Microsoft 2004 Bedienungsanleitung

ISA Server 2004 Configuration Guide For the latest information, please see http://www.microsoft.com/isaserver/[...]

Contents Chapter 1 How to Use the Guide Chapter 2 Installing Certificate Services Chapter 3 Installing and Configuring the Microsoft Internet Authentication Service Chapter 4 Installing and Configuring Microsoft DHCP and WINS Server Services Chapter 5 Configuring DNS and DHCP Support for Web Proxy and Firewall Client Autodiscovery Chapter 6 Install[...]

ISA Server 2004 Configuration Guide: How to Use the Guide Chapter 1 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 1[...]

ISA Serv er 2004 Configuration Guide 2 Introduction Welcome to the ISA Server 2004 Configuration Guide ! This guide was designed to help you get started using ISA Server 2004 firewalls to protect your network and allow secure remote access to your network. While the Guide isn’ t a comprehensive set of documentation of all network scenarios, it wi[...]

ISA Serv er 2004 Configuration Guide 3 Lear n about ISA Ser ver 2004 f eatures ISA Server 2004 is designed to protect your net work from intruders located on the inside of your network and those outside of your network. The ISA Server 2004 firewall does this by controlling what communications can pass through t he firewall. The basic concept is sim[...]

ISA Serv er 2004 Configuration Guide 4 Practice configuring the ISA Ser v er 2004 fir ewall The firewall is your first line of defense against Internet attackers. A misconfigured firewall can potentially allow Internet attacks access to your network. For this reason, it’s v ery important that you understand how to configure the firewall for secur[...]

ISA Serv er 2004 Configuration Guide 5 T he ISA Ser ver 2004 Configuration Guide Lab Configuration We will use a lab network configuration to demonstrate the capabilities and features of ISA Server 2004 in this ISA Server 2004 Configuration Guide . We recommend that you set up a test lab with a similar configuration. If you do not have the resource[...]

RA DIUS DHCP DNS WINS D om ain C ont roller Ent erpris e C A Ex c hange 2003 Server IIS 6.0 Cachi ng- only DNS 172. 16 . 0. 0/ 16 1 0 . 0.0 .0 / 2 4 IP : 1 7 2 .1 6 .0 .2 /1 6 DG : 1 7 2 . 1 6 . 0 .1 D N S : 17 2. 16. 0. 2 IP : 1 0 .0 .0. 2 /2 4 DG : 1 0 .0 .0 . 1 D N S : 1 0 . 0 .0 .2 WINS : 1 0 . 0.0 .2 I P: 192 . 168. 1. 70 /24 D G: 192. 168. 1.[...]

ISA Serv er 2004 Configuration Guide 7 Lab Network Details Setting TRIHOMELAN1 CLIENT IP Address 172.16.0.2 10.0.0.3 Default Gatew ay 10.0.0.1 10.0.0.1 DNS 10.0.0.2 10.0.0.2 WINS 10.0.0.2 10.0.0.2 OS Windows Server 2003 Windows 2000 Services DC DNS WINS DHCP RADIUS Enterprise CA IIS: WWW SMTP NNTP FTP Installing and Configuring the Internal Network[...]

ISA Serv er 2004 Configuration Guide 8 5. On the Window s Server 2003 , Standard Edition Setup screen, select the Format the partition using the NTFS file system by using the up and down arrows on the keyboard. Then press ENTER. 6. Windows Setup formats the hard disk. This can take quite some time if the disk is large. Setup will copy files to the [...]

ISA Serv er 2004 Configuration Guide 9 Install and Configure DNS The next step is to install the Domain Naming System (DNS) server on the machine that will be the domain controller. This is required because the Active Directory requires a DNS server into which it registers domain-related DNS re cords. We will install the DNS server and then create [...]

ISA Serv er 2004 Configuration Guide 10 8. Expand the Forw ard Lookup Zones node and click on the msfirew all.org zone. Right click on the msfirew all.org and click New Host (A) . 9. In the New Host dialog box, enter the value EXCHANGE2003BE in the Name (uses parent domain name if blank) text box. In the IP address text box, enter the value 10.0.0.[...]

ISA Serv er 2004 Configuration Guide 11 17. Click Restart Now on the Active Directory Installation Wizard page. 18. Log on as Administrator after the machine restarts. Installing and Configuring Microsoft Exchange on the Domain Controller The machine is ready for installing Microsoft Exchange. In this section we will perform the following steps: ?[...]

ISA Serv er 2004 Configuration Guide 12 8. Select the Create a New Exchange Organization option on the Installation Type page and click Next . 9. Accept the default name in the Organization Name text box on the Organization Name page, and click Next . 10. On the Licensing Agreement page, select the I agree that I have read and will be bound by the [...]

ISA Serv er 2004 Configuration Guide 13 (passw ord is sent in clear text) checkbox. Click Yes in the IIS Manager dialog box informing you that the password is sent in the clear . In the Default domain text box, enter the name of the Internal network domain, which is MSFIREWALL . Click OK . 17. Click Apply in the ExchWeb Properties dialog box. Click[...]

Conc lusion In this ISA Server 2004 Configuration Guide document we discussed the goals of this guide and suggested methods you can use to get the most out of this guide. The remainder of this ISA Server 2004 Configuration Guide provided detailed step-by-st ep instructions on how to install and configure the domain controller com puter on the inter[...]

ISA Server 2004 Configuration Guide: Installing Certificate Services Chapter 2 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 15[...]

ISA Serv er 2004 Configuration Guide 16 Introduction Microsoft Certificate Services can be installed on the domain controller on the internal network and issue certificates to hosts within the internal network domain, as well as to hosts that are not members of the Internal network dom ain. We will use certificates in a variety of configuration sce[...]

Install Inter net Infor mation Ser vices 6.0 The Certificate Authority’s Web enrollment site uses the Internet Information Services World Wide Publishing Service. Because Exc hange 2003 has already been installed on this machine, we will not need to manually insta ll the IIS Web services. The Exchange 2003 setup routine requires that you insta ll[...]

ISA Serv er 2004 Configuration Guide 18 Install Microsoft Cer tificate Ser vices in Enter prise CA Mode Microsoft Certificate Services will be inst alled in Enterprise CA mode on the domain controller. There are several advantages to in stalling the CA in enterprise mode versus standalone mode. These include: • The root CA certificate is automati[...]

6. On the CA Identifying Information page, enter a name for the CA in the Common name for this CA text box. This should be the DNS host name for the domain controller. Ideally, you will have configured a split DNS infrastr ucture and this name will be accessible from internal and external locations, so that exter nal hosts will be able to check the[...]

7. If the same machine had been configured as a CA in the past, you will be presented with a dialog box asking if you wish to overwrit e the existing key. If you have already deployed certificates to hosts on your network, then do not overwrite the cu rrent key. If you have not yet deployed certificates to hosts on y our network, then choose to ove[...]

Conc lusion In this ISA Server 2004 Configuration Guide document we discussed the uses of a certificate authority and how to install an En terprise CA on the domain controller on the internal network. Later in this guide, we w ill use this Enterprise CA to issue machine certificates to VPN clients and servers and issue a Web site certificate to the[...]

ISA Server 2004 Configuration Guide: Installing and Configuring the Microsoft Internet Authentication Service Chapter 3 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 22[...]

ISA Serv er 2004 Configuration Guide 23 Introduction The Microsoft Internet Authentication Server (IAS) is an industry standard RADIUS server that can be used to authenticate users connecting to the ISA Server 2004 firewall machine. You can use IAS to authenticate Web Proxy client s on the internal network and VPN clients and VPN gateways calling i[...]

Installing the Microsoft Inter net Authentication Ser vice The Microsoft Internet Authentication Service server is a RADIUS server. We will use the RADIUS server later in this ISA Server 2004 Configuration Guide to enable RADIUS authentication for Web Publishing Rules and in vestigate how RADIUS authentication can be used to authenticate VPN client[...]

Configuring the Microsof t Inter net Authentica tion Ser vice You need to configure the IAS server to work together with the ISA Server 2004 firewall computer so that they can communicate proper ly. At this time, we will configure the IAS Server to work with the ISA Server 2004 firewall. Later we will configure the firewall to communicate with the [...]

4. Click the Verify button. In the Verify Client dialog box, the fully qualified domain name of the ISA Server 2004 firewall computer will appear in the Client text box. Click the Resolve button. If the RADIUS server is able to resolve the name, the IP address will appear in the IP address frame. If the RADIUS server is not able to resolve the name[...]

5. Click Next on the Name and Address page of the New RADIUS Client wizard. 6. On the Additional Information page of the wizard, use the default Client-Vendor entry, which is RADIUS Standard . Enter a password in the Shared secret text box and confirm the password in the Confirm shared secret text box. This shared secret will allow the ISA Server 2[...]

8. Close the Internet Authentication Service console. Later in this ISA Server 2004 Configuration Guide series we will configure a RADIUS server entry in the Microsoft Internet Security and Acceleration Serv er 2004 management console and use that entry fo r Web and VPN client requests. ISA Serv er 2004 Configuration Guide 28[...]

