tip

    If you have e-mail that contains foreign characters, select the Enable High Bit Characters Used By Non-English Character Sets check box. For example, if you are using a German-language computer and open Outlook Web Access, you cannot create new e-mails. Why? Because Outlook Web Access saves new opened e-mails in the folder called Drafts—in German the folder is called Entwürfe—and the save will fail if you don't select the Enable High Bit Characters check box.

  6. On the Bridging Mode page, select Secure Connection To Clients And Mail Server, and then click Next to continue.

    Note

    Recall that by using bridging, you can force secure communications for all transmissions between the client and the ISA server and the mail server and the ISA server, which is our recommended configuration. Choosing other configurations is an option, but not preferred.

  7. On the Specify The Web Mail Server page, enter the name of the Outlook Web Access site you're securing into the Web Mail Server box, and then click Next.

    Note

    If you're using SSL bridging, use a host name here or else provide name resolution using a HOSTS file entry for the Mail Server on the ISA server itself.

  8. On the Public Name Details page, determine the names that the public will use to connect to this server—the ISA server will accept only names designated here. In the Accept Requests For drop-down list box, select This Domain Name (Type Below) and type the registered DNS name of the Outlook Web Access site in the Public Name text box. Click Next.

    Note

    Your clients will use the Public Name value to connect to Outlook Web Access remotely.

  9. On the Select Web Listener page, click New (or choose an already created listener and skip to Step 13).

  10. On the Welcome To The New Web Listener Wizard page, enter a name for this listener, and then click Next.

  11. The IP Addresses page appears. Select the External option. Click Address.

  12. In the External Network Listener IP Selection box, select the Specified IP Addresses on the ISA Server computer in the selected network option, and then, in the Available IP Addresses list, select the external address on which you want to listen for connection requests. Click OK, and then click Next.

    Note

    You can include other networks if you will use Outlook Web Access from them.

  13. On the Port Specification page, select Enable HTTP and Enable SSL. Click Select, then select the certificate you imported to the ISA server from the Exchange server earlier. Click Next, and then click Finish.

  14. On the Select Web Listener page, click Edit, and then click the Preferences tab. Click Authentication.

  15. Select Basic Authentication, and clear the check boxes for the other authentication methods. Click OK twice. Finally, click Next on the IP Addresses page.

  16. On the User Sets page, select the user sets you want to allow access to, and then click Next.

  17. On the Completing The New Mail Server Publishing Rule Wizard page, click Finish.

  18. Double-click the rule you just created, click the Users tab, and then select the Forward Basic Authentication Credentials (Basic Delegation) check box, and click OK.

  19. Click Apply to commit the changes, and then click OK.

Preauthenticating Connections

ISA Server 2004 also provides another benefit: preauthentication of connections. ISA Server actually hosts the forms that a user is used to seeing, such as the login screen. This screen queries the user for his or her credentials, and once the user enters them into the form, ISA Server verifies them against Active Directory directory service. Note that RADIUS is also supported, so even ISA servers that do not trust or are not members of a domain can do this preauthentication. ISA Server then takes the result of that verification and embeds the credentials into the actual HTTP headers of the packets that it forwards to the front-end Outlook Web Access server, so the user doesn't receive a second prompt. In effect, the ISA server is vetting your users with an actual Outlook Web Access form, ensuring that they are who they say they are, and actually authenticating them at the perimeter of your network before the packets ever hit the Outlook Web Access server. Figure 16-1 shows this process in detail.

Image from book
Figure 16-1: Forms-based authentication with ISA Server 2004 and Outlook Web Access.

To configure forms-based authentication, protecting your Exchange server from any nonauthenticated requests, follow these instructions:

  1. In the ISA Server Management console tree, click Firewall Policy.

  2. In the Tasks pane, click the Toolbox tab, expand Network Objects, expand Web Listeners, right-click the Web listener you are using and then select Properties.

    Note

    If you do not have a Web listener, see Chapter 7, "Configuring Toolbox Elements."

  3. In the Web Listener Properties dialog box (where Web Listener is the name of your Web listener), click the Preferences tab, and then click Authentication.

  4. In the Authentication dialog box, clear the Basic Method check box. Click OK when you receive a warning.

  5. Select the OWA Forms-Based check box, and then click Configure.

  6. In the Idle Session Timeout area, type in the amount of time you want Outlook Web Access to wait before requiring authentication again.

    Best Practices

    For public machines, you might want to choose a very low number, between 2 and 5 minutes.

  7. Select whether you want to block any e-mail attachments.

  8. Select Log Off OWA When The User Leaves OWA Site, unless there are good reasons for not doing so.

  9. Click OK to close the OWA Forms-Based Authentication dialog box, OK to close the Authentication dialog box, and then OK once more to close the Web Listener Properties dialog box.

    Tip

    Remember that you cannot use forms-based authentication and another form of authentication on the same listener, just as you can only have one listener per Internet Protocol (IP) address. Therefore, to publish Outlook Web Access with forms-based authentication and something like Active-Server-Sync, you need more than one external IP address.

  10. Click Apply to commit the changes, and then click OK.

    Planning

    You can perform almost the same steps as those to publish Outlook Web Access to publish Outlook Mobile Access or ActiveSync. You need a unique certificate and Web listener (and therefore a unique IP address) for each method published.


Providing Full-Featured Remote Access for Exchange Clients

Virtual private network (VPN) clients, present in all versions of Windows, are the typical choice for anyone needing to provide full Outlook client functionality to users across the Internet. However, VPN security leaves a lot to be desired, at least out of the box: although Point-to-Point Tunneling Protocol (PPTP) can be made highly secure, doing so requires an extensive knowledge of both the machines running the VPN software (a feat not always possible when you're dealing with your users' home machines) and a deep familiarity with encryption techniques and settings. Of course, there are also logistical hurdles you'll jump through when using a VPN: they simply won't work in some public locations because of firewalls blocking the needed ports. In addition, users encounter difficulties with using IPSec and Layer Two Tunneling Protocol (L2TP) across the Internet because of packet fragmentation issues and other problems. Finally, although VPNs are useful tools for connecting remote clients to corporate networks, they are less useful for connecting from a corporate network to an application service provider that might be running your Exchange servers for you.

The grim reality is that people have grown at best accustomed, and at worst absolutely dependent, on full Outlook client functionality. For example, suppose your corporation has standardized LookOut, the popular Outlook search plug-in, or perhaps you have a third-party calendaring and agenda plug-in. You might also require the ability to synchronize your mailbox with a handheld personal digital assistant (PDA)—like device, or your users might need the functionality provided by Outlook 2003 to work seamlessly offline, with full Outlook functionality even when not connected to an Exchange server. Your front-line customer service users might depend heavily on custom functionality offered by client-side rules, or your organization might require its users to take advantage of a standard, business-wide address book.

Therein lies the problem: How does one provide secure access to an Exchange server for remote users while not making those users jump through hoops to access their groupware application? The best answer to this might be to deploy a machine running ISA Server 2004.

Security Features within Exchange

ISA Server 2004 provides a specially designed Exchange RPC filter, which takes the good parts of the RPC Proxy element that is included with the raw Exchange Server 2003 product to allow RPC-over-HTTP connections, and then marries them to a certain intelligence about how Exchange Server does its business. The Exchange RPC filter is programmed to know how Exchange RPC connections are established and what the proper format for that protocol is. It also allows only Exchange RPC Unique User IDs (UUIDs) to be transmitted, all while enforcing client authentication and requiring encryption.

Here's how it works:

  1. The client connects to the Exchange RPC filter's quasi-port mapper. This piece of the puzzle really isn't a port mapper—it just acts like one, which reduces the attack surface by only responding to requests for Exchange-based RPCs.

  2. Once the connection is established, the ISA server returns the filter's Exchange RPC port numbers. Remember, the client is connecting to the filter, which then uses the RPC element proxy in Exchange Server 2003 itself, so the client never directly touches the Exchange server during this stage.

  3. The client, filled with knowledge about the location of RPC ports, logs onto Exchange Server. During this process, Exchange Server refers the logon to Active Directory, which makes the final decision on whether the user is authenticated or not.

  4. The RPC filter on the ISA server is monitoring this process the whole time, waiting for the approval from Active Directory that the user is valid. Once it sees that approval, the filter makes sure that the connection is using encryption (if you specify that you want to require it), and then the client sees his or her mailbox open.

It is also important to note that the entire process just outlined is transparent from the clients' perspective. They will see a user name and password prompt when they open Outlook and they are away from the corporate network, but once the users enter those credentials, they see an approximately five-second delay and then their mailbox opens. Thus, this solution passes the first litmus test of all security solutions: Make it easy for the user to do things securely.

This solution also protects you from various RPC-based attacks. For example, the ISA RPC filter is immune to reconnaissance attacks and denial-of-service attacks against the RPC port mapper. All known attacks fail, but even if an attack were successfully able to penetrate the RPC filter, recall that Exchange is still protected because ISA Server works at the perimeter to vet your connections before they ever reach your Exchange server. This solution is also highly resistant to service attacks, mainly because such attacks require reconnaissance information that is unavailable. Also, the back end of this RPC filter connection, the ISA Server to Exchange Server part of the transmission, simply dies if the first part of the connection (the client to the ISA server) isn't correctly positioned or formatted.

Publishing Outlook RPC for MAPI Clients

ISA Server 2004 provides Outlook clients behind an ISA server the ability to access external Exchange servers through the use of outbound RPC access. This option creates a more flexible environment to allow mail access across campuses through the Internet, without the configuration of dedicated VPN connections or tunnels.

Caution

This configuration is supported for Exchange 2000 and Exchange Server 2003 and Outlook 2000, Outlook XP, and Outlook 2003, and provides the safest method to access Exchange Server, as it takes advantage of the ISA Server RPC filter. If you have Exchange Server 2003 and Outlook 2003 clients, you can use the RPC over HTTP publishing option described later, as well—just be aware that the method does not use the RPC filter.

To publish Outlook RPC for MAPI clients, follow these instructions:

  1. In the ISA Server Management console, click the Firewall Policy node.

  2. On the Task pane, click the Tasks tab, then click Publish A Mail Server.

  3. On the Welcome To The New Mail Server Publishing Rule Wizard page, type the name of the rule (such as Outlook RPC), and then click Next.

  4. On the Select Access Type page, select Client Access: RPC, IMAP, POP3, SMTP, and then click Next.

  5. On the Select Services page, select Outlook (RPC) and click Next.

  6. On the Select Server page, type in the IP address of your Exchange server, and then click Next.

  7. On the IP Addresses page, select the networks from which you will allow RPC over HTTP access (normally External and VPN Clients), and then click Next.

  8. On the Completing The New Mail Server Publishing Rule Wizard page, click Finish.

  9. Click Apply to commit the changes, and then click OK.

Configuring the Remote Client for RPC

Your clients will most likely be laptop users who connect both from within your network and from external locations. For client access to work, you must have a name resolution infrastructure that allows clients to resolve the name of the Exchange server both internally and externally. You must then configure the Outlook client to connect to the Exchange server.

Creating a Split DNS To set up name resolution, you can configure a split DNS. To create a split DNS, you create a structure like that shown in Figure 16-2.

Image from book
Figure 16-2: A split DNS ensures that clients can always resolve the IP address for mail regardless of their location—when inside the network, they use the internal Exchange server IP address; when outside, they use the IP address for the ISA server's external network adapter.
Note

Another option is to update the HOSTS file on your Outlook clients. This solution is not recommended, as managing the HOSTS file on many clients is time-consuming, unreliable, and sometimes can result in unintended consequences.

To connect from a remote client, configure Outlook using the following procedures.

Enabling Client Authentication By default, external clients aren't able to authenticate directly with a domain controller on the internal network. You must configure the Exchange server to act as a proxy for these clients. To configure the Exchange server as a proxy for the Outlook client, complete the following steps:

  1. On the Exchange server, click Start and then click Run.

  2. Type regedit and then click OK.

  3. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeSA\Parameters key.

  4. Right-click the Parameters key.

  5. Select New and then choose DWORD Value.

  6. Type No RFR Service.

  7. Double-click the new value, and set Value Data to 1. Click OK.

Configuring the Outlook Client Create a new profile on the Outlook client by performing the following procedures.

Configuring Outlook 2002 and Outlook 2003 Clients

  1. Start the Mail program in Control Panel. You will see the Mail Setup – Outlook dialog box.

  2. Click Show Profiles.

  3. If a profile does not exist, follow these steps:

    1. Click Add, and then enter a name for the profile.

    2. Select Add A New E-Mail Account, and then click Next.

    3. Select Microsoft Exchange Server, and then click Next.

    4. Type the name of the Microsoft Exchange server and the user name of your mailbox. When prompted, enter your password.

    5. Click Next, and then click Finish.

  4. If a profile already exists, select the profile for your Exchange server, and then click Properties.

  5. Click E-Mail Accounts.

  6. Select View Or Change Existing E-Mail Accounts, and then click Next.

  7. Choose the e-mail account for your Exchange server, and then click Change.

  8. On the General tab, verify that the Exchange server can resolve the name of your mailbox by retyping your mailbox name, and then clicking Check Name.

  9. If you cannot connect, create an entry in the local HOSTS file that maps the external IP address for the Exchange server address to its NetBIOS name.

  10. Click More Settings.

  11. Click the Advanced tab. Select Encrypt Information Both When Using The Network And When Using Dial-Up Networking.

  12. Click OK to close the Microsoft Exchange Server dialog box, and return to the E-Mail Accounts dialog box.

  13. Click Next, and then click Finish.

  14. Click Close in the Mail Setup dialog box, and then click OK to close the Mail dialog box.

Publishing RPC over HTTP for Outlook Clients

RPC over HTTP allows RPC requests to be encapsulated in the HTTP protocol, for which most firewalls are already configured and allow access. RPC over HTTP depends on an optional element of Windows Server 2003 called the RPC proxy, an Internet Server Application Programming Interface (ISAPI) extension running in Microsoft Internet Information Services (IIS) on a front-end Outlook Web Access server that sets up an RPC session after authentication. Essentially, the Outlook client connects to this filter using RPC over HTTP, and the filter terminates the "over HTTP" portion of the connection, takes out the RPC requests, and passes them back to the Exchange server.

However, RPC over HTTP isn't a panacea. It supports only basic HTTP authentication, so make certain the HTTP connection uses SSL. Also, there is no support for SecurID, and the limitation here is twofold. For one, there is no dialog within Outlook 2003 to ask for the SecurID PIN from the user's device. Second, Exchange has no built-in, direct ability to proxy authentication requests to an RSA ACE server and not to Active Directory. RADIUS authentication is also not possible with RPC over HTTP, nor is the use of client certificates in most cases. So, although RPC over HTTP solves some configuration problems and some legitimate security problems, there remain other issues to address.

In the following section you learn to configure the front-end Exchange server as an RPC proxy server, create an RPC over HTTP publishing rule, and then configure the Outlook remote client.

Configuring the Exchange Server

Install the RPC Proxy service and set up Exchange as a back-end RPC server by following these steps:

  1. On the Exchange server, install the RPC Over HTTP Proxy component from the Add Or Remove Programs, Add/Remove Windows Components, Networking Services interface.

  2. On the Exchange server, configure the RPC virtual directory to use basic authentication and require SSL by following these steps:

    1. In the Internet Information Services Manager, expand the Web site hosting Exchange, right-click the RPC virtual directory, and then select Properties.

    2. Click the Directory Security tab, and then in the Authentication And Access Control area, click Edit.

    3. In the Authentication Methods dialog box, select Basic Authentication, clear all other options (including Enable Anonymous Access), click Yes to acknowledge the warning, and then click OK.

    4. On the Directory Security tab, in the Secure Communications area, click Edit.

    5. Select the Require Secure Channel (SSL) check box, and then click OK.

    6. In the RPC Properties dialog box, click OK, and then close the Internet Information Services Manager.

    Note

    You need to request and install a certificate from a third-party or internal CA to provide SSL encryption for the Exchange server. Once the certificate is installed on the Exchange server, export it, along with the private key, and import it into the ISA server.

  3. On the Exchange server, open the System Manager by clicking Start, All Programs, Microsoft Exchange, System Manager.

  4. In Exchange System Manager, click Servers, right-click your Exchange server, and then select Properties.

  5. In the Properties dialog box for your Exchange server, click the RPC-HTTP tab, and then select RPC-HTTP Back-End Server.

    Note

    When using Exchange Server 2003 Service Pack 1 or higher, no manual port configuration is necessary (as described in Step 7). The order is important when using back-and front-end servers, but you must simply enable it, and nothing else.

  6. When prompted with a warning, click OK twice, and close Exchange System Manager.

  7. Configure the RPC Proxy port settings by using the RPC Configuration tool (RpcCfg.exe) from the Windows resource kit. To use RpcCfg.exe, follow these steps:

    1. Open a Resource Kit Tools command shell by clicking Start, clicking All Programs, then Windows Resource Kit Tools, and then Command Shell.

    2. At the command prompt, to clear the default RPC ports, type

      rpccfg.exe /hr ExchangeServer

      where ExchangeServer is the name of your Exchange server.

    3. To set the Exchange RPC ports, type the following commands, pressing the Enter key where you see <Enter>:

      rpccfg.exe /ha ExchangeServer 6001-6002 6004 <Enter>
rpccfg.exe /ha ExchangeServer.DomainName.com 6001-6002 6004
<Enter>
rpccfg.exe /hd <Enter>

    4. Type exit to close the command prompt.

    Note

    You can download the RpcCfg.exe tool from http://www.microsoft.com/downloads/details.aspx?FamilyID=&displaylang=en.

  8. Ensure that you schedule and inform your clients of any downtime that results from the reboot of the server, and then restart the Exchange server.

You have now completed configuring the Exchange server.

Creating an RPC over HTTP Publishing Rule

Next, on the ISA server, you create a Web publishing rule by performing these steps:

  1. In the ISA Server Management console tree, click the Firewall Policy node.

  2. In the Tasks pane, click the Publish A Secure Web Server link.

  3. On the New SSL Web Publishing Rule Wizard page, type the name of the rule (such as RPC Over HTTP Publishing rule), and then click Next.

  4. On the Publishing Mode page, select the SSL Bridging option, and then click Next.

  5. On the Select Rule Action page, select Allow, and then click Next.

  6. On the Bridging Mode page, select Secure Connection To Clients And Web Server, and then click Next.

    Best Practices

    You could select other options here, but maintaining HTTPS provides the best protection for your data.

  7. On the Define Website To Publish page shown in Figure 16-3, type the computer name or IP address of the Exchange server, select the Forward The Original Host Header check box, and type /rpc/* in the Path text box. Click Next.

  8. On the Public Name Details page, in the Accept Requests For drop-down list, select This Domain Name (Type Below), and then type the FQDN for your Web site, such as SecureExchange.Contoso.com. Type /rpc/* in the Path text box, and then click Next.

    Note

    This FQDN must be publicly registered.

  9. On the Select Web Listener page, select your Web listener for HTTPS, or create one (as described in the section entitled, "Creating an Outlook Web Access Publishing Rule," earlier in this chapter), and then click Next.

  10. On the User Sets page, click Add to add users to whom the rule should apply, and then click Next.

  11. On the Completing The New SSL Web Publishing Rule Wizard page, click Finish.

  12. In the Details pane, right-click the rule you just created, and then select Properties.

  13. Click the Users tab, select the Forward Basic Authentication Credentials (Basic Delegation) check box, and then click OK.

    Important

    To use Basic Authentication, you must use SSL to ensure that your credentials are encrypted. Basic Authentication sends information in clear text, which can be intercepted by network sniffers.

  14. Click Apply, and then click OK.

Image from book
Figure 16-3: Configure the RPC over HTTP publication rule to point to the Exchange server's RPC path.

Configuring the Remote Client for RPC over HTTP

To allow remote clients to connect to the Exchange server, configure the properties of the Outlook 2003 clients by following these steps:

  1. Launch the Mail program in Control Panel. You will see the Mail Setup – Outlook dialog box.

  2. Click Show Profiles.

  3. If a profile does not exist, follow these steps:

    1. Click Add, and then enter a name for the profile.

    2. Select Add A New E-Mail Account, and then click Next.

    3. Select Microsoft Exchange Server, and then click Next.

    4. Type the name of the Microsoft Exchange server and the user name of your mailbox. When prompted, enter your password.

    5. Click Next, and then click Finish.

  4. If a profile already exists, select the profile for your Exchange server, and click Properties.

  5. Click E-Mail Accounts.

  6. Select View Or Change Existing E-Mail Accounts, and then click Next.

  7. Choose the e-mail account for your Exchange server, and then click Change.

  8. On the General tab, verify that the Exchange server can resolve the name of your mailbox by retyping your mailbox name, and then clicking Check Name.

  9. If you cannot connect, create an entry in the local HOSTS file that maps the external IP address for the Exchange server address to its NetBIOS name.

  10. Click More Settings.

  11. Click the Connections tab, select the Connect To My Exchange Mailbox Using HTTP check box, and then click Exchange Proxy Settings.

  12. In the Exchange Proxy Setting dialog box, complete the information as shown in Figure 16-4, replacing the SecureExchange.contoso.com options with the FQDN to the public name of your Exchange server, listening on port 443. Click OK.

  13. Click OK to close the Microsoft Exchange Server dialog box, and return to the E-Mail Accounts dialog box.

  14. Click Next, and then click Finish.

  15. In the Mail Setup dialog box, click Close, and then click OK to close the Mail dialog box.

Image from book
Figure 16-4: Configure the RPC Proxy settings for Outlook to connect to your Exchange server.


Publishing Basic Mail: SMTP, POP3, and IMAP4

To provide basic Simple Mail Transfer Protocol (SMTP), POP3, and IMAP4 access to remote clients, create a publishing rule for your Exchange server, and create an access rule that allows SMTP traffic to travel from the internal network to the external network.

To create an Exchange publishing rule, follow these steps:

  1. In the ISA Server Management console tree, expand your ISA Server node, and then click Firewall Policy.

  2. In the Tasks pane, on the Tasks tab, click Publish A Mail Server.

  3. On the Welcome To The New Mail Server Publishing Wizard page, type in the rule name (such as Mail Server Publishing Rule), and then click Next.

  4. On the Select Access Type page, select Server-To-Server Communication: SMTP, NNTP, and then click Next.

  5. On the Select Services page, select the protocols you want to publish. SMTP will be necessary to send mail, and POP3 mail might be necessary if your clients use external POP3 accounts. If you want to publish a news server, you can also select NNTP.

  6. On the Select Server page, type in the IP address of your Exchange server, and then click Next.

  7. On the IP Addresses page, select the networks on which you want to publish the Exchange server. Most often you will select External and VPN Clients. Click Next.

  8. On the Completing The New Mail Server Publishing Rule Wizard page, click Finish.

To create an SMTP traffic access rule, follow these steps:

  1. On the Tasks tab, click Create New Access Rule.

  2. On the Welcome To the New Access Rule Wizard page, type in the name of your access rule (like SMTP to External).

  3. On the Rule Action page, select Allow, and then click Next.

  4. On the Protocols page, in the This Rule Applies To drop-down list box, select Selected Protocols and then click Add.

  5. In the Add Protocols dialog box, expand the Mail container, select SMTP, POP3, or NNTP (depending on what you want to publish), click Add, and then click Close. On the Protocols page, click Next.

  6. On the Access Rule Sources page, click Add to open the Add Network Entities dialog box. Expand the Networks container, select Internal, click Add, and then click Close. Click Next.

