Introduction

header graphic
Microsoft® Internet Security and Acceleration (ISA) Server 2004 offers secure, fast, and manageable Internet connectivity. ISA Server 2004 integrates a sophisticated, application layer aware, multiple layer enterprise firewall and a high performance Web cache.

This release introduces multi-networking support, an easy-to-use and highly integrated virtual private networking configuration, extended and extensible user and authentication models, and improved management features, including configuration import and export. The ISA Server Enterprise Edition adds support of arrays, multiple arrays, Network Load Balancing (NLB), and Cache Array Routing Protocol (CARP). Because you can have more than one ISA Server computer in an array, you have the advantages of high availability, failover, and redundancy.
branding bullet ISA Server Guides and Articles
Your primary source for in-depth technical information about ISA Server is the set of Web-based ISA Server Guides and Articles. New documents are added to the library periodically, ensuring that you always have the latest ISA Server technical information.

ISA Server Help may be updated after ISA Server is released.

To download and install any Help updates, and to get additional, up-to-date content, go to ISA Server Guides and Articles.
branding bullet ISA Server Community
Whether you are a novice or an experienced user, Community is your place to share ideas, get answers to your questions, read expert advice, and more. Join peer-to-peer discussions about ISA Server issues and solutions at ISA Server Community.


Product Overview

The following topics describe Microsoft Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition architecture, features, and solutions.

  • Enterprise Edition architecture
  • Enterprise Edition features
  • New and Improved Features
  • Solutions

Web Link Get latest ISA Server content at ISA Server Guides and Articles.
Send feedback about this page Send feedback about this page.


Enterprise Edition architecture

The Microsoft Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition is composed of the following components:

  • ISA Server Management. ISA Server Management is the console through which the administrator manages the enterprise.
    • Through the user interface (UI) console, the administrator connects to a specific Configuration Storage server to manage the enterprise.

    ISA Server Management will also perform specific remote procedure calls (RPCs) to various computers running ISA Server services to obtain computer specific information. For example, when performing monitoring, the management console makes calls directly to the computers to monitor their state.

  • Configuration Storage server. A Configuration Storage server is a server on which the configuration for all the arrays in the enterprise is stored. The Configuration Storage server uses Active Directory® Application Mode (ADAM) for storage. When you install the Configuration Storage server, you also automatically install ADAM on the computer. When you configure arrays in the enterprise, you are changing the information in the Configuration Storage server. At a later time, the ISA Server 2004 Enterprise Edition computers will access the Configuration Storage server to check whether there is any configuration change, and update their local storage (registry based) to reflect the recent changes in the enterprise.

    The Configuration Storage server service runs under the network service account. If you install the Configuration Storage server on a domain controller, you must provide an account under which the service will run. For more information, see the product documentation.

    There can be multiple Configuration Storage servers in the enterprise, each holding an exact replica of the enterprise configuration.

    Each array points to a specific Configuration Storage server from which it gets the updated configuration. You can also specify an alternate Configuration Storage server, which is used if the first Configuration Storage server fails.

  • ISA Server services. This is the computer that runs the firewall, virtual private network (VPN), and caching functions of ISA Server. The computer running ISA Server services is connected to a Configuration Storage server, which stores the configuration information.
  • Array. An array represents one or more ISA Server 2004 computers running ISA Server services that are physically connected and share the same configuration.

    • Notes

    All computers grouped in an array must have the same:

    • Number of network adapters, connected to array-level networks with the same names.
    • Dial-up connections configured.
    • Time zone, with synchronized clocks (for logging).
    • Partitions (for logging).
    • Certificates installed on each array member.
    • Language version of ISA Server and Microsoft Windows Server™ 2003 installed, with the same locale set for the computer and for the user who is logged on.
    • Updates installed.
    • Domain and site configuration (or belong to a workgroup).
    • Also, network services should be available to each array member (for example, DNS, CRL Verification connectivity, and Active Directory connectivity).
  • Enterprise. An enterprise is a collection of ISA Server 2004 computers that are grouped into arrays. An enterprise includes one or more Configuration Storage servers that store ISA Server information, such as the arrays and servers that are part of the enterprise. Each array points to a specific Configuration Storage server from which it gets the updated configuration.

    • ISA Server Management, even though it may be installed with ISA Server 2004 services (it is also installed with the Configuration Storage server), gets its information from the Configuration Storage server. Therefore, if a Configuration Storage server fails, ISA Server Management will not provide access to any ISA Server functionality. At the same time, the ISA Server 2004 array will continue to provide firewall, VPN, and proxy services based on the last known configuration it received from the Configuration Storage server. However, you will not be able to monitor or change its configuration until the Configuration Storage server is restored, or until you connect the computer running ISA Server services and ISA Server Management to a replica of the Configuration Storage server.


Enterprise Edition features

Microsoft Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition provides the following features not found in the Standard Edition:

  • Centralized management. You can manage all of the arrays and their member servers from a single, centralized location.
  • Enterprise policy. You can enforce policy on an enterprise level. The enterprise administrator has granular control over policy throughout the enterprise, including the level of policy authority granted to array administrators.
  • CARP. Using Cache Array Routing Protocol (CARP), you can efficiently manage the storage and retrieval of cached information for an array of ISA Server computers.
  • Network Load Balancing. Because Network Load Balancing (NLB) is integrated with ISA Server, you can manage NLB from ISA Server.
  • Centralized storage. ISA Server configuration information is stored in the Active Directory® Application Mode (ADAM).
  • Centralized monitoring. With the proper credentials, you can monitor ISA Server computers from any location.


New and Improved Features

The following topics provide information about new and improved features in Microsoft Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition.

  • Features overview
  • Multi-networking and firewall policy
  • Network Load Balancing
  • Networks and network objects
  • Firewall policy
  • Cache
  • CARP


Features overview

The following table lists new and improved Microsoft Internet Security and Acceleration (ISA) Server 2004 features.

Multi-Networking
New or improved | Feature | Description
New | Multiple network configuration and enterprise networks | You can configure one or more networks, each with distinct relationships to other networks. Access policies are defined relative to the networks, and not necessarily relative to a given Internal network. Whereas in ISA Server 2000, all traffic was inspected relative to a local address table (LAT) that included only address ranges on the Internal network, ISA Server 2004 extends the firewall and security features to apply to traffic between any networks. Enterprise Edition also provides enterprise networks, to enable you to manage networks and policy on an enterprise level.
New | Unique per-network policies | The new multi-networking features of ISA Server enable you to protect your network against internal and external security threats, by limiting communication between clients even within your own organization. Multi-networking functionality supports sophisticated perimeter network (also known as a DMZ, demilitarized zone, or screened subnet) scenarios, so that you can configure how clients in different networks access the perimeter network.
New | Stateful inspection of all traffic | You can examine data crossing the firewall in the context of its protocol and the state of the connection, no matter the source or destination.
New | NAT and route network relationships | You can use ISA Server to define relationships between networks, depending on the type of access and communication allowed between the networks. In some cases, you may want more secure, less transparent communication between the networks. For these scenarios, you can define a network address translation (NAT) relationship. In other scenarios, you want to simply route traffic through ISA Server. In these cases, you can define a route relationship.
New | Network templates | ISA Server includes network templates, which correspond to common network topologies. You can use the network templates to configure the firewall policy for traffic between networks. When you apply a network template, ISA Server creates the necessary set of rules to allow traffic, in accordance with your specified policy.