Conc lusion In this ISA Server 2004 Configuration Guide document we discussed the uses of a Microsoft Internet Authentication Server and how to install and configure the IAS server on the domain controller on the internal network. Later in this guide we will use this IAS server to authenticate incoming Web and VPN client connections. This is a prel[...]

ISA Server 2004 Configuration Guide: Installing and Configuring the Microsoft DHCP and WINS Server Services Chapter 4 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 30[...]

ISA Serv er 2004 Configuration Guide 31 Introduction The Windows Internet Name Service (WINS) enables machines to resolve NetBIOS names of hosts on remote networks. Machines configured as WINS clients register their names with the WINS server. WINS clients are also able to send name queries to a WINS server to resolve the names to IP addresses. Win[...]

Installing the WINS Ser vice The Windows Internet Name Service (WINS) is used to resolve NetBIOS names to IP addresses. On modern Windows networks, the WINS service is not required. However, many organizations want to use the My Network Places applet to locate servers on the network. The My Network Places applet depends on the functiona lity provid[...]

ISA Serv er 2004 Configuration Guide 33 The WINS server is ready to accept NetBIOS name registrations immediately. The ISA Server 2004 firewall, the domain controller, and the inte rnal network clients are all configured to register with the WINS server in their TCP/IP Properties settings.[...]

Configuring the DHCP Ser vice The Dynamic Host Configuration Protocol (DHCP) is used to automatically assign IP addressing information to internal network clients and VPN clients. In the scenarios covered in the ISA Server 2004 Configuration Guide , the DHCP server will be used primarily to assign IP addressing information to the VPN clients networ[...]

4. Right click on the server name in the left pane of the console and click the New Scope command. 5. Click Next on the Welcome to the New Scope Wizard page. 6. On the Scope Name page, enter a name for the scope in the Name text box and enter an optional description in the Description text box. In this example, we will name the scope Scope1 and wil[...]

12. On the Domain Name and DNS Serv ers page, enter the domain name used on the internal network in the Parent domain text box. This is the domain name that will be used by DHCP clients to fully qualify unqualified names , such as the wpad entry that is used for Web Proxy and Firewall client autodiscovery. In this example, the domain name is msfire[...]

s 13. On the WINS Servers page, enter the IP address of the WINS server in the IP address text box and click Add . In this example, the WINS server is located on the domain controller on the internal network, so we will enter 10.0.0.2 . Click Next . 14. On the Activate Scope page, select the Yes, I want to activate this scope now option and click N[...]

Conc lusion In this ISA Server 2004 Configuration Guide document we discussed the uses of the Microsoft WINS and DHCP servers, installed t he server services on the domain controller, and configured a scope on the DHCP server. Later in this guide we will see how the addition of the WINS and DHCP service help enhance the VPN client experience. This [...]

ISA Server 2004 Configuration Guide: Configuring DNS and DHCP Support for Web Proxy and Firewall Client Autodiscovery Chapter 5 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 39[...]

ISA Serv er 2004 Configuration Guide 40 Introduction The Web Proxy Autodiscovery Protocol (WPAD ) can be used to allow Web browsers and the Firewall client application to automatically discover the address of the ISA Server 2004 firewall. The client can then download autoconfigur ation information from the firewall after the Web Proxy or Firewall c[...]

Configure DHCP WP AD Suppor t The DHCP scope option number 252 can be used to automatically configure Web Proxy and Firewall clients. The Web Proxy or Firewall c lient must be configured as a DHCP client, and the logged on user must be a member of the lo cal administrators group or Power users group (for Windows 2000). On Windows XP systems, t he N[...]

4. In the Value frame, enter the URL to the ISA Server 2000 firewall in the String text box. The format for this value is: http://ISAServername:Autodiscovery Port Number/w pad.dat The default autodiscovery port number is TCP 80. You can customize this value in the ISA Management console. We will cover this subject in more detail later. In the curre[...]

5. Right click the Scope Options node in the left pane of the console and click the Configure Options command. 6. In the Scope Options dialog box, scroll through the list of Available Options and put a checkmark in the 252 w pad check box. Click Apply and then click OK . 7. The 252 w pad entry now appears in the right pane of the console under the [...]

ISA Serv er 2004 Configuration Guide 44 Configure DNS WP AD Suppor t Another method that used to deliver autodisco very information to Web Proxy and Firewall clients is DNS. You can create a wpad alias entry in DNS and allow browser clients to use this information to automatically configure themse lves. This is in contrast to the situation we saw w[...]

Create the Wpad Entr y in DNS The first step is to create a wpad alias entry in DNS. This alias (also known as a CNAME record) points to a Host (A) record for the ISA Server 2004 firewall. The Host (A) record resolves the name of the ISA Server 2004 firewall to the Internal IP address of the firewall. Create the Host (A) record before you creat e t[...]

4. In the Brow se dialog box, double click on the Forw ard Lookup Zone entry in the Records frame. 5. In the Brow se dialog box, double click on the name of your forward lookup zone in the Records frame. ISA Serv er 2004 Configuration Guide 46[...]

6. In the Brow se dialog box, select the name of t he ISA Server 2000 firewall in the Records frame. Click OK . 7. Click OK in the New Resource Record dialog box. ISA Serv er 2004 Configuration Guide 47[...]

8. The CNAME (alias) entry appears in the right pane of the DNS management console. 9. Close the DNS Management console. ISA Serv er 2004 Configuration Guide 48[...]

Configure the Client to Use the Full y Qualified wpad Alias The Web Proxy and Firewall client need to be able to resolve the name wpad . The Web Proxy and Firewall client configurations are not aware of the domain containing the wpad alias . The Web Proxy and Firewall client operating system mu st be able to provide this information to the Web Prox[...]

4. In the DNS Suffix and NetBIOS Computer Name dialog box, enter the domain name that contains your wpad entry in the Primary DNS suffix of this computer text box. The operating system will append this domain nam e to the wpad name before sending the DNS query to the DNS server. By default, the primary domain name is the same as the domain name the[...]

Configure the Client Br owser to Use Autodisco v er y The next step is to configure the browser to use autodiscovery. To configure the Web browser to use autodiscovery to automatically configure itself to use the ISA Server 2000 firewall’s Web Proxy service: 1. Right click on the Internet Explorer icon on the desktop and click Properties . 2. In [...]

Conc lusion In this ISA Server 2004 Configuration Guide document we discussed the uses of a Microsoft Internet Authentication Server and how to install and configure the IAS server on the domain controller on the Internal network. Later in this guide, we will us e this IAS server to authenticate incoming Web and VPN client connections. This is a pr[...]

ISA Server 2004 Configuration Guide: Installing and Configuring a DNS Caching-only DNS Server on the Perimeter Network Segment Chapter 6 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 53[...]

ISA Serv er 2004 Configuration Guide 54 Introduction DNS servers allow client system s to resolve names to IP addresses. Internet applications need to know the IP address of a destination host before they can connect. A caching-only DNS server is a special type of DNS in that is it not authoritative for any domain. This means the caching-only DNS s[...]

Installing the DNS Ser v er Ser vice The first step is to install the DNS server se rvice on the perimeter network host. This machine will act as both a secure caching-only DNS server and a publicly accessible Web and SMTP relay machine. Perform the following steps to install the DNS server service on the perimeter network host computer, TRIHOMELAN[...]

Configuring the DNS Ser ver as a Secure Cac hing-onl y DNS Ser ver The DNS server on the perimeter network will be in direct contact with Internet hosts. These hosts can be DNS clients that query the perim eter network DNS server for addresses of publicly accessible domain resources. They can also be DNS servers on the Internet that the caching-onl[...]

4. Click on the Forw arders tab. Make sure there is not a checkmark in the Do not use recursion for this domain check box. If this option is selected, the caching-only DNS server cannot use the root hints list of the r oot Internet DNS server to resolve Internet host names. Select this option only if you decide to use a forwarder. In this case, we [...]

6. Click the Monitoring tab. Put checkmarks in the A simple query against this DNS server and A recursive query to other DNS servers check boxes. Then click the Test Now button. Note in the Test results frame that the Simple Query shows a Pass , while the Recursive Query displays a Fail . The reason is that an Access Rule has not been created that [...]

7. Click Apply and then click OK in the DNS server’s Properties dialog box. 8. Close the DNS management console. At this point, the caching-only DNS server is able to resolve Internet host names. Later, we will create Access Rules allowing hosts on the in ternal network to use the caching-only DNS server to resolve Internet host names. ISA Serv e[...]

Conc lusion In this ISA Server 2004 Configuration Guide document we discussed the uses of a caching- only DNS server and how to install and configure the Microsoft DNS server service. Later in this guide we will configure Access Policies that a llow hosts on the internal network to use this DNS server and allow the caching-only DNS server to connec[...]

ISA Server 2004 Configuration Guide: Installing ISA Server 2004 on Windows Server 2003 Chapter 7 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 61[...]