    Tip

    If you want to limit the computers that can send mail using port 25, create a computer set with only the Exchange server and those other clients that have a specific need. Replace the internal network described earlier with the computer set you created.

  7. On the Access Rule Destinations page, click Add to open the Add Network Entities dialog box. Expand the Networks container, select External, click Add, and then click Close. Click Next.

  8. On the User Sets page, select the users that will have rights to send SMTP. Typically, you will choose Domain Users. Click Next.

  9. On the Completing The New Access Rule Wizard page, click Finish.

  10. Click Apply, and then click OK to commit the changes.

Tip

You can control SMTP traffic on your network by using the SMTP Message Screener, which can filter SMTP traffic based on your criteria, and then delete, hold, or forward messages. For more information on how to configure the SMTP Message Screener, see the ISA Server Help file.


Chapter 17: Configuring Microsoft ISA Server with Microsoft Sharepoint Portal Server 2003

Overview

Publishing Microsoft SharePoint Portal Server 2003 and Microsoft Windows SharePoint Services involves unique challenges. These challenges include items such as configuring appropriate link translations to internal servers, managing security, and understanding authentication scenarios. In this chapter, we address these issues and list options for dealing with them in multiple environments. We address these issues by

  • Identifying key features of SharePoint Portal Server 2003

  • Identifying key features of Windows SharePoint Services

  • Publishing Windows SharePoint Services

  • Publishing SharePoint Portal Server 2003 using various Microsoft ISA Server 004 configurations

  • Configuring SharePoint Portal Server 2003 to work with ISA Server 2004


SharePoint Portal Server 2003 and Windows SharePoint Services Overview

Key SharePoint Portal Server 2003 Features

SharePoint Portal Server 2003 provides an infrastructure that enables organizations to efficiently share knowledge and information. It allows users to quickly access needed information and collaborate with other users. Microsoft designed Share-Point Portal Server 2003 to accomplish three separate goals: personalization, integration, and collaboration. The key features of SharePoint Portal Server 2003 include the following:

  • Team sites Windows SharePoint Services team sites can be integrated and connected using SharePoint Portal Server 2003. This integration includes the ability to index and categorize team sites. In addition, team sites can contain components that allow integration and searching capabilities from within SharePoint Portal Server 2003.

  • Active Directory integration SharePoint Portal Server 2003 integrates with Active Directory directory service to provide consistent access to profile information from within SharePoint Portal Server 2003. Users can manage this profile information as needed from within Portal Server.

  • Group-based security Groups can be used to control access to information within Portal Server. This can be configured to limit access to information based on group membership or role.

  • Topic hierarchy Topics can be organized into hierarchies that allow for grouping of topics by subject, area of responsibility, or other means that are useful to an organization.

  • Advanced search capabilities These capabilities include the ability to crawl documents across an organization and intelligently index that information based on content. This also includes the ability to index documents such as Microsoft Office documents or any document for which there is an appropriate content filter. Word breakers also enable indexing that relates similar words and terms and returns all results that apply to a specific query.

Key Windows SharePoint Services Features

Windows SharePoint Services provides the base functionality on which SharePoint Portal Services builds. The basic Windows SharePoint Services sites utilized by teams to collaborate are connected using SharePoint Portal Server 2003. Some of the main functions provided by Windows SharePoint Services sites include the following:

  • Microsoft Office System Integration Windows SharePoint Services is integrated with Microsoft Office System 2003. This integration includes the ability to share and save documents into SharePoint sites from within Office applications. Other integration aspects include integration with Outlook and Windows Instant Messenger. For instance, a document that is being opened from a SharePoint site shows tasks associated with that document and also gives presence information for other users of the site using Instant Messenger information.

  • Check-in and check-out Documents can be checked out for revisions, allowing multiple revisions of documents to be integrated together.

  • Document versions Document changes are tracked through document versions that can be retrieved as needed.

  • Customization Sites can be customized based on the user's preferences and needs.

  • Alerts Modifications to a site or to a document within a site can be sent to users.

  • Web parts Additional Web parts can be used to extend the basic functionality of Windows SharePoint Services sites.

How ISA Server Improves SharePoint Portal Server and Windows SharePoint Services Access

ISA Server 2004 and SharePoint Portal Server work together to provide a secure portal for organizational information. ISA Server 2004 provides intelligent publishing for SharePoint Portal sites and Windows SharePoint Services sites. ISA Server 2004 can inspect requests made to SharePoint sites to determine if there is any unusual or harmful content in the Uniform Resource Locator (URL). ISA Server 2004 can also authenticate users or pass authentication requests directly through to the SharePoint server. In addition, ISA Server 2004 provides link translation to deal with absolute URL references within SharePoint.


Publishing Windows SharePoint Services

Windows SharePoint Services allow companies to make file sharing and collaboration easier by allowing users to access critical company information anywhere. ISA Server can make these sites available on the Internet while maintaining the security and privacy of the internal network. You can take advantage of the Web publishing rules, access rules, and content caching to maintain the level of security required for the data being accessed.

Because SharePoint Portal Server 2003 is built on Windows SharePoint Services technology, we start by describing how to publish Windows SharePoint Services sites.

Publishing a Windows SharePoint Services site is similar to publishing a standard Web site. However, there are differences that make the Windows SharePoint Services site function properly when accessed using an external URL. Windows SharePoint Services uses absolute URLs within a site and these URLs will cause problems with some content on the site when accessed by a computer not on the corporate network. We use link translation on the Web publishing rule for the Windows SharePoint Services site to allow the external name of the site to work properly. Link translation and absolute URLs are explained in more detail in the next section.

In the following scenario, you configure ISA Server to publish the Windows SharePoint Services site. Because the scenario is very similar to a standard Web publishing rule, we only go into detail on the parts that are different. Creating a Web publishing rule is outlined in Chapter 8, "Configuring ISA Firewall Policy."

Note

For a more detailed walkthrough of how to set up Windows SharePoint Services publishing with ISA Server, see the Microsoft TechNet article, "Publishing Windows SharePoint Services with Microsoft Internet Security and Acceleration (ISA) Server 2004," at http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/isawss.mspx.

Allow Windows SharePoint Services to Connect to the Internet

To allow Windows SharePoint Services to connect to the Internet, complete the following steps:

  1. Create a computer set that contains the IP address range of your Windows SharePoint Services servers.

    For step-by-step procedures on creating a computer set, see Chapter 7, "Configuring Toolbox Elements."

  2. Create an access rule that allows the Windows SharePoint Services computer set to have access to All Networks.

    Note

    For step-by-step procedures on creating an access rule, see Chapter 8.

  3. Modify the Web.Config file. Web.Config must be modified as shown in the section entitled, "Modifying Web.Config File For Outbound Internet Access," later in this chapter.

Defining the Web Listener

The next step in publishing Windows SharePoint Services is to create a Web listener. To do so, follow these steps:

  1. Create the Web listener for the Windows SharePoint Services site.

  2. On the IP Addresses page, select the External check box to listen for requests from the Internet.

    Note

    For step-by-step procedures on creating a Web listener, see Chapter 7.

Creating the Web Publishing Rule

Creating and configuring the Web publishing rule is one of the last actions you should take. To do so, follow these steps:

  1. Create the Web publishing rule as described in Chapter 8.

  2. On the Define Website To Publish page, shown in Figure 17-1, type the internal name of the Windows SharePoint Services server and type the path to define the folder to publish. Click Next.

  3. On the Public Name Details page, type the computer name or IP address reachable on the Internet, as shown in Figure 17-2. Click Next.

  4. On the Select Web Listener page, select the Web listener you created in the section, "Defining the Web Listener," earlier in this chapter. Click Next.

  5. On the User Sets page, click Next.

  6. On the Completing The New Web Publishing Rule Wizard page, click Finish.

  7. In the details pane, right-click the new Web publishing rule and select Configure HTTP.

  8. On the General tab, under URL Protection, clear the Verify Normalization check box, as shown in Figure 17-3. Click OK.

    Important

    If you do not turn off normalization, ISA Server will block certain types of escape characters and this prevents the SharePoint document libraries from working properly.

  9. In the details pane, right-click the new Web Publishing rule, select Properties, and click the Link Translation tab.

  10. Add three dictionary entries for link translations, as shown in Figure 17-4, by selecting the Replace Absolute Links In Web Pages check box, clicking Add, and then typing in the following information in the Replace This Text and With This Text fields:

    • For the inside-name, use the name used to access the server on the internal network.

    • For the inside-ip, use the IP address used for the internal Windows Share-Point Services site.

    • For the outside-name, use the external Domain Name System (DNS) name used to access the Windows SharePoint Services site.

  11. Click OK.

  12. In the details pane, click Apply to save the changes, and then click OK.

Image from book
Figure 17-1: You should define the internal name when publishing the SharePoint site.
Image from book
Figure 17-2: This screen shot shows the publicly accessible name for the SharePoint site.
Image from book
Figure 17-3: Ensure the Verify Normalization check box is cleared.
Image from book
Figure 17-4: You should configure link translation in the Web Publishing Rule Properties dialog box.

Modifying the Web.Config File for Outbound Internet Access

Some Web parts on a Windows SharePoint Services site will make outbound Internet connections. If the firewall policy on ISA Server does not allow outbound port 80 access using Secure NAT, then the Windows SharePoint Services server has to be configured to use the proxy engine on the ISA Server. This requires modification of the SharePoint Services Web.config file, which is the central location for your Web application configuration. The Web.config file is stored in the root of the virtual server that has been extended with Windows SharePoint Services by default, for example, %SystemDrive%\Inetpub\Wwwroot.

To modify the Web.config file, complete the following steps:

  1. Browse to the %SystemDrive%\Inetpub\Wwwroot folder and open the eb.config file with Notepad.

  2. Locate the </Sharepoint> tag in the file. Immediately after the tag, insert the following code snippet:

    WEB.CONFIG
<system.net>
<defaultProxy>
<proxy proxyaddress="http://ISASERVER:8080" bypassonlocal="true" />
</defaultProxy>
</system.net>

  3. Change ISASERVER to the name or IP address of your ISA server, specify the port number, save the Web.config file, and close Notepad.


Publishing SharePoint Portal Server

There are several conditions you should evaluate before publishing your SharePoint Portal Server to the Internet: determining how to configure the appropriate network services, such as DNS, choosing an authentication mechanism for external users, configuring link translation, and deciding on Secure Sockets Layer (SSL) tunneling versus SSL bridging. The following sections define each of these issues and provide appropriate guidelines.

Network Services

Name resolution is one of the first conditions to consider when publishing a SharePoint Portal or Windows SharePoint Services site. Just as with other Web publishing scenarios, it is important to have a consistent split DNS infrastructure that allows both internal and external users to access the site in the most efficient way. In other words, internal users should resolve the sites with internal IP addresses and external users should resolve the sites with external IP addresses.

Warning

Avoid configuring the network in such a way that forces internal users to access internal sites through the ISA Server 2004 firewall unless you have a specific and definite need.

Creating a split DNS infrastructure, as shown in Figure 17-5, resolves this problem by supplying different addresses for internal and external users. This allows external users to get the correct external address and prevents internal users from accessing the SharePoint site using the external address.

Image from book
Figure 17-5: This illustration shows an example of a split DNS configuration where internal and external DNS servers provide different addresses for the same DNS zone.
Tip

For more information on split DNS, see the article, "You Need to Create a Split DNS!" at http://www.isaserver.org/tutorials/You_Need_to_Create_a_Split_DNS.html.

Authentication

When publishing SharePoint Portal Server 2003 by requiring users to log on, it is best to use basic authentication because it will work with most Web browsers and will pass through most firewalls. In addition, ISA Server provides a great feature called basic delegation, which makes it possible to authenticate users at the ISA Server level and then have those credentials forwarded to the Web server for any authentication request. If the Web site requires several authentication requests, the ISA server provides the subsequent credentials to the Web site and the user is not bothered with logging on again. Basic delegation also works with SSL bridging because the SSL tunnel is terminated at the ISA server.

Important

Because credentials are passed in clear text when using basic authentication, be sure to also use SSL encryption to protect the authentication information.

Link Translation

Internal clients, of course, access Web sites by referencing the Web server's host name or NetBIOS name. This resolution is often an issue for external clients accessing published SharePoint sites. When referencing items such as document libraries or other information within the SharePoint site, SharePoint uses the local server name or even the server IP address in the URL. Obviously, these references do not work properly from the Internet because the internal machine name and internal addresses are not accessible through the ISA Server 2004 server. In addition, exposing this information over the Internet can create a security issue by allowing internal naming and addressing information to pass to the Internet.

ISA Server 2004 provides the link translation feature that reads and changes references to internal server names and IP addresses to appropriate links for Internet access. This is demonstrated in Figure 17-6.

Image from book
Figure 17-6: Link translation modifies references to internal server names and addresses to externally accessible names.
Note

SharePoint sites are unique in that they tend to require long URLs for query and site requests. SharePoint also requires ASP.NET and HTTP1.1 WebDAV. This is important to take into account when setting up publishing rules and restricting content.

Publishing SharePoint Portal ServerPublishing SPS with ISA Server 2004

We said before that SharePoint Portal Server 2003 is built on top of Windows SharePoint Services. Because of this, SharePoint Portal Server 2003 Web sites have many of the same benefits as Windows SharePoint Services sites, and many of the same publishing steps are required.

This book does not go into detail about the feature differences in SharePoint Portal Server and Windows SharePoint Services; if you would like further information on this, please see the following Microsoft Web page: http://www.microsoft.com/sharepoint/evaluationoverview.asp.

This section explains the steps required to publish SharePoint Portal Server 2003. We discuss the configuration of publishing a SharePoint Portal Server 2003 site using SSL bridging. This is the deployment model for SharePoint Portal Server 2003 sites that require secure publishing because link translation is not supported in SSL tunneling.

Note

The following scenario about setting up a SharePoint Portal Server 003 site using SSL bridging covers each step at an elevated level. If you require a more in-depth explanation, please reference the Microsoft white paper, "SharePoint Portal Server 2003 Document: Deploying on an Extranet by Using ISA Server 2000 and ISA Server 2004," at http://www.microsoft.com/downloads/details.aspx?FamilyId=4C5BF9DD-3EFB-451DB213-8ED039190BF.

This scenario assumes that the following items are already in place:

  • A split DNS has been created for the public name of the SharePoint Portal Server site.

  • The default Web site in Microsoft Internet Information Services (IIS) is configured with an SSL certificate and requires SSL.

  • One SharePoint Portal Server site has been set up on the default Web site in IIS using basic authentication only.

  • The SharePoint Portal Server site can be accessed from your corporate intranet using the SSL fully qualified domain name (FQDN).

  • A proper certificate has been installed on the ISA server to securely publish the SharePoint Portal Server site using the external name.

  • A secure Web listener has been created on the ISA server using the proper certificate.

  • A firewall policy rule has been created to allow the physical SharePoint Portal Server computer access to the Internet through the ISA server.

  • The Web.config file has been modified to allow the SharePoint Portal Server site access to the Internet through the ISA server.

In ISA Server we need to create a secure Web publishing rule. To do this, follow these steps:

  1. Open the ISA Server Management console. In the console tree, expand the server name, and then click Firewall Policy.

  2. In the task pane, under Firewall Policy Tasks, click the Tasks tab. Under Firewall Policy Tasks or Array Policy Tasks, click Publish A Secure Web Server.

  3. On the Welcome To The SSL Web Publishing Rule Wizard page, type a name for the rule and click Next.

  4. On the Publishing Mode page, click SSL Bridging and click Next.

  5. On the Select Rule Action page, click Allow and click Next.

  6. On the Bridging Mode page, select Secure Connection To Clients And Web Server and click Next.

    Important

    For SSL bridging to work, the inside-name must match the name on the SSL certificate that is installed on the SharePoint Portal Server site.

  7. On the Define Website To Publish page, type the computer name and path of the file or folder to publish, as shown in Figure 17-7, and click Next.

  8. On the Public Name Details page, type in the public name and path as shown in Figure 17-8, and click Next.

  9. On the Select Web Listener page, select the Web listener that was created and configured to allow SSL with the proper certificate and click Next.

  10. On the User Sets page, click Next.

  11. On the Completing The New SSL Web Publishing Rule Wizard page, click Finish.

  12. In the details pane, click Apply to save your changes, and then click OK.

  13. In the details pane, right-click the secure publishing rule you just created, and then select Properties.

  14. In the Properties dialog box, click the Link Translation tab.

  15. Add two link translations, as shown in Figure 17-9, by selecting the Replace Absolute Links In Web Pages check box, clicking Add, and then typing the following information in the Replace This Text and With This Text fields:

    • Inside-name of the SharePoint Portal Server site

    • Inside IP of the SharePoint Portal Server site

  16. Click OK.

  17. In the details pane, right-click the new rule again and select Configure HTTP.

  18. Under URL Protection, clear the Verify Normalization check box and click OK.

  19. In the details pane, right-click the new rule again, select Properties, and click the Listener tab.

  20. On the Listener tab, click Properties, click the Preferences tab, and then click Authentication.

  21. In the Authentication dialog box, clear the Integrated check box, and click OK.

  22. Select the Basic check box, and click Yes to the warning message.

  23. Select the Require All Users To Authenticate check box as shown in Figure 17-10. Click OK twice to continue.

  24. Click the Users tab. Select the Forward Basic Authentication Credentials (Basic Delegation) check box, as shown in Figure 17-11. Click OK.

  25. In the details pane, click Apply to save your changes, and then click OK.

Image from book
Figure 17-7: It's important that you provide the internal name of the SharePoint Portal Server server when completing this step.
Image from book
Figure 17-8: You should configure the Public Name Details when completing the Public Name Details page.
Image from book
Figure 17-9: Two dictionary entries for link translations should be created— one for the inside-name of the SPS server and one for the inside IP of the SPS server.
Image from book
Figure 17-10: Configure basic authentication for the SharePoint Portal site.
Image from book
Figure 17-11: Forwarding basic authentication is necessary for successful completion of the publishing rule.

The SharePoint Portal Server site should now be accessible using SSL encryption through the ISA Server 2004 server.


Configuring SharePoint Portal Server to Work with ISA Server

The following sections cover the extra steps required to publish the SharePoint Portal site behind an ISA server.

Modifying the Default URL for the Portal Site

To modify the default URL for your Portal site, follow these instructions:

  1. Open the SharePoint Central Administration Web site.

  2. Under Portal Site And Virtual Server Configuration, click the Configure Alternate Portal Site URLs For Intranet, Extranet, And Custom Access link.

  3. On the Configure Alternate Portal Access Settings page, click the name of your portal site, and then click Edit.

  4. On the Change Alternate Access Setting page shown in Figure 17-12, the Default URL text box should read http://servername, where servername is the NetBIOS name of the computer. In the Extranet URL text box, type the URL to read https://outside-name.contoso.com, where outside-name.contoso.com is the external name of your SharePoint Portal Server server, and click OK.

  5. Click the SharePoint Portal Server link on the left side of the page to return to the main Central Administration Web page.

  6. Under Server Configuration, click the Configure Server Farm Account Settings link.

  7. On the Configure Server Farm Account Settings page, under Proxy Server Settings, select Use The Proxy Server Specified, click Use The Proxy Server Specified, type the address and port used by your ISA server, and select the Bypass Proxy Server For Local (Intranet) Addresses check box, as shown in Figure 17-13 (where isa-se is the NetBIOS name of your ISA server), and click OK.

Image from book
Figure 17-12: You should configure alternate access settings within the SharePoint Portal Server configuration.
Image from book
Figure 17-13: Configure the appropriate proxy settings for the SharePoint Portal Server site.

Some Web parts on a SharePoint Portal Server 2003 site will make outbound Internet connections. If the firewall policy on the ISA server does not allow outbound port 80 access using SecureNAT, the SharePoint Portal Server 2003 site has to be configured to use the proxy engine on the ISA server. The following code snippet has to be added to the Web.config file after the </SharePoint> tag, which resides as the root of the SharePoint Portal Server 2003 site. You need to change ISASERVER to the name or IP address of the ISA server.

To modify the Web.config file, complete the following steps:

  1. Browse to the %SystemDrive%\Inetpub\Wwwroot folder and open the Web.config file with Notepad.

  2. Locate the </Sharepoint> tag in the file and insert the following code snippet immediately after the tag:

    WEB.CONFIG
<system.net>
<defaultProxy>
<proxy proxyaddress="http://ISASERVER:8080" bypassonlocal="true" />
</defaultProxy>
</system.net>

  3. Change ISASERVER to the name or IP address of your ISA server, save the Web.config file, and close Notepad.


Chapter 18: Configuring Microsoft ISA Server with Microsoft Operations Manager 2005

Microsoft Operations Manager (MOM) 2005 is Microsoft's alert and event monitoring solution that can help any size business improve its overall IT operations by providing ways to effectively identify the root cause of problems through detailed monitoring, trending, and reporting analysis on Windows servers in your company. In this chapter, we introduce some of the key features of MOM 2005, and then we step through the most common procedures for grasping the health and state of your ISA servers with MOM 2005.

Microsoft Operations Manager 2005 Overview

MOM 2005 comes in two versions to support any size business:

  • MOM 2005 For use in companies of all sizes.

  • MOM 2005 Workgroup Edition For use in smaller organizations to monitor 10 or fewer servers. It includes all of the functional capabilities found in MOM 2005, but is limited to the maximum number of servers that can be monitored.

Note

Agentless monitoring is not supported on servers using MOM 2005 Workgroup Edition.

The focus of this chapter is on MOM 2005, but the procedures should apply to either version with little variation.

MOM 2005 can be used to monitor Microsoft Windows NT 4, Windows 2000, and Windows Server 2003 operating systems. For servers running software versions prior to Windows 2000 Service Pack 4 and Microsoft Internet Explorer Service Pack 4, the type of monitoring is limited to only agentless communication. To support the latest Windows Server 2003 Service Pack 1 (SP1) release, download Service Pack 1 (SP1) for MOM 2005.

Note

MOM 2005 SP1 requires that Windows Installer 3.1 be installed on each managed server.

MOM 2005 supports two different types of agents that can be used on the servers in your infrastructure:

  • Agent-based monitoring Involves installing the MOM agent on the servers you want to monitor.

    Note

    The procedure for installing the MOM agent is described in the section entitled, "Deploying the MOM Client to Your ISA Servers," later in this chapter.

  • Agentless-based monitoring Allows MOM to monitor events, services, state, and performance of a server without requiring the MOM agent to be installed. This function is not supported through a firewall and on all management packs.


Getting Started with MOM 2005

MOM 2005 provides both administrators and product experts with a variety of consoles that can be used to configure and monitor the MOM environment. One of the major changes from MOM 2000 to MOM 2005 was creating separate consoles for administration and monitoring. The new Operator console uses the friendly interface of Microsoft Outlook 2003, as shown in Figure 18-1.

Image from book
Figure 18-1: The Operator console is very user-friendly, especially for those familiar with Outlook 2003.

Table 18-1 explains the purpose of each of the MOM consoles.

Table 18-1: Explanation of the Operations Manager Consoles
Console | Description
Administrator Console | Where you configure MOM 2005 and perform tasks like installing management packs, deploying MOM agents, and defining your MOM administrators.
Operator Console | Where you monitor your servers and check their alerts, events, and state, and even run certain tasks to resolve problems.
Web Console | Where you monitor your servers if you have limited access to the Operator console. Provides a subset of the functions you get with the Operator console.
Reporting Console | Where you go to view reports, such as common alerts and events, and performance metrics for the hardware in your servers.