Virtual Private Networking
New or improved | Feature | Description
Improved | VPN administration | ISA Server includes a highly integrated virtual private network (VPN) mechanism. You can administer VPN connections through ISA Server Management as you would administer physically connected networks and clients. You have the full functionality of ISA Server available for VPN connections, including monitoring, logging, and session management.
New | Stateful inspection for VPN | VPN clients are configured as a separate network. Therefore, you can create distinct policies for VPN clients. The rule engine discriminately checks requests from VPN clients, statefully inspecting these requests and dynamically opening connections, based on the access policy.
New | Interoperability with third-party VPN solutions | Because of support for industry standard Internet Protocol security (IPsec), ISA Server 2004 can plug into environments with existing VPN infrastructures from other vendors, including those employing IPsec tunnel mode configurations for site-to-site connections.
New | Quarantine control | VPN clients can be quarantined by ISA Server in the Quarantined VPN Clients network, until their compliance with corporate security requirements is verified.

Security and Firewall
New or improved | Feature | Description
New | Extensive protocol support | ISA Server 2004 extends ISA Server 2000 functionality, by allowing you to control access and usage of any protocol, including IP-level protocols. You can use applications such as ping and tracert, and create VPN connections using the Point-to-Point Tunneling Protocol (PPTP). In addition, Internet Protocol security (IPsec) traffic can be enabled through ISA Server.
Improved | Authentication | Users can be authenticated using built-in Microsoft Windows® or Remote Authentication Dial-In User Service (RADIUS) authentication types, or other namespaces. Rules can be applied to users or user groups in any namespace. Third-party vendors can use the software development kit to extend these built-in authentication types, offering additional authentication mechanisms.
Improved | Publishing | With ISA Server, you can place servers behind the firewall, either on the corporate network or on a perimeter network, and securely publish their services.

Cache
New or improved | Feature | Description
Improved | Cache rules | With the centralized cache rule mechanism of ISA Server, you can configure how objects stored in the cache are retrieved and served from the cache.

Management
New or improved | Feature | Description
Improved | Management | ISA Server includes new management features, making it easier to secure your networks. New user interface features include a task pane, a Help tab, an improved getting started wizard, and a new look for the firewall policy editor.
New | Export and import | ISA Server introduces the ability to export and import configuration information. You can use this feature to save configuration parameters to an .xml file and then import the information from the file to another server, enabling simple replication of firewall configurations for multiple site deployment.
New | Dashboard | A single view presents a summarized version of key monitoring information. If you note a problem, you can open detailed monitoring views for more information.
New | Log viewer | The ISA Server log viewer displays the firewall logs in real time. You can display logs in an online real time mode, or in a historic review mode. You can apply filtering on log fields to identify specific entries.
Improved | Reporting | You can generate recurring or one-time-only reports on Web usage, application usage, network traffic patterns, and security.

Redundancy and Failover
New or improved | Feature | Description
New | Integrated Network Load Balancing | Network Load Balancing (NLB) is integrated with ISA Server, so that you can easily manage NLB between the various networks protected by ISA Server.

Storage
New or improved | Feature | Description
New | Active Directory Application Mode | ISA Server Enterprise Edition uses Active Directory® Application Mode (ADAM) for storage, so that the configuration does not have to be stored in an Active Directory schema.


Multi-networking and firewall policy

You can use the multi-networking features of Microsoft Internet Security and Acceleration (ISA) Server 2004 to protect your network against internal and external security threats by limiting communication between clients, even within your own organization. You can define relationships between the various networks you define in ISA Server, thereby determining how computers on each network communicate with each other by way of ISA Server. You can also group computers into ISA Server network objects such as computer sets and address ranges, and configure an access policy specific to each network object.

The following figure illustrates a multi-networking scenario.

Multi-networking scenario

In the figure, the main ISA Server array connects the Internet (External network), the corporate network (Internal network), and the perimeter network. Three network adapters are on each computer in the main array, each connected to one of the networks. Using ISA Server, you can configure different access policies between any pair of networks. You can determine if and how computers on each of the networks communicate with each other. Each network is isolated from the other, and is only made accessible when you configure rules to allow communication.

To implement the multi-networking scenarios, ISA Server introduces the following concepts:

  • Networks. From an ISA Server perspective, a network is a rule element that can contain one or more ranges of IP addresses and domains. Networks include one or more computers, always corresponding to a specific network adapter on the ISA Server computer. You can apply rules to one or more networks.
  • Network objects. After you create networks, you can group them into sets of network objects (subnets, address ranges, computer sets, URL sets, or domain name sets). Rules can be applied to networks or to network objects.
  • Network rules. You can configure network rules to define and describe a network topology. Network rules determine if there is connectivity between two networks, and what type of connectivity will be allowed. Networks can be connected in one of the following ways: network address translation (NAT) or route.

Multi-networking enables you to isolate communication between the members of your ISA Server array and all other network traffic. Install an additional network adapter on each computer running ISA Server services, specifically for intra-array communication. Then, define an intra-array network using the IP addresses of those network adapters. We recommend this configuration for all multi-server ISA Server arrays, and it is required for arrays that use Network Load Balancing (NLB).


Network Load Balancing

Network Load Balancing (NLB) allows all of the computers in a cluster to be addressed by the same set of cluster IP addresses, while maintaining their existing unique, dedicated IP addresses.

NLB configuration is enabled per array. Each array can be configured in one of these modes:

  • Integrated NLB. In this mode, you use ISA Server Management to configure NLB. You can configure whether a specific network should be load balanced. You have the benefits of integrated easy-to-manage configuration, array integrity maintenance, multi-networking, virtual private network (VPN) support, and troubleshooting information. NLB configuration for the following is supported: unicast mode and single affinity.
  • Non-integrated NLB. In this mode, you use the Microsoft Windows®-based NLB tools to configure NLB.

By default, NLB integration is not enabled when you install Microsoft Internet Security and Acceleration (ISA) Server 2004.

A dedicated network adapter is required on each array member for intra-array communication in NLB deployments.

After NLB is enabled for the array, you can configure NLB on the array-level networks. You can enable NLB on any physical Ethernet network. Do not enable NLB on networks that are not physically connected to the array. Specifically, we recommend that you enable NLB on all networks physically connected to the array (except for the intra-array network).

ISA Server performs stateful inspection on all traffic. For this reason, ISA Server works with Windows NLB to ensure that incoming and outgoing traffic for each session is handled by the same array member. This is important, because this enables ISA Server to perform stateful inspection on the traffic.

When you enable NLB on a network, you specify the virtual IP address for that network. An example of how to configure NLB integration is provided in Procedure 11: Configuring and testing NLB.


Networks and network objects

Networks include one or more computers, typically corresponding to a physical network, defined by ranges of IP addresses. Network objects are any group of computers that you define, for example, single networks, network sets of two or more networks, or computer sets for which you want to create distinct access rules. You can apply rules to one or more networks or network objects, or to all addresses except those in the specified network or network object. Each network adapter on the computer can be mapped to a single network. You can establish the types of Microsoft Internet Security and Acceleration (ISA) Server 2004 clients that are supported on a particular network: Firewall, Web Proxy, or both.

These types of rules can be applied to networks, network sets, or network objects:

  • Network rules

  • Access rules

  • Publishing rules

For access rules, you specify a source network and a destination network to which the rule is to be applied. The source network indicates which networks are allowed or denied access to the specified destination networks. For server publishing rules, you specify a source network, which is allowed access to a specific computer.

Network rules define and describe a network topology. Network rules determine if there is connectivity between two networks, and what type of connectivity is defined. Networks can be connected in one of the following ways:

  • Network address translation (NAT). When you specify this type of connection, ISA Server replaces the IP address of the client on the source network with its own IP address. NAT network rules might be used when defining a relationship between your Internal network and the External network.
  • Route. When you specify this type of connection, client requests from the source network are directly relayed to the destination network. The source client address is included in the request. A route network rule might be used when you publish a server located on the perimeter network.

Route network relationships are bidirectional. If a route relationship is defined from network A to network B, a route relationship also exists from network B to network A. Conversely, NAT relationships are unique and unidirectional. If a NAT relationship is defined from network A to network B, no network relationship can be defined from B to A. You can create a network rule defining both relationships, but the second network rule in the ordered list of rules will be ignored by ISA Server.