ISA Serv er 2004 Configuration Guide 62 Introduction In this ISA Server 2004 Configuration Guide document we will install the ISA Server 2004 software onto the Windows Server 2003 computer we installed and configured in Chapter 1. Installing ISA Server 2004 is straightforward as there are only a few decisions that need to be made during installatio[...]

Installing ISA Ser v er 2004 Installing ISA Server 2004 on Windows Server 2003 is relatively straightforward. The major decision you make during setup is what IP addresses should be part of the Internal network. The Internal network address configuration is important because the firewall’s System Policy uses the Internal network addresses to defi[...]

7. On the Custom Setup page you can choose which components to install. By default, the Firew all Services and ISA Server Management options are installed. The Message Screener , which is used to help prevent spam and file attachments from entering and leaving the network, is not inst alled by default; neither is the Firew all Client Installation S[...]

9. In the Internal Network setup page, click the Select Netw ork Adapter button. 10. In the Select Network Adapter dialog box, remove the checkmark from the Add the follow ing private ranges … checkbox. Leave the checkmark in the Add address ranges based on the Window s Routing Table checkbox. Put a checkmark in the checkbox next to the adapter c[...]

11. Click OK in the Setup Message dialog box informing you that the Internal network was defined, based on the Wi ndows routing table. 12. Click OK on the Internal network address ranges dialog box. 13. Click Next on the Internal Network page. ISA Serv er 2004 Configuration Guide 66[...]

14. On the Firewall Client Connection Settings page, place checkmarks in the Allow non- encrypted Firewall client connections and Allow Firew all clients running earlier versions of the Firewall client softw are to connect to ISA Server checkboxes. These settings will allow you to connect to the ISA Server 2004 firewall using downlevel operating sy[...]

16. Click Install on the Ready to Install the Program page. 17. On the Installation Wizard Completed page, click Finish . 18. Click Yes in the Microsoft ISA Server dialog box informing you that the machine must be restarted. 19. Log on as Administrator after the machine restarts ISA Serv er 2004 Configuration Guide 68[...]

Vi ewing the System P olicy By default, ISA Server 2004 does not allow outbound access to the Internet from any protected network and it does not allow Inter net hosts access the firewall or any networks protected by the firewall. However, a default fi rewall System Policy is installed that allows network management tasks to be completed. Note: A p[...]

Order number Name Action (Allow or Deny) Protocols From (source netw ork or host) To (destination netw ork or host) Condition (w ho or w hat the rule applies to) You may want to widen the Name column to get a quick view rule the rule descriptions. Notice that not all the rules are enabled. Di sabled System Policy Rules have a tiny down- pointing re[...]

5. Review the System Policy Rules and then hide the rules by clicking the Show/Hide System Policy Rules button in the console’s button bar. This is the depressed (pushed in) button seen in the figure below. The following table includes a complete lis t of the default, built-in System Policy: Table 1: System Policy Rules Order Name Action Protocol[...]

ISA Serv er 2004 Configuration Guide 72 Order Name Action Protocols From To Condition NetBIOS Session 3 Allow Remote Management using Terminal Server Allow RDP(Terminal Services) Remote Management Computers Local Host All Users 4 Allow remote logging to trusted servers using NetBIOS Allow NetBIOS Datagram NetBIOS Name Service NetBIOS Session Local [...]

ISA Serv er 2004 Configuration Guide 73 Order Name Action Protocols From To Condition Server Remote Gateway s 15 Allow Microsoft CIFS protocol from ISA Server to trusted servers Allow Microsoft CIFS(TCP) Microsoft CIFS(UDP) Local Host Internal All Users 16 7 Allow Remote logging using Microsoft SQL protocol from firewall to trusted servers Allow Mi[...]

ISA Serv er 2004 Configuration Guide 74 Order Name Action Protocols From To Condition to specified Microsoft Error Reporting sites sites 24 4 Allow SecurID protocol from ISA Server to trusted servers Allow SecurID Local Host Internal All Users 25 5 Allow remote monitoring from ISA Server to trusted servers, using Microsoft Operations Manager (MOM) [...]

Bac king Up the Post-Installa tion Configur ation Perform the following steps to back up the post installation configuration: 1. Open the Microsoft Internet Security and Acceleration Serv er 2004 management console and right click on the server name in the left pane of the console. Click the Back Up command. 2. In the Backup Configuration dialog bo[...]

4. Click OK in the Exporting dialog box when you see the The configuration w as successfully backed up message. Make sure to copy the backup file to another location on the network after the backup is complete. The backup file should be stored off- line on media that supported NTFS formatting so that you can encrypt the file ISA Serv er 2004 Config[...]

Conc lusion In this ISA Server 2004 Configuration Guide document we discussed the procedures required to install the ISA Server 2004 so ftware on a Windows Server 2003 computer. We also examined the firewall System Policy that is created during installation. Finally, we finished up with step by step procedures requi red to back up the post-installa[...]

ISA Server 2004 Configuration Guide: Backing Up and Restoring Firewall Configuration Chapter 8 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 78[...]

ISA Serv er 2004 Configuration Guide 79 Introduction ISA Server 2004 includes a new and enhanced backup and restore feature set. In ISA Server 2000, the integrated backup utility could back up the ISA Server 2000 firewall configuration. That backup file could be used to restore the configuration to the same installation on the same machine. However[...]

Bac king up the Fir ewall Configuration The ISA Server 2004 integrated backup utility ma kes saving the firewall configuration very easy. There are only a handful of steps requir ed to backup and restore the configuration. Perform the following steps to back up the entire firewall configuration: 5. Open the Microsoft Internet Security and Accelerat[...]

8. Click OK in the Exporting dialog box when you see the The configuration w as successfully backed up message. Make sure to copy the backup file to another location on the network after the backup is complete. The backup file should be stored off- line on media that supported NTFS formatting so that you can encrypt the file. ISA Serv er 2004 Confi[...]

R estoring the Fir ewall Configuration from the Bac kup File You can use the backup file to restore the mach ine configuration. The restore can be to the same machine and same ISA Server 2004 firewall installation, the same machine and a new ISA Server 2004 firewall installation, or to a completely new machine. Perform the following steps to restor[...]

4. Click OK in the Importing dialog box when it shows the The configuration w as successfully restored message. 5. Click Apply to save the changes and update firewall policy. 6. Select the Save the changes and restart the service(s) option in the ISA Serv er Warning dialog box (note that this is not the se lected option in the figure, please select[...]

The restored configuration is now fully functi onal and the previous firewall policies are now applied. ISA Serv er 2004 Configuration Guide 84[...]

Expor ting Firewall P olicy You may not always want or need to export all aspects of the ISA Server 2004 firewall configuration. For example, you may have problems with your Access Policies and want someone to view them for you. You can expor t the firewall’s current Access Policies and send the export file to an ISA Server 2004 professi onal who[...]

3. In the Set Passw ord dialog box, enter a password and confirm the password in the Confirm passw ord text box. Click OK . 4. Click OK in the Exporting dialog box when you see the message Successfully exported the configuration . ISA Serv er 2004 Configuration Guide 86[...]

Impor ting Firewall P olic y The export file can be imported to the same machine or another machine that has ISA Server 2004 installed. In the following example, we will import the VPN Clients settings that were exported in the previous exercise. Perform the following steps to import the VPN Clients settings from the export file: 1. In the Microsof[...]

4. Click OK in the Importing Virtual Private Networks (VPN) dialog box when you see the Successfully imported the configuration message. 5. Click Apply to apply the changes and update firewall policy. 6. Click OK in the Apply New Configuration dialog box when you see the message Changes to the configuration w ere successfully applied . Note that ch[...]

Conc lusion In this ISA Server 2004 Configuration Guide section, we discussed the procedures for backing up and restoring the ISA Server 2004 fire wall configuration. We also explored the export and import feature that allows you to back up selected elements of the firewall configuration. In the next section of the ISA Server 2004 Configuration Gui[...]

ISA Server 2004 Configuration Guide: Simplifying Network Configuration with Network Templates Chapter 9 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 90[...]

ISA Serv er 2004 Configuration Guide 91 Introduction The ISA Server 2004 firewall comes with a number of pre-built Network Templates you can use to automatically configure Networks, Network Rules and Access Rules. The Network Templates are designed to get you started quickly by creating a base configuration on which you can build. You can choose fr[...]

ISA Serv er 2004 Configuration Guide 92 Scenario 1: T he Edge Fir ewall Configuration The Edge Firewall template configures the ISA Server 2004 firewall to have a network interface directly connected to the Internet and a second network interface connected to the Internal network. The network template allows you to quickly configure firewall policy[...]

ISA Serv er 2004 Configuration Guide 93 Firewall Policy Description access Server will prevent access from the Internet. The following access rules will be created: 1. Allow all protocols from Internal Network and VPN Clients Network to External Network (Internet) 2. Allow all protocols from VPN Clients Network to Internal Network Perform the follo[...]