Installing Microsoft Operations Manager 2005

The installation process for MOM 2005 has several dependencies. For example, you might need Microsoft SQL Server 2000 or SQL Server Reporting Services based on your planned implementation design. With that, this chapter assumes that you already have a working installation of MOM 2005 either in test or production.

Note

For more information on installing MOM 2005, reference the Microsoft Operations Manager Web site at http://www.microsoft.com/mom.

Deploying the MOM Client to Your ISA Servers

One of the first steps to complete after you have a working MOM environment running is to deploy the MOM agent to your ISA servers. To deploy the MOM agent, complete the following steps:

  1. Open the MOM Administrator Console by clicking Start, All Programs, Microsoft Operations Manager 2005, and then selecting Administrator Console.

  2. Click the Microsoft Operations Manager node in the console tree, and in the details pane, under Step 1, click Install Agents.

  3. On the Welcome To The Install/Uninstall Agents Wizard page, click Next.

  4. On the Install Or Uninstall Agents page, shown in Figure 18-2, ensure that Install Agents is selected, and then click Next.

  5. On the Method For Discovering Computers And Installing Agents page, illustrated in Figure 18-3, you can either browse for a specific type of server or use a search to discover a greater number of servers that might require the agent. Ensure that Browse For Or Type In Specific Computer Names is selected, and then click Next.

  6. On the Computer Names page, type the name of the server to receive the agent or click Browse to search for the server in the directory. Click Next.

  7. On the Agent Installation Permissions page, ensure that Management Server Action Account is selected, and then click Next.

  8. On the Agent Action Account page, ensure that Local System is selected, and then click Next.

  9. On the Agent Installation Directory page, you can specify the path to where the agent will be installed on the ISA server, as shown in Figure 18-4. Click Next to continue.

    Note

    The default path is %ProgramFiles%\Microsoft Operations Manager 2005.

  10. On the Completing The Install/Uninstall Agents Wizard page, review the summary, and click Finish. If you want to monitor the progress of the agent install, ensure that the Show Task Progress check box is selected.

  11. In the Microsoft Operations Manager Task Progress window, click Close when the agent has successfully been installed.

Image from book
Figure 18-2: The wizard assists you in getting the MOM agent deployed to your ISA servers.
Image from book
Figure 18-3: You have flexibility in your search for computers to receive the agent.
Image from book
Figure 18-4: The default installation path can be modified as necessary.

Agent Communication

MOM 2005 agents communicate with the MOM Management server using both Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) protocols on port 1270. The agent heartbeat to the MOM server is UDP communication. The default port of 1270 can be changed by completing the following steps:

  1. In the Administrator console, expand the Administration node, and then click Global Settings.

  2. In the details pane, right-click Communications, and select Properties.

  3. Click the Communications tab as shown in Figure 18-5, and change the Encrypted Communication Port Number setting to the port number you want to use.

  4. Click OK to close.

Image from book
Figure 18-5: 1270 is the default port number used between the agent and the MOM Management server.

ISA Communication Access Rule

ISA Server 2004 defines a system policy rule by default that enables remote monitoring capabilities between the local host (ISA server) and your internal network. The name of the policy rule is Allow Remote Monitoring From ISA Server To Trusted Servers, Using Microsoft Operations Manager (MOM) Agent. To ensure that the proper communication occurs on networks outside of the internal network, you should create an access rule that allows incoming TCP/UDP traffic on the encrypted communication port (port 1270 by default) from the defined, additional network to the host address of your MOM Management server.

To create the access rule, follow these steps:

  1. In the console tree, click Firewall Policy.

  2. In the task pane, click the Tasks tab. Under Firewall Policy Tasks (in ISA Server 2004 Standard Edition) or Array Policy Tasks (in ISA Server 2004 Enterprise Edition), click Create New Access Rule or Create Array Access Rule.

  3. On the Welcome To The New Access Rule Wizard page, type a name for the new access rule, and then click Next.

  4. On the Rule Action page, select Allow, and click Next.

  5. On the Protocols page, from the This Rule Applies To drop-down list, choose Select Protocols, and then click Add. Click New and click Protocol. Continue through the New Protocol Wizard to create a protocol allowing both Inbound TCP and Receive UDP for the encrypted communication port (port 1270 by default) for MOM communication. Click Add to add the new protocol, click Close, and then click Next to continue.

  6. On the Access Rule Sources page, click Add. In the Add Network Entities dialog box, expand Networks, click Internal, click Add, and then click Close. Click Next to continue.

  7. On the Access Rule Destinations page, click Add. Click New and then click Computer. Type the name and IP address of your MOM Management server, and click OK. Select the entry you just added. Click Add, and then click Close. Click Next to continue.

  8. On the User Sets page, the default setting is for the rule to apply requests from the All Users user set. Click Next to continue.

  9. On the Completing The New Access Rule Wizard page, review the summary of information, and then click Finish.

  10. Click Apply to save your changes, and then click OK.

Installing the ISA Server 2004 Management Pack

Management packs are created for every new product that Microsoft releases to enhance the detailed level of monitoring available within MOM 2005. For MOM 2005, there are ISA Server management packs for ISA Server 2000 and ISA Server 2004.

Note

For a complete listing of management packs available with MOM 2005, check the Web site http://www.microsoft.com/management/mma/catalog.aspx.

To download and extract the ISA Server 2004 management pack in preparation for the import, complete the following steps:

  1. Download the ISA Server 2004 Management Pack to your MOM server from www.microsoft.com/downloads.

  2. Double-click the file Microsoft ISA Server 2000-2004 MOM 2005 MP.msi to begin the installation.

  3. On the License Agreement page, click I Agree, and then click Next.

  4. On the Select Installation Folder page, review the default installation location, and click Browse if you would like to modify it. Review whether or not you want the installation to be viewable by all users or just yourself, and then click Next to continue, as shown in Figure 18-6.

    Note

    The default location is C:\Program Files\MOM 2005 Management Packs\Microsoft ISA Server 2000-2004 MOM 2005 MP\.

  5. On the Confirm Installation page, click Next.

  6. On the Installation Complete page, click Close.

Image from book
Figure 18-6: You can extract the ISA Server 2004 management pack for a later import.

The following steps show you how to import the ISA Server 2004 management pack on your MOM server:

  1. In the Administrator console, click the Microsoft Operations Manager node in the console tree, and in the details pane, under Step 2, click Import Management Packs.

  2. On the Welcome To The Management Pack Import/Export Wizard page, click Next to continue.

  3. On the Import Or Export Management Packs page, select Import Management Packs And/Or Reports, and then click Next.

  4. On the Select A Folder And Choose Import Type page, click Browse to locate the folder where you installed the management pack in the preceding procedure. You will also specify whether to import only the management pack, only the reports, or both the management pack and the reports, as illustrated in Figure 18-7. Click Next to continue.

  5. On the Select Management Packs page, as shown in Figure 18-8, select the ISA 2004 management pack, choose your import options, whether you like to back up any existing management pack, and then click Next.

  6. On the Completing The Management Pack Import/Export Wizard page, click Finish to complete.

  7. On the Import Status page, click Close when the management pack has been 100 percent imported, as shown in Figure 18-9.

Image from book
Figure 18-7: In this example, you want to import only the management pack, and not the reports.
Image from book
Figure 18-8: Backing up any existing management packs is preferred if not starting from scratch.
Image from book
Figure 18-9: After the import has completed, you can begin to view the default settings applied with the ISA Server 2004 management pack.

Managing ISA Servers with MOM 2005

Although we can't cover every detail of the rich monitoring functionality that MOM 2005 provides, we do cover some key steps for monitoring your ISA servers with MOM 2005. These procedures include adding custom event rules, putting your ISA servers into maintenance mode, creating computer groups for better organization, and running reports to gather key performance indicators.

Rule Groups and Adding Custom Event Rules

To begin receiving alerts or events on your ISA servers, associate a rule group with a computer group. Rule groups are created in the MOM Administrator console and contain rules for events, alerts, and performance. With the ISA Server 2004 management pack, standard rule groups are created by default, as shown in Figure 18-10.

Image from book
Figure 18-10: Several rule groups are created for both ISA Server 2000 and ISA Server 2004.

The rules are applied at the folder level; therefore, for example, if you want a rule to apply to both ISA Server 2000 and ISA Server 2004 servers, you can create a rule group at the parent folder. If you want a rule to apply only to ISA Server 2004 servers, create a rule group within that folder. You can create customized rule groups for particular functions that might not already be captured by a standard rule group, so it is valuable to review and understand what the standard rule groups are doing.

To create a new rule group for your ISA Server 2004 servers, complete the following steps on your MOM server:

  1. Open the MOM 2005 Administrator console.

  2. In the console tree, expand Management Packs, expand Rule Groups, expand Microsoft ISA Server (Enabled), expand Microsoft ISA Server 2004 (Enabled), and then right-click ISA 2004 (All) (Enabled) and select Create Rule Group.

  3. In the Rule Group Properties — General dialog box, type a name and description and click Next.

  4. In the Rule Group Properties — Knowledge Base window, type any information that you would like to have appear in the company knowledge base for the custom rules to be associated with the rule group. Click Finish.

  5. At the prompt, click Yes to deploy the rules to the associated group of computers. Otherwise, click No to do so at a later time. Click OK.

Now that you have created a rule group, you can create a customized event rule, alert rule, or performance rule. Because the options are plentiful when creating a custom rule, evaluate existing rules prior to creating your own custom rule to prevent duplication.

Note

Refer to the MOM 2005 Help File for further information on the best practices for creating event and alert rules.

Working with Maintenance Mode

When you have planned server work, you can put the server in maintenance mode so that the MOM agent doesn't send alerts to the MOM server when stated services are unresponsive or the server is down. One of the main reasons you would want to put a server into maintenance mode would be if you are providing service level agreements to your users and you don't want your operation reports showing the server as being down every weekend when the weekend is your acceptable time to do server maintenance outside of the agreement.

To place your ISA server into maintenance mode, complete the following steps:

  1. Open the Operator Console by clicking Start, clicking Programs, clicking Microsoft Operations Manager 2005, and then selecting Operator Console.

  2. Click Computers And Groups. Expand the All: Computers And Groups View node, and click Computers.

  3. In the details pane, right-click the applicable server, and select Put Computer In Maintenance Mode.

  4. In the Maintenance Mode dialog box, type a reason, and specify the duration the server will be in maintenance mode either by typing the number of minutes or specifying a specific end time as shown in Figure 18-11, and click OK.

Image from book
Figure 18-11: You will find it helpful for ongoing administration to provide as much information in the text boxes as possible.
Note

The server automatically comes out of maintenance mode after the specified duration has expired. A wrench icon appears next to the server to represent its current status.

Removing a Computer from Maintenance Mode

To manually remove a server from maintenance mode, right-click the applicable server and select Remove Computer From Maintenance Mode. Click Yes to confirm.

Note

The wrench icon next to the server should disappear.

Creating Computer Groups

Computer groups are useful for organizing similar servers together. For example, if you have an array of ISA servers, you can create a computer group to include only the ISA servers in the array instead of all managed servers. When you install the ISA Server 2004 management pack, you will see seven new computer groups, three for ISA Server 2000 and four for ISA Server 2004, created under the root of the Computer Groups node. During the process of creating a computer group, you identify which servers should be discovered and joined to the computer group.

To create a computer group, follow these steps:

  1. In the MOM 2005 Administrator Console, in the console tree, expand the Management Packs node, right-click on Computer Groups, and select Create Computer Group.

  2. On the Welcome To The Create Computer Group Wizard page, click Next to continue.

  3. On the General page, enter a name and optional description, and then click Next.

  4. On the Included Subgroups page, click Add. In the Add Subgroup dialog box, select the applicable check boxes of the computer groups you want to add, and click OK. For example, if you created a computer group named ISA in Step 3, in this step you select each of the seven ISA Server computer group check boxes for inclusion in the ISA group, as shown in Figure 18-12. Click Next.

  5. On the Included Computers page, click Add. In the Add Computers dialog box, browse and select the applicable computers' checkboxes you want to add, and click OK. Click Next to continue.

  6. On the Excluded Computers page, you can specify computers that should never appear in the computer group. Computers identified in this step will override the computers identified in Step 5. You can click Add to include computers or you can click Search to use wildcards for denoting types of servers to exclude. Click Next to continue.

  7. On the Search For Computers page shown in Figure 18-13, you can choose to not search for computers or search for computers based on various criteria. Click Next to continue.

  8. On the Formula page, you can specify a formula for including computers in the computer group. Formulas can be based on the following:

    • Operator

    • Function

    • Attribute

    • Computer Group

    • Discovery Group

  9. Click Next to continue.

  10. On the State Roll-Up Policy page shown in Figure 18-14, you have the following options:

    • The Worst State Of Any Member Computer Or Subgroup

    • The Worst State From The Specified Percentage Of Best States In The Computer Group

    • The Best State Of Any Member Computer Or Subgroup

  11. Select the option of your choice, set a percentage figure if applicable and click Next to continue.

  12. On the Confirmation page, review the summary, and click Next to create the computer group.

  13. On the Completing The Create Computer Group Wizard page, click Finish.

Image from book
Figure 18-12: You can include the seven ISA Server computer groups as part of a new computer group.
Image from book
Figure 18-13: Various options for assisting with your computer searches are available.
Image from book
Figure 18-14: You can clearly designate the state of your servers based on the model.

There is no way in the default installation of ISA Server to map Computer groups in MOM to Computer or Computer Sets objects in ISA Server. For more information about ISA Server computer or computer set objects, see Chapter 7, "Configuring Toolbox Elements."

Monitoring ISA Server Performance with MOM 2005

With the MOM agent installed on your ISA servers, MOM is collecting data around the clock so that you can check statistics and generate reports in areas like performance analysis or problem discovery. You can check performance data within the Operator console, or by using the Reporting Console to generate a formal report if you are using Microsoft SQL Server 2000 Reporting Services. The next two procedures specify how to keep a close eye on server performance with MOM 2005.

To monitor performance using the MOM 2005 Operator console, follow these steps:

  1. Open the Operator console. Click Performance to switch the context of the console tree to Performance Views.

  2. In the console tree, expand Microsoft ISA Server, expand Microsoft ISA Server 2004, and click ISA 2004 (All Performance).

  3. In the details pane, select the ISA server that you want to gather performance statistics against, and then click Select Counters near the top of the details pane.

  4. In the details pane, select the applicable counter check boxes to include in the graph, and then click Draw Graph near the top of the details pane.

  5. A performance graph will be displayed with the details of each counter shown at the bottom of the dialog box.

To view performance reports stored in the MOM Reporting Server database using the MOM 2005 Reporting console, follow these steps:

  1. Open the Operator console. Click the Go menu bar, and then click Open Reporting Console.

  2. On the Microsoft Operations Manager Reporting Web page, shown in Figure 18-15, you have a set of categories to choose from based on the type of report you want to run.

  3. Select the applicable category to display a list of reports that can be generated.

  4. Select the report to be generated.

  5. Fill out the report detail, such as Begin Date, End Date, Sort By, and so on, and then click View Report.

Image from book
Figure 18-15: Reporting services offers a method for running weekly or monthly reports, with a variety of file export options available.

The reports viewable from the MOM Reporting server database can be customized, although you need to understand SQL Server Reporting Services to do this.

See www.microsoft.com/sql for more information.


Chapter 19: Configuring Microsoft ISA Server with Microsoft Virtual Server 2005

Overview

Microsoft Virtual Server 2005 provides the ability to run multiple instances of workstations and servers on a single piece of hardware. This functionality can be leveraged with Microsoft ISA Server 2004 to provide an environment for educational purposes and a test environment for creating and modifying production ISA Server configurations. In this chapter, we address utilizing Virtual Server 2005 with ISA Server 2004 by

  • Identifying key features of Virtual Server 2005

  • Describing usage scenarios for using Virtual Server 2005

  • Configuring an ISA Server test environment using Virtual Server 2005


Virtual Server 2005 Overview

Virtual Server 2005 allows users to run multiple independent operating system instances on a single piece of hardware. Virtual Server 2005 runs as a service on Microsoft Windows Server 2003 and provides the framework in which the virtual machines run. Each virtual machine can have its own hard disk drives that correspond to files on the host operating system. In essence, a full backup of a virtual machine would entail backing up the configuration and the hard disk files.

Note

When working with Virtual Server, be aware of the terms guest and host machines. Host machines describe the physical server and the operating system running on that server, whereas guest machines are those virtual server sessions that run on top of the host operating system.

This virtualization has several benefits. First, it allows for greater utilization of hardware resources. Because more than one server can run on a single piece of hardware, hardware can be used more efficiently. Second, because all virtual hardware drivers (such as video, network, and hard disk resources) within a virtual machine are the same, virtual machines can be moved to different hardware running Virtual Server 2005 with minimal effort.

Key Features of Virtual Server 2005

  • Service-based Virtual Server 2005, unlike Microsoft Virtual PC 2004, runs as a service on the host operating system. This allows for virtual machines to run regardless of desktop interaction and allows them to be started automatically after a host server reboot.

  • Hardware standard within the virtual machines Regardless of the disk interface, network adapters, or video adapters in the host machine, the virtual machines always see the same types of hardware. This allows for virtual machines to be moved from host server to host server without requiring reconfiguration within the virtual machines.

    Note

    For a complete list of the hardware that is emulated within the virtual machines, see the Virtual Server 2005 help file.

  • Multiple network access methods Virtual Server 2005 allows direct access to the network by virtual machines through physical network adapters in the host. In addition, virtual networks can be created that are only visible to one or more virtual machines.

  • Scriptable interface Virtual Server 2005 provides a scripting interface that can be used to automate creating virtual machine definitions, changing their configuration, and rebooting the virtual machines through scripts. There are also various other capabilities exposed by the scripting interface.

    Note

    This benefit also opens up a vulnerability, as ISA Server could be shut down by scripting a shutdown of the guest operating system on which it runs, or by attacking the host machine.

  • Undoable drives Undoable drives provide the ability to make changes to a virtual machine, such as major configuration changes or software updates, and then undo those changes. This can be valuable when testing patches or service packs or when automating software installation packages.

Caution

Be vigilant as you use the Undo Disks feature. If it is not used correctly, you could lose changes you want to keep.

Usage Scenarios for Virtual Server 2005 and ISA Server

There are several situations in which Virtual Server 2005 can be quite beneficial. Although not an exhaustive list, this section provides several examples.

  • Earlier application support Earlier applications that cannot run under upgraded operating systems might be supported by running them as virtual machines with an earlier operating system, thereby allowing you to replace dated hardware while keeping the earlier operating systems and applications in place.

  • Migrations During migrations it is often useful to test upgrades in an environment that will not affect production systems. By copying ISA Server computer configurations, along with other key servers, to a virtual machine, it is possible to test upgrades of software and operating systems to ensure compatibility before upgrading the actual production environment.

    Note

    Because licensing can vary by customer and situation, you should check with your Microsoft licensing representative to ensure that you have the appropriate licenses required for your particular situation.

  • Test labs Virtual Server is an excellent tool for creating test labs that can be used for training purposes or for validating procedures for maintenance or upgrades. Often, Virtual Server is used as part of a production rollout scheme to mirror an entire production environment without having to mirror all the hardware of the production environment. Updates to application code or software and operating system patches can be installed in the Virtual Server environment first for validation and then rolled out to production.

  • Demonstrations Virtual Server can be used to demonstrate all types of environments. These can be full-fledged multiserver installations that can run on a laptop and be taken wherever needed.

  • Disaster recovery A good disaster recovery plan includes the ability to quickly bring up a secondary test site in case of a catastrophe. Virtual Server can be used to provide an off-site platform for running systems after a disaster. This could be configured as either a warm backup from which to restore current data after a disaster or as a hot backup site that is continually updated using replication software with the primary site.

  • Configuration builds When implementing Virtual Server 2005 in a production environment, an installation of ISA Server 2004 in a virtual machine can be used to create the configurations for the production server. This allows for large changes to be made and verified in a test environment before you roll those changes out to the production ISA server.

    Note

    Be certain that you verify that you are not violating any licensing agreements by checking with your Microsoft licensing representative, and reading the End User Licensing Agreement (EULA) for each product.

  • Applications in a box There might be situations in which it is advantageous to have an entire test environment consisting of several servers in a single, portable configuration. For example, you might need to place an entire Web application on a single piece of hardware. This might include an ISA Server 2004 computer, a Web server, a business components server, and a database server packaged and consolidated on a single portable machine.

Virtual Disks

The guest operating system stores its disks as files on the host operating system—these files are called virtual disks. Virtual disks come in several different types. Table 19-1 shows the different types of disks and the advantages of each type.

Table 19-1: Virtual Disk Types

Disk Type

Description

Dynamically expanding

Dynamically expanding disks are disk files that grow as needed on the host server. For example, the ISA2004SE virtual machine that you create might have a 16-GB partition; however, it would only use 2 to 3 GB on the host server because there is only 2 to 3 GB of data being used on that partition.

The advantage of dynamically expanding disks is that they only use as much space on the host operating system disk as needed. If you define a 16 GB dynamically expanding virtual disk, the file will only be as large as is needed to store the files in it, and the file will expand as needed. However, performance can suffer when the disk needs to expand. In addition, it's possible for the host server's physical hard disk to run out of space, preventing the dynamically expanding disk from growing.

Fixed size

Fixed size disks preallocate all the space that could potentially be used for a virtual disk. For example, an ISA Server virtual machine created with a 16 GB virtual hard disk would take up 16 GB of space on the host server.

The advantage of fixed size disks is that the space is already allocated, which makes it unlikely that the host server would accidentally run out of space. Furthermore, fixed sized virtual disks can decrease fragmentation on the host system that can be caused by expanding disks—the performance on the guest operating system can increase because the file does not need to expand.

Differencing

Differencing disks are disks that only record changes from another disk. For example, suppose you have a Windows Server 2003 virtual machine. Once Windows Server 2003 is installed and fully patched and all related software has been loaded, that virtual hard disk can be used as the source for differencing disks. This could allow for several different Windows Server 2003 virtual machines all based on the single source image, while consuming much less disk space than would be required if each virtual machine used its own virtual disk.

Linked

These are disks that actually read files directly on the host system's hard disk.

Images

Images can include CD and floppy disk images and are typically in the ISO CD disk format (file extension .iso).
Tip

Because virtual disks on a virtual server can compete against each other for disk access resources, fast disk speeds are important for a production Virtual Server 2005 environment. Best disk performance can be achieved by using a separate disk channel from the host, such as a dedicated Small Computer Software Interface (SCSI) hardware array.

The Virtual Server Migration Toolkit is available for simplifying moving physical servers to a virtual server environment. Information can be found at http://www.microsoft.com/windowsserversystem/virtualserver/.


Virtual Networks

Virtual networks allow you to create networks to which only specified virtual machines can connect. They can also be used to allow virtual machines to attach directly to the physical network through the host computer's network adapter. You can have any number of virtual networks defined within Virtual Server. Each virtual machine can use up to four network adapters, each of which can have different configurations.

When using virtual networks that are not connected to a physical network adapter, you can create environments where virtual machines can talk only to other virtual machines. This is valuable when creating test environments such as when testing ISA Server configurations.