Upon installation, the following default rules are created:

  • Local Host Access. This rule defines a route relationship between the Local Host network and all other networks.
  • VPN Clients to Internal Network. This rule defines a route relationship between the two virtual private network (VPN) client networks (VPN Clients and Quarantined VPN Clients) and the Internal network.
  • Internet Access. This rule defines a NAT relationship between the Internal network and the External network.

Network rules are processed in order, for each network.

Enterprise networks

The ISA Server 2004 enterprise represents all the IP addresses in your organization’s network. As an ISA Server enterprise administrator, you can create enterprise networks, which include IP address ranges in your network topology. Traffic within an enterprise network does not cross any security boundary, such as a firewall or a VPN connection.

An IP address can be included in only one enterprise network. IP addresses that are defined at the enterprise level—that are included in some enterprise network—are considered the address range for the enterprise.

Using enterprise networks at the enterprise level

As an enterprise administrator, you use enterprise networks to create access rules at the enterprise level. This eases policy maintenance, because a single change at the enterprise level can be propagated to multiple arrays. Enterprise networks also provide a mechanism for arrays to reference each other across the enterprise.

An enterprise network does not have any of the other properties that you would define for array networks. For example, you cannot configure Network Load Balancing (NLB) or Cache Array Routing Protocol (CARP) for an enterprise-level network.

Using enterprise networks at the array level

As an array administrator, you can use enterprise networks at the array level, by using them to define address ranges of array-level networks.

Consider for example, two arrays: a front-end array and a back-end array, both connected to a network with an IP address range from 10.0.0.0 through 10.0.0.8. Suppose also that the enterprise administrator has defined an enterprise network called ENT-Perimeter with the IP address range from 10.0.0.0 through 10.255.255.255. Each array administrator can then define an array-level network called Perimeter, and include the IP range of the enterprise network ENT-Perimeter in it. They can then create array-level firewall policy rules based on the network Perimeter.

At the array level, each array-level network may include more than one enterprise network.

In some cases, the array administrator might want to create only an array-level network, thereby effectively creating a network visible and usable only for that array. The rest of the enterprise cannot use this network. For example, array-level networks might be useful in these scenarios:

  • You don't want the array-level network to be impacted by changes made at the enterprise level.
  • The array-level network is unused and unneeded at the enterprise level.

Traffic from an IP address that is not in an array-level network is, by default, considered spoofed. This is true even if the IP address is included in an enterprise network. You can configure how ISA Server determines if traffic from a specific IP address should be considered spoofed.

Predefined enterprise networks

ISA Server includes predefined enterprise networks that act as placeholders for array-level networks of the same name. Predefined enterprise networks cannot be explicitly used when creating array-level firewall policy rules. Instead, they are typically used in the enterprise policy. Any rule applied by the enterprise administrator to the predefined enterprise network will be applied to the array-level network of the same name. For example, a rule that applies to the enterprise network named Local Host would apply to the IP addresses in the Local Host network for that array. ISA Server includes the following predefined enterprise networks:

  • External
  • Local Host
  • Quarantined VPN Clients
  • VPN Clients

For example, suppose an enterprise rule allows HTTP access to the External network. When the enterprise policy with this rule is applied to a specific array, the rule will allow access to all computers on the array's External network.

Array network

An array network is a network explicitly defined in the array. This network has both properties and IP addresses. The IP addresses of an array network can contain IP ranges as well as enterprise networks, including more than one enterprise network. The only restriction is that an array network can not partially overlap with an enterprise network.


Firewall policy

In Microsoft Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition, firewall policy consists of the enterprise policy, the array policy, and the array system policy, which together result in an effective array policy.

Enterprise policy

An enterprise policy is a policy defined on the enterprise level that can be applied to arrays. In ISA Server 2004 Enterprise Edition, an enterprise administrator can define enterprise policies and assign them to the arrays in the enterprise. The enterprise policy consists of access rules, each of which can be applied either before or after the array policy rules. Because ISA Server reads the rules in order, and applies the first rule that matches a request, the rule order and the placement of enterprise rules before or after array rules, affects the final policy.

The enterprise administrator can define several enterprise policies, such as an enterprise policy that blocks known vulnerabilities, an enterprise policy that allows baseline traffic (such as HTTP), and an enterprise policy for the virtual private network (VPN) servers. Then the administrator can assign the enterprise policies to the relevant arrays.

In addition to enterprise policies, the enterprise administrator can define policy elements, such as URL sets or subnets, which can be used as building blocks for enterprise policies, as well as for building array policies.

Each rule in the policy can be defined so that it applies either before or after the array policy. This is important because policy rules are ordered. The first allow rule to match a request received by ISA Server will be used, and subsequent rules will not be checked.

Array policy

An array policy is a set of rules that is defined on the array level and is specific to the array.

On the array level, the administrator can create and edit the array policy (but not the enterprise policies assigned to the array), as well as create array policy elements to be used in the array policy. The administrator can also use the policy elements defined by the enterprise administrator.

System policy

When you install ISA Server, a default system policy is created. The system policy defines access rules between the computers running ISA Server services and the networks connected to them, for specific resource access.

Effective array policy

Effective array policy is the firewall behavior that results from the ordered set of rules, which is the combination of the array system policy, an array policy, and an enterprise policy that is assigned to the array. For example, if you want to allow FTP access across the enterprise without exception, an enterprise administrator should create a pre-array enterprise access rule allowing FTP. However, if you want to allow FTP access but give the array administrators the ability to deny FTP access, you should create a post-array enterprise access rule allowing FTP. If an array administrator then creates an array access rule denying FTP, the effective policy will be that FTP is denied. If the array administrator does not create a rule that denies FTP, the effective policy will be that FTP is allowed.

An example of how rules work together to create effective policy is provided in Procedure 5: Creating enterprise policies.


Cache

With Microsoft Internet Security and Acceleration (ISA) Server 2004 cache rules, you can specify the types of content stored in the cache, and how objects are served from the cache. Depending on your organization's needs, cache rules can be applied to content from all sites or to specified sites, and to all content or limited to specified content types. In addition, you can limit the amount of time that objects are considered valid, and the way cache rules handle expired objects.

With cache rules configuration, you can define whether caching will be enabled for Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP), and Secure Sockets Layer (SSL) responses. In addition, you can configure the cache rule to limit cached content according to file size. You can also define how objects stored in the cache are retrieved and served from the cache.

Cache rules are ordered, with the default cache rule processed last. For each new connection, the ISA Server computer processes the cache rules in order (that is, the first rule is processed first). If the request matches the conditions specified by the rule, the request is routed, redirected, and cached accordingly. Otherwise, the next rule is processed. This continues until the last, default rule is processed, and applied to the request.

When you install ISA Server, it configures a default cache rule. The default rule is initially configured so that only valid, requested objects will be retrieved from the ISA Server cache. If the object in the cache is not valid, it will be retrieved directly from the Internet. You cannot modify how the default cache rule retrieves objects.

ISA Server 2004 uses the Cache Array Routing Protocol (CARP) to provide seamless scaling and efficiency when using multiple ISA Server computers that are arrayed as a single logical cache. For more information, see CARP.


CARP

Microsoft Internet Security and Acceleration (ISA) Server 2004 uses the Cache Array Routing Protocol (CARP) to provide seamless scaling and efficiency when using multiple ISA Server computers that are arrayed as a single logical cache. CARP allows arrays of ISA Server computers to efficiently balance Web-based client load and split cached content between them. CARP provides client computers with the information and algorithms required to identify the best server in the array to serve their request, thus eliminating the need for array members to forward requests between them. CARP also supports array server selection by the servers and chained proxies.