3. Click Next on the Welcome to the Netw ork Template Wizard page. ISA Serv er 2004 Configuration Guide 94[...]

4. On the Export the ISA Server Configuration page, you are offered the opportunity to export the current configuration. You can return the ISA Server 2004 firewall to the state it was in prior to using the Edge Firewall network template using this file. We have already backed up the system configuration, so we w ill not need to export the configur[...]

5. On the Internal Netw ork IP Addresses page, you define the Internal network addresses. The current Internal network address range is automatically included in the Address ranges list. You can use the Add , Add Adapter and Add Private button to expand this list of addresses. In our current example we will keep the current Internal network address[...]

6. On the Select a Firew all Policy page you can select a firewall policy and a collection of Access Rules. In this example, we want to allow Internal network clients access to all protocols to access all sites on the Internet. After you become more familiar with the ISA Server 2004 firewall, you should increase the level of security for outbound a[...]

7. Review your settings and click Finish on the Completing the Netw ork Template Wizard page. 8. Click Apply to save the changes and update firewall policy. 9. Click OK in the Apply New Configuration dialog box after you see the message Changes to the configuration w ere successfully applied . 10. Click on the Firew all Policies node in the left pa[...]

ISA Serv er 2004 Configuration Guide 99[...]

ISA Serv er 2004 Configuration Guide 100 Scenario 2: T he 3-Le g P erimeter Configuration The 3-leg perimeter configuration creates net work relationships and Access Rules to support an Internal network segment and a perimeter (DMZ) network segment. The perimeter network segment can host your publicly-accessible resour ces and infrastructure server[...]

ISA Serv er 2004 Configuration Guide 101 Firewall Policy Description The following access rules will be created: 1. Allow HTTP, HTTPS, FTP fr om Internal Network and VPN Clients Network to the Ex ternal Network (Internet) 2. Allow DNS from Internal Network, VPN Clients Network and Perimeter Network to External Network (Internet) 3. Allow all protoc[...]

3. Click Next on the Welcome to the Netw ork Template Wizard page. 4. On the Export the ISA Server Configuration page, you can choose to export your current configuration. This is useful if you find that you need to return the firewall to its current settings in the event that the temp late settings do not meet your needs. We have already backed up[...]

5. On the Internal Netw ork IP Addresses page, you set the addresses that represent the Internal network. The addresses included in the current Internal network are automatically included in the Address ranges list. We will not add any addresses to the Internal network. Click Next . ISA Serv er 2004 Configuration Guide 103[...]

6. You configure the addresses that compri se the perimeter network segment on the Perimeter Netw ork IP Addresses page. The wizard does not make any assumptions regarding what addresses should be included in the perimeter network, so the Address ranges list is empty. ISA Serv er 2004 Configuration Guide 104[...]

7. Click the Add Adapter button. In the Netw ork adapter details dialog box, put a checkmark in the DMZ check box. Note that the names t hat we previously set for network adapters appear in this list. Renaming network adapters helps you identify the network association of that adapter. Click OK . ISA Serv er 2004 Configuration Guide 105[...]

8. The wizard automatically enters an address range to the Address ranges list based on the Windows routing table. Click Next . 9. On the Select a Firew all Policy page, you select a firewall policy that will create network relationships between the Internet, perimet er and Internal networks and also creates Access Rules. In this example, we want t[...]

10. Review the settings on the Completing the Netw ork Template Wizard and click Finish . 11. Click Apply to save the changes and update firewall policy. 12. Click OK in the Apply New Configuration dialog box after you see the message Changes to the configuration w ere successfully applied . 13. Click on the Firew all Policy node in the left pane o[...]

14. Expand the Configuration node in the left pane of the Microsoft Internet Security and Acceleration Server 2004 management console. Click on the Netw orks node. Here you see a list of networks, including the Perimeter network created by the template. 15. Click on the Netw ork Rules tab. Right click on the Perimeter Configuration Network Rule and[...]

16. In the Perimeter Configuration Properties dialog box, click on the Source Networks tab. You can see in the This rule applies to traffic from these sources list the Internal , Quarantined VPN Clients and VPN Clients networks listed as source networks. 17. Click on the Destination Netw orks tab. You see the Perimeter network in the This rule appl[...]

18. Click the Network Relationship tab. The default setting is Netw ork Address Translation (NAT) . This is a slightly higher security configuration because it hides the addresses of the Internal network clients that connect to perim eter network hosts. However, NAT relationships can complicate access for certain protocols as not all protocols supp[...]

19. Click Apply and then click OK . 20. Click Apply to save the changes and update the firewall policy. 21. Click OK in the Apply New Configuration dialog box after you see the message Changes to the configuration w ere successfully applied . ISA Serv er 2004 Configuration Guide 111[...]

Conc lusion In this ISA Server 2004 Configuration Guide chapter, we discussed how you can use the Edge Firewall and 3-Leg Perimeter network templa tes to simplify initial configuration of network addresses, Network Rules and Access Rules. In the next chapter of the ISA Server 2004 Configuration Guide, we will discuss the various ISA Server 2004 cli[...]

ISA Server 2004 Configuration Guide: Configuring ISA Server 2004 SecureNAT, Firewall and Web Proxy Clients Chapter 10 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 113[...]

ISA Serv er 2004 Configuration Guide 114 Introduction An ISA Server 2004 client is a machine that connects to a resource by going through the ISA Server 2004 firewall. In general, the ISA Server 2004 client is located on an Internal or perimeter network segment and connects to the Internet through the ISA Server 2004 firewall. There are three ISA S[...]

ISA Serv er 2004 Configuration Guide 115 • Configuring the ISA Server 2004 Web Proxy client • Configuring the ISA Server 2004 Firewall client[...]

ISA Serv er 2004 Configuration Guide 116 Configuring the SecureNA T Client The SecureNAT client configuration is simple . The only requirement is that the machine be configured with a default gateway that routes Internet-bound requests through the ISA Server 2004 firewall machine. There are two primary met hods you can use to configure a machine as[...]

5. Click OK in the Local Area Connection Properties dialog box. 6. Confirm the new IP addre ss assignment by using the ipconfig command. Click Start and Run . In the Open text box, enter cmd . 7. In the Command Prompt window, enter ipconfig /all and press ENTER. Here you can see the IP address assigned to the client, as well as the DNS, WINS and de[...]

8. Close the Command Prompt window. Return to the TCP/IP Properties dialog box and change the CLIENT machine to use a static IP address again. The IP address is 10.0.0.4 ; the subnet mask is 255.255.255.0 ; the default gateway is 10.0.0.1 , and the DNS server address is 10.0.0.2 . ISA Serv er 2004 Configuration Guide 118[...]

ISA Serv er 2004 Configuration Guide 119 Configuring the W eb Pro xy Client The Web Proxy client configuration requires that the Web browser be set to use the ISA Server 2004 firewall as its Web Proxy server. T here are several ways to configure the Web browser as a Web Proxy client. It can be: • manually configured to use the IP address of the I[...]

Enter the TCP port number that t he Web Proxy filter lists on the Port text box, which is by default 8080 . Click OK in the Local Area Netw ork (LAN) Settings dialog box. 4. Click OK in the Internet Properties dialog box. The Web browser is now confi gured as a Web Proxy client. ISA Serv er 2004 Configuration Guide 120[...]

ISA Serv er 2004 Configuration Guide 121 Configuring the Firewall Client The Firewall client software enables you to cont rol Internet access on a per user/group basis for all Winsock (TCP or UDP) connections to the Internet. The Firewall client software automatically sends user cr edentials in the background to the ISA Server 2004 firewall machine[...]

7. Click Install on the Ready to Install the Program page. 8. Click Finish on the Installation Wizard Completed page. You can now install the Firewall client softwar e from the Firewall client share on the domain controller. Perform the following steps to install the Firewall client software: 1. At the CLIENT computer on the Internal network, click[...]

5. Click Install on the Ready to Install the Program page. 6. Click Finish on the Install Wizard Completed page. The next step is to configure Firewall client support for the Internal network. Perform the following steps on the ISA Server 2004 firewall computer: 1. Open the Microsoft Internet Security and Acceleration Serv er 2004 management consol[...]

3. Click on the Auto Discovery tab. Place a checkmark in the Publish automatic discovery information check box. Leave the default port as 80 . Click Apply and OK . ISA Serv er 2004 Configuration Guide 124[...]

4. Click Apply to save the changes and update the firewall policy. 5. Click OK in the Apply New Configuration dialog box. We can now configure the Firewall client. Perf orm the following steps on the client computer on the Internal network: 1. At the CLIENT computer, double click on the Firewall client icon in the system tray. 2. In the Microsoft F[...]

3. Click the Detect Now button. The name of the ISA Server 2004 firewall computer will appear in the Detecting ISA Server dialog box when the client finds the ISA Server 2004 firewall. Click Close . ISA Serv er 2004 Configuration Guide 126[...]

4. Confirm that there is a checkmark in the Enable Web brow ser automatic configuration checkbox and click the Configure Now button. Note that based on the settings we created on the ISA Server 2004 firewall, the browser has been automatically configured. Click OK in the Web Brow ser Settings Update dialog box. ISA Serv er 2004 Configuration Guide [...]