When a virtual network adapter is connected to a physical network through a network adapter in the host server, the virtual machine has complete access to the physical network. This allows for virtual machines to function on the network just as any other machine. For example, you could easily create a caching-only ISA server as a virtual machine and attach that virtual machine to the physical network.


Configuring an ISA Server Test Environment Using Virtual Machines

Best Practices

  • Back up systems regularly As with any other server, the virtual machines should be backed up consistently. This might include shutting down the servers and copying the hard disk files and configuration files to another location. If this is not possible, back the virtual machines up with the appropriate backup software as you would with any other server.

  • Purchase licenses for each Virtual Server Be sure to properly license software running on virtual machines, which have the same licensing requirements as physical servers—this means that when it comes to licensing software, each of the virtual servers is considered a separate physical server.

  • Label virtual networks and adapters When setting up an ISA Server 2004 test environment on Virtual Server 2005, you create several different virtual networks and several virtual network adapters. Be sure to label each virtual network and virtual adapter to assist with keeping track of each network.

  • Disable hyperthreading technology Hyperthreading (which creates its own sort of virtual environment, making one processor appear as two) used with Virtual Server can adversely affect performance when there is a heavy workload on the host server.

Gotchas

There are certain issues to be aware of when running in a Virtual Server environment:

  • Single point of failure Because all the virtual machine hard disks are located in files on the host server's hard disk, a drive or array failure might disable all the virtual servers as well (depending on the redundancy of the disk array itself, and the extent of the failure). In the event of a catastrophic failure of the host server's hardware, you might be in a situation in which several servers go offline and all systems must be recovered rather than just one.

  • Performance monitoring challenges Because a virtual server environment places multiple servers on a single piece of hardware, performance tuning can be challenging. Be sure to include sufficient memory for each virtual machine and for the host operating system. Fast disk access is also important.

  • Network adapter bottlenecks When multiple virtual machines share the same physical network adapter on the host server, network cards can become overwhelmed with traffic requirements. Be sure to monitor usage on network ports with multiple virtual machines attached. If needed, add additional network cards to the host machine and attach some of the virtual machines to the additional adapters.

Creating a Virtual Server Environment

The following sections outline how to create a Virtual Server environment with ISA Server. We assume that you have already installed Virtual Server. Should you require more information, see the resources available on the Virtual Server Web site at http://www.microsoft.com/windowsserversystem/virtualserver/.

Including a Simple, Isolated Client and an ISA Server Environment

In this scenario, you create a simple network environment that includes a single isolated client connected to an ISA server. The first step in setting up this situation is to create the virtual machines for both the client (in this case, Windows XP Professional) and the server (Microsoft Windows Server 2003 with ISA Server 2004). The ISA server is connected directly to the Internet. Perhaps this is in a test environment where you are setting up the configurations for a production ISA server. A diagram of the test lab is shown in Figure 19-1.

Image from book
Figure 19-1: This screenshot shows the configuration of the test lab being created in this chapter.

To create a new machine in Virtual Server, you first create a new virtual hard disk, then create a new virtual machine that utilizes that virtual hard disk. Next, you install the operating system onto that virtual machine just as you would a physical server.

Creating a Virtual Hard Disk

The first step in creating a virtual machine is to create a virtual hard disk.To do so, follow these steps:

  1. Open the Virtual Server Administration Web site.

  2. Under Virtual Disks, select Create, then select Dynamically Expanding Virtual Hard Disk, as shown in Figure 19-2.

    Tip

    You must then choose the location for the virtual disk file and the size. The size is the actual size of the hard disk, not the C partition. The example shown in Figure 19-3 would look like a 16 GB hard disk that could then be partitioned as needed by Windows Server during the installation.

  3. Enter the appropriate location and size for the virtual hard disk, then click Create, as shown in Figure 19-3.

Image from book
Figure 19-2: You can create multiple types of virtual hard disks.
Image from book
Figure 19-3: You can create a dynamically expanding virtual hard disk and specify the maximum size for the hard disk and the physical location of the virtual hard disk file.

Once the virtual disk has been created, you must create the virtual networks to which the virtual machine will attach. You will configure the network adapters properly once the virtual machine has been installed.

Creating Virtual Networks

The next step in creating a lab environment is to create two additional networks within Virtual Server 2005 that will become the inside (internal) and outside (Internet) networks for the test lab. Figure 19-4 shows an example of creating a virtual network that is not connected to a physical adapter on the host server. This configuration creates a network that can connect multiple virtual machines but does not connect to the outside world. Creating an isolated test environment can be very useful for testing potentially unstable, dangerous, or confidential technologies or configurations.

Image from book
Figure 19-4: You can create new virtual networks as needed within the Virtual Server console.

To create the lab, you create two virtual networks that are not connected to any physical adapters on the host server. This creates an external and internal network for testing purposes. Figure 19-5 shows the final look of the virtual networks for Virtual Server. The internal and external networks are not connected to a physical adapter on the host machine. NIC 1 and NIC 2 are virtual networks that are connected to physical adapters in the host machine. You do not use NIC 1 or NIC 2 in this example.

  1. Navigate to the Master Status page of the Virtual Server 2005 Administration Web site.

  2. Under Virtual Networks, click Create.

  3. For the first virtual network, enter a virtual network name of Outside and do not attach the virtual network to a physical adapter. This procedure is shown in Figure 19-4. Then, click OK.

  4. Repeat this procedure to create an Inside virtual network.

Image from book
Figure 19-5: This shows a Virtual Server with four separate virtual networks.

Your final virtual network configuration should look similar to what is shown in Figure 19-5.

Finally, you create the virtual machine and attach it to the correct virtual hard disks and virtual networks, by following these steps:

  1. On the Master Status page of the Virtual Server 2005 Administration Web site, under Virtual Machines click Create.

  2. Enter the virtual machine name, its location, the amount of virtual memory to assign, and the virtual hard disk to use, as shown in Figure 19-6.

  3. Click Create.

Image from book
Figure 19-6: You can control various aspects of a new virtual machine, including its physical location, during creation.
Note

Notice that we have attached the virtual network adapter to NIC 1 (a physical adapter on the host machine) at this stage. This allows you to connect to the outside world to apply any necessary updates to the virtual machine. you connect the virtual machines to the virtual networks at a later stage.

Finally, you can start the new virtual machine and install it as you would any other machine. To install Windows Server 2003, you would put the installation CD in the CD drive, ensure that the virtual machine has captured the physical CD drive, and start the virtual machine. You could also mount an image of a Windows Server 2003 CD and boot from it. Next, on the virtual machine configuration screen, click the virtual machine name, and click Turn On. This is shown in Figure 19-7.

Image from book
Figure 19-7: You can turn on a virtual machine from the Virtual Server interface.

Once the server is installed, you can administer and run it just as you would any other server. Figure 19-8 shows the Web-based Virtual Server 2005 interface with a remote control session to a virtual machine named ISA2004SE.

Image from book
Figure 19-8: The virtual machine can be controlled through the Virtual Server Web interface.
Important

Always load the Virtual Machine Additions onto each virtual machine you create. This greatly improves performance of the virtual machine.

The final task you want to accomplish is to add the appropriate virtual network adapters and attach them to the correct virtual networks. To do so, follow these steps:

  1. Shut down the virtual machine.

  2. On the Master Status page of the Virtual Server 2005 Administration Web site, click the virtual machine name, and then click Edit Configuration, as shown in Figure 19-9.

  3. Click Network Adapters as shown in Figure 19-10.

    You next create two virtual network adapters for the virtual machine. One of the adapters will be connected to the external virtual network and the other will be connected to the internal virtual network. Figure 19-11 shows this configuration.

  4. Click OK.

  5. Boot the virtual machine.

Image from book
Figure 19-9: You can edit the configuration of the virtual machine to change items such as memory, processor utilization, network adapters, and virtual disks.
Image from book
Figure 19-10: You can add multiple virtual network adapters to each virtual machine and connect those virtual network adapters to the appropriate virtual networks.
Image from book
Figure 19-11: Two separate virtual network adapters are connected to two separate virtual networks. These correspond to the internal and external networks in the ISA Server 2004 configuration.

Once the virtual machine is booted, it detects two network adapters. These correspond to the adapters created previously in Virtual Server, as shown in Figure 19-12.

Image from book
Figure 19-12: This screenshot shows the two network adapters that the ISA Server 2004 virtual machine sees. These correspond to the virtual network adapters added previously.

At this point, you can enter the appropriate network address information into each network adapter and install ISA Server 2004 just as you would on a normal physical server. Once this is complete, you can create various other workstations and servers to be on either the internal or external networks for testing access through the ISA Server 2004 computer.

Note

If needed, you can attach either the internal virtual adapter or the external virtual adapter to the physical network. For example, if you wanted to test accessing physical internal servers through the ISA2004SE virtual server, you would attach the internal virtual adapter to the physical network card in the host server that is attached to the internal network. You could then attempt to access these servers from a virtual test machine located on the virtual external network.

Creating a Complex Client, ISA Server, and Perimeter Network Environment

It is possible to create more complex environments using Virtual Server 2005 and ISA Server 2004. For example, by creating an additional virtual network and virtual network adapter, you can create a perimeter network (also known as a demilitarized zone, or DMZ) and use that environment to test network access with a perimeter network and create the appropriate configurations within ISA Server.


Setting Up a Production ISA Server Virtual Machine

You might wonder whether it is possible to use Virtual Server 2005 to create a production ISA Server 2004 virtual machine. Please note that an ISA Server 2004 installation in a Virtual Server 2005 configuration will not be supported by Microsoft's Product Support Services (PSS) team.

For more information, see the Microsoft Knowledge Base article "Windows Server System Software not Supported Within a Microsoft Virtual Server Environment" at http://support.microsoft.com/kb/897614.

Virtual Server 2005 provides security to protect the virtual machines from other virtual machines and to protect the virtual machines from the host machine. You can configure the virtual machines to prevent them from talking with other systems on the production network, or you can configure the virtual server to run in "network isolation" mode—to do this, make certain that all the virtual servers are running on the same subnet, which is separate from the production subnet.

Note

Be aware that the host and guest machines cannot intercept network packets from one another. The virtual machine network services driver routes all packets to the appropriate machine. For this reason, a firewall or antivirus program running on the host machine does not protect the virtual machine. You must install protection on every machine you wish to protect.

Best Practices

Although it is possible to use Virtual Server to run a production ISA Server 2004 computer, we do not recommend doing so, as it is unsupported by Microsoft and provides additional attack surface (both the individual guest machine, and access to the host environment). Using ISA Server to protect internal resources or networks within the corporate network, or using the ISA server as a proxy server, would be the most likely scenarios. In any case, follow these recommendations when using ISA Server 2004 in a Virtual Server environment:

  • Use a dedicated network adapter When connecting an ISA Server 2004 virtual server to the network, dedicate a physical network adapter to only the ISA Server 2004 virtual machine.

  • Check your licensing situation Be certain that you verify that you have the appropriate licenses purchased when using Virtual Server 2005.

  • Know your environment Be sure to understand the security implications on both the virtual machine and the host machine before attaching an interface to an unsecure network such as the Internet. For example, an access rule that allows traffic to pass directly from the Internet to other protected networks would make your environment extremely vulnerable.

  • Allocate appropriate resources Allocate memory and processor availability appropriately for the ISA Server 2004 virtual machine to ensure it is not starved for resources by other virtual machines. ISA Server performance degradations can affect the performance of all traffic passing through the firewall. We recommend a machine with one or more 1.5 GHz processors, 1.5 GB or more of RAM, and a 20 GB or larger hard disk.

For more information about the system requirements for Virtual Server 2005, see http://www.microsoft.com/windowsserversystem/virtualserver/evaluation/sysreqs.mspx. For more information about the hardware requirements for ISA Server 2004, see Chapter 2 , "Installing and Configuring Microsoft ISA Server 2004 Standard Edition," and Chapter 3 , "Installing and Configuring Microsoft ISA Server 2004 Enterprise Edition."


Chapter 20: Configuring Microsoft ISA Server 2004 with Microsoft Small Business Server 2003

Overview

This chapter covers how to install and configure Microsoft ISA Server 2004 on Microsoft Small Business Server 2003 (SBS). This process is really an upgrade for owners of Small Business Server Premium Edition, because it comes with ISA Server 2000.

We will provide an overview of SBS versions, and then explain the requirements for SBS to work with ISA Server 2004. Next, we explain how to upgrade your SBS 2003 Premium Edition system from ISA Server 2000 to ISA Server 2004. We conclude with common troubleshooting steps.


Overview of Small Business Server 2003 and ISA Server 2004

The SBS environment is unique in that you have a single server that contains the crown jewels of your computing environment. Any downtime for the ISA server also affects the server that authenticates clients, processes e-mail, and runs your SQL server. It's important to plan your upgrade to the system carefully, so that the downtime (which can last between three and eight hours) doesn't affect normal business operations.

Because upgrading ISA Server is just one part of upgrading SBS 2003 to Service Pack 1, you should take into consideration the whole process of upgrading Microsoft SQL, Microsoft Exchange, and the like.

For more specific information, see the excellent article "How to Install Service Pack 1 For SBS 2003," by Mariëtte Knap et al., located at http://www.smallbizserver.net/Default.aspx?tabid=236. This article provides detailed information about the entire process of upgrading SBS.

How Different SBS Versions Interact with ISA Server 2004

SBS 2003 comes in two editions: Standard Edition and Premium Edition. Only SBS Premium Edition includes ISA Server, as shown in Table 20-1. If you are using the Standard Edition, we recommend either upgrading to the Premium Edition, or installing ISA Server on a separate machine as described in Chapter 2, "Installing and Configuring Microsoft ISA Server 2004 Standard Edition." For the rest of the chapter, we focus solely on configuring ISA Server with SBS Premium Edition 2003.

Table 20-1: Comparing SBS 2003 Standard Edition to Premium Edition
 | SBS 2003 Standard Edition | SBS 2003 Premium Edition
Windows Server 2003 | Yes | Yes
Exchange 2003 | Yes | Yes
Windows SharePoint Services | Yes | Yes
ISA Server 2000 | No [*] | Yes
ISA Server 2004 | No[*] | Only after installing SBS 2003 Service Pack 1 and installing ISA Server 2004 from the Service Pack 1 CD
SQL Server 2000 | No | Yes
[*]You can use ISA Server in an SBS Standard Edition environment when it is installed on a separate computer from SBS itself.


Installing ISA Server 2004 on Small Business Server 2003

For ISA Server 2004 to install on SBS 2003, you must install SBS 2003 Service Pack 1. You should order the CD from Microsoft—it's important to install using the CD, rather than downloading the service pack, as there are some special scripts that are included on the CD that accommodate the unique configuration of ISA Server being colocated with a Windows Server 2003 domain controller, SQL Server 2000, and Exchange.

Note

You can obtain a copy of SBS 2003 Service Pack 1 on a CD, which includes ISA Server 2004, by contacting https://www.microsoft.upgrade.com/sbs/. It normally takes four to six weeks to receive this media.

The SBS 2003 Service Pack 1 CD installs the following updates:

  • Windows Server 2003 Service Pack 1

  • Exchange Server 2003 Service Pack 1

  • SBS 2003 Update KB891193 for Windows XP Service Pack 2

  • Windows Small Business Server 2003 Service Pack 1

  • Windows SharePoint Services Service Pack 1

  • ISA Server 2004 Service Pack 1

  • SQL Server 2000 Service Pack 4

There are two ways to install ISA Server 2004: on a new SBS server or as an upgrade to an existing SBS installation. We cover the basic steps, which are the same in both cases, and then discuss the things to consider when upgrading from an existing installation of SBS 2003 with ISA Server 2000.

Documenting and Backing Up ISA Server 2000 Settings

As with any significant upgrade, you should document and back up your SBS server before conducting an upgrade of ISA Server by following these steps:

  1. On the SBS 2003 server, click Start, and then select Server Management.

  2. In the left console tree, click the Backup node.

  3. In the right-hand details pane, click Backup Now.

Note

If you have not yet configured your backup settings, you must click Configure Backup to set up your backup process. Follow the steps defined in the Backup Wizard to configure where you will back up the settings (preferably to storage locations off of the existing server), and what data you will back up (preferably everything).
Tip

For more detailed information about backing up and restoring your SBS server, download "Backing Up and Restoring Windows Small Business Server 2003" from http://www.microsoft.com/downloads/details.aspx?familyid=&displaylang=en.

Applying SBS Service Pack 1

If you are upgrading an existing installation of SBS 2003 that does not already have Service Pack 1 and ISA Server 2004 preconfigured, follow these steps before upgrading to ISA Server 2004:

  1. Perform the following prerequisite activities:

    1. Plan and communicate downtime, and then take the server offline so that it is not connected to the network.

    2. Log on to the SBS 2003 computer at the console using the local, built-in Administrator account. Do not try to perform the upgrade remotely.

    3. Ensure that the local, built-in Administrator account is not a member of the Power Users group.

    4. Temporarily disable all antivirus services during the upgrade.

    5. Be aware that the setup may cause some uninterruptible power source (UPS) devices to switch to battery power during the upgrade, and this can cause problems. To prevent problems, connect the computer directly to a surge protector connected to an outlet.

    6. To avoid an error during setup, ensure that you have Microsoft Outlook 2003 installed in the ClientApps folder.

    7. Ensure that you have at least 2 GB of free space on the boot drive.

    8. Ensure that the ClientApps share on the SBS server is the same as the ClientAppsRoot value in the HKEY_LOCAL_MACHINE\Software \Microsoft\SmallBusinessServer\clientsetup key.

    9. Remove the Firewall Client from existing computers, so that you can reinstall the new Firewall Client (which supports encryption).

  2. Install SBS 2003 Service Pack 1 Premium using the CD obtained from Microsoft. You cannot upgrade to Service Pack 1 Premium with the Service Pack 1 Standard download from the Microsoft Web site if you have Premium Edition. Install the following items, following the instructions on the screen:

    1. Install Windows Server 2003 Service Pack 1.

    2. Install Windows SharePoint Services 2.0 Service Pack 1.

    3. Install Exchange Server 2003 Service Pack 1.

    4. Install Windows XP Service Pack 2 for Client Deployment.

    5. Install Windows Small Business Server 2003 Service Pack 1.

    6. Install SQL Server 2000 Service Pack 4.

    Detailed instructions on how to update all the SBS 2003 components to Service Pack 1 is outside the scope of this book, which focuses on ISA Server 2004. For a delightfully detailed step-by-step guide, see "How To Install Service Pack 1 For SBS 2003" by Mariëtte Knap et al., located at http://www.smallbizserver.net/Default.aspx?tabid=236.

  3. Finally, install Microsoft ISA Server 2004 as described in the next section.

Installing ISA Server 2004

  1. From the Windows Small Business Server Service Pack 1 Premium Technologies Setup CD, click the Install Microsoft Internet Security And Acceleration Server 2004 link shown in Figure 20-1.

    Important

    Be sure to use only the SBS 2003 CDs from Microsoft, as they contain scripts that accommodate the unique colocation of all SBS components on the same computer as ISA Server.

  2. On the Welcome To The ISA Server 2004 Setup For Small Business Server 2003 Wizard page, click Next.

  3. On the License Agreement page, select I Accept The Terms In This License Agreement, and then click Next.

  4. On the Installation Path page, select the location where you will install ISA Server, and then click Next.

  5. On the Completing The ISA Server 2004 Setup For Small Business Server 2003 Wizard page, review your settings, and then click Finish.

    Note

    If you wish to view or save the configuration information from the wizard, click the To Print, Save, Or E-Mail This Information, Click Here link.

  6. The wizard will back up the existing ISA Server 2000 configuration, uninstall ISA Server 2000, and then install ISA Server 2004.

  7. The wizard then prompts you to configure the SBS 2003 Internet and e-mail settings. Walk through the wizard as described in the next section, "Running the Configure E-Mail and Internet Connection Wizard."

  8. Once you've completed the Configure E-Mail and Internet Connection Wizard, the Setup Wizard installs the Microsoft SQL Server 2000 Desktop Engine (MSDE) Service Pack 4 to support SQL logging in ISA Server 2004.

  9. When the ISA Server Setup For Small Business Server 2003 dialog box states that The Wizard Has Completed Successfully, click Close.

  10. When prompted to reboot your server, click OK.

Image from book
Figure 20-1: Install ISA Server 2004 onto an SBS 2003 computer using the Service Pack 1 CDs from Microsoft.

Running the Configure E-Mail and Internet Connection Wizard

If you are configuring ISA Server for the first time, you need to create the settings to connect to the Internet. SBS 2003 provides the Configure E-Mail and Internet Connection Wizard to step you through the configuration of Internet connectivity for your server.

Note

Remember that you should have two network adapters—one external-facing, and one internal-facing—in your SBS 2003 Server. Without two network adapters, you cannot take advantage of the firewall features of ISA Server. Instead, you will only have the ability to use the Proxy services.

To do this, perform the following steps:

  1. From the To-Do List that appears after completing the Service Pack 1 Setup, in the Network Tasks area, click the Start link next to the Connect To The Internet entry. The Configure E-Mail and Internet Connection Wizard appears, as shown in Figure 20-2.

  2. On the Connection Type page, select either Broadband or Dial-Up, depending on the type of configuration you have, and then click Next.

    Note

    Broadband connections include Digital Subscriber Line (DSL) and cable modem installations. Even if you have an Integrated Systems Digital Network (ISDN) connection, the modem is probably doing the dialing, so you should still choose Broadband. Choose Dial-Up only if the computer must dial a number to establish an Internet connection.

  3. If you select Dial-Up, click Next. If you select Broadband, select the option that most closely fits your connection from the My Server Uses list shown in Figure 20-3, and then click Next. The following instructions are organized based on the selection you choose here—go to the appropriate step based on your selection.

  4. If you selected Dial-Up Connection, follow these steps to finish setting up your SBS Server to connect to the Internet:

    1. On the Dial-Up Connection page, select an already-existing dial-up connection, or create a new one by clicking New, and then typing in the relevant information, as shown in Figure 20-4. Click Next to continue.

    2. On the Local Network Connection page, select the network adapter that connects to the Internal network, and then click Next.

  5. If you select A Local Router Device With An IP Address, follow these steps to finish setting up your SBS Server to connect to the Internet:

    1. On the Router Connection page, type in the DNS information for your local connection, as shown in Figure 20-5. If you select the My Server Uses A Single Network Connection For Both Internet Access And The Local Network check box, you will be able to take advantage of a limited set of ISA Server's services—it will not function as a viable firewall in this configuration.

    2. On the Network Configuration page, select the network adapter for external access (ISA Network Connection), and the network adapter connecting to your internal network (Local Network Connection), and then click Next.

  6. If you select A Connection That Requires A User Name And Password (PPPoE), follow these steps to finish setting up your SBS Server to connect to the Internet:

    1. On the PPPoE Connection page, create a new connection designating the settings given to you by your DSL provider, and then click Next.

    2. On the Local Network Connection page, select the network adapter that connects to the internal network, and then click Next.

  7. If you select A Direct Broadband Connection, follow these steps to connect your SBS server to the Internet:

    1. On the Network Configuration page, select the network adapter for external access (ISA Network Connection), and the network adapter connecting to your internal network (Local Network Connection), and then click Next.

    2. On the Direct Broadband Connection page, type in the Default Gateway value provided by your Internet service provider (ISP), as well as the DNS server addresses, as shown in Figure 20-6, and then click Next.