CARP uses hash-based routing to determine the best path through an array to resolve a request. The request resolution path is based upon a hash of array member identities and Uniform Resource Locators (URLs). For any given URL request, the browser or downstream proxy server will know exactly where in the array the information will be stored. The request resolution path indicates if the information was already cached from a previous request, or has to be obtained from the Internet and then cached for future requests.

CARP provides powerful benefits:

  • Because CARP determines the best request resolution path, there is no query messaging between proxy servers, as is found with conventional Internet Cache Protocol (ICP) networks. By doing this, CARP avoids the heavier query congestion that normally occurs with a greater number of servers.
  • CARP eliminates the duplication of contents that otherwise occurs on an array of proxy servers. With an ICP network, an array of five proxy servers can rapidly evolve into duplicate caches of the most frequently requested URLs. The hash-based routing of CARP keeps this from happening by allowing all five ISA Server computers to exist as a single logical cache. The result is a faster response to queries and a far more efficient use of server resources.
  • CARP has positive scalability. Due to its hash-based routing and its resultant independence from peer-to-peer searching, CARP becomes faster and more efficient as more proxy servers are added. ICP arrays must conduct queries to determine the location of cached information, an inefficient process that generates extraneous network traffic. ICP arrays have negative scalability: The more servers added to the array, the more querying required between servers to determine location.
  • CARP automatically adjusts to additions or deletions of servers in the array. The hash-based routing means that, when a server is either taken offline or added, only minimal reassignment of URL caches is required.
  • CARP ensures that the cache objects are either distributed evenly between all servers in the array or by the load factor that you configure for each server.


Solutions

Microsoft Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition provides a variety of solutions. For most solutions, a reference for additional information is also provided.

ISA Server 2004 documents are available on the ISA Server 2004 Guidance page.

Internet access control

Connecting networks and users to the Internet introduces security and productivity concerns. ISA Server 2004 provides your organization with the comprehensive ability to control access and monitor usage on a per-user basis. For more information, see Controlling Secure Internet Access Using ISA Server 2004.(http://www.microsoft.com/)

Branch configuration

You can install ISA Server 2004 in many variations of branch topologies. For information about how to configure a branch ISA Server array, see Branch Configuration Scenarios in ISA Server 2004 Enterprise Edition.(http://www.microsoft.com/)

Workgroup deployment

You may want to install your ISA Server firewall servers in a workgroup specifically because the workgroup is separated from your domain. You may have specific reasons for wanting to isolate a small portion of your corporate network from the domain. For information about how to deploy ISA Server in a workgroup, see ISA Server 2004 Enterprise Edition in a Workgroup.(http://www.microsoft.com/)

Digital certificate integration

ISA Server enables the use of digital certificates for Web publishing rules, server publishing rules, and site-to-site virtual private network (VPN) connections. For more information, see Digital Certificates for ISA Server 2004.(http://www.microsoft.com/)

Export and import

You can export and import parts of ISA Server configurations or entire configurations, on an enterprise or array level. Exported configuration information is stored as an XML document. If you export a complete enterprise or array configuration, the XML document can be used as a backup of the configuration.

Web publishing

ISA Server uses Web publishing rules to handle issues associated with publishing Web content to the Internet, without compromising Internal network security. Web publishing rules determine how ISA Server intercepts incoming requests for Hypertext Transfer Protocol (HTTP) objects on an internal Web server and how ISA Server responds on behalf of the Web server. Requests are forwarded downstream to an internal Web server, located behind the ISA Server computer. If possible, the request is serviced from the ISA Server cache. Web publishing rules map incoming requests to the appropriate Web servers behind the ISA Server computer. For more information about Web publishing, see Publishing Web Servers Using ISA Server 2004 Enterprise Edition.(http://www.microsoft.com/)

Virtual private networks

ISA Server 2004 provides secure site-to-site and roaming client virtual private network (VPN) functionality. VPN clients can be quarantined by ISA Server in the Quarantined VPN Clients network, until their compliance with corporate security requirements is verified, and can then be moved to the VPN Clients network. For more information about VPN, see VPN Roaming Clients and Quarantine Control in ISA Server 2004 Enterprise Edition (http://www.microsoft.com/) and Site-to-Site VPN in ISA Server 2004 Enterprise Edition.(http://www.microsoft.com/)

Exchange Server publishing

ISA Server 2004 and Microsoft Exchange Server 2003 are designed to work closely together in your network environment to provide a secure messaging environment. For more information, see Using ISA Server 2004 Enterprise Edition with Exchange Server 2003.(http://www.microsoft.com/)

Remote administration

ISA Server 2004 enables you to administer ISA Server computers from other computers. You can perform all ISA Server administrative tasks remotely, either from a computer running a Terminal Services client, such as a Remote Desktop Connection, or from Microsoft Management Console (MMC) installed on the remote computer. For more information, see Remote Administration of ISA Server 2004 Enterprise Edition.(http://www.microsoft.com/)

HTTP filtering

ISA Server 2004 provides granular control over Hypertext Transfer Protocol (HTTP) communication. This control is provided in the form of an HTTP filter, an application-layer filter that examines HTTP commands and data, through which you set HTTP policy. The HTTP filter screens all HTTP traffic that passes through the ISA Server computer, and only allows compliant requests to pass through. This significantly improves the security of your Web servers, by helping ensure that they only respond to valid requests. It also enables you to control the specifics of ISA Server client Internet access. For more information, see HTTP Filtering in ISA Server 2004.(http://www.microsoft.com/)

Fast Web access

The Internet offers organizations productivity benefits, but only if content is accessible, access is fast, and the cost is reasonable. The ISA Server 2004 cache minimizes performance bottlenecks and saves network bandwidth by serving locally cached Web content. Enterprise Edition also includes Cache Array Routing Protocol Protocol (CARP) functionality. To take advantage of ISA Server caching functionality, you must enable the cache. For more information about caching, see Cache. For more information about CARP, see CARP.

Unified management

By combining firewall and high performance Web cache functions, ISA Server 2004 delivers a common management infrastructure that reduces network complexity and costs. ISA Server is tightly integrated with Microsoft Windows Server™ 2003. This provides a consistent and powerful way to manage user access and configuration of firewall rules.

Extensible platform

Security policies and imperatives vary from organization to organization. Traffic volume and content formats pose unique concerns. No single product fits all security and performance needs, so ISA Server 2004 is built to be highly extensible. Available for ISA Server are a comprehensive software development kit (SDK), a large selection of third-party add-on solutions, and an extensible administration option. For more information about third-party add-on solutions, see the ISA Server Partners (http://www.microsoft.com/) Web site.

Using the ISA Server administration Component Object Model (COM), you can extend ISA Server functionality. The administration objects also allow for automation of all tasks that are done through ISA Server Management. This means that any task can be automated by an ISA Server administrator by using the administration objects. For more information, see the Microsoft SDK (http://www.microsoft.com/) Web site.


Enterprise Edition Walk-through

This walk-through will take you through the following steps for configuring Microsoft Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition.

  • Installation requirements
  • Walk-through topology
  • Procedure 1: Creating users
  • Procedure 2: Installing the Configuration Storage server
  • Procedure 3: Adding enterprise administrators
  • Procedure 4: Creating enterprise networks
  • Procedure 5: Creating enterprise policies
  • Procedure 6: Creating an array
  • Procedure 7: Installing a server in the array
  • Procedure 8: Creating a second array in the enterprise
  • Procedure 9: Configuring array policy
  • Procedure 10: Testing your policy
  • Procedure 11: Configuring and testing NLB
  • Procedure 12: Configuring CARP load factor
  • Procedure 13: Backing up your configuration
  • Procedure 14: Monitoring ISA Server


Installation requirements

Microsoft Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition must be installed on a computer running Microsoft Windows™ Server 2003. We recommend a minimum processor speed of 550 megahertz (MHz) and at least 256 megabytes (MB) of RAM. ISA Server services and cache require a hard drive that uses the NTFS file system.