5. Click Apply and then click OK in the Microsoft Firewall Client for ISA Server 2004 dialog box. The machine is now configured as a Firewall client and can access the Internet in its role as a Firewall client based on the Access Rules c onfigured on the ISA Server 2004 firewall. ISA Serv er 2004 Configuration Guide 128[...]

Conc lusion In this ISA Server 2004 Configuration Guide section we discussed the various ISA Server 2004 client types and the features provided by each client. After discussing the types of ISA Server 2004 clients, we went over the procedures required to install and configure each client type. In the next chapter of this ISA Server 2004 Configurati[...]

ISA Server 2004 Configuration Guide: Configuring ISA Server 2004 Access Policy Chapter 1 1 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 130[...]

ISA Serv er 2004 Configuration Guide 131 Introduction The ISA Server 2004 firewall controls w hat communications move between networks connected to one another via the firewall. By default, the ISA Server 2004 firewall computer blocks all traffic. The methods used to allo w traffic to move through the firewall are: • Access Rules, and • Publish[...]

ISA Serv er 2004 Configuration Guide 132 Rule Element Value Order (priority) 1 Action Allow Protocols HTTP and FTP (download). From/Listener Internal Network. To www.microsoft.com and ftp.microsoft.com. Condition Limited Web Access (Group). This rule limits allows users that belong to the Limited Web Access group to use the HTTP and FTP (download) [...]

Create a User Account The first step is to create a user account to which we can later assign limited Internet access privileges. In practice, the user account can be created in the Active Directory or on the local user database on the firewall computer. In our current example, we will create the user account in the Active Directory. Perform the fo[...]

5. Click Next on the Create an Exchange mailbox page. 6. Click Finish on the last page of the New User Wizard. ISA Serv er 2004 Configuration Guide 134[...]

Disable the Access Rules created by the Netw or k T emplate The next step is to disable the Access Rules created by the Network Template. In this example, we disable the Access Rules creat ed by the 3-Leg perimeter template. You can perform a similar procedure if you used the Front -end firewall Network Template. We want to use these rules later, s[...]

ISA Serv er 2004 Configuration Guide 136[...]

Create an Access R ule Limiting Pr otocols and Sites User s Can Access The first Access Rule will limit users access to only the HTTP and HTTPS protocols. In addition, the users will only be able to use these protocols when accessing Microsoft operated Web properties. A custom firewall group, Limited Access Web Users , will be created and user2 , l[...]

2. On the Welcome to the New Access Rule Wizard page, enter a name for the rule in the Access Rule name text box. In this example, we will call the rule Limited Users Web Access . Click Next . 3. On the Rule Action page, select Allow and click Next . 4. On the Protocols page, select Selected protocols from the This rule applies to dropdown list. Cl[...]

5. In the Add Protocols dialog box, double click on the HTTP and HTTPS protocols. Click Close . 6. Click Next on the Protocols page. ISA Serv er 2004 Configuration Guide 139[...]

7. On the Access Rule Sources page, click Add . In the Add Netw ork Entities dialog box, click on the Netw orks folder. Double click on the Internal network, and click Close . ISA Serv er 2004 Configuration Guide 140[...]

8. Click Next on the Access Rule Sources page. 9. On the Access Rule Destinations page, click Add . On the Add Netw ork Entities dialog box, click the New menu, and click Domain Name Set . 10. In the New Domain Name Set Policy Element dialog box, click New . Enter the first domain name *.microsoft.com and press ENTER. Enter the following three doma[...]

11. In the Add Network Entities dialog box, click on the Domain Name Sets folder and then double click on the Microsoft entry. Click Close . ISA Serv er 2004 Configuration Guide 142[...]

12. On the User Sets page, select All Users entry from the This rule applies to request from the follow ing user sets list, and click Remove . Click Add . 13. In the Add Users dialog box, click the New menu. 14. On the Welcome to the New User Sets Wizard page, enter a name for the User Set in the User set name text box. In this example, we will nam[...]

18. In the Select Users or Groups dialog box, enter User2 in the Enter the object names to select text box and click Check Names . When the Active Directory finds the user name, it will be underlined. Click OK . 19. Click Next on the Users page. 20. Click Finish on the Completing the New User Set Wizard page. 21. Double click the Limited Web Users [...]

Create an Access R ule Pr o viding Administr a tor s Greater Access to Protocols and Sites Network administrators require a higher level of Internet access than other users on the network. However, even network administrators should be restrained from protocols that can lead to a significant risk of network compromise. One of these protocols is the[...]

5. In the Add Protocols dialog box, click on the Instant Messaging folder. Double click on the IRC protocol. Click Close . ISA Serv er 2004 Configuration Guide 146[...]

6. Click Next on the Protocols page. 7. On the Access Rule Sources page, click Add . In the Add Netw ork Entities dialog box, click on the Netw orks folder. Double click on the Internal entry and click Close . 8. On the Access Rule Sources page, click Next . 9. On the Access Rule Destinations page, click Add . Click the Netw orks folder and then do[...]

17. Click Next on the Users page. 18. Click Finish on the Completing the New User Set Wizard page. 19. In the Add Users dialog box, double click on the Administrators entry, and click Close . 20. Click Next on the User Sets page. 21. Click Finish on the Completing the New Access Rule Wizard page. ISA Serv er 2004 Configuration Guide 148[...]

Create a DNS Ser v er Access Rule Allo wing Inter nal Networ k DNS Ser v er s Access to Inter net DNS Ser v er s We use a DNS server located on the Internet net work to resolve Internet host names in our current scenario. This DNS server must be able to resolve Internet host names by contacting other DNS servers located on the Internet. Most machin[...]

6. Click Next on the Protocols page. 7. On the Access Rule Sources page, click Add . In the Add Netw ork Entities dialog box, click the New menu, then click the Computer Set command. 8. In the New Computer Set Rule Element dialog box, click Add . Click the Computer option. ISA Serv er 2004 Configuration Guide 150[...]

9. In the New Computer Rule Element dialog box, enter a name for the DNS server in the Name text box. In this example, we’ll name the first DNS server DNS1 . Enter the IP address of the DNS server in the Computer IP Address text box. Click OK . 10. Click OK in the New Computer Set Rule Element dialog box. 11. In the Add Network Entities dialog bo[...]

12. Click Next on the Access Rule Sources page. 13. On the Access Rule Destinations page, click Add . Click the Networks folder and double click on the External entry. Click Close . 14. Click Next on the Access Rule Destinations page. 15. On the User Sets page, accept the default entry, All Users , and click Next . 16. Click Finish on the Completin[...]

Use HTTP P olicy to Pre v ent Access to Suspect We b Sites You can block access to Web sites based on virtually any component of the HTTP communication using ISA Server 2004 HTTP policy. For example, you might want to prevent access to all Web sites that contain a referenc e to the popular file-sharing application, Kaaza. This file-sharing program [...]

6. Click Apply and OK in the Configure HTTP policy for rule dialog box. ISA Serv er 2004 Configuration Guide 154[...]

7. Repeat the preceding steps for the Limited Access Web Users rule. 8. Click Apply to save the changes and update firewall policy. 9. Click OK in the Apply New Configuration dialog box. ISA Serv er 2004 Configuration Guide 155[...]

T est the Access Rules Now the we have an ISA Server 2004 Access Polic y in place, we can test the policy. Perform the following steps to test Access Policy: 1. First, review the Access Policies creat ed on the ISA Server 2004 firewall. In the Microsoft Internet Security and Acceleration Serv er 2004 management console, expand the server name and c[...]

8. Log off the CLIENT machine and then log on as Administrator . 9. Open the Web browser and enter www.microsoft.com in the Address bar of Internet Explorer and press ENTER . The Microsoft Web site appears. 10. Enter www.isaserver.org in the Address bar of Internet Explorer and press ENTER. As an Administrator, you are able to access the site. 11. [...]

Conc lusion In this ISA Server 2004 Configuration Guide section, we discussed the variety of methods you can use to control outbound access to the Internet using ISA Server 2004 Access Rules. In the walkthroughs, you created Access Rules t hat controlled access to specific Web sites and protocols based on user and group membership . In addition, yo[...]

ISA Server 2004 Configuration Guide: Publishing a Web and FTP Server on the Perimeter Network Chapter 12 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 159[...]

ISA Serv er 2004 Configuration Guide 160 Introduction ISA Server 2004 firewalls enable you to publish resources located on protected networks so external users can access those resources. There are two primary methods available to publish resources on a protected network: • Web Publishing Rules • Server Publishing Rules Web Publishing Rules can[...]

Configure the Web Site The first step is to configure the Web site on the perimeter network segment. In a production environment, the Web site will already be confi gured and be ready to publish. In this current example, we need to create a default Web site document and set a few parameters so that we can test it successfully. Perform the following[...]

6. Use the Move Up button to move the default.txt entry to the top of the list. ISA Serv er 2004 Configuration Guide 162[...]