  8. On the Firewall page, select Enable Firewall to enable ISA Server, and then click Next.

  9. On the Services Configuration page, select the additional services you wish to enable, and then click Next.

    Note

    By default, all users have the ability to connect to the Internet. These options create additional access and publishing rules that allow additional connectivity. Depending on what services you select, you will see other options. We recommend creating your own rules after the installation of ISA Server.

  10. On the Web Services Configuration page, select the Web services you wish to make available, as shown in Figure 20-7, and then click Next. This action creates publishing rules for these Web sites. By default, no Web sites will be published.

    Note

    If you chose the Dial-Up option, the Web Services Configuration page does not appear. You cannot publish Web services if you do not have a persistent connection to the Internet.

    1. If you do choose to publish Web sites, on the Web Server Certificate page, either select Create A New Web Server Certificate or—if you already have a Web server certificate from Verisign, Thawte, or some other third-party trusted authority—select Use A Web Server Certificate From A Trusted Authority.

    2. Type the name of the server or navigate to the certificate file, and then click Next.

  11. On the Internet E-Mail page, select the option to configure Internet e-mail. If you select Enable Internet E-Mail, the SmallBusiness SMTP Connector is installed—use this option if you want to connect to Post Office Protocol 3 (POP3) mailboxes. If you select Disable Internet E-Mail, the SmallBusiness SMTP Connector is deleted—you will be able to use Exchange internally. If you select Do Not Change Internet E-Mail Configuration, nothing is altered. Click Next.

  12. On the E-Mail Delivery Method page, select Use DNS To Route E-Mail to use your own Simple Mail Transfer Protocol (SMTP) server to send e-mail, or select Forward All E-Mail To E-Mail Server At Your ISP, and type the fully qualified domain name (FQDN) of your ISP's SMTP server. Click Next.

  13. On the E-Mail Retrieval Method page, select the options that are appropriate for your Exchange server, and then click Next.

  14. On the E-Mail Domain Name page, type in the registered domain name for your e-mail addresses, as shown in Figure 20-8. Click Next.

  15. On the Mail Schedule page, select the schedule your server will use to check e-mail, and then click Next.

  16. On the Remove E-Mail Attachments page, select the file extensions that you wish to strip from e-mail messages. You can select Save Removed E-Mail Attachments In A Folder to save the attachments in a central location. Click Next to continue.

  17. On the Completing The Configure E-Mail And Internet Connection Wizard page, review your configuration, and then click Next.

  18. The Configure E-Mail and Internet Connection Wizard then shows your progress as it configures the server, as shown in Figure 20-9.

  19. When the Configure E-Mail and Internet Connection Wizard states that "The Wizard Has Completed Successfully," click Close.

    Note

    You might be prompted to configure Password Policies. We recommend selecting all three check boxes, as shown in Figure 20-10. You are also prompted to connect to the Microsoft Update site to patch your server. Do so.

  20. Restart your server, and reenable and start the services you disabled earlier (such as antivirus programs and the IIS Admin Service).

Image from book
Figure 20-2: SBS 2003 uses the Configure E-Mail and Internet Connection Wizard to configure the initial settings for ISA Server. You can then configure more detailed settings.
Image from book
Figure 20-3: The Broadband Connection page allows you to choose the type of broadband connection you use.
Image from book
Figure 20-4: Enter the information for your dial-up account.
Image from book
Figure 20-5: Type in your DNS and router information here.
Image from book
Figure 20-6: Enter the default gateway used by your ISP and the DNS server addresses that will resolve host names.
Image from book
Figure 20-7: The Web Services Configuration page provides you with an easy way to create publishing rules for the different Web services provided by SBS 2003.
Image from book
Figure 20-8: Type the domain name that your e-mail addresses will use.
Image from book
Figure 20-9: The Configure E-Mail and Internet Connection Wizard configures SBS 2003 based on the settings you choose in the wizard.
Image from book
Figure 20-10: Although not directly related to ISA Server, configuring Password Policies is a vital step toward having a secured SBS 2003 environment.


Troubleshooting ISA Server 2004 on Small Business Server 2003

There are a few issues you might encounter when installing or configuring ISA Server 2004 on SBS 2004. Here are some of the more common issues:

Tip

For the most current information and issues, search for ISA Server 2004 issues at http://support.microsoft.com.

Setup Issues

  • You're prompted to uninstall ISA Server manually because IISAdmin cannot be shut down. In this case, don't uninstall ISA Server 2000 manually, or you'll have to recreate all of your settings. Instead, temporarily disable the IIS Admin Service (also known as IISAdmin) from the Services console, reboot the server, and then restart the installation.

  • During the installation, you lose connectivity to the server. You're connected remotely. Log into the console at the server itself.

  • The Configure E-Mail and Internet Connection Wizard fails. You've changed the name of the default SBS Internet Users group. Change it back to SBS Internet Users.

  • Miscellaneous failures are recorded in the log files. You're not logged into the server with the built-in Administrator account. Log on with the default Administrator account and restart the installation.

You cannot Connect to Exchange Server from Outlook After Installing SBS Service Pack 1

After applying Service Pack 1, you might not be able connect to Exchange from Outlook 2003. Changes to the Remote Procedure Call (RPC) filter cause this problem. To resolve the issue, you can either disable the RPC filter (not recommended), or install the Microsoft Internet Security and Acceleration (ISA) Server 2004 Standard Edition RPC Filter Blocks Outlook Traffic from Computers Running Windows Server 2003 Service Pack 1 (SP1) hotfix on your ISA Server 2004 computer from http://go.microsoft.com/fwlink/?LinkID=47520.

You Receive "Service Not Responding" Errors in the Event Log

If your SBS computer is performing CPU-intensive operations, you might receive a Service Not Responding error with the following detailed description: "Due to an unexpected error, the service fwsrv stopped responding to all requests. Try to stop the service or kill the corresponding process if it does not respond, and start it again. Check the Event Viewer for related error messages."

First, check to ensure that the Fwsrv service is started by opening the Services console from the Administrative Tools folder on the SBS 2003 computer and verify that the Microsoft Firewall service shows a status of Started.

If it is, you can safely ignore the error message, as explained in the article, "You Receive A False Positive Firewall Service Error Message on your ISA Server 2004 Computer," at http://support.microsoft.com/kb/840180.

Web Publishing Rule Is Invalid

You might receive an error stating that a Web publishing rule is invalid. Delete the ISA22 rule if you published your http://CompanyWeb site using the article "How to Publish http://Companyweb to the Internet by Using ISA Server 2000 on a Server That Is Running Windows Small Business Server 2003, Premium Edition," at http://support.microsoft.com/kb/838304.


Appendix A: Additional Resources

General Books and References

  • Dr. Tom Shinder's Configuring ISA Server 2004 by Deb and Tom Shinder http://www.amazon.com/exec/obidos/ASIN/1931836191/isaserver/

  • Microsoft ISA Server 2004 - Das Handbuch—German Language ISA Server book by Marc Grote, Christian Gröbner, and Dieter Rauscher http://www.msisafaq.de/Buch/

  • ISA Server 2004 Standard Edition Protégez votre système d'information—French Language ISA Server book by Philippe Mathon and Frédéric Esnouf http://www.amazon.fr/exec/obidos/ASIN/2746029812/esnoufnet-21


Chapter 1

  • Microsoft ISA Server 2004 product overview: http://www.microsoft.com/isaserver/evaluation/overview/default.mspx

  • What's new in ISA Server 2004: http://www.microsoft.com/isaserver/evaluation/whatsnew.mspx

  • Comparison of ISA Server 2004 Standard and Enterprise Editions: http://www.microsoft.com/isaserver/evaluation/se_ee_comp/default.mspx

  • ISA Server 2004 overview presentation: http://www.microsoft.com/isaserver/evaluation/demo/default.mspx

  • ISAserver.org: http://www.isaserver.org/

  • German ISA Server FAQ: http://www.msisafaq.de/

  • ISA Server Community: http://www.microsoft.com/isaserver/community/default.mspx

  • ISA Server 2004 technical resources: http://www.microsoft.com/isaserver/techinfo/default.mspx

  • ISA Server books: http://www.microsoft.com/isaserver/techinfo/books/default.mspx


Chapter 2

  • How to install ISA Server 2004 hotfixes and updates: http://support.microsoft.com/default.aspx?scid=kb;en-us;885957

  • Lockdown mode of operation in ISA Server 2004: http://support.microsoft.com/default.aspx?scid=kb;en-us;838711

  • The features and limitations of a single-homed ISA Server 2004 computer: http://support.microsoft.com/default.aspx?scid=kb;en-us;838364

  • How to configure ISA Server 2004 after you add a new network adapter or replace a network adapter: http://support.microsoft.com/default.aspx?scid=kb;en-us;840698


Chapter 3

  • Core services that must be enabled for your ISA Server 2004 computer to function correctly: http://support.microsoft.com/?scid=kb;en-us;888649&spid=2108&sid=global

  • Microsoft ISA Server 2000 Enterprise Edition installation and deployment guide: http://www.microsoft.com/technet/prodtechnol/isa/2000/deploy/isaentin.mspx

  • An update is available to prevent Configuration Storage server account settings from expiring when you use certificate authentication in ISA Server 2004 Enterprise Edition: http://support.microsoft.com/default.aspx?scid=kb;en-us;894609

  • Upgrading to Microsoft ISA Server 2004 Enterprise Edition: http://www.microsoft.com/technet/prodtechnol/isa/2004/isa2kexport.mspx


Chapter 4

  • How to deploy the ISA Server 2004 Firewall Client program: http://support.microsoft.com/?scid=kb;en-us;838122&spid=2108&sid=global

  • How to configure, manage, and troubleshoot the Firewall client in Microsoft ISA Server 2004: http://support.microsoft.com/?scid=kb;en-us;886993&spid=2108&sid=global


Chapter 5

  • ISA Server 2000 settings and features that are not supported when you migrate to ISA Server 2004: http://support.microsoft.com/default.aspx?scid=kb;en-us;840697

  • The migration stops responding when you try to migrate configuration settings from an ISA Server 2000–based computer that uses SSL certificates to an ISA Server 2004–based computer: http://support.microsoft.com/default.aspx?scid=kb;en-us;888643


Chapter 6

  • How to configure ISA Server 2004 to log data to an SQL Server database: http://support.microsoft.com/default.aspx?scid=kb;en-us;838710

  • How to manually remove the MSDE database in ISA Server 2004: http://support.microsoft.com/?scid=kb;en-us;838707&spid=2108&sid=global


Chapter 7

  • How to use ISA Server 2004 to redirect requests to different Web sites based on the client IP address: http://support.microsoft.com/default.aspx?scid=kb;en-us;843128

  • How to use America Online 6.0 with ISA Server 2004: http://support.microsoft.com/default.aspx?scid=kb;en-us;837738


Chapter 8

  • How to publish a Web server on a perimeter network using ISA Server 2004: http://support.microsoft.com/?scid=kb;en-us;838242&spid=2108&sid=global

  • How to publish a DNS server in ISA Server 2004: http://support.microsoft.com/?scid=kb;en-us;837833&spid=2108&sid=global

  • How to publish a File Transfer Protocol server that is running on an ISA Server 2004 computer: http://support.microsoft.com/?scid=kb;en-us;838243&spid=2108&sid=global

  • Best practices when you publish two or more internal Web sites that use authentication on an ISA Server 2004–based computer: http://support.microsoft.com/?scid=kb;en-us;886998&spid=2108&sid=global

  • Host headers and URLs are considered to be encoded by UTF8 encoding in ISA Server 2004: http://support.microsoft.com/?scid=kb;en-us;888927&spid=2108&sid=global

  • How to permit non-Microsoft programs to connect to the Internet through ISA Server 2004: http://support.microsoft.com/default.aspx?scid=kb;en-us;837831

  • Differences between server publishing rules and access rules in ISA Server 2004: http://support.microsoft.com/?scid=kb;en-us;837863&spid=2108&sid=global


Chapter 9

  • How to configure networks in ISA Server 2004: http://support.microsoft.com/default.aspx?scid=kb;en-us;867483


Chapter 10

  • RADIUS support in ISA Server 2004: http://support.microsoft.com/default.aspx?scid=kb;en-us;886994

  • The RADIUS authentication process in ISA Server 2004: http://support.microsoft.com/default.aspx?scid=kb;en-us;884492


Chapter 11

  • Support for the Windows Server 2003 Network Access Quarantine Control feature in ISA Server 2004: http://support.microsoft.com/default.aspx?scid=kb;en-us;888651

  • Site-to-site VPNs in ISA Server 2004: http://support.microsoft.com/default.aspx?scid=kb;en-us;888711

  • How to configure a VPN server using ISA Server 2004: http://support.microsoft.com/?scid=kb;en-us;837355&spid=2108&sid=global


Chapter 12

  • Microsoft Coding Corner: http://www.microsoft.com/isaserver/techinfo/Guidance/2004/coding.mspx

  • Jim Harrison's ISA Server Tools Repository: http://isatools.org/

  • Jason Fossen's ISAscripts.org: http://www.isascripts.org/

  • ISA Server 2004 Software Development Kit: http://www.microsoft.com/downloads/details.aspx?FamilyID=&displaylang=en

  • Jespen Hanno Hansen's website at http://www.hanno.dk


Chapter 13

  • Setting Configuration Storage server delay times: http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/setcssdelaytimes.mspx


Chapter 14

  • Best practices firewall policy for ISA Server 2004: http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/firewall_policy.mspx


Chapter 15

  • ISA Server 2004 Standard Edition does not support NLB functionality: http://support.microsoft.com/default.aspx?scid=kb;en-us;884319

  • How to install and use certificates for SSL connections in ISA Server 2004: http://support.microsoft.com/default.aspx?scid=kb;en-us;840614


Chapter 16

  • How to configure ISA Server 2004 to allow for RPC over HTTP client connections from Microsoft Office Outlook 2003 to Microsoft Exchange Server 2003: http://support.microsoft.com/?scid=kb;en-us;884506&spid=2108&sid=global

  • How to publish a Microsoft Exchange server for Outlook Web Access in ISA Server 2004: http://support.microsoft.com/default.aspx?scid=kb;en-us;837354


Chapter 17

  • Deploying Microsoft SharePoint Portal Server 2003 on an extranet: http://office.microsoft.com/en-us/assistance/HA011912721033.aspx


Chapter 18

  • Microsoft ISA Server Management Pack for Microsoft Operations Manager (MOM) 2005: http://www.microsoft.com/downloads/details.aspx?FamilyId=&displaylang=en


Chapter 19

  • ISA Server Virtual Lab: http://www.microsoft.com/technet/traincert/virtuallab/isa.mspx


Chapter 20

  • Microsoft Small Business Server 2003 Service Pack 1 Release Notes: http://download.microsoft.com/download/d/5/b//SBSRelNotes_WEB.htm

  • Small Business Server ISA Server FAQ: http://www.smallbizserver.net/SBS2003/ISAServer2004/tabid/180/Default.aspx


Index

A

absolute URLs, 211
access control, SACLs (system access control lists), 90
access rules
arrays, 266
arrays policies, 266
between remote site and internal network, 238
changing order of, 172
connection limits and, 217
content types, 136–137
creating enterprise access rules, 277
creating ISA communication access rules, 336
creating new, 169
deleting, 171
disabling, 170
enterprise policies for configuring, 277
internal client to Internet, 3
list of, 132
migration to ISA Server 2004 and, 90
network objects, 138–148
order of application, 284
overview of, 168
protocols, 133–135
RPC filters and, 167
schedules, 137
script for creating, 253
user sets, 135–136
VPN clients, 228
access, network, 348
account credentials, 283
accounts, configuring on domain controller, 52
active caching, 4, 90
Active Directory
enterprise-level roles and, 279
group access to VPNs, 221
integration of SharePoint Portal Server with, 316
ISA Server preauthentication and, 302
RADIUS authentication and, 226
user account permissions for connecting to VPNs, 228
Active Directory Application Mode. See ADAM (Active Directory Application Mode)
Active Directory Users And Computers, 228
Active Sync, 304
ADAM (Active Directory Application Mode)
array information stored in, 265
installation executable, 48
ISA Server scalability and, 9
ADAM Data folder, backing up, 280
adamsetup.exe, 48
AddComputer.vbs, 250–253
add-ons, ISA Server 2004, 16
address ranges
creating address range object, 142
Standard Edition with single network adapter, 24
address ranges. See IP addresses
administration, 205–212
certificate revocation, 208
delegating administrative tasks, 205
dial-in preferences, 207
enterprise and array policies and, 275
enterprise level, 276
firewall chaining configuration, 206
firewall client settings, 209
link translation configuration, 211
role-based, 36
viewing ISA Server details, 210
Administration Delegation Wizard, 205
Administration Tools, 28
administrative roles, Enterprise Edition
Array Administrator, 65
assigning, 36, 65
Enterprise Administrator, 65
overview of, 65, 279
Administrator account, 365
agents, MOM 2005
agent-based vs. agentless monitoring, 332
communication configuration, 335
deploying, 333
alerts, 106–113
acknowledging, 113
by e-mail, 108
configuration options, 111
configuring to run a program, 109
creating, 107
creating alert rules, 341
firewall breaches and, 3
intrusion detection, 216
overview of, 106
predefined, 106
reporting alert event to Windows Event Log, 110
resetting, 113
rule groups and, 340
SharePoint Services, 316
starting/stopping ISA Server services, 110
viewing, 112
Windows Event Logs, 110
All Authenticated Users, 136
All Networks (and Local Host), 140
All Protected Networks, 140
All Users, 136
Allow access, array access rules, 266, 285
Allowed Sites, System Policy, 145
antivirus software, disabling during upgrade installation, 365
application filters, 133, 265
application inspection, firewalls, 1
Application Log, Event Viewer, 105
Application mode, Terminal Services, 27
application settings, Firewall clients, 82
Application Usage Content, reports, 127
Application.ini file, Firewall clients, 86
application-layer filtering
ISA Server capabilities, 3
single network adapter configuration, 25
applications
legacy application support, 348
not installing on dedicated ISA Server computer, 20
Array Administrator
array administrative roles, 285
array policy administration, 275
Enterprise Edition administrative roles, 65
granting ability to create access rules, 286
policy management can be delegated to, 284
viewing enterprise policies, 276
Array Auditor
array administrative roles, 285
Enterprise Edition administrative roles, 65
Array Monitoring Auditor
array administrative roles, 284
Enterprise Array Administrator roles, 65
array policies, 284–286
access rules, 285
administration rights for, 275
backing up, restoring, deleting array configuration, 286
checking settings, 285
comparing with enterprise policies, 275
configuring, 286
creating access rules, 336
enterprise policies working in tandem with, 276
flexibility of combining with enterprise policies, 276
overview of, 284
role-based administration, 284
rules for applying effective policies, 284
arrays, 265–274
adding servers to ISA server array, 52
administering with policy set, 275
communication, 271–273
configuring, 266–269
configuring roles and permissions, 285
connecting to remote, 282
creating, 265
creating ISA Server array, 49
deleting, 269
DNS name for, 267
intra-array communication, 289–291
ISA Server scalability and, 9
managing, 270
managing centrally with enterprise polices, 277
member requirements, 265
moving server to different array, 270
renaming, 269
rules for applying enterprise policies at array level, 276
troubleshooting, 273–274
Web caching and, 4
attacks
Exchange Server vulnerabilities, 298
firewall breaches, 3
firewall configuration and, 20
intrusion detection and, 214
RPC-based, 305
authentication
array members, 268
certificate for workgroup authentication, 59
forms-based authentication, 303
legacy TCP/UDP connections, 3
Outlook clients via Exchange, 307
over SSL encrypted channel, 101
RADIUS, 212, 225
SharePoint Portal Server, 323
user authentication for caching, 41
VPN clients, 224
VPN options, 219
Web connections, 73
Web proxy clients, 75
Windows Authentication, 101
automatic dialing, network connection configuration, 207
Autorun, 21


Previous Page
Next Page

Index

B

back firewall, 194
back ups
array configuration, 286
.bkf extension, 54
enterprise configuration, 279–280
ISA Server prior to upgrade to SBS installation, 365
management packs, ISA Server 2004, 339
virtual machines, 351
bandwidth rules, 90
basic delegation, authentication, 323
.bkf extension, 54
bridging, Outlook Web Access, 301
broadband connections, 368


Previous Page
Next Page

Index

C

CA (Certificate Authority)
installing root certificate from, 60
obtaining certificate for Outlook Web Access, 299
cable modems, 368
Cache Array Routing Protocol. See CARP (Cache Array Routing Protocol)
caching
active caching not available in ISA Server 2004, 90
configuring cache properties, 38
configuring cache rules, 39
dynamic content, 41
enabling and disabling ISA Server cache, 36
enabling for CARP, 287
ISA Server capabilities, 3–4
offline content, 41
user authentication and, 41
Web content on arrays, 271
Caching-Only Mode, ISA Server 2000, 24
CALs (Client Access Licenses), 8
capabilities, ISA Server 2004
caching, 3–4
firewall benefits, 2–3
CARP (Cache Array Routing Protocol), 287–291
enabling caching, 287
enabling for Web requests, 288
Enterprise Edition and, 6
intra-array communication, 289–291
load factor configuration, 290
overview of, 287
scheduled content download jobs, 291
CERN (Conseil Européen pour la Recherche Nucléaire), 67
Certificate Authority (CA). See CA (Certificate Authority)
certificate revocation list (CRL), 208
certificates
configuring certificate revocation, 208
exporting server certificates, 60
importing Web server certificates, 176
installing root certificate, 60
obtaining for Outlook Web Access, 299–301
server certificate, 60
SSL encryption for Exchange server, 309
VPN authentication options, 224
Challenge Handshake Authentication Protocol (CHAP), 219
CHAP (Challenge Handshake Authentication Protocol), 219
CIDR (classless interdomain routing), 143
Circuit, filtering, 3
classless interdomain routing (CIDR), 143
Client Access Licenses (CALs), 8
client certificates, verifying, 208
ClientApps folder, Outlook 2003 in, 365
clients
access options to internal network, 91, 94
access rules, 3
MOM 2005, 333
Virtual Server 2005, 352
clients, installing and configuring, 67–88
choosing the right client, 68
DHCP services, 87
DNS settings, 87
Firewall clients, 76–86
SecureNAT clients, 69–72
troubleshooting, 87
types of clients, 67
Web proxy clients, 72–75
cluster parameters, NLB, 293
clusters, NLB configuration, 292
CM (Connection Manager), 240
CMAK (Connection Manager Administration Kit), 240
COM (Component Object Model), 241
command-line
running Migration Tool from, 103
setup parameters, 27, 55
unattended installation of Enterprise Edition, 54
Common.ini file, Firewall clients, 86
communication, arrays, 271–273
overview, 271
policy rules for, 272
protocols for, 272
Component Object Model (COM), 241
components
selecting during Enterprise Edition install, 50
troubleshooting missing components following upgrades, 103
computer groups, creating with MOM 2005, 343–345
computer object, creating, 142
computer rule element, 250, 260
computer sets, 144
Conseil Européen pour la Recherche Nucléaire (CERN), 67
confidential information, backing up enterprise configuration, 280
configuration nodes, ISA Server 2004 Management console, 14
configuration storage servers. See CSSs (configuration storage servers)
Configure E-Mail and Internet Connection Wizard, 367–374
connection limits, 217–218
Connection Manager Administration Kit (CMAK), 240
Connection Manager (CM), 240
Connection Timeout setting, 73
connections/connectivity
confirming in VPNs, 239
Connection Timeout setting, 73
quotas for TCP/UDP connections, 3
verifying session connectivity, 116
connectivity verifier, 116
content types, 136–137
Control Panel, Network Connections, 207
CreateHTTPAllowRule.vbs, 253–255
credentials, basic delegation and, 323
CRL (certificate revocation list), 208
CSSs (configuration storage servers)
array communication and, 271
array policy information stored in, 268
arrays connecting to, 276
arrays storing policies and server information in, 265
back-to-back scenario, 58
configuring CSS and alternate CSS for arrays, 273
connecting to remote enterprises and arrays, 282–283
disaster recovery and, 274
ensuring connectivity to, 48
installing, 46
installing CSS from media, 54
installing during Enterprise Edition upgrade, 97, 103
installing on domain controller, 52
renaming, 61
selecting installation environment, 47
specifying alternative, 62
troubleshooting connection to arrays, 274
Workgroup Enterprise scenario, 48
workgroup scenario, 57