Your ISA Server computers will require network adapters for communication with the various networks to which they are connected. For example, if the ISA Server array will be connected to the External network (the Internet) and the Internal network, each computer in the array will require two network adapters. In a multi-server array, an additional network adapter is required on each array member for intra-array communication in Network Load Balancing (NLB) deployments. In other scenarios, using an additional network adapter provides enhanced security.

Security best practices

To ensure that your ISA Server deployment is secure, follow the guidelines in the product help topics: Security best practices and Security best practices for enterprise management.


Walk-through topology

The walk-through is based on the topology shown in the following figure.

Walk-through scenario

The figure shows two offices, Main and Branch.

The main office has an internal network containing a domain controller, a computer that will be the Microsoft Internet Security and Acceleration (ISA) Server 2004 Configuration Storage server, and a client computer. There are three computers that will constitute the firewall array.

The branch office is in the same domain as the main office. The branch office has an Internal network containing a computer that will be the ISA Server Configuration Storage server, and one computer in the firewall array.

IP addresses

The IP addresses used in the laboratory for this walk-through are provided in the following table.

Office | Network | Computer | IP address
Main | Internal | Main-DC | 10.1.2.1
Main | Internal | Main-Client1 | 10.1.2.3
Main | Internal | Main-Storage | 10.1.2.2
Main | LocalHost | FW-A1 | 10.1.1.1 157.54.1.1
Main | LocalHost | FW-A2 | 10.1.1.2 157.54.1.2
Main | LocalHost | FW-A3 | 10.1.1.3 157.54.1.3
Branch | Internal | Branch-Storage | 10.2.2.2
Branch | LocalHost | FW-B1 | 10.2.1.1 157.60.1.1

Virtual IP addresses for Network Load Balancing

You will use the following virtual IP addresses when you configure Network Load Balancing (NLB).

Office | NLB | Virtual IP address
Main | LocalHost to Internal | 10.1.1.4
Main | LocalHost to External | 157.54.1.4
Branch | LocalHost to Internal | 10.2.1.4
Branch | LocalHost to External | 157.60.1.4


Procedure 1: Creating users

Privileges on specific levels of ISA Server Management are defined through administrator roles. You can allow users to be administrators on an enterprise level, while other users will be administrators of specific arrays. Some administrators can make changes to policy, while others can only view the policy or monitor ISA Server. These procedures are oriented toward enterprise and array administrators, but will be useful for all ISA Server enterprise roles.

There are some procedures in the Enterprise Edition walk-through that may typically be performed by an array administrator, rather than an enterprise administrator. Examples include creating an array, adding servers to an array, and configuring array policy, Network Load Balancing (NLB), and Cache Array Routing Protocol (CARP).

To complete the walk-through, you must have three administrative users in Active Directory. In this scenario, the three users are:

  • EnterpriseAdmin. The enterprise administrator.
  • MainArrayAdmin. The administrator for the array in the main office.
  • BranchArrayAdmin. The administrator for the branch array.

Perform this procedure on the domain controller, Main-DC.

  1. Click Start, point to All Programs, point to Administrative Tools, and click Active Directory Users and Computers.
  2. Expand the node for the local domain (Fabrikam).
  3. Right-click Users, point to New, and select User.
  4. Provide the name information needed.
  5. On the next page, provide the password information, and then click Next.
  6. Click Finish.
  7. Repeat this procedure to create other users.

Note

  • These users must also be local administrators on any computers on which they will install ISA Server components (except for ISA Server Management).


Procedure 2: Installing the Configuration Storage server

The Configuration Storage server stores the configuration information for all of the arrays in the enterprise. This procedure describes how to install the Configuration Storage server. Perform this procedure on the computer that you have designated as the Configuration Storage server, CS-1 in this walk-through.

  1. On the Configuration Storage server (Main-Storage), log on to the domain as EnterpriseAdmin.
  2. Insert the ISA Server CD into the CD drive, or run ISAautorun.exe from the shared network drive.
  3. In Microsoft ISA Server Setup, click Install ISA Server.
  4. After the setup program prompts that it has completed determining the system configuration, on the Welcome page, click Next.
  5. If you accept the terms and conditions stated in the user license agreement, click I accept the terms in the license agreement, and then click Next.
  6. Type your customer information, and then click Next.
  7. On the Setup Scenarios page, select Install Configuration Storage server, and then click Next.

  8. On the Component Selection page, you can review the settings, and then click Next.
  9. On the Enterprise Installation Options page, select Create a new ISA Server enterprise, and then click Next.

  10. On the New Enterprise Warning page, click Next. This page warns you not to install more than one enterprise. Because you are creating a new enterprise, you can ignore the warning.
  11. On the Create a New Enterprise page, provide a name and description for the enterprise. In this walk-through, the enterprise will be called Fabrikam. You can provide a description of the enterprise (optional). Click Next.
  12. On the Enterprise Deployment Environment page, you have the option of installing a digital certificate to enable encrypted communication between the Configuration Storage server and the computer running ISA Server services. All communication between computers running ISA Server services and Configuration Storage servers in a single domain is encrypted. We recommend that you use this option when your computers running ISA Server services are in a workgroup, or are in a domain other than that in which the Configuration Storage server is located, and there is no trust relationship between the domains. In this walk-through, the Configuration Storage server and the computers running ISA Server services are in the same domain, so you can leave the default selection, I am deploying in a single domain or in domains with trust relationships. Click Next.

    Notes

    • If you choose I am deploying in a single domain or in domains with trust relationships, you can change to server certificate authentication anytime after installation, if your deployment needs change. To do so, obtain an exported server certificate and save it on the Configuration Storage server. Then, run ISA Server setup and select Repair, and on the Enterprise Deployment Environment page, select the workgroup option. Alternatively, instead of running Repair, you can run the ISACertTool tool.

      For information about installing ISA Server in a workgroup, including certificate installation instructions, see ISA Server 2004 in a Workgroup (http://www.microsoft.com/).

  13. On the Ready to Install the Program page, click Install to begin the installation.
  14. After the installation is complete, select Invoke ISA Management when the wizard closes, and then click Finish.
  15. In the ISA Server console, expand the Enterprise node, and expand the Enterprise Policies node. Note that there is one policy listed, the Default Policy. Click Default Policy and look at the rules in the details pane. There is one enterprise policy rule, a rule that denies all traffic, that is applied after array level rules. This rule ensures that unless access is specifically allowed, ISA Server denies it. Other than this enterprise policy rule, in the Default Policy, only array rules will apply.
  16. Click the Enterprise Networks node. The details pane displays the default enterprise networks. Note that there are no networks defined that are specific to the IP address ranges in your enterprise. You will define those in Procedure 4: Creating enterprise networks.
  17. Click the Arrays node. Note that this node is empty, because an array has not yet been created.

    Notes

    • You can manage the enterprise from the Configuration Storage server, from an array member, or from a remote management computer, if you are logged on with enterprise administrator credentials.
    • The Configuration Storage server service runs under the network service account. If you install the Configuration Storage server on a domain controller, you must provide an account under which the service will run. For more information, see the product documentation.


Procedure 3: Adding enterprise administrators

Enterprise administrators can manage the ISA Server enterprise and the arrays it contains. Array administrators can manage only their arrays. You may want to strictly limit enterprise administration, and not allow array administrators enterprise rights.

On the Configuration Storage server, you can only create enterprise administrators. Array administrators must be created on an array computer.

Note

  • When you install the Configuration Storage server, a default enterprise administrator is created, using the credentials of the user who is logged on at the time of installation. In this scenario, that user is EnterpriseAdmin. If you do not want to create additional enterprise administrators, skip this step.

This procedure takes place on the Configuration Storage server.

  1. Right-click the Enterprise node and select Properties.
  2. On the Fabrikam Properties page, on the Assign Roles tab, you will see one user listed. This is the user who was logged on when the enterprise was created. You can choose to remove this user by clicking Remove, or leave this user in place.