7. Click Apply ; then click OK in the Default Web Site Properties dialog box. 8. Right click the server name in t he left pane of the console and point to All Tasks . Click Restart IIS . 9. Select Restart Internet Services on TRIHOMEDMZLAN1 in the Stop/Start/Restart dialog box and click OK . 10. Close the Internet Information Services (IIS) Manager[...]

ISA Serv er 2004 Configuration Guide 164 11. Click Start and Window s Explorer . 12. Navigate to the C:Inetpub wwwr oo t folder. Click the File menu, point to New and click Text Document . 13. Double click the New Text Document.txt entry in the right pane of the console. Enter into the document the following text: This is the Web site on the peri[...]

Configure the FTP Site The next step is to configure the FTP site so that it is ready to be published. You will set the IP address the FTP site listens on and configure me ssages for the FTP site to return to users connecting to the site. In addition, you will enable users to upload files to the FTP site. In a production environment, you may want t[...]

6. Click on the Home Directory tab. On the Home Directory tab, put a checkmark in the Write text box. Note that in a production env ironment you should be very careful about allowing write access to FTP sites. Inte rnet intruders can take advantage of poorly- secured FTP sites and store illegal material on your site. ISA Serv er 2004 Configuration [...]

7. Click Apply and OK in the Default FTP Site Properties dialog box. 8. Right click the server name in t he left pane of the console and point to All Tasks . Click Restart IIS . 9. Select the Restart Internet Services on TRIHOMEDMZLAN1 entry in What do you w ant IIS to do? and click OK . 10. Close the Internet Information Services (IIS) Manager con[...]

Disable the Custom Rules and Enable the T emplate Created Ru les In the last chapter in this ISA Server 2004 Configuration Guide , we created Access Rules that allowed for user/group-based access cont rol for outbound connections. We now want to disable those rules and use the rules that the 3-Leg Perimeter Network Template Wizard created. Perform [...]

6. With the two Access Rules still selected, click the blue, up-pointing arrow in the console button bar to move the rules to the top of the list. 7. Click Apply to save the changes and update firewall policy. 8. Click OK in the Apply New Configuration dialog box. ISA Serv er 2004 Configuration Guide 169[...]

ISA Serv er 2004 Configuration Guide 170 Create the W eb Publishing R ule You’re now ready to create the Web Publishing Rule. The Web Publishing Rule will configure the ISA Server 2004 firewall to listen for inco ming requests for your Web site. Because the ISA Server 2004 firewall is an intelligent, applicat ion layer aware firewall, it will acc[...]

6. On the Public Name Details page, select This domain name (type below ) in the Accept requests for list. In the Public name text box, enter the name that external users will use to access the site. In this example we will use the name perimeter.msfirew all.org . When users enter http://perimeter.msfirewall.org into their browsers, the name will r[...]

7. On the Select Web Listener page, click New . 8. On the Welcome to the New Web Listener Wizard page, enter a name for the Web listener in the Web listener name text box. In this example we will name the listener Listener1 . Click Next . 9. On the IP Addresses page, put a checkmark in the External check box and click Address . ISA Serv er 2004 Con[...]

10. On the External Network Listener IP Selection page, select Specified IP addresses on the ISA Server computer in the selected network . In the Available IP Addresses list, select the IP address on the external interface of the ISA Server 2004 firewall and click Add . The address now appears in the Selected IP Addresses list. Click OK . 11. Click[...]

12. On the Port Specification page, confirm that there is a checkmark in the Enable HTTP check box and that the default HTTP port number is 80 . Click Next . ISA Serv er 2004 Configuration Guide 174[...]

13. Click Finish on the Completing the New Web Listener Wizard page. 14. The Listener1 entry now appears in the Web listener list. Click Next . 15. On the User Sets page, accept the default entry, All Users , and click Next . 16. Click Finish on the Completing the New Web Publishing Rule Wizard page. 17. Click Apply to save the changes and update t[...]

3. Add the following line to the HOSTS file: 172.16.0.2 perimeter.msfirew all.org Press ENTER at the end of the line so that t he insertion point sits on the next line. Click File and then click Exit . In the Notepad dialog box, click Yes to indicate that you wish to save the changes. ISA Serv er 2004 Configuration Guide 176[...]

ISA Serv er 2004 Configuration Guide 177[...]

Create the FTP Ser v er Publishing Rule Server Publishing Rules are simpler than Web Publishing Rules. A Server Publishing Rule forwards incoming requests to the published se rver and exposes them to application layer filters installed on the ISA Server 2004 firewall. The only information you need to supply to the Server Publishing Rule wizard is t[...]

6. On the IP Addresses page, place a checkmark in the External check box. Click the Addresses button. 7. In the External Netw ork Listener IP Selection dialog box, select the Specified IP addresses on the ISA Server computer in the selected network option. Select the IP address on the external interface of the ISA Server 2004 firewall in the Availa[...]

T est the Connection We are now ready to test the connection. Inte rnet Explorer 6.0 can access both Web and FTP sites within the browser. The only difference in the current example is that you will specify http:// for the Web site and ftp:// for the FTP site. You will also see in the following walkthrough how to configure the FTP site to accept up[...]

x 7. If you would like to upload files to the site, return to the Microsoft Internet Security and Acceleration Server 2004 management console and right click on the Perimeter FTP Server publishing rule and click Configure FTP . 8. In the Configures FTP protocol policy dialog box, remove the checkmark from the Read Only check box. Click Apply and OK[...]

9. Click Apply to save the changes and update the firewall policy. 10. Click OK in the Apply New Configuration dialog box. ISA Serv er 2004 Configuration Guide 182[...]

Conc lusion In this ISA Server 2004 Configuration Guide document we discussed two primary methods that allow external users access to resource s contained on protected networks. We first used a Web Publishing Rule to allow inbound access to resources contained in a perimeter network segment. Next, we used a Server Publishing Rule to allow inbound a[...]

ISA Server 2004 Configuration Guide: Configuring the Firewall as a Filtering SMTP Relay Chapter 13 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 184[...]

ISA Serv er 2004 Configuration Guide 185 Introduction One of the optional components included with the ISA Server 2004 is the SMTP Message Screener. The SMTP Message Screener can in spect SMTP messages at the application layer relay or reject messages based on par ameters you configure. The SMTP Message Screener can evaluate incoming SMTP mail base[...]

ISA Serv er 2004 Configuration Guide 186 R estor e the System to its P ost-installation Sta te In order to fully test the inbound and outbound SMTP relay configuration in this scenario, we will return the machine to its post-installation state so that other Access Rules do not interfere with the scenario development. In a production environment, yo[...]

Assign a second IP addr ess to the Inter nal interface of the ISA Ser v er 2004 firewall We will add a second IP address to the Internal interface of the ISA Server 2004 firewall machine. This will allow us to publish the outbound SMTP relay on a different IP address than the inbound SMTP relay. While this is not required, it greatly simplifies tra[...]

Install and Configure the SMTP Ser vice Install the IIS 6.0 SMTP service before t he ISA Server 2004 SMTP Message Screener. The SMTP service works together with the SM TP Message Screener to examine and block offending e-mail messages. Perform the following steps to inst all the IIS 6.0 SMTP service: 1. Click Start and point to Control Panel . Clic[...]

2. In the Internet Information Services (IIS) Manager console, expand the computer name in the left pane of the console. Right click the Default SMTP Virtual Server and click Properties . 3. In the Default SMTP Virtual Server Properties dialog box, click the Access tab. 4. On the Access tab, click the Relay button in the Relay restrictions frame. 5[...]

14. Right click the Default SMTP Virtual Server node and click Stop . Right click the Default SMTP Virtual Server node and click Start . ISA Serv er 2004 Configuration Guide 190[...]

Install the SMTP Message Scr eener The SMTP Message Screener is an optional ISA Server 2004 component. This feature integrates with the IIS 6.0 SMTP serv ice to examine and block SMTP mail based on parameters you configure in the Message Screener. Perform the following steps to install the SMTP Message Screener on the ISA Server 2004 firewall compu[...]

7. Click Install on the Ready to Modify the Program page. 8. Put a checkmark in the Invoke ISA Server Management when the w izard closes check box and click Finish on the Installation Wizard Completed page. 9. Close the Autorun menu. ISA Serv er 2004 Configuration Guide 192[...]

Create the SMTP Ser v er Publishing Rules The SMTP Message Screener works together with SMTP Server Publishing Rules. Each SMTP Server Publishing Rule can be configured with a custom set of SMTP Message Screener parameters. This allows you to create different e-mail screening policies for the inbound and outbound SMTP relays. Different SMTP Message[...]

6. On the IP Addresses page, put a checkmark in the External check box and click the Address button. 7. In the External Netw ork Listener IP Selection dialog box, select Specified IP addresses on the ISA Server computer in the selected network . Click the IP address for the external interface you want to use in the rule. In this example, the IP add[...]