Previous Page
Next Page

Index

D

dashboard
overview of, 105
refresh rate settings, 106
Data Source Name (DSN), 120
database, SQL Server, 119
Default Policy, enterprise policies, 277, 283
Default Rule, enterprise policies, 283
delegation, administrative tasks, 205
demand dial interface, VPNs, 232
demilitarized zone (DMZ), 361
Deny access, 266, 285
deployment, Enterprise Edition strategies, 45
DHCP (Dynamic Host Configuration Protocol)
Firewall client configuration, 87
IP addresses for VPNs, 223
SecureNAT clients, 70
DHCP Relay Agent, 223
dial-in preferences, 207
dial-up connections
ISA Server/SBS configuration, 368
prerequisites for installing Standard Edition, 19
dictionary entries, Web publishing rules, 212
Digital Subscriber Line (DSL), 368
disaster recovery
CSS, 274
Virtual Server 2005, 349
disk drives
virtual. See virtual hard disks
Virtual Server 2005 and, 348
distributed caching, 4
DMZ (demilitarized zone), 361
creating, 139, 197
virtual networks and, 361
DNS (Domain Name System)
application level attacks, 215
arrays, 266, 267
creating split DNS, 306
Exchange Server and, 297
firewall client configuration, 87
ISA Server/SBS configuration, 370
SharePoint Portal Server and SharePoint Services and, 322
split DNS, 322
VPN clients and, 223
DNS intrusion detection filters, 215
DNS Hostname Overflow, 215
DNS Length Overflow, 215
DNS round robin, 296
DNS Zone Transfer, 215
documents, SharePoint Services, 316
Domain Admins group, 52
domain controllers
installing CSS on, 52
not installing ISA Server on, 20, 31
domain name sets
creating, 145
overview of, 145
Domain Name System. See DNS (Domain Name System)
domains
firewall client connections and, 83
ISA Server joining, 31
registering, 298
downloads, scheduling, 4, 41–44
DSL (Digital Subscriber Line), 368
DSN (Data Source Name), 120
dynamic content, caching, 41
Dynamic Host Configuration Protocol. See DHCP (Dynamic Host Configuration Protocol)


Previous Page
Next Page

Index

E

EAP (Extensible Authentication Protocol)
certificates, 225
mapping EAP clients to Windows accounts, 221
EAP-TLS (Extensible Authentication Protocol-Transport Layer Security), 219
edge firewalls, 190
e-mail
configuring remote access, 298
ISA Server/SBS configuration, 372
receiving alerts, 108
encryption, ISA Server firewall client and, 22
End User License Agreement (EULA), 21
Enterprise Administrator
assigning administrative roles, 65
creating and configuring enterprise policies, 276
enterprise administration roles, 279
enterprise policy administration and, 275
Enterprise Auditor, 65, 279
Enterprise CA, requesting certificate from, 299–301
Enterprise Edition, ISA Server
arrays. See arrays
assigning administrative roles, 65
CARP configured on per-network basis, 289
CARP support, 287
choosing right ISA Server edition, 6
configuring, 64
CSS installation and, 46
distributed caching, 4
features, 6–7
firewall share and message screener and, 52
installation requirements, 45
installing, 49–52
installing CSS from media, 54
installing CSS on domain controller, 52
ISA Server array as prerequisite, 49
licensing, 10
remote administration, 66
scalability, 9
troubleshooting installation, 63
unattended installation, 54
uninstalling, 63
upgrading ISA Server 2000. See upgrading ISA Server 2000 Enterprise Edition to ISA Server 2004 Enterprise Edition
upgrading ISA Server 2004 Standard Edition to, 102–103
where not to install, 46
workgroup installation, 56
Enterprise Edition, Windows Server 2003, 293
enterprise networks, 139
enterprise policies, 276–283
administration rights for, 275
applying at array level, 276
array policies working in tandem with, 276
backing up and restoring configuration, 279–281
comparing with array policies, 275
configuring roles and permissions, 279
creating, 277
creating enterprise access rules, 277–278
deleting, 281
enterprise administration and, 276
flexibility of combining with array policies, 276
role-based administration, 279
setting in default policy, 283
enterprise technologies, 287–296
Cache Array Routing Protocol. See CARP (Cache Array Routing Protocol)
Network Load Balancing. See NLB (Network Load Balancing)
overview of, 287
enterprises
administering, 276
connecting to remote, 282
Error Reporting sites, Microsoft, 145
errors, configuration errors following import, 104
EULA (End User License Agreement), 21
Event Viewer, 105
events
analyzing, 118
creating event rules, 341
monitoring, 118
overview of, 118
rule groups and, 340
Exchange Server
secure access to, 1
Service Pack 1, 364
troubleshooting SBS connection to, 375
unable to connect from Outlook 2003, 375
Exchange Server Active Sync, 184
Exchange Server, integrating with ISA Server, 297–314
configuring Exchange as back-end RPC server, 309–310
configuring Outlook clients 2002 and 2003, 308
configuring remote clients for RPC, 306–308
configuring remote RPC client for RPC over HTTP, 312–313
creating Outlook Web Access publishing rule, 301–302
creating RPC over HTTP publishing rule, 310–312
DNS name resolution and, 297
mail publishing with, 313–314
methods for accessing, 297
obtaining Outlook Web Access certificate, 299–301
outbound RPC access for Outlook clients, 306
Outlook Web Access for connecting with remote Exchange clients, 298–299
overview of, 298
preauthentication of connections, 302–304
publishing Outlook Web Access to Exchange clients, 299
publishing RPC over HTTP for Outlook clients, 308–309
remote access for Exchange clients, 304–305
security features within Exchange, 305–306
exports
firewall policies, 160, 198
ISA Server 2000 Enterprise Edition configuration to ISA Server 2004 Enterprise Edition, 96
ISA Server 2000 Standard Edition configuration to ISA Server 2004 Standard Edition, 93
ISA Server 2004 Standard Edition configuration to ISA Server 2004 Enterprise Edition, 102
script for exporting data, 248
ExportServers.vbs, 255–259
Extensible Authentication Protocol. See EAP (Extensible Authentication Protocol)
Extensible Authentication Protocol-Transport Layer Security (EAP-TLS), 219
extensions, ISA Server 2004, 16
external networks
creating, 139, 197
Internet access rule, 200
multinetwork configuration and, 196
types of networks, 139


Previous Page
Next Page

Index

F

file extensions, 136
file logging, 121
filters
Application Filter, 133
application-layer, 3
HTTP Web content filtering, 4
importing/exporting definitions, 118
logs, 122
session, 115
Web proxy, 82
firewall chaining
configuring, 206
multinetworking, 203
Firewall Client Share
installing, 23
when not to install, 24
firewall clients
application settings, 82
Application.ini file, 86
checking version number of, 79
Common.ini file, 86
configuring, 80, 209
configuring on local computer, 83
defining settings with Management console, 81
direct access to specified Web sites, 82
enabling client support on ISA Server, 80
excluding domains from Firewall client connections, 83
firewall chaining and, 206
functionality of, 67
GUI settings, 84
installing, 77–79
legacy support, 81
LocalLAT.txt file, 85
making Firewall client share available, 76
Management.ini file, 86
overview of, 76
removing during ISA Server/SBS installation, 365
service packs, 79
troubleshooting, 87
types of ISA server clients, 67
when to use, 68
working with, 76
Firewall Engine (fweng.exe), 113
firewall policies
access rules. See access rules
array access rules, 285
arrays, 271
best practices, 159
creating access rules, 336
enterprise and array policies and, 276
exporting, 160
FTP filtering, 162
HTTP filtering, 163, 166
importing, 161
ISA Server 2004 Management console, 14
lockdown mode, 160
order of, 159
overview of, 150, 159
RPC filtering, 166, 168
RPC over HTTP publishing rule, 310
server publishing rules, 301
system policies. See system policy
troubleshooting, 188
Firewall Policy node
creating content types, 137
creating protocols, 134
creating schedules, 138
creating user sets, 136
ISA Server management console, 131
system policy configuration, 33
firewalls
application inspection, 1
back firewalls, 194
edge firewalls, 190
exporting firewall policy, 198
firewall clients for Enterprise Edition, 51
firewall policies, 33
front firewalls, 193
importing firewall policy, 198
installing firewall share, 52
intrusion detection, 3
ISA Server as perimeter firewall, 20
ISA Server/SBS configuration, 371
leg perimeter firewalls, 192
Microsoft Firewall (wpsrv.exe), 113
not available with single network adapter configuration, 24
packet, circuit, and application-layer filtering, 3
policy access rule for VPN clients, 228
policy options, 191
secure publishing, 3
securing Outlook Web Access, 299
toolbox elements and, 131
types of network templates for, 189
forms-based authentication, 303
FPC Root object, 246
FQDN (fully qualified domain name)
of Exchange Server, 300
remote CSS and, 282
front firewalls, 193
FTP, caching FTP content, 41
FTP Application filter, 162
FTP filtering, firewall policies, 162
fweng.exe, 113, 160
Fwsrv service, 375


Previous Page
Next Page

Index

G

gateways
ISA Server/SBS configuration, 371
primary VPN gateway, 233
secondary VPN gateway, 239
specifying default gateway for external networks, 20
Group Policy
automating configuration of Internet Explorer, 75
Firewall client installation with, 78
groups
access to VPNs, 221
array member role assignments, 269
enterprise-level roles and, 279
group-based security in SharePoint Portal Server, 316
guest machines, Virtual Server 2005, 347
GUI (graphical user interface) settings, Firewall clients, 84


Previous Page
Next Page

Index

H

hard disks
virtual. See virtual hard disks
Virtual Server 2005, 348
hardware
compatibility with virtual machines, 348
Enterprise Edition, 10
SBS system requirements, 8
SCSI arrays, 350
Standard Edition, 9
virtual server requirements, 362
Harrison, Jim, 90
host (A) record, 298
host machines, Virtual Server 2005, 347
host parameters, NLB (Network Load Balancing), 293
"How To Install Service Pack 1 for SBS 2003" (Knap), 366
HTML, security of, 299
HTTP (Hypertext Transfer Protocol)
access rule, 253
caching HTTP content, 41
RPC over. See RPC over HTTP
securing Outlook Web Access and, 299
SSL Bridging and, 179
Web content filtering, 4
HTTP filtering, firewall policies, 163–166
HTTP listener, Web listeners, 148
HTTPS, 179
hyperthreading, 351


Previous Page
Next Page

Index

I

IAS (Internet Authentication Server), 225
ICF (Internet Connection Firewall), 20
ICS (Internet Connection Sharing), 20
IE (Internet Explorer)
automatic configuration of, 75
manual configuration of, 74
prerequisites for installing Standard Edition, 19
IIS (Internet Information Service), 299
IISAdmin (IIS Admin Service), 374
IMAP4 (Internet Message Access Protocol 4)
client services for server publishing, 186
methods for ISA Server to access Exchange, 297
publishing basic mail for Exchange servers, 313
imports
configuration errors following, 104
ISA Server 2000 Enterprise Edition configuration into ISA Server 2004 Enterprise Edition, 99
ISA Server 2000 Standard Edition configuration into ISA Server 2004 Standard Edition, 94
firewall policies, 161, 198
Web publishing certificates, 176
ImportServers.vbs, 260–263
in-place upgrade. See upgrading ISA Server 2000 Standard Edition to ISA Server 2004 Standard Edition
Install/Uninstall Agents Wizard, 333
Integrated Systems Digital Network (ISDN), 19, 368
internal networks
client access options, 91, 94
configuring, 140
creating, 139, 197
Internet access rule, 200
multinetwork configuration and, 196
specifying address range for, 22
types of networks, 139
Internet
access rules, 3
configuring ISA Server/SBS installation for, 367
difficulties with L2 TP across, 304
modifying SharePoint Services Web.config file, 321
SharePoint Services connecting to, 318
VPNs for secure access, 219
Internet Authentication Server (IAS), 225
Internet Connection Firewall (ICF), 20
Internet Connection Sharing (ICS), 20
Internet Explorer. See IE (Internet Explorer)
Internet Information Service (IIS), 299
Internet Security and Acceleration Server. See ISA Server
Internet Server Application Programming Interface (ISAPI), 308
intra-array communication, 289
intrusion detection, 214–216
alerts, 216
DNS attacks, 215
ISA Server firewall and, 3
types of attacks, 214
IP addresses
add range to, 140
assigning to external network adapter, 298
avoiding duplicates on VPNs, 238
back firewall configuration, 194
checking with IPCONFIG, 71
computer designation and, 141
connection limits and, 218
edge firewall configuration, 190
Enterprise Edition install, 51
front firewall configuration, 193
INTERNALNETRANGES property of Msisaund.ini, 27
intra-array communication, 289
leg perimeter firewall configuration, 192
methods for assigning to networks, 197
Network Load Balancing and, 291, 295
ranges, 142
remote CSS, 282
reserved, 29
SecureNAT clients, 70
single network adapter configuration, 196
static addresses, 19
viewing domain addresses, 298
VPN client, 223
Web publishing and, 182
IP Fragments, 216
IP Half Scan attacks, 214
IP preferences, 216–217
IP Routing, 216
IPCONFIG, 71
IPSec, 304
IPSec Tunnel Mode, 232
ISA Server 2000
Caching-Only Mode, 24
comparing with ISA Server 2004, 4–6
Management console, 11
upgrading Enterprise Edition. See upgrading ISA Server 2000 Enterprise Edition to ISA Server 2004 Enterprise Edition
upgrading Standard Edition. See upgrading ISA Server 2000 Standard Edition to ISA Server 2004 Standard Edition
Web caching, 4
ISA Server 2004
capabilities, 2–4
comparing features of product editions, 7
comparing with ISA Server 2000, 4–6
editions, 6
Enterprise Edition. See Enterprise Edition
features removed from, 5
methods for installing on SBS server, 364
new features, 5
remote administration. See remote administration
renaming, 30
Service Pack 1, 364
Standard Edition. See Standard Edition
support community, 17
tools, 15, 16
upgrading Standard Edition to Enterprise Edition, 102–103
viewing installation details, 210
wizards, 15
ISA Server 2004 Enterprise Edition. See Enterprise Edition
ISA Server 2004 Security Hardening Guide, 20
ISA Server 2004, with SBS, 7
ISA Server 2004 /Exchange Server Deployment Kit, 297
ISA Server arrays
adding servers to, 52
creating, 49
ISA Server Basic Monitoring, 36, 205
ISA Server Extended Monitoring, 36, 205
ISA Server Full Administrator, 36, 205
ISA Server Management console. See Management console
ISA Server Network Object Toolbox, 250
ISA Server Storage (Isastg.exe), 113
ISA servers
administration with Terminal Services, 30
connecting to remote, 30
system policies, 33
ISA Tools (Harrison), 90
ISA2k_config.log, 92
Isaautorun.exe, 21
ISAPI (Internet Server Application Programming Interface), 308
isastg.exe, 113
ISDN (Integrated Systems Digital Network), 19, 368


Previous Page
Next Page

Index

L

L2TP (Layer Two Tunneling Protocol)
analyzing and selecting tunneling protocol for VPNs, 232
difficulties with using across Internet, 304
pre-shared keys option, 225
VPN connections and, 221
VPNs connecting via, 219
LAND attacks, 214
language options, Outlook Web Access, 301
LANs (local area networks), 3
LAT (local address table), 189
Layer Two Tunneling Protocol. See L2 TP (Layer Two Tunneling Protocol)
LDAP (Lightweight Directory Access Protocol), 48
ldp.exe, 48
legacy support
Firewall clients, 81
Virtual Server 2005, 348
licenses/licensing
Enterprise Edition, 10
EULA (End User License Agreement), 21
SBS (Small Business Server), 8
Standard Edition, 9
virtual machines, 351
Virtual Server 2005, 362
Lightweight Directory Access Protocol (LDAP), 48
link translation
configuring, 211
SharePoints and, 323
links. See URLs (uniform resource locators)
load balancing. See also NLB (Network Load Balancing)
Enterprise Edition and, 45
overview, 287
load factor, CARP, 290
local address table (LAT), 189
local area networks (LANs), 3
local host
access rule, 200
multinetwork configuration and, 196
networks, 139–140
LocalLAT.txt file, 85
lockdown mode, firewall policies, 160
logon, secondary logon with RunAs, 27
logs, 119–122
examining setup logs, 63
filtering, 122
logging to files, 121
logging to MSDE, 121
logging to SQL Server database, 119
reconfiguring following migration to ISA Server 2004, 90
setup, 32
summaries, 128
troubleshooting ISA Server/SBS installation, 375
types of, 119


Previous Page
Next Page

Index

M

mail exchange (MX) records, 298
mail servers, 184
maintenance mode
placing ISA servers in, 342
removing computer from, 343
malware, 20
managed computers, array communication and, 271
Management console, 11–14
accessing System Policy Editor, 157
administration section. See administration
Administrative Tool installation, 29
configuration nodes, 14
connecting to remote ISA server, 30
creating alerts, 107
creating arrays, 266
defining Firewall client settings, 81
enabling Web proxies, 72
firewall policy, 14, 131
ISA Server 2000, 11
monitoring, 13
overview, 11
refresh rate configuration, 106
remote administration, 16
scripting, 241
security policy section. See security policies
session filters, 115
specifying direct access to certain Web sites, 82
tasks, 13
VPN functionality, 14
management packs, ISA Server 2004
backing up, 339
downloading, 337
importing, 338
Management.ini file, 86
mapadmin.exe (Microsoft ISA Server Control), 113
MAPI (message application programming interface)
methods for ISA Server to access Exchange, 297
publishing Outlook RPC for MAPI clients, 306
media, installing CSS from, 54
memory requirements, virtual servers, 362
message application programming interface (MAPI). See MAPI (message application programming interface)
Message Screener
installing, 23, 52
prerequisites for installing Standard Edition, 20
Microsoft
Error Reporting sites, 145
Trustworthy Computing Initiative, 32
Microsoft Challenge Handshake Protocol. See MSCHAP (Microsoft Challenge Handshake Protocol)
Microsoft Data Engine Service (mssqlserver.exe), 113
Microsoft Desktop Engine (MSDE), 27, 121
Microsoft Exchange Server. See Exchange Server
Microsoft Firewall (wpsrv.exe), 113
Microsoft Internet Explorer. See IE (Internet Explorer)
Microsoft ISA Job Scheduler (W3Prefetch.exe), 113
Microsoft ISA Server Control (mapadmin.exe), 113
Microsoft Management Console (MMC), 16
Microsoft NetMeeting, 17
Microsoft Office System 2003, 316
Microsoft Operations Manager. See MOM (Microsoft Operations Manager) 2005
Microsoft Point-to-Point Encryption Protocol (MMPE), 219
Microsoft Script Editor (MSE), 244
Microsoft Update, 373
Microsoft Virtual Server 2005. See Virtual Server 2005
Microsoft Windows. See Windows OSs
migration, Virtual Server 2005, 349
Migration Guide
missing components following upgrades, 103
overview of, 90
upgrading to ISA Server 2004 Enterprise Edition, 90
Migration Wizard, 91
configuration import errors and, 104
Enterprise Edition upgrade, 96
RRAS configuration, 95
running from command line, 103
Standard Edition upgrade, 93
MIME types, 136
MMC (Microsoft Management Console), 16
MMPE (Microsoft Point-to-Point Encryption Protocol), 219
Modems, prerequisites for installing Standard Edition, 19
MOM (Microsoft Operations Manager) 2005, 331–346
access rules, creating, 336
computer groups, creating, 343–345
configuring agent communication, 335
consoles, 333
deploying MOM clients (agents), 333
installing, 333
installing ISA Server management packs, 337
maintenance mode for ISA servers, 342
managing ISA servers with, 340
monitoring ISA server's performance, 345
rule groups for ISA servers, 341
versions, 331
monitoring
alerts. See alerts
dashboard, 105
events, 118
ISA Server 2004 Management console, 13
logs. See logs
MOM and, 345
overview of, 105
Performance Monitor, 129
services, 113
sessions. See sessions
MS Firewall Control
array communication protocols, 272
MS Firewall Storage, 273
MS Firewall Storage Replication, 273
MSCHAP (Microsoft Challenge Handshake Protocol)
MSCHAPv2 as default for VPN clients, 224
VPN authentication options, 219
MSDE (Microsoft Desktop Engine), 27, 121
MSE (Microsoft Script Editor), 244
msisaund.ini, 25, 27
mspadmin.exe, 113
mssqlserver.exe, 113
multinetworking, 189–204
firewall chaining, 203
network configuration, 196–199
network rule configuration, 200
network set configuration, 199
network templates. See network templates
overview of, 189
Web chaining, 201–203
MX (mail exchange) records, 298


Previous Page
Next Page

Index

N

Naming, ISA Server 2004, 30
naming prefixes, scripting, 243
NAT (Network Address Translation), 238
NetMeeting, 17
network adapters. See also NICs (network interface connectors)
adding to network, 140
adding virtual network adapters to virtual machines, 360
array member requirements, 265
dedicated adapters in virtual server environment, 362
Enterprise Edition and, 45
installing Standard Edition with single network adapter, 24–25
ISA Server/SBS installation, 367
labeling in virtual machine test environment, 351
prerequisites for installing Standard Edition, 19
single network adapter configuration, 195
virtual environment and, 352
network addresses
specifying range for internal network, 22
Standard Edition with single network adapter, 24
Network Address Translation (NAT), 238
Network Connection Wizard, 230
Network Connections, in Control Panel, 207
network interface connectors (NICs), 355. See also network adapters
Network layer protocols, 133
Network Load Balancing. See NLB (Network Load Balancing)
network objects, 138–148
computer sets, 144
configuring internal network object, 140
creating address range object, 142
creating computer object, 142
creating computer set object, 144
creating domain name set object, 145
creating network set object, 141
creating new, 139
creating subnet object, 143
creating URL set object, 144
creating Web listener object, 147
domain name sets and, 145
network sets and, 140
networks and, 139
subnets and, 143
URL sets and, 144
Web listeners and, 146
network rules
access connections and, 168
configuring, 200
creating, 200
overview of, 150
preconfigured, 200
types of relationships in, 159
network sets
configuring, 199
creating, 141
creating network set object, 199
preconfigured, 140
types of, 199
network templates, 189–196
back firewall, 194
edge firewall, 190
front firewalls, 193
leg perimeter firewalls, 192
single network adapter configuration, 195
types of, 189
networks. See also multinetworking
configuring for multinetworking, 196–199
creating new network object, 197
enabling NLB for, 295
exporting firewall configuration, 198
importing firewall policy, 198
preconfigured, 139
traffic, 131
troubleshooting exported/imported network sets, 199
virtual. See virtual networks
new features, ISA Server 2004, 5
NICs (network interface connectors), 355. See also network adapters
NLB (Network Load Balancing), 291–296
configuring, 292
configuring for optimal efficiency, 295
DNS round robin as load balancing alternative, 296
enabling NLB integration mode, 294
enabling on network, 295
Enterprise Edition and, 6
installing, 292
integrated NLB, 292
nonintegrated NLB, 292
prerequisites for, 292
server publishing and, 296
stopping, 296
NNTP, 187
nslookup, 298