  3. Click Add. In the Administration Delegation dialog box, under Group or User, you can enter the name of the user, or click Browse to find the user through the Select User or Group dialog box, and then click OK. Under Role, select ISA Server Enterprise Administrator. Click OK twice, to close the dialog boxes.

  4. Note that the Apply and Discard buttons appear at the top of the details pane after you add an administrator. Your changes are not applied until you click Apply. You can wait until you have made all of your changes to the enterprise before clicking Apply, or click it after each change.


Procedure 4: Creating enterprise networks

As enterprise administrator, you should define enterprise networks. This will enable you to create access rules on the enterprise level, referring to the enterprise networks. This will enable your array administrators to define array networks, to easily create rules for networks throughout the enterprise, and to assist spoof detection through the proper definition of networks.

Follow these steps to define the Fabrikam enterprise corporate network, which will include all of the IP addresses of the main and branch internal networks.

  1. On the Configuration Storage server, expand the Enterprise node, and click Enterprise Networks.
  2. In the task pane, on the Tasks tab, select Create a New Network to start the New Network Wizard.
  3. In Network name, provide a name for the new network, such as Internal, and then click Next.
  4. On the Welcome page, enter a name, and then click Next. On the Network Addresses page, click Add Range to open the IP Address Range Properties dialog box. In Start address, type the low end of the IP address range, such as 10.1.0.0 and in End address, type the high end of the IP address range, such as 10.2.255.255, and then click OK. This range of addresses will cover all of the internal IP addresses for the main and branch arrays. On the Network Addresses page, click Next.
  5. On the summary page, review the properties of the enterprise network you are creating, and then click Finish.


Procedure 5: Creating enterprise policies

In the Fabrikam enterprise, the main array has a faster Internet connection than does the branch. For this reason, you will allow users on the main array to use the File Transfer Protocol (FTP), whereas, on the branch array, use of FTP will be at the discretion of the array administrator. The administrator of the branch array will be able to deny use of FTP to certain users or at certain times of day.

In this exercise, you will create the two enterprise policies that fit this scenario. The first will allow access on Hypertext Transfer Protocol (HTTP) and HTTPS, and will allow access on FTP unless an array administrator specifically denies it. The second enterprise policy will allow access on all protocols except for HTTPS, and will allow access on FTP without enabling array administrators to deny access on FTP. The difference between the FTP approach of these two policies depends on the location of the enterprise rule allowing FTP access relative to the rules that the array administrator creates.

These procedures take place on the Configuration Storage server. You can also create enterprise policies from an ISA Server array when logged on using enterprise administrator credentials, but in this walk-through you have not yet installed an array.

Create the FTP Optional policy

To create a functional enterprise policy, you must first create the policy, and then create access rules in the policy.

Creating the policy

Create and name the enterprise policy following these steps.

  1. Log on to the domain using enterprise administrator credentials (the user EnterpriseAdmin).
  2. Open ISA Server Management. To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  3. In the MMC console, expand Enterprise, and click Enterprise Policies.
  4. In the task pane, on the Tasks tab, click Create New Enterprise Policy to start the New Enterprise Policy Wizard.
  5. On the Welcome page, provide a name for the new policy, such as Fabrikam FTP Optional Access Policy, and then click Next.
  6. On the Completing the New Enterprise Policy Wizard page, click Finish.

    Important

    • Changes you make in ISA Server Management are not applied until you click the Apply button in the details pane. You can click Apply after each change, or when you have made all of your changes.

Adding access rules to the enterprise policy

After you create the policy, you can add access rules to it. In this example, you will add a pre-array enterprise policy rule that allows Internal clients access to the Internet using HTTP and HTTPS, and a post-array enterprise policy rule that allows Internal clients access to the Internet using FTP. The net effect of this set of rules is that all clients will have Internet access on HTTP and HTTPS, and will also have access on FTP unless the array administrator expressly denies access with an array rule. By putting the FTP enterprise access rule in post-array enterprise rules, you are giving the array administrator an opportunity to control access using this protocol.

  1. In ISA Server Management, expand Enterprise, expand Enterprise Policies, and click Fabrikam FTP Optional Access Policy.
  2. In the task pane, on the Tasks tab, select Create Enterprise Access Rule to start the New Access Rule Wizard.
  3. On the Welcome page of the wizard, enter the name for the access rule. Use a descriptive name, such as Enterprise Internet Access on HTTP and HTTPS, and then click Next.
  4. On the Rule Action page, select Allow, and then click Next.
  5. On the Protocols page, in This rule applies to, select Selected protocols. Click Add to open the Add Protocols dialog box. Expand Web, click HTTP, click Add, click HTTPS, and then click Add. Click Close to close the Add Protocols dialog box. On the Protocols page, click Next.
  6. On the Access Rule Sources page, click Add to open the Add Network Entities dialog box, expand Network Sets, select All Protected Networks, click Add, and then click Close. On the Access Rule Sources page, click Next.

    7. Note

    • The advantage of using All Protected Networks as the source, rather than listing specific networks, is that this rule will include future networks that are added to your enterprise, without requiring you to modify the rule.
  7. On the Access Rule Destinations page, click Add to open the Add Network Entities dialog box, expand Enterprise Networks, select the External network (representing the Internet), click Add, and then click Close. On the Access Rule Destinations page, click Next.
  8. On the User Sets page, because your rule applies to all users, you can leave the user set All Users in place and then click Next.
  9. Review the information on the wizard summary page, and then click Finish.
  10. Repeat these steps to create a rule called Enterprise Internet Access on FTP allowing access on FTP.
  11. Both rules were created in the post-array enterprise policy by default. Now, you will move the Enterprise Internet Access on HTTP and HTTPS rule into the pre-array enterprise policy. Right-click the rule and select Move Up. Continue to do this until the rule is in the pre-array enterprise policy.

    12. Note

    • Access rules are processed in order. When a request matches a rule, subsequent rules are ignored. Therefore, pre-array enterprise rules, which are first sequentially, will not be affected by array rules.

Creating the FTP Always Allowed policy

First create the policy, and then create access rules in the policy.

Creating the policy

Create and name the enterprise policy following these steps.

  1. If you logged out, log on to the domain using enterprise administrator credentials (the user EnterpriseAdmin).
  2. Open ISA Server Management. To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  3. In the MMC console, expand Enterprise, and click Enterprise Policies.
  4. In the task pane, on the Tasks tab, click Create New Enterprise Policy to start the New Enterprise Policy Wizard.
  5. On the Welcome page, provide a name for the new policy, such as Fabrikam FTP Always Allowed Policy, and then click Next.
  6. On the Completing the New Enterprise Policy Wizard page, click Finish.

    Important

    • Changes you make in ISA Server Management are not applied until you click the Apply button in the details pane. You can click Apply after each change, or when you have made all of your changes.

Adding access rules to the enterprise policy

After you create the policy, you can add access rules to it. In this example, you will add a pre-array enterprise policy rule that allows Internal clients access to the Internet using HTTP, HTTPS, and FTP. Because this rule will be in the pre-array enterprise rules, the array administrator will not be able to deny FTP access.