7. In the External Netw ork Listener IP Selection dialog box, select the Specified IP addresses on the ISA Server computer in the selected network option. Click the IP address on the Internal interface you want to use in the rule. In this example, the IP address is 10.0.0.10 , then click Add . The IP address now appears in the Selected IP Addresses[...]

2. Click on the General tab in the Configure SMTP Protocol Policy dialog box. Place a checkmark in the Enable support for Message Screener checkbox. 3. Click on the Keywords tab. Place a checkmark in the Enable this rule checkbox. Click Add . In the Mail Keyword Rule dialog box, enter resume in the Keyword text box. Select the Message header or bod[...]

Perform the following steps on the Inbound SMTP Relay Server Publishing Rule: 1. Right click the Inbound SMTP Relay rule and click Configure SMTP . 2. Click on the General tab in the Configure SMTP Protocol Policy dialog box. Place a checkmark in the Enable support for Message Screener check box. 3. Click on the Keywords tab. Click the Add button. [...]

Create the Outbound SMTP Access Ru le Perform the following steps to create an out bound SMTP Access Rule that enables the ISA Server 2004 firewall to relay SMTP from the In ternal Exchange Server to SMTP servers for other domains on the Internet: 1. In the Microsoft Internet Security and Acceleration Serv er 2004 management console, expand the com[...]

ISA Serv er 2004 Configuration Guide 199 10. On the User Sets page, accept the default value, All Users , and click Next . 11. Click Finish on the Completing the New Access Rule Wizard page. 12. Click Apply to save the changes and update the firewall policy. 13. Click OK in the Apply New Configuration dialog box.[...]

Configure SMTP Messa ge Scr eener Log ging The SMTP Message Screener logs all messages moving the inbound and outbound SMTP relays. This logging feature helps you tr oubleshoot and access the e-mail messages moving through the server and confirm that the SMTP Message Screener is doing what you expect it to do. Perform the following steps to configu[...]

5. Click OK in the Options dialog box. 6. Click Apply and then click OK in the SMTP Message Screener Properties dialog box. 7. Click Apply to save the changes and update the firewall policy. 8. Click OK in the Apply New Configuration dialog box. ISA Serv er 2004 Configuration Guide 201[...]

ISA Serv er 2004 Configuration Guide 202 T est SMTP Filtering Now that the SMTP Server Publishing Rule and SMTP Message Screener configurations are in place, we’re ready to test t he effectiveness of the Message Screener. Perform the following on the external client ma chine to test the inbound SMTP relay function: 1. On the external client compu[...]

Conc lusion In this ISA Server 2004 Configuration Guide document, we discussed how to make the ISA Server 2004 firewall your front line protecti on as an e-mail defense in-depth plan. The ISA Server 2004 SMTP Message Screener can provide initial inspection and protection against dangerous and inappropriate e-mail messages. The Message Screener can [...]

ISA Server 2004 Configuration Guide: Publishing the Exchange Outlook Web Access, SMTP Server and POP3 Server Sites Chapter 14 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 204[...]

ISA Serv er 2004 Configuration Guide 205 Introduction One of the main reasons to deploy a ISA Se rver 2004 firewall is to protect Microsoft Exchange Servers. ISA Server 2004 includes a num ber of technologies focused on providing enhanced support to protect Micros oft Exchange Services published to the Internet. This increased level of protection f[...]

ISA Serv er 2004 Configuration Guide 206 R estor e the System to its P ost-installation Sta te In order to fully test the inbound and outbound SMTP relay configuration in this scenario, we will return the machine to its post-installation state so that other Access Rules do not interfere with the scenario development. In a production environment, yo[...]

Create the OWA W eb Publishing Rule You can publish the Microsoft Exchange Outlook Web Access site using ISA Server 2004 Web Publishing after the site is configur ed to support secure SSL connections. These procedures include forcing SSL on the OWA direct ories and allowing the directories to accept only basic authentication. Perform the following [...]

6. On the Bridging Mode page, select Secure connection to clients and mail server and click Next . ISA Serv er 2004 Configuration Guide 208[...]

7. On the Specify the Web Mail Serv er page, enter the name for the Internal OWA Web site in the Web mail server text box. In this example, we will use the name ow a.msfirew all.org . Click Next . ISA Serv er 2004 Configuration Guide 209[...]

8. On the Public Name Details page, select This domain name (type below ) in the Accept requests for list. Enter the name external users will use to access the OWA Web site in the Public name text box. In this example, the external users will use the name ow a.msfirew all.org . Click Next . ISA Serv er 2004 Configuration Guide 210[...]

9. On the Select Web Listener page, click New . 10. On the Welcome to the New Web Listener Wizard page, enter a name for the listener in the Web listener name text box. In this example, we will use the name OWA SSL Listener . Click Next . 11. On the IP Addresses page, put a checkmark in the External check box. Click the Address button. 12. In the E[...]

19. In the OWA SSL Listener Properties dialog box, click the Preferences tab. 20. On the Preferences tab, click the Authentication button. 21. In the Authentication dialog box, remove the checkmark from the Integrated check box. Click OK in the Microsoft Internet Security and Acceleration Serv er 2004 dialog box warning that the no authentication m[...]

23. Click Apply and then click OK in the OWA SSL Listener Properties dialog box. 24. Click Next on the Select Web Listener page. ISA Serv er 2004 Configuration Guide 213[...]

25. On the User Sets page, accept the default entry, All Users , and click Next . 26. Click Finish on the Completing the New Mail Server Publishing Rule Wizard page. 27. Click Apply to save the changes and update the firewall policy. 28. Click OK in the Apply New Configuration dialog box. The next step is to create a HOSTS file entry on the ISA Ser[...]

6. Add the following line to the HOSTS file: 10.0.0.2 ow a.msfirew all.org Press ENTER at the end of the line so that t he insertion point sits on the next line. Click File and Exit . In the Notepad dialog box, click Yes to indicate that you wish to save the changes. ISA Serv er 2004 Configuration Guide 215[...]

ISA Serv er 2004 Configuration Guide 216[...]

Create the SMTP Ser v er Publishing Rule You can create an SMTP Server Publishing Ru le to provide external users and servers access to the Microsoft Exchange SMTP service. In general, you will prefer to use the ISA Server 2004 firewall as a secure SMTP filteri ng relay to prevent external users and servers from directly connecting to the Exchange [...]

16. In the External Network Listener IP Selection dialog box, select Specified IP addresses on the ISA Server computer in the selected network . Click the IP address on the external interface you want to use in the rule. In this example, the IP address is 192.168.1.70 . Click Add . The IP address now appears in the Selected IP Addresses list. Click[...]

ISA Serv er 2004 Configuration Guide 219 Create the POP3 Ser v er Publishing Rule Remote access to the Exchange Server POP3 service allows users located away from the office to download their mail from the Exc hange Server to virtually any e-mail client application. Users must provide a user nam e and password when they connect to the POP3 service.[...]

8. Click Next on the IP Addresses page. 9. Click Finish on the Completing the New Server Publishing Rule Wizard page. ISA Serv er 2004 Configuration Guide 220[...]

T est the connection We are now ready to test the OWA, SMTP and POP3 connections to the Exchange Server located behind the ISA Server 2004 firewall. The first step is to create a HOSTS file entry on the client so that it correct resolves the name of the OWA site. In a production environment, you would create a public DNS resource record t hat corre[...]

5. In the Outlook Web Access Log on form, enter the user name in the Domainuser name text box, and the password in the Passw ord text box. Select the Premium client type and the Private computer Security type. In the current ex ample, we will enter the user name MSFIREWALLAdministrator and the Administrator’s password. Click Log On . Next, we w[...]

7. On the Internet Mail Logon page, enter Administrator in the Account name text box and the administrator’s password in the Passw ord text box. Click Next . 8. Click Finish on the Congratulations! page. 9. Click Close on the Internet Accounts dialog box. 10. Close Outlook Express and then open it again. Click the Create Mail button and address a[...]

Conc lusion In this ISA Server 2004 Configuration Guide document, we discussed how to publish a Microsoft Exchange Outlook Web Access (OWA) site and how to publish the Exchange POP3 and SMTP services. In the next document in this ISA Server 2004 Configuration Guide series, we will discuss how the firewall can be used to publish an array of Exchange[...]

ISA Server 2004 Configuration Guide: Configuring the ISA Server 2004 Firewall as a VPN Server Chapter 15 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 225[...]

ISA Serv er 2004 Configuration Guide 226 Introduction The ISA Server 2004 firewall can be configured as a VPN server. The VPN server component enables it to accept incoming VPN client calls so that the VPN client computer can become a member of a protected network. Traditional VPN servers allow VPN clients full access to the networks to which they [...]

Enable the VPN Ser ver By default, the VPN server component is disabled. The first step is to enable the VPN server feature and configure the VPN server components. Perform the following steps to enable and c onfigure the ISA Server 2004 VPN Server: 1. Open the Microsoft Internet Security and Acceleration Serv er 2004 management console and expand [...]