Previous Page
Next Page

Index

O

object oriented programming (OOP), 242
Office System 2003, 316
offline content, caching, 41
Online Log Viewer, 122
OOP (object oriented programming), 242
Open Systems Interconnection (OSI), 1
Operator console
checking performance data in, 345
MOM 2005, 332
performance monitoring with, 346
OSI (Open Systems Interconnection), 1
outbound traffic, enterprise access rules for, 278
Outlook 2003
ClientApps folder, 365
RPC filter prevents connection to Exchange, 375
Outlook clients
authentication via Exchange, 307
configuring, 308
configuring Outlook 2002 and 2003 clients, 308
configuring remote client for RPC, 306–308
dependence of, 304
outbound RPC access to external Exchange servers, 306
remote access with, 304–305
RPC filtering and, 168
RPC over HTTP, 308–309
RPC over HTTP for remote clients, 312–313
Outlook Mobile Access, 184, 304
OWA (Outlook Web Access)
accessing Exchange Server through ISA Server, 297
configuring remote access to e-mail, 298
forms-based authentication, 303–304
ISA server role in protecting, 299
overview, 184
publishing rule, 301–302
publishing to ISA Server clients, 299
securing, 299
security concerns with, 298


Previous Page
Next Page

Index

P

packet filters
FWENG driver, 160
migration to ISA Server 2004 and, 90
overview, 3
single network adapter configuration, 25
PAP (Password Authentication Protocol), 219
Password Authentication Protocol (PAP), 219
password policies, ISA Server/SBS configuration, 374
patches
Microsoft Update site for, 373
Standard Edition, 25
PATHPING, 71
PathToINIFile, 27, 55
PathToISASetup, 27, 55
PCAnywhere, 17
performance
challenges of performance tuning in virtual environment, 352
creating performance rules, 341
monitoring with MOM 2005, 345
Performance Monitor
objects, 129
overview of, 129
perimeter networks
creating, 139, 197
virtual networks and, 361
permissions
configuring array permissions, 285
enterprise-level, 279
Ping of Death attacks, 214
PKI (public key infrastructure), 225
Point-to-Point Tunneling Protocol. See PPTP (Point-to-Point Tunneling Protocol)
policies
access. See access policies
array. See array policies
enterprise. See enterprise policies
firewall. See firewall policies
migration to ISA Server 2004 and, 90
remote sites in VPNs, 237
system. See system polices
POP3 (Post Office Protocol 3)
client services for server publishing, 186
ISA Server accessing Exchange via, 297
publishing basic mail for Exchange servers, 313
Port Scan attacks, 214
ports
MOM agents, 335
server publishing, 182
Post Office Protocol. See POP3 (Post Office Protocol 3)
PPTP (Point-to-Point Tunneling Protocol)
analyzing and selecting tunneling protocol for VPNs, 232
security of, 304
VPN connections and, 221
VPNs connecting via, 219
preauthentication, integrating Exchange with ISA Server, 302–304
predefined alerts, 106
Premium Edition, SBS (Small Business Server) 2003, 363
pre-shared keys, L2TP (Layer Two Tunneling Protocol), 225
PrimalScript, 244
exposing object properties and methods, 245
object model in drop-down menu, 245
Primary To Secondary Access Rule, gateways, 238
primary VPN gateway
access rules, 238
creating, 233
private networks, 140
Product Support Services (PSS), 361
production servers, Virtual Server 2005, 349
programs, alert-activated, 109
properties
viewing, 247
Web chaining rules, 203
Web publishing rules, 175
protocol rules, in migration to ISA Server 2004, 90
protocols, 133–135
categories of, 133
creating custom, 134
enterprise access rules applied to, 278
overview of, 133
predefined, 133
proxies, Exchange as proxy for Outlook client, 307
proxy servers
Proxy 2.0, 24
single network adapter configuration and, 195
PSS (Product Support Services), 361
public key infrastructure (PKI), 225
Publish Secure Web Server Wizard, 178–182
publishing
mail services for Exchange servers, 313–314
reports, 126
SharePoint Portal Server, 322, 324–329
SharePoint Services, 317
publishing rules
arrays, 285
firewall policies, 301


Previous Page
Next Page

Index

Q

quarantine, VPNs, 240
quarantined VPN client
multinetwork configuration and, 196
route configuration, 200
types of networks, 139
quotas, TCP/UDP connection, 3


Previous Page
Next Page

Index

R

RADIUS (Remote Authentication Dial-In User Service)
configuring, 212
ISA Server preauthentication and, 302
mapping RADIUS clients to Windows accounts, 221
VPN clients and, 225
Rainfinity, 296
RainWall, 296
ranges, IP address, 142
refresh rate, 106
Registry Editor, 75
remote access, VPNs, 219
remote administration, 16–17
Enterprise Edition, 66
Management console, 16
remote control applications, 17
Terminal Services, 16
Remote Authentication Dial-In User Service. See RADIUS (Remote Authentication Dial-In User Service)
remote clients
configuring for RPC, 306–308
RPC over HTTP, 312–313
Remote Console, 64
Remote Desktop, in Windows Server 2003, 17
remote logging, System Policy, 120
Remote Management, Administrative Tools, 29
remote procedure calls. See RPC (remote procedure calls)
remote site network, connecting to VPN servers, 234
Repair option, reinstalling ISA Server, 270
replication, CSS, 274
reports
creating report job, 125
customizing, 127
generating, 123
publishing, 126
recreating report jobs following migration, 90
types of, 122
viewing, 126
reports, MOM 2005
options, 346
SQL Server 2000 Reporting Services, 345
restore
array configuration, 286
enterprise configuration, 280–281
role-based administration
array policies, 284
backing up enterprise configuration, 280
configuring at enterprise level, 279
Enterprise Edition and, 65
enterprise policies, 279
restoring role-based permissions, 281
roles
administrators, 205
configuring array roles, 285
root certificate, 60
router, in ISA Server/SBS configuration, 370
Routing and Remote Access (RRAS), 95
routing tables, in Standard Edition, 20
RPC (remote procedure calls), 3, 306–308
RPC filters, 166–168
configuring in system policy, 166
configuring on access rule, 167
in Exchange, 305–306
Outlook clients and, 168
overview of, 166
unable to connect to Exchange from Outlook 2003, 375
RPC over HTTP
configuring Exchange Server for, 309–310
configuring remote clients for, 312–313
creating publishing rule for, 310–312
for Outlook clients, 308–309
limitations of, 309
RPC over HTTPS (Remote Procedure Call over Secure HTTP), 297
RPC proxy
in Windows Server 2003, 308
installing, 309
RpcCfg.exe, 310
RRAS (Routing and Remote Access), 95
rules
creating custom, 341
creating rule groups, 340
RunAs, 27


Previous Page
Next Page

Index

S

SACLs (system access control lists), 90
Sapien Technology, 244
SBS (Small Business Server)
editions, 7
features, 7
ISA Server installation and, 20
licensing, 8
scalability, 7
system requirements, 8
SBS (Small Business Server) 2003, 363–375
applying Service Pack 1 prior to upgrade, 365
Configure E-Mail And Internet Connection Wizard, 367–374
documenting and backing up ISA Server prior to upgrade, 365
editions, 363
Exchange Server connection issues, 375
installing ISA Server 2004, 366
invalid Web publishing rule, 375
ISA Server setup issues, 374
overview, 363
prerequisites for installing ISA Server on, 364
Service Not Responding errors, 375
Service Pack 1, 364
scalability
Enterprise Edition, 9
SBS (Small Business Server), 7
Standard Edition, 8
scheduled content download jobs, CARP, 291
schedules
creating, 138
downloads, 4
overview of, 137
scripts/scripting, 241–264
AddComputer.vbs, 250–253
CreateHTTPAllowRule.vbs, 253–255
Exchange Server vulnerabilities, 298
ExportServers.vbs, 255–259
ImportServers.vbs, 260–263
in virtual test lab, 243
installing ISA Server 2004 SDK and, 243
naming prefixes, 243
overview, 241
scripting interface with Virtual Server 2005, 348
ShowBasicInfo1.vbs, 244–249
ShowBasicInfo2.vbs, 249
terminology, 242
VBScript, 242
SCSI (Small Computer Software Interface), 350
SDK
installing, 243
Windows Script SDK, 250
searches
advanced capability in SharePoint Portal Server, 316
cached content, 4
locating computers to add to computer groups, 344
Secondary To Primary Access Rule, gateways, 238
secondary VPN gateway
access rules, 238
configuring, 239
secure publishing, ISA Server, 3
SecureNAT
firewall chaining and, 203
FTP filtering, 162
SecureNAT clients
configuring, 71
firewall chaining and, 206
functionality of, 67
installing, 69–71
NLB and, 295
simple vs. complex networks and, 70
single NIC configuration and, 24
types of ISA server clients, 67
VPNs and, 71
when to use, 68
SecurID, 309
security
Outlook Web Access vulnerabilities, 298
prerequisites for installing Standard Edition, 20
report content and, 128
virtual machines, 361
virtual server environment, 362
security policies, 212–218
connection limits, 217–218
intrusion detection configuration, 214–216
IP preferences, 216–217
RADIUS server configuration, 212
Server Name properties dialog, 210
server publishing, 182–187
client access services, 186
connection limit rules, 217
creating server publishing rule, 182
deleting server publishing rules, 171
disabling server publishing rules, 170
mail servers, 184
NLB (Network Load Balancing), 296
server-to-server communication services, 187
single network adapter configuration, 25
Web client access, 184
servers. See also ISA servers
adding to ISA Server arrays, 52
exporting list to Windows Server 2003 text file, 255
exporting server certificates, 60
moving to different arrays, 270
obtaining server certificate, 60
Service Not Responding errors, SBS, 375
service packs
Firewall clients, 79
included with SBS upgrade CD, 364
SBS 2003 Service Pack 1, 364
SP1 for MOM 2005, 331
services
alerts stopping/starting, 110
client access to server publishing, 186
Enterprise Edition install and, 52
not installing on dedicated ISA Server computer, 20
overview of, 113
starting and stopping, 114
stopped or disabled when installing Standard Edition, 20
services.msc, 114
sessions, 114–118
connectivity verifiers, 116
disconnecting, 117
filtering, 115
importing/exporting filter definitions, 118
information regarding, 115
overview of, 114
viewing active, 114
setup
command-line parameters, 27, 55
examining setup logs, 63
ISA Server/SBS installation, 374
log files, 32
troubleshooting, 56
troubleshooting Standard Edition setup, 27
SharePoint Portal Server
authentication, 323
configuring to work with ISA Server, 329
DNS name resolution and, 322
features, 315
ISA Server improvements to, 317
link translation, 323
modifying default URL for site, 329–330
overview, 315
publishing, 322, 324–329
secure access to, 1
SharePoint Services
connecting to Internet, 318
defining Web listener for, 318
DNS name resolution, 322
features, 316
ISA Server improvements to, 317
modifying Web.config file for outbound access, 321
overview, 315
publishing, 317
Service Pack 1, 364
Web publishing rule, 318–321
Shinder, Dr. Tom, 72
Shiva Password Authentication Protocol (SPAP), 219
ShowBasicInfo1.vbs, 244–249
ShowBasicInfo2.vbs, 249
Simple Mail Transfer Protocol. See SMTP (Simple Mail Transfer Protocol)
site-to-site VPNs
configuration, 230
connection testing, 239
policy rules for remote sites, 237
Small Business Server. See SBS (Small Business Server)
Small Computer Software Interface (SCSI), 350
smart cards, 224
SMS (Systems Management Server), 79
SMTP (Simple Mail Transfer Protocol)
client services for server publishing, 186
prerequisites for installing Standard Edition, 20
publishing basic mail for Exchange servers, 313
server-to-server communication services, 187
traffic access rule, 314
SMTP Message Screener, 121
SMTP server, 108
snap-ins, MMC (Microsoft Management Console), 16
software
SBS system requirements, 8
Standard Edition, 9
SPAP (Shiva Password Authentication Protocol), 219
SQL Server, Service Pack 4, 364
SQL Server 2000 Reporting Services, 345
SQL Server database, 119
SSL (Secure Sockets Layer)
authentication over SSL encrypted channel, 101
encryption for Exchange server, 309
securing SSL traffic, 299
SSL bridging, 178, 203
SSL listeners, 148
SSL Tunneling, 178, 181
SSL Web Publishing Rule Wizard, 178
Standard Edition
arrays not supported, 287
firewall share and message screener and, 52
licensing, 9
SBS (Small Business Server) 2003, 363
scalability, 8
system requirements, 9
upgrading ISA Server 2000. See upgrading ISA Server 2000 Standard Edition to ISA Server 2004 Standard Edition
upgrading ISA Server 2004 Standard Edition to ISA Server 2004 Enterprise Edition, 102–103
Standard Edition, installing, 19–44
Administration Tools, 28–30
Administrative Roles, 36
before starting, 19–20
caching configuration, 36–44
command-line parameters for setup, 27
configuration, 35
Firewall Client Installation Share and Message Screener, 23
joining ISA Server to a domain, 31
patches and updates, 25
post installation, 32
renaming ISA Server, 30
setup types, 23
single network adapter, 24–25
steps in, 21–23
system policies, 33
troubleshooting, 31–32
troubleshooting setup, 27
unattended installation, 25–26
uninstalling, 28
where not to install, 20
static IP addresses, 19, 223
subnets
creating subnet object, 143
overview of, 143
SecureNAT clients, 70
summary content, reports, 127
system access control lists (SACLs), 90
system policies
Allowed Sites, 145
array level communication, 272
configuring RPC in, 166
editing system policy rules, 157
exporting system policy rules, 158
importing system policy rules, 158
ISA servers, 33
list of system policy rules, 151–157
order of application, 284
overview of, 150
remote logging, 120
viewing system policy rules, 150
System Policy Editor
accessing, 157
managing system policies, 33
system requirements
Enterprise Edition, 10
SBS (Small Business Server), 8
Standard Edition, 9
virtual servers, 362


Previous Page
Next Page

Index

T

TCP (Transmission Control Protocol)
array communication and, 272
connection quotas, 3
MOM agent communication and, 335
user authentication for legacy connections, 3
TCP/IP (Transmission Control Protocol/Internet Protocol), 19
team sites, SharePoint Portal Server, 315
Terminal Services
administration of ISA servers with, 30
Application mode, 27
assigning administrative roles, 64
remote administration, 16
test labs
creating isolated test environment with virtual servers, 355
virtual networks for, 355
with Virtual Server 2005, 349
toolbox elements
content types, 136–137
functions of, 131
list of access rules, 132
network objects, 138–148
network traffic and, 131
protocols, 133–135
schedules, 137
user sets, 135–136
tools, ISA Server 2004, 15
topical hierarchies, SharePoint Portal Server, 316
TRACERT, 71
traffic
allow/deny rules, 135
identifying incoming/outgoing, 135
rules set, 149
Traffic and Utilization content reports, 127
Transmission Control Protocol. See TCP (Transmission Control Protocol)
Transport layer protocols, 133
troubleshooting
arrays, 273–274
Configure E-Mail and Internet Connection Wizard, 374
exported/imported network sets, 199
firewall clients, 87
firewall policies, 188
ISA Server installation, 115
setup, 56
upgrades, 103, 104
Web proxy clients, 75
troubleshooting ISA Server/SBS installation, 374–375
"Service Not Responding" errors, 375
connectivity issues between Exchange and Outlook, 375
set up issues, 374
Web publishing rule invalid, 375
Trustworthy Computing Initiative, 32
tunneling protocols
analyzing and selecting for VPNs, 232
site-to-site VPN configuration and, 231
VPN connection options, 221
VPN options, 219


Previous Page
Next Page

Index

U

UDP (User Datagram Protocol)
connection quotas, 3
MOM agent communication, 335
user authentication for legacy connections, 3
UDP Bomb attacks, 214
unattended install
Enterprise Edition, 54
of Firewall clients, 78
Standard Edition, 25–26
UNC (Universal Naming Convention), 77
Uniform Resource Locators. See URLs (Uniform Resource Locators)
uninstalling Enterprise Edition, 63
uninterruptible power supplies (UPSs), 365
Unique User IDs (UUIDs) 305
Universal Naming Convention (UNC), 77
updates
prerequisites for installing Standard Edition, 19
Standard Edition, 25
upgrades
troubleshooting, 103–104
upgrading to Enterprise Edition from ISA Server 2000, 63
virtual server allowing test prior to implementation, 349
upgrading ISA Server 2000 Enterprise Edition to ISA Server 2004 Enterprise Edition, 95–102
CSS installation, 97
exporting ISA Server 2000 configuration, 96
importing configuration into ISA Server 2004 Enterprise Edition computer, 99
in-place upgrade, 101
installing ISA Server 2004 Enterprise Edition, 100
overview of, 63,95
upgrading ISA Server 2000 Standard Edition to ISA Server 2004 Standard Edition, 91–95
exporting ISA Server 2000 configuration, 93
importing ISA Server configuration, 94
installing ISA Server 2004, 94
migrating RRAS configuration, 95
steps in, 91
upgrading ISA Server 2004 Standard Edition to Enterprise Edition, 102–103
UPS (uninterruptible power supplies), 365
URL sets
creating, 144
overview of, 144
URLs (Uniform Resource Locators)
absolute URLs, 211
blocking URL-based attacks, 299
modifying default URL for SharePoint Portal Server, 329–330
user accounts
array member role assignments, 269
configuring for VPN access, 228
enterprise-level roles and, 279
User Datagram Protocol. See UDP (User Datagram Protocol)
user mapping, RADIUS and EAP clients to Windows accounts, 221
user sets
creating, 136
overview, 135
toolbox elements, 135–136
UUIDs (Unique User IDs) 305


Previous Page
Next Page

Index

V

VBScript. See also scripting
beginning coding, 244
creating new file, 244
essentials of, 242–243
version number, Firewall clients, 79
virtual hard disks
creating, 353
creating virtual networks and, 356
types of, 350
virtual machines. See Virtual Server 2005
Virtual Network Computing (VNC), 17
virtual networks
creating, 355–359
overview of, 351
virtual private networks. See VPNs (virtual private networks)
Virtual Server 2005, 347–362
best practices, 351
complex network environments, 361
creating virtual hard disk, 353
creating virtual networks, 355–359
issues with, 352
key features, 348
overview, 347
setting up production virtual machine, 361
single isolated client virtual environment, 352
usage scenarios for, 348
virtual hard disks, 350
virtual networks, 351
Virtual Server Migration Toolkit, 350
viruses, 20
VNC (Virtual Network Computing), 17
VPN clients
access rules, 228
authentication, 224
configuring or modifying access to VPNs, 220
default configuration settings, 220
enabling access to VPNs, 220
IP addresses, 223
multinetwork configuration and, 196
network connection configuration, 229
providing Outlook client functionality across Internet, 304
RADIUS authentication, 225
route configuration, 200
selecting access networks, 222
types of networks, 139
user accounts configured to connect as, 228
VPN connections, 207
VPN Site-to-Site networks, 139, 197
VPNs (virtual private networks), 14, 219–240
access rules between remote site and internal network, 238
access rules for VPN clients, 228
arrays and, 271
authentication for VPN clients, 224
configuring or modifying client access, 220
configuring VPN client connectivity, 229
connectivity confirmation, 239
creating remote site network, 234
default configuration settings, 220
demand dial interface, 232
enabling client access, 220
IP address assignments for VPN clients, 223
not available with single network adapter, 24
policy rules for remote sites, 237
primary VPN gateway, 233
Quarantine, 240
RADIUS authentication for VPN clients, 225
remote access configuration, 219
secondary VPN gateway, 239
SecureNAT clients, 71
selecting access networks for VPN clients, 222
site-to-site VPN configuration, 230
testing site-to-site connection, 239
tunneling protocols, 232
user account configuration for VPN access, 228
VPN clients for providing Outlook client functionality across Internet, 304


Previous Page
Next Page

Index

W

W3Prefetch.exe, 113
W3proxy.exe, 4
Web addresses. See URL sets
Web caching, ISA Server, 4
Web chaining, 201–203
CARP and, 287
creating Web chaining rule, 201
modifying Web chaining rule, 203
overview, 201
Web chaining rule properties, 203
Web clients, access configuration to Web servers, 184
Web connections, authenticating, 73
Web content caching, on array, 271
Web filters, array requirements, 265
Web listeners
creating, 147
overview of, 146
SharePoint Services, 318
Web parts, SharePoint Services, 316
Web Proxy, ISA Server feature, 299
Web proxy clients
configuring, 74–75
enabling, 72
functionality of, 67
installing, 72–73
troubleshooting, 75
types of ISA server clients, 67
when to use, 68
Web proxy filters, 82
Web publishing, 172–182
deleting Web publishing rules, 171
disabling Web publishing rules, 170
importing certificates, 176
modifying Web publishing rules, 174–176
NLB and, 296
overview of, 172
publishing Web servers, 172–174
rule properties, 175
secure Web servers, 176–182
Web publishing rules
connection limits and, 217
dictionary entries, 212
link translation and, 211
SharePoint Services, 318–321
troubleshooting SBS/ISA Server installation, 375
Web requests, CARP, 288
Web servers
publishing, 172–174
publishing secure, 176–182
single network adapter configuration and, 195
Web services, ISA Server/SBS configuration, 371
Web sites
customization with SharePoint Services, 316
direct access to specified, 82
Harrison's ISA Tools, 90
ISA Server resources, 17
Web Usage content reports,, 127
Web.config file, 321
weekends, schedules, 138
Windows Authentication, 101
Windows Back Up, 280
Windows Event Log, 110
Windows Internet Name Service (WINS), 223
Windows Out Of Band (WinNuke) attacks, 214
Windows servers
exporting servers list to, 255
installing on virtual network, 357
MOM (Microsoft Operations Manager) 2005, 331
NLB configuration and, 292
NLB installation on Windows Server 2003, 293
Remote Desktop, 17
RPC proxy, 308
server publishing and NLB support in Windows Server 2003, 296
Service Pack 1 for Windows Server 2003, 364
tools, 15
Windows SharePoint Server (WSS), 146
Windows SharePoint Services. See SharePoint Services
WinNuke (Windows Out Of Band) attacks, 214
WINS (Windows Internet Name Service), 223
Winsock Proxy AutoDetect Protocol (WPAD), 87
Wizards, ISA Server 2004, 15
work hours, schedules, 138
Workgroup Edition, MOM, 331
workgroups
array member requirements and, 265
authentication, 59
back-to-back scenario, 58
Enterprise scenario, 57
installing Enterprise Edition, 56
ISA Server workgroup scenario, 57
Workstations, Administration Tools installed on, 29
worms, 20
WPAD (Winsock Proxy AutoDetect Protocol), 87
wpsrv.exe, 113
WSS (Windows SharePoint Server), 146


List of Figures

Chapter 1: Overview of Microsoft ISA Server 2004 Administration

Figure 1-1: Comparison of OSI Layer 4 and Layer 7 firewalls.
Figure 1-2: The ISA Server 2000 Management console is very basic compared to the rich features in the ISA Server 2004 Management console.
Figure 1-3: Tabbed pages in the ISA Server 2004 Management console make accessing common tasks simpler.

Chapter 2: Installing and Configuring Microsoft ISA Server 2004 Standard Edition

Figure 2-1: The setup splash screen contains useful links to explore in addition to the link to start your ISA Server installation.
Figure 2-2: You have flexibility in how you define your internal network addresses in ISA Server 2004.
Figure 2-3: The Change/Remove option for ISA Server 2004 in the Add/Remove Programs interface.
Figure 2-4: When you click Show System Policy Rules on the Tasks tab, system policies appear in the center Firewall Policy pane.
Figure 2-5: The System Policy Editor allows you to configure system policies from a single interface.
Figure 2-6: The Getting Started pane guides you through the options available for configuring ISA Server.
Figure 2-7: The ISA Server Cache node is located on the Configuration menu.
Figure 2-8: Define the amount of space for your cache in megabytes.
Figure 2-9: To configure the cache properties, use the Cache Settings dialog box.
Figure 2-10: Using a descriptive name on the Welcome To The New Cache Rule Wizard page helps you manage jobs.
Figure 2-11: You can create new network entities, like Domain Name Sets, from within the Add Network Entities dialog box.
Figure 2-12: Specify the URL (Web link) from which a content download job will pull content.
Figure 2-13: Specify the contents of the cache, and the TTL for the objects pulled down by the content download job.

Chapter 3: Installing and Configuring Microsoft ISA Server 2004 Enterprise Edition

Figure 3-1: Select the environment into which you will install the CSS.
Figure 3-2: Select the components you wish to install on the Setup Scenarios page.
Figure 3-3: Enter the IP address ranges or Enterprise Networks that define your network.
Figure 3-4: Specify a user account when installing CSS on a domain controller, and give it a long and complex password.
Figure 3-5: A back-to-back scenario.
Figure 3-6: In a back-to-back configuration, configure the gateway address of the internal network adapter of the Front array to that of the External network adapter of the Back array server.
Figure 3-7: Specifying an alternate CSS server
Figure 3-8: The Getting Started pane guides you through the options available for configuring your ISA server.

Chapter 4: Installing and Configuring Microsoft ISA Server 2004 Clients

Figure 4-1: This chart shows how the different ISA Server clients compare based on different requirements.
Figure 4-2: This diagram shows how complex networks route Secure NAT client traffic.
Figure 4-3: You can configure the Web Proxy properties on the ISA server by selecting the properties of the network.
Figure 4-4: You can configure the Web Proxy authentication properties to control how clients identify themselves to the ISA server.
Figure 4-5: Firewall client support must be enabled on the ISA server in the Networks interface.
Figure 4-6: You can manage Connection settings for Firewall clients from the ISA Server Management console.
Figure 4-7: You can manage how ISA Server processes application traffic using the Application Settings tab.
Figure 4-8: The ISA Server Firewall client processes configuration settings for the client applying the most unique settings first, then moving to the more general. Settings most specific to the user have higher priority.
Figure 4-9: The Firewall client icon—which you can double-click to bring up configuration options—appears in the notification area and in Control Panel.
Figure 4-10: You can configure the Firewall client from this dialog box.

Chapter 5: Upgrading from Microsoft ISA Server 2000

Figure 5-1: From this screen you can read supporting documentation, run the Migration Wizard, or start the installation of ISA Server.
Figure 5-2: This dialog box sets the level of protection for ISA Server.
Figure 5-3: Choose to install the CSS.
Figure 5-4: Select the components required to install and manage the CSS.
Figure 5-5: Configure the CSS Service account information.
Figure 5-6: You can import the settings from the ISA Server 2000 configuration when upgrading to ISA Server 2004.
Figure 5-7: Export the configuration of an ISA Server 2004 machine before upgrading to Enterprise Edition.

Chapter 6: Monitoring and Reporting

Figure 6-1: To receive alerts by e-mail, the SMTP server information must be entered and verified.
Figure 6-2: If you would like to execute a program after an alert is triggered, the program and an account with sufficient access needs to be configured.
Figure 6-3: You can configure an alert to start one or all ISA Server services.
Figure 6-4: You have a lot of control over the types of filters you would like to configure, which can even be saved for future use.
Figure 6-5: Creating a connectivity verifier to ensure communications on your network.
Figure 6-6: Logging to an SQL database requires a predefined ODBC Data Source Name (DSN), a data table, and an account with appropriate permissions.
Figure 6-7: You can publish reports to a network share for increased visibility and ease of access.
Figure 6-8: E-mail notifications can be sent to notify you when reports have been generated.
Figure 6-9: You can determine the frequency with which the report job will run.
Figure 6-10: Log summaries are essential to gathering reporting data.
Figure 6-11: The default performance console is configured to capture several key objects and their most useful counters.

Chapter 7: Configuring Toolbox Elements

Figure 7-1: This diagram shows the way in which ISA Server manages traffic in Access, Server Publishing, and Web rules.
Figure 7-2: This view shows the toolbox elements available. This screen shows an ISA Server Enterprise Edition installation—the Standard Edition installation is similar, but does not include the Enterprise node.
Figure 7-3: You can create a new protocol by configuring the information about its connection, including the protocol type, direction, and port range or properties.
Figure 7-4: Defining a new content type—like this example where we're defining Pointcast news data—allows you to control traffic based on application type, which is defined by MIME types or file extensions.
Figure 7-5: This schedule defines active times as being from 9—00 PM to 6—00 AM on weekdays.
Figure 7-6: You select the networks you wish to include or exclude from your network set on the Network Selection page.
Figure 7-7: You can define any device with an IP address as a computer object—in this case we are defining a wireless access point.
Figure 7-8: You can specify the subnet mask in the Network Mask text box.
Figure 7-9: You can create a URL set, which consists of one or more URLs, using wildcards.
Figure 7-10: Domain name sets allow you to block or allow sites based on DNS domain names.
Figure 7-11: You can choose from a predefined network.
Figure 7-12: The External Network Listener IP Selection dialog box provides granular control of the IP addresses used by the external Web listener.

Chapter 8: Configuring Microsoft ISA Server Firewall Policy

Figure 8-1: ISA Server processes network rules, system policy rules, and then firewall policy rules when inspecting network traffic. After the rules are processed, the network rules determine whether to route or NAT the traffic. Finally client-specific rules are processed.
Figure 8-2: The System Policy Editor in ISA Server 2004.
Figure 8-3: Each policy has a General tab that illustrates the properties, and either a From or To tab that controls the source or destination to which the policy applies.
Figure 8-4: If you select this option, be sure to protect the exported file, as it contains confidential information.
Figure 8-5: The Read Only check box allows downloads without allowing uploads, reducing the possibility of systems or data being compromised.
Figure 8-6: Use the HTTP filter for fine control of HTTP traffic on a per-rule basis.
Figure 8-7: This policy defines how the ISA server processes RPC traffic.
Figure 8-8: This dialog box allows you to configure how ISA Server manages RPC traffic for this particular rule.
Figure 8-9: You can determine to which protocols the rule applies on this page.
Figure 8-10: Notice how the icon has changed to reflect the disabled access rule.
Figure 8-11: The Define Website To Publish page is very important to configure correctly.
Figure 8-12: From the rule's Properties dialog box you can configure additional information, like Link Translation.
Figure 8-13: Don't select the Delete The Private Key If The Export Is Successful check box, as it will remove the private key (which is necessary) from the Web server.
Figure 8-14: The images and descriptions of SSL Bridging and SSL Tunneling add a nice touch to this wizard.
Figure 8-15: Bridging mode options define what type of protocol (HTTP or HTTPS) access you will support to the ISA server and how you will send the traffic to the published secure Web server.
Figure 8-16: The Public Name setting is what Internet clients would type in their browsers to access this Web site.
Figure 8-17: You can choose from any existing networks to define which IP address ranges will listen for requests for the published Web server.
Figure 8-18: You have a lot of control over which IP addresses from the selected networks will listen for requests directed to the published Web server.
Figure 8-19: You can choose from one of 24 different pre-created protocols, or define your own.
Figure 8-20: The view of the Select Services page publishing Outlook Web Access, Outlook Mobile Access, or Exchange ActiveSync.
Figure 8-21: The view of the Select Services page publishing Outlook (RPC), POP3, IMAP4, and SMTP.
Figure 8-22: The view of the Select Services page publishing SMTP and NNTP.

Chapter 9: Configuring Multinetworking

Figure 9-1: There are several different types of firewall policies for you to choose from when configuring your ISA server using network templates.
Figure 9-2: A network rule can enforce the relationship between any two networks to use NAT or routing.
Figure 9-3: You have several options when defining how client requests should be proxied or forwarded to an upstream server when dealing with Web chaining.
Figure 9-4: This Properties dialog box lets you configure how requests are routed to the upstream server.

Chapter 10: Microsoft ISA Server Security and Administration

Figure 10-1: Role-based delegation allows you to assign roles to administrators of your ISA Server environment.
Figure 10-2: You can configure how ISA Server should use your dial-up or VPN connection to the ISP.
Figure 10-3: You can determine how incoming client certificates are verified in multiple scenarios.
Figure 10-4: Viewing the ISA Server computer details provides you with a quick reference to common ISA Server information.
Figure 10-5: The use of a RADIUS server is beneficial for authentication when the Web client and ISA Server are not in the same domain.
Figure 10-6: Connection limits are important for preventing a worm from bringing down your corporate network, as alerts will be triggered when the values you have set are exceeded.

Chapter 11: Securing Virtual Private Network Access

Figure 11-1: The VPN Clients Properties dialog box allows you to configure remote VPN clients.
Figure 11-2: The User Mapping option allows RADIUS and EAP clients to process user-and group-based access rules. If ISA Server is not a member of a domain in which the user accounts for domain mapping rest, your VPN clients cannot connect.
Figure 11-3: Choose the networks that ISA Server will use to establish VPN connections.
Figure 11-4: When configuring a VPN, select the source for IP addresses and infrastructure services.
Figure 11-5: You can use RADIUS authentication for your VPN clients, which allows authentication with Active Directory if your ISA Server computer is not a member of your domain.
Figure 11-6: Configure the RADIUS Server information used for authentication.
Figure 11-7: Enable the user's account in Active Directory to allow access using VPN.
Figure 11-8: Use the Network Connection Wizard to create a connection from your client computer to the VPN on your ISA server.
Figure 11-9: Connecting a primary site and a secondary site using ISA Server's site-to-site VPN configuration.
Figure 11-10: When setting up accounts for your VPN gateway, use the name of the remote VPN server's demand dial interface.
Figure 11-11: The Remote Sites tab allows you to configure site-to-site VPN connections. Use the Tasks pane to perform actions.
Figure 11-12: Depending on the VPN protocol you select, you will see different pages, as described next.
Figure 11-13: Depending on whether you're using the Enterprise Edition or Standard Edition of ISA Server, you will see this information in either a pop-up dialog box or as a page.
Figure 11-14: These rules allow all outbound traffic for all users—your access rules should be more specific based on your traffic requirements analysis and usage scenarios.

Chapter 12: Scripting with Microsoft ISA Server 2004

Figure 12-1: One of the advanced functions of PrimalScript is that it provides the object model in a drop-down menu to speed scripting functions.
Figure 12-2: The GetContainingServer Method entry in the SDK provides detailed information regarding the properties and usage of the method.

Chapter 13: Configuring Arrays Using Centralized Management

Figure 13-1: Configure the array name and array DNS name on the General tab.
Figure 13-2: Unlike in ISA Server 2000, ISA Server 2004 now provides the capability to "allow" access rules at the array level.
Figure 13-3: The CSS stores the array policy information for all array members.
Figure 13-4: Choose the appropriate authentication option based on your network configuration— domain members or workgroup mode.
Figure 13-5: Assign roles to various users or groups to manage who can connect to the CSS.
Figure 13-6: Click Help if you are unsure about deleting the array.
Figure 13-7: The Getting Started page guides you through the options available for configuring your array.
Figure 13-8: The Configuration tab is very useful for checking that all array members are in sync.

Chapter 14: Using Enterprise and Array Policies

Figure 14-1: The Default Policy and the Default Rule created out of the box cannot be changed.
Figure 14-2: The Ports option gives you granular control over the types of traffic that can originate from source ports. This is a per-rule setting.
Figure 14-3: Select both check boxes to ensure that the complete ISA Server configuration is being exported.
Figure 14-4: Confirm that you want to overwrite the existing configuration before clicking OK.
Figure 14-5: The IP address of the remote CSS must be in the Remote Management Computers computer set.
Figure 14-6: Ensure you have accounts with appropriate credentials or you will have difficulty connecting to a remote CSS.
Figure 14-7: The flow of effective policies in ISA Server 2004 is much improved.
Figure 14-8: To grant array administrators the ability to create all types of access rules, select all three appropriate check boxes.
Figure 14-9: The ability to create access rules is denied if the policy settings for the array are not configured properly.

Chapter 15: Working with Enterprise Technologies and Microsoft ISA Server 2004

Figure 15-1: You have the option to apply certain settings immediately by restarting the services, which might affect connected users, or to wait to restart the services at a later time.
Figure 15-2: CARP can be configured on a per-network basis in ISA Server 2004 Enterprise Edition.
Figure 15-3: You can change the default load factor of 100 on any array member from the CARP tab.
Figure 15-4: You will be presented with an informative message that is important to follow to properly configure NLB.

Chapter 16: Configuring Microsoft ISA Server with Microsoft Exchange Server 2003

Figure 16-1: Forms-based authentication with ISA Server 2004 and Outlook Web Access.
Figure 16-2: A split DNS ensures that clients can always resolve the IP address for mail regardless of their location—when inside the network, they use the internal Exchange server IP address; when outside, they use the IP address for the ISA server's external network adapter.
Figure 16-3: Configure the RPC over HTTP publication rule to point to the Exchange server's RPC path.
Figure 16-4: Configure the RPC Proxy settings for Outlook to connect to your Exchange server.

Chapter 17: Configuring Microsoft ISA Server with Microsoft Sharepoint Portal Server 2003

Figure 17-1: You should define the internal name when publishing the SharePoint site.
Figure 17-2: This screen shot shows the publicly accessible name for the SharePoint site.
Figure 17-3: Ensure the Verify Normalization check box is cleared.
Figure 17-4: You should configure link translation in the Web Publishing Rule Properties dialog box.
Figure 17-5: This illustration shows an example of a split DNS configuration where internal and external DNS servers provide different addresses for the same DNS zone.
Figure 17-6: Link translation modifies references to internal server names and addresses to externally accessible names.
Figure 17-7: It's important that you provide the internal name of the SharePoint Portal Server server when completing this step.
Figure 17-8: You should configure the Public Name Details when completing the Public Name Details page.
Figure 17-9: Two dictionary entries for link translations should be created— one for the inside-name of the SPS server and one for the inside IP of the SPS server.
Figure 17-10: Configure basic authentication for the SharePoint Portal site.
Figure 17-11: Forwarding basic authentication is necessary for successful completion of the publishing rule.
Figure 17-12: You should configure alternate access settings within the SharePoint Portal Server configuration.
Figure 17-13: Configure the appropriate proxy settings for the SharePoint Portal Server site.

Chapter 18: Configuring Microsoft ISA Server with Microsoft Operations Manager 2005

Figure 18-1: The Operator console is very user-friendly, especially for those familiar with Outlook 2003.
Figure 18-2: The wizard assists you in getting the MOM agent deployed to your ISA servers.
Figure 18-3: You have flexibility in your search for computers to receive the agent.
Figure 18-4: The default installation path can be modified as necessary.
Figure 18-5: 1270 is the default port number used between the agent and the MOM Management server.
Figure 18-6: You can extract the ISA Server 2004 management pack for a later import.
Figure 18-7: In this example, you want to import only the management pack, and not the reports.
Figure 18-8: Backing up any existing management packs is preferred if not starting from scratch.
Figure 18-9: After the import has completed, you can begin to view the default settings applied with the ISA Server 2004 management pack.
Figure 18-10: Several rule groups are created for both ISA Server 2000 and ISA Server 2004.
Figure 18-11: You will find it helpful for ongoing administration to provide as much information in the text boxes as possible.
Figure 18-12: You can include the seven ISA Server computer groups as part of a new computer group.
Figure 18-13: Various options for assisting with your computer searches are available.
Figure 18-14: You can clearly designate the state of your servers based on the model.
Figure 18-15: Reporting services offers a method for running weekly or monthly reports, with a variety of file export options available.

Chapter 19: Configuring Microsoft ISA Server with Microsoft Virtual Server 2005

Figure 19-1: This screenshot shows the configuration of the test lab being created in this chapter.
Figure 19-2: You can create multiple types of virtual hard disks.
Figure 19-3: You can create a dynamically expanding virtual hard disk and specify the maximum size for the hard disk and the physical location of the virtual hard disk file.
Figure 19-4: You can create new virtual networks as needed within the Virtual Server console.
Figure 19-5: This shows a Virtual Server with four separate virtual networks.
Figure 19-6: You can control various aspects of a new virtual machine, including its physical location, during creation.
Figure 19-7: You can turn on a virtual machine from the Virtual Server interface.
Figure 19-8: The virtual machine can be controlled through the Virtual Server Web interface.
Figure 19-9: You can edit the configuration of the virtual machine to change items such as memory, processor utilization, network adapters, and virtual disks.
Figure 19-10: You can add multiple virtual network adapters to each virtual machine and connect those virtual network adapters to the appropriate virtual networks.
Figure 19-11: Two separate virtual network adapters are connected to two separate virtual networks. These correspond to the internal and external networks in the ISA Server 2004 configuration.
Figure 19-12: This screenshot shows the two network adapters that the ISA Server 2004 virtual machine sees. These correspond to the virtual network adapters added previously.

Chapter 20: Configuring Microsoft ISA Server 2004 with Microsoft Small Business Server 2003

Figure 20-1: Install ISA Server 2004 onto an SBS 2003 computer using the Service Pack 1 CDs from Microsoft.
Figure 20-2: SBS 2003 uses the Configure E-Mail and Internet Connection Wizard to configure the initial settings for ISA Server. You can then configure more detailed settings.
Figure 20-3: The Broadband Connection page allows you to choose the type of broadband connection you use.
Figure 20-4: Enter the information for your dial-up account.
Figure 20-5: Type in your DNS and router information here.
Figure 20-6: Enter the default gateway used by your ISP and the DNS server addresses that will resolve host names.
Figure 20-7: The Web Services Configuration page provides you with an easy way to create publishing rules for the different Web services provided by SBS 2003.
Figure 20-8: Type the domain name that your e-mail addresses will use.
Figure 20-9: The Configure E-Mail and Internet Connection Wizard configures SBS 2003 based on the settings you choose in the wizard.
Figure 20-10: Although not directly related to ISA Server, configuring Password Policies is a vital step toward having a secured SBS 2003 environment.


List of Tables

Chapter 1: Overview of Microsoft ISA Server 2004 Administration

Table 1-1: New Features in ISA Server 2004
Table 1-2: Features Removed in ISA Server 2004
Table 1-3: Features Unique to ISA Server 2004 Enterprise Edition
Table 1-4: Feature Comparison by Product Edition
Table 1-5: System Requirements for Microsoft Small Business Server 2003 Premium Edition
Table 1-6: System Requirements for ISA Server 2004 Standard Edition
Table 1-7: System Requirements for Microsoft ISA Server 2004 Enterprise Edition
Table 1-8: ISA Server Tasks
Table 1-9: Monitoring Mode Page Descriptions
Table 1-10: PN Tab Descriptions
Table 1-11: Configuration Node Descriptions
Table 1-12: Commonly Used ISA Server Wizards
Table 1-13: Useful ISA Tools and Resources

Chapter 2: Installing and Configuring Microsoft ISA Server 2004 Standard Edition

Table 2-1: ISA Server 2004 Setup Types
Table 2-2: Unattended Installation Options in the Microsoft ISA Unattended Installation Configuration File (Msisaund.ini)
Table 2-3: ISA Server 2004 Installation Log Files
Table 2-4: Caching Configuration Properties

Chapter 3: Installing and Configuring Microsoft ISA Server 2004 Enterprise Edition

Table 3-1: ISA Server 2004 Installation Log Files

Chapter 4: Installing and Configuring Microsoft ISA Server 2004 Clients

Table 4-1: ISA Server 2004 Clients and Their Functionality
Table 4-2: Preferred Clients for Specific Requirements

Chapter 5: Upgrading from Microsoft ISA Server 2000

Table 5-1: Supported Upgrade Paths for ISA Server Versions
Table 5-2: RRAS Settings Migrated During an ISA Server 2000 Upgrade
Table 5-3: Upgrade Paths Supported for ISA Server 2004 Enterprise Edition

Chapter 6: Monitoring and Reporting

Table 6-1: Monitoring Components
Table 6-2: Alert Configuration Options
Table 6-3: Session Information
Table 6-4: ISA Server Log Types
Table 6-5: Built-In Report Categories and Descriptions
Table 6-6: Performance Objects

Chapter 7: Configuring Toolbox Elements

Table 7-1: Access Rule Elements
Table 7-2: Server Protocol Categories

Chapter 8: Configuring Microsoft ISA Server Firewall Policy

Table 8-1: ISA Server 2004 System Policy Rules
Table 8-2: Performance Impact of Rule Components
Table 8-3: HTTP Security Filter Settings
Table 8-4: Property Settings for a Web Publishing Rule

Chapter 9: Configuring Multinetworking

Table 9-1: Explanation of Network Templates
Table 9-2: Property Settings for a Web Chaining Rule

Chapter 10: Microsoft ISA Server Security and Administration

Table 10-1: Configuring Firewall Client Settings
Table 10-2: Intrusion Attacks Explained
Table 10-3: Application-Level DNS Attacks Explained
Table 10-4: IP Preferences Explained

Chapter 11: Securing Virtual Private Network Access

Table 11-1: Default VPN Configuration Settings
Table 11-2: VPN Tunneling Protocols

Chapter 12: Scripting with Microsoft ISA Server 2004

Table 12-1: Script Terminology
Table 12-2: Common Naming Prefixes
Table 12-3: FPC Root Object

Chapter 13: Configuring Arrays Using Centralized Management

Table 13-1: System Policies Rules Providing Array Level Communication

Chapter 14: Using Enterprise and Array Policies

Table 14-1: Comparing Enterprise and Array Policies

Chapter 15: Working with Enterprise Technologies and Microsoft ISA Server 2004

Table 15-1: Configuring the Cluster Parameters
Table 15-2: Configuring the Host Parameters

Chapter 18: Configuring Microsoft ISA Server with Microsoft Operations Manager 2005

Table 18-1: Explanation of the Operations Manager Consoles

Chapter 19: Configuring Microsoft ISA Server with Microsoft Virtual Server 2005

Table 19-1: Virtual Disk Types

Chapter 20: Configuring Microsoft ISA Server 2004 with Microsoft Small Business Server 2003

Table 20-1: Comparing SBS 2003 Standard Edition to Premium Edition