  1. In ISA Server Management, expand Enterprise, expand Enterprise Policies, and click Fabrikam FTP Always Allowed Policy.
  2. In the task pane, on the Tasks tab, select Create Enterprise Access Rule to start the New Access Rule Wizard.
  3. On the Welcome page of the wizard, enter the name for the access rule. Use a descriptive name, such as Enterprise Internet Access on HTTP, HTTPS and FTP, and then click Next.
  4. On the Rule Action page, select Allow, and then click Next.
  5. On the Protocols page, in This rule applies to, select Selected protocols. Click Add to open the Add Protocols dialog box. Expand Web, click HTTP, click Add, click HTTPS, click Add, click FTP, and then click Add. Click Close to close the Add Protocols dialog box. On the Protocols page, click Next.
  6. On the Access Rule Sources page, click Add to open the Add Network Entities dialog box, expand Network Sets, select All Protected Networks, click Add, and then click Close. On the Access Rule Sources page, click Next.
  7. On the Access Rule Destinations page, click Add to open the Add Network Entities dialog box, click Enterprise Networks, select the External network (representing the Internet), click Add, and then click Close. On the Access Rule Destinations page, click Next.
  8. On the User Sets page, because your rule applies to all users, you can leave the user set All Users in place and then click Next.
  9. Review the information on the wizard summary page, and then click Finish.
  10. Move the rule into the pre-array enterprise policy. Right click the rule Enterprise Internet Access on HTTP, HTTPS and FTP and select Move Up. Continue to do this until the rule is in the pre-array enterprise policy.
  11. In the Firewall Policy details pane, click Apply to apply the changes.


Procedure 6: Creating an array

After you install the Configuration Storage server, you can create a firewall array. You will create the array as an enterprise administrator on the Configuration Storage server. This enables you to configure how enterprise policy and array policy work together, before the array is released to the array administrator and populated with servers.

Important

  • An array administrator can also create arrays and populate them with servers, by running ISA Server installation and choosing Create a New Array on the Array Membership page. The enterprise administrator will be able to limit the types of rules the array administrator can create, but only after the array has been created, and will not be able to limit a type of rule if the array administrator has already created a rule of that type.

This procedure assumes that you are still logged on to the Configuration Storage server as an enterprise administrator.

  1. On the Configuration Storage server, open ISA Server Management.
  2. Click Arrays. In the task pane, on the Tasks tab, click Create New Array to start the New Array Wizard.
  3. On the Welcome page, provide a name for the new array, such as Main, and then click Next.
  4. On the Assign Enterprise Policy page, from the drop-down menu, select the enterprise policy that will be applied to the new array. The policies to choose from are:
    • The Default Policy, in which no enterprise policy is applied, and only the array policy applies.
    • The Fabrikam FTP Optional Access Policy, which enables client access on HTTP, HTTPS, and FTP, and enables the array administrator to deny FTP as appropriate.
    • The Fabrikam FTP Always Allowed Policy, which enables client access on HTTP, HTTPS, and FTP, and does not enable the array administrator to deny access on FTP.

    Because the main array has the bandwidth to support FTP usage, select Fabrikam FTP Always Allowed Policy, and then click Next.

  5. On the Array Policy Rule Types page, select the types of rules the array administrator is allowed to make. In this scenario, allow the administrator to make allow rules and deny rules, but not publishing rules, because you do not want any publishing to take place on the main array. Click Next.

    Array policy rule types

  6. On the summary page, review the array configuration and then click Finish. When the progress bar indicates that the array has been created, click OK.
  7. After the array has been created, assign array administrator privileges to the main array. In ISA Server Management, right-click the name of the array and select Properties.
  8. On the Assign Roles tab, click Add. Add the user MainArrayAdmin. From the drop-down Role menu, select ISA Server Array Administrator, and then click OK.
  9. Click OK to close the properties page.
  10. In the Firewall Policy details pane, click Apply to apply the changes.


Procedure 7: Installing a server in the array

Now that you have created an array, you can add the ISA Server computers, FW-A1, FW-A2, and FW-A3 to the array.

Perform this procedure three times, once each on computers FW-A1, FW-A2, and FW-A3.

  1. Log on to the domain using the credentials of the administrator of the main array (MainArrayAdmin).
  2. Insert the ISA Server CD into the CD drive, or run ISAautorun.exe from the shared network drive.
  3. In Microsoft ISA Server Setup, click Install ISA Server.
  4. After the setup program prompts that it has completed determining the system configuration, on the Welcome page, click Next.
  5. If you accept the terms and conditions stated in the user license agreement, click I accept the terms in the license agreement, and then click Next.
  6. Type your customer information, and then click Next.
  7. On the Setup Scenarios page, select Install ISA Server services, and then click Next.

  8. On the Component Selection page, you can review the settings, and then click Next.
  9. On the Locate Configuration Storage Server page, specify the Configuration Storage server to which this computer will connect. You can click Browse to locate the Configuration Storage server computer. Note that the name you use to refer to the Configuration Storage server computer is its fully qualified domain name on the network, and not the enterprise name (Fabrikam) that you provided previously. On this page, if the user is not logged on as an enterprise or array administrator, you must select Connect using this account and then provide the credentials of an enterprise or array administrator to connect to the Configuration Storage server. Click Next.

  10. On the Array Membership page, select Join an Existing Array, and then click Next.
  11. On the Join Existing Array page, provide the name of the array, Main. You can also click Browse to open the Arrays to join dialog box, and select the array from the list. Click Next.
  12. On the Configuration Storage Server Authentication Options page, select the authentication type that will be used for connections between the ISA Server computer and the Configuration Storage server. Because in this scenario the firewall array and the Configuration Storage server are in the same domain, select Windows authentication, and then click Next.
  13. This step will only take place on the first server you install in the array. On the Internal Network page, specify the IP address range that will constitute the Internal network for this array. We recommend that you map your Internal network to the enterprise network you created in Procedure 4: Creating enterprise networks.
    1. Click Add to open the Addresses dialog box.
    2. Click Add Network to open the Select Enterprise Networks dialog box.
    3. Select Internal, and then click OK.
    4. In the Addresses dialog box, click OK.
    5. On the Internal Network page, click Next.
  14. On the Services Warning page, review the list of services that will be stopped or disabled during installation of ISA Server. To continue the installation, click Next.
  15. On the Ready to Install the Program page, click Install.
  16. After the installation is complete, click Finish.
  17. You will be prompted to restart the computer. Click Yes to restart the computer.
  18. Repeat this procedure for the other servers that have to be installed.

Exploring the array environment

After the servers are installed, you can view the changes.

  1. After the computer restarts, open ISA Server Management. To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  2. Expand the Enterprise Policies node. The enterprise policies that you created on the Configuration Storage server are listed. However, you cannot modify those policies from this array member, unless you are logged on with enterprise administrator credentials (EnterpriseAdmin).
  3. Expand the Arrays node. Click Firewall Policy. In the task pane, on the Tasks tab, the tasks you can perform to create an array-level firewall policy are listed. You will do this on the branch array in Procedure 9: Configuring array policy.
  4. Expand the Configuration node, and click Servers. Any servers that you added to the array are listed.

    Notes

    • Changes will not be visible in ISA Server Management on the Configuration Storage server until you refresh the console (press F5).


Procedure 8: Creating a second array in the enterprise

You have an enterprise Configuration Storage server and a single array, representing the main branch. You can now add a second array to the enterprise.

Note

  • This procedure requires connectivity between the branch network and the main network. In a production environment, the connectivity would likely be a VPN connection. In a laboratory environment, use a physical connection to provide connectivity. Site-to-site VPN connections are described in the document Site-to-Site VPN in ISA Server 2004 Enterprise Edition (http://www.microsoft.com/).

Configuring the replicate Configuration Storage server

We recommend that each branch include a replicate Configuration Storage server. This provides fault tolerance for your enterprise configuration, and can provide a shorter communication path from the array to the enterprise storage.

Adding the replicate Configuration Storage server to the replicate Configuration Storage servers computer set

The computer on which you will install the replicate Configuration Storage server will not be able to communicate with the main Configuration Storage server unless you add it to the replicate Configuration Storage servers computer set on the main Configuration Storage server.

Perform this procedure on the main office Configuration Storage server, Main-Storage.

  1. In ISA Server Management, expand Enterprise, expand Enterprise Policies, and click one of the enterprise policies.
  2. In the task pane, on the Toolbox tab, select Network Objects, and expand Computer Sets.
  3. Double-click the Replicate Configuration Storage servers computer set to open its properties.
  4. Click Add and select Computer. In the New Computer Rule Element dialog box, click Browse.
  5. In the Find Internal IP Address dialog box, provide the server name and then click Find. When the IP address appears, click OK. Click OK again to close the New Computer Rule Element dialog box. Click OK to close the Replicate Configuration Storage servers Properties page.
  6. In the details pane, click Apply to apply your changes.

Creating the replicate Configuration Storage server

To perform this procedure you must have connectivity between the new Configuration Storage server Branch-Storage, and the existing Configuration Storage server, Main-Storage.

  1. On the replicate Configuration Storage server, Branch-Storage, log on using enterprise administrator credentials (EnterpriseAdmin).
  2. Insert the ISA Server CD into the CD drive, or run ISAautorun.exe from the shared network drive.
  3. In Microsoft ISA Server Setup, click Install ISA Server.
  4. After the setup program prompts that it has completed determining the system configuration, on the Welcome page, click Next.
  5. If you accept the terms and conditions stated in the user license agreement, click I accept the terms in the license agreement, and then click Next.
  6. Type your customer information, and then click Next.
  7. On the Setup Scenarios page, select Install Configuration Storage server, and then click Next.
  8. On the Component Selection page, you can review the settings, and then click Next.
  9. On the Enterprise Membership page, select Create a replica of the enterprise configuration, and then click Next.
  10. On the Locate Configuration Storage Server page, provide the name of the Configuration Storage server. You can also use the Browse button to locate the server. If you are logged on to the replicate server with enterprise administrator credentials, leave the default selection, Connect using the credentials of the logged on users. If you are not logged on to the replicate server with enterprise administrator credentials, select Use this account and provide those credentials (EnterpriseAdmin). Click Next.
  11. On the Install Server Certificate page, you have the option of installing a digital certificate to enable encrypted communication between the Configuration Storage server and the computers running ISA Server services. We recommend that you use this option when your computers running ISA Server services are in a workgroup, or are in a domain other than that in which the Configuration Storage server is located, and there is no trust relationship between the domains. In this walk-through, the Configuration Storage server and the computers running ISA Server services are in the same domain, so you can leave the default selection, I am deploying in a single domain or in domains with trust relationships. Click Next.
  12. On the Ready to Install the Program page, click Install to begin the installation.
  13. After the installation is complete, select the Invoke ISA Management check box, and then click Finish.
  14. In ISA Server Management, examine the policies and configuration. You will note that the policies and configuration of Main-Storage have been replicated on Branch-Storage.
  15. Close ISA Server Management.

Creating the array

To create the array, perform the following steps.

  1. On the Configuration Storage server (main or branch), open ISA Server Management.
  2. Click Arrays. In the task pane, on the Tasks tab, click Create New Array to start the New Array Wizard.
  3. On the Welcome page, provide a name for the new array, such as Branch, and then click Next.
  4. On the Array Enterprise Policy page, from the drop-down menu, select the enterprise policy that will be applied to the new array. Select Fabrikam FTP Optional Access Policy, and then click Next.
  5. On the Array Policy Rule Types page, select the types of rules the array administrator is allowed to make. In this scenario, allow the administrator to make allow rules, deny rules, and publishing rules. Click Next.
  6. On the summary page, review the array configuration and then click Finish. When the progress bar indicates that the array has been created, click OK.
  7. After the array has been created, assign array administrator privileges to the branch array. In ISA Server Management, right-click the name of the array and select Properties.
  8. On the Assign Roles tab, click Add. Leave the default settings, and add the user BranchArrayAdmin. From the drop-down Role menu, select ISA Server Array Administrator, and then click OK.
  9. Click OK to close the properties page.
  10. In the Firewall Policy details pane, click Apply to apply the changes.

Adding a server to the array

Now that you have created an array, you can add the computer that will run ISA Server services, FW-B1, to the array.

Notes

  • All computers grouped in an array must have the same:
    • Number of network adapters, connected to array-level networks with the same names.
    • Dial-up connections configured.
    • Time zone, with synchronized clocks (for logging).
    • Partitions (for logging).
    • Certificates installed on each array member.
    • Language version of ISA Server and Windows Server 2003 installed, with the same locale set for the computer and for the user who is logged on.
    • Updates installed.
    • Domain and site configuration (or belong to a workgroup).
  • Also, network services should be available to each array member (for example, Domain Name System (DNS), CRL Verification connectivity, and Active Directory connectivity).

Perform this procedure on FW-B1.

  1. Log on to the computer using the credentials of the administrator of the branch array (BranchArrayAdmin).
  2. Insert the ISA Server CD into the CD drive, or run ISAautorun.exe from the shared network drive.
  3. In Microsoft ISA Server Setup, click Install ISA Server.
  4. After the setup program prompts that it has completed determining the system configuration, on the Welcome page, click Next.
  5. If you accept the terms and conditions stated in the user license agreement, click I accept the terms in the license agreement, and then click Next.
  6. Type your customer information, and then click Next.
  7. On the Setup Scenarios page, select Install ISA Server Services, and then click Next.
  8. On the Component Selection page, you can review the settings, and then click Next.
  9. On the Locate Configuration Storage Server page, specify the Configuration Storage server to which this computer will connect. You can click Browse to locate the Configuration Storage server computer. On this page, you will have to provide the credentials of an enterprise administrator, such as EnterpriseAdmin, to connect to the Configuration Storage server. Click Next.
  10. On the Array Membership page, select Join an Existing Array, and then click Next.
  11. On the Join an Existing Array page, provide the name of the array, Branch. You can also click Browse to open the Arrays to join dialog box, and select the array from the list. Click Next.
  12. On the Configuration Storage Server Authentication Options page, select the authentication type that will be used for connections between the ISA Server computer and the Configuration Storage server. Because in this scenario the firewall array and the Configuration Storage server are in the same domain, select Windows authentication, and then click Next.
  13. This step will only take place on the first server you install in the array. On the Internal Network page, specify the IP address range that will constitute the Internal network for this array. We recommend that you map your Internal network to the enterprise network you created in Procedure 4: Creating enterprise networks.
    1. Click Add to open the Addresses dialog box.
    2. Click Add Network to open the Select Enterprise Networks dialog box.
    3. Select Internal, and then click OK.
    4. In the Addresses dialog box, click OK.
    5. On the Internal Network page, click Next.
  14. On the Services Warning page, review the list of services that will be stopped or disabled during installation of ISA Server. To continue the installation, click Next.
  15. Click Install.
  16. After the installation is complete, click Finish.
  17. You will be prompted to restart the computer. Click Yes to restart the computer.


Procedure 9: Configuring array policy

After you add servers to an array, you can create an array policy. The array policy you create will be limited based on the restrictions applied to the array by the enterprise administrator.

In this scenario, the FTP Optional enterprise policy created in Procedure 5: Creating enterprise policies allowed access on HTTP and HTTPS, and enables the array administrator to deny FTP access on the array level. This policy was only applied to the branch array. You will create an access rule for the branch array that denies access on FTP.

Note

  • You can apply granular control over client HTTP access by using the HTTP filter of ISA Server. For more information about HTTP filtering, see HTTP Filtering in ISA Server 2004 (http://www.microsoft.com/).

Creating the access rule for the branch array

Perform this procedure on any member server of the branch array, such as FW-B1.

  1. In ISA Server Management, expand Arrays, expand Branch, and click Firewall Policy.
  2. In the task pane, on the Tasks tab, select Create Array Access Rule to start the New Access Rule Wizard.
  3. On the Welcome page of the wizard, enter the name for the access rule. Use a descriptive name, such as Deny Access on FTP from Branch, and then click Next.
  4. On the Rule Action page, select Deny, and then click Next.
  5. On the Protocols page, in This rule applies to, select Selected protocols. Click