7. Click on the Groups tab. On the Groups tab, click the Add button. 8. In the Select Groups dialog box, click the Locations button. In the Locations dialog box, click the msfirew all.org entry and click OK . 9. In the Select Group dialog box, enter Domain Users in the Enter the object names to select text box. Click the Check Names button. The gro[...]

10. Click the Protocols tab. On the Protocols tab, put a checkmark in the Enable L2TP/IPSec check box. ISA Serv er 2004 Configuration Guide 229[...]

11. Click the User Mapping tab. Put a checkmark in the Enable User Mapping check box. Put a checkmark in the When username does not contain a domain, use this domain check box. Enter msfirew all.org in the Domain Name text box. ISA Serv er 2004 Configuration Guide 230[...]

12. Click Apply in the VPN Clients Properties dialog box. Click OK in the Microsoft Internet Security and Acceleration Serv er 2004 dialog box that informs that you must restart the ISA Server firewall befor e the settings take effec t. Click OK . 13. Click Apply to save the changes and update the firewall policy. 14. Click OK in the Apply New Conf[...]

Create an Access R ule Allowing VPN Clients Access to the Inter nal Networ k At this point, VPN clients c an connect to the VPN server. However, the VPN clients cannot access any resources on the Internal network. You must first create an Access Rule that allows members of the VPN clients network acce ss to the Internal network. In this example, yo[...]

ISA Serv er 2004 Configuration Guide 233 6. Click Next on the Access Rule Sources page. 7. On the Access Rule Destinations page, click Add . On the Add Netw ork Entities dialog box, click the Netw orks folder and double click on Internal . Click Close . 8. On the User Sets page, accept the default setting, All Users , and click Next . 9. Click Fini[...]

Enable Dial-in Access for the Administrator Account In non-native mode Active Directory domains, a ll user accounts have dial-in access disabled by default. In this circumstance, you must enable dial-in access on a per account basis. In contrast, Active Directory domains in native mode have dial-in access set to be controlled by Remote Access Polic[...]

T est the VPN Connection The ISA Server 2004 VPN server is now ready to accept VPN client connections. Perform the following steps to test the VPN Server: 1. On the Windows 2000 external c lient machine, right click the My Network Places icon on the desktop and click Properties . 2. Double click the Make New Connection icon in the Netw ork and Dial[...]

12. Click Start and the Run command. In the Run dialog box, enter EXCHANGE2003BE in the Open text box, and click OK . The shares on the domain controller computer appear. 13. Right click the Connection icon in the system tray and click Disconnect . ISA Serv er 2004 Configuration Guide 236[...]

Conc lusion In this ISA Server 2004 Configuration Guide document, we discussed how to enable the ISA Server 2004 VPN server component and how to configure the VPN server. We tested the VPN server functionality by creating a VPN client connection to the server and accessing resources on the Internal network . In the next chapter in this ISA Server 2[...]

ISA Server 2004 Configuration Guide: Creating a Site-to-Site VPN with ISA Server 2004 Firewalls Chapter 16 For the latest information, please see http://www.microsoft.com/isaserver/ ISA Serv er 2004 Configuration Guide 238[...]

ISA Serv er 2004 Configuration Guide 239 Introduction A site-to-site VPN connection connects two or more networks using a VPN link over the Internet. The VPN site-to-site configuration wo rks just like a LAN router; packets destined for IP addresses at a remote site are routed through the ISA Server 2004 machine. The ISA Server 2004 firewall machin[...]

Create the R emote Site at the Main Office We will begin by configuring the ISA Server 2004 firewall at the main office. First, create the Remote Site Network in the Microsoft Internet Security and Acceleration Server 2004 management console. Perform the following steps to create the Remote Site Network at the main office ISA Server 2004 firewall m[...]

5. On the Remote Site Gatew ay page, enter the IP address of the external interface of the remote ISA Server 2004 firewall machine. In this example, the IP address is 192.168.1.71 , so we will enter this value into the text box. Click Next . 6. On the Remote Authentication page, put a checkmark in the Local site can initiate connections to remote s[...]

7. Read the information on the Local Authentication page, and click Next . 8. On the L2TP/IPSec Authentication page, put a checkmark in the Allow pre-shared key IPSec authentication as a secondary (backup) authentication method check box. Enter a key in the Use pre-shared key for authentication text box. In this example, use the key 123 . Click Nex[...]

9. Click Add on the Network Addresses page. In the IP Address Range Properties dialog box, enter 10.0.1.0 in the Starting address text box. Enter 10.0.1.255 in the Ending address text box. Click OK . ISA Serv er 2004 Configuration Guide 243[...]

ISA Serv er 2004 Configuration Guide 244 10. Click Next on the Netw ork Addresses page. 11. Click Finish on the Completing the New Netw ork Wizard page.[...]

ISA Serv er 2004 Configuration Guide 245 Create the Netw or k R ule at the Main Office The ISA Server 2004 firewall must know what me thod to use to route packets to the branch office network. There are two options: Route and NAT. A route relationship routes packets to the branch office and preserves the source IP address of the clients who make a [...]

11. Click Finish on the Completing the New Netw ork Rule Wizard page. ISA Serv er 2004 Configuration Guide 246[...]

Create the Access R ules at the Main Of fice In this example, we want the clients on both the main and branch office networks to have full access to all resources on each network. We must create Access Rules t o allow traffic from the main office to the branch office and from the branch office to the main office. Perform the following steps to crea[...]

11. On the User Sets page, accept the default entry All Users and click Next . 12. Click Finish on the Completing the New Access Rule Wizard page. The second rule will allow the hosts on the branc h office network access to the main office network: 1. Click the Tasks tab in the Task pane. Click Create New Access Rule . 2. On the Welcome to the New [...]

Finally, to enable access for VPN clients: 1. Click on the Virtual Private Network node in the left Pane of the console. 2. Click the VPN Clients tab in the Details Pane. Click the Tasks tab in the Task Pane. Click Enable VPN Client Access . 3. Click OK in the ISA Server 2004 dialog box informing you that the Routing and Remote Access service must [...]

ISA Serv er 2004 Configuration Guide 250 Create the VPN Ga teway Dial-in Account a t the Main Of fice A user account must be created on the main office firewall that the branch office firewall can authenticate when it creates the site-to-site connection. This user account must have the same name as the demand-dial interface on the ma in office comp[...]

Set the Shared Pass word in the RRAS Console at the Main Of fice The pre-shared key you entered into the Microsoft Internet Security and Acceleration Server 2004 management console is not automatically copied to the Routing and Remote Access service. You must configure the Routing and Remote Access service to use the pre- shared key you configured [...]

ISA Serv er 2004 Configuration Guide 252 Create the R emote Site at the Branc h Of fice Now that the main office is ready, we c an configure the branch office ISA Server 2004 firewall. First, create the Remote Si te Network at the branch office: Perform the following steps to create the Re mote Site Network at the branch office: 1. Open the Microso[...]

ISA Serv er 2004 Configuration Guide 253[...]

Create the Network Rule a t the Br anch Of fice Just as we did at the main office, we must create a routing relationship between the branch office and the main office networks. We will conf igure a route relationship so that we can get the highest level of protocol support. Perform the following steps to create t he Network Rule at the branch offic[...]

ISA Serv er 2004 Configuration Guide 255 Create the Access R ules at the Branch Of fice We need to create two Access Rules, one that allows traffic from the branch office to the main office, and the second to allow traffic from the main office to the branch office. To create Access Rules that allow traffic to move between the branch and main office[...]

The last step we need to take in the Microsoft Internet Security and Acceleration Server 2004 management console is to enable access for VPN clients: 1. Click on the Virtual Private Network node in the left Pane of the console. 2. Click the VPN Clients tab in the Details Pane. Click the Tasks tab in the Task Pane. Click p Enable VPN Client Access p[...]

ISA Serv er 2004 Configuration Guide 257 Create the VPN Ga teway Dial-in Account a t the Main Of fice We must create a user account that the main office VPN gateway can authenticate when it initiates the VPN site-to-site connection. The user account must have the same name as the demand-dial interface created on the branch office machine. Perform t[...]

ISA Serv er 2004 Configuration Guide 258[...]

ISA Serv er 2004 Configuration Guide 259 Set the Shared Pass word in the RRAS Console at the Branch Of fice The pre-shared key configured in the Microsoft Internet Security and Acceleration Server 2004 management console is not automatically copied to the Routing and Remote Access service. You must manually c onfigure the Routing and Remote Access [...]

ISA Serv er 2004 Configuration Guide 260 Activa te the Site to Site Links Now that both the main and branch office ISA Server 2004 firewalls are configured as VPN routers, you can test t he site-to-site connection. Perform the following steps to test the site-to-site link: 1. At the remote client computer behind the remote ISA Server 2004 firewall [...]

Conc lusion In this ISA Server 2004 Configuration Guide document we discussed how to use the ISA Server 2004 firewall as a VPN gateway that enables site-to-site VPN links. We configured two ISA Server 2004 firewalls, one at the main office and a second at the branch office. We tested the VPN site-to-site connectivity by pinging from clients on each[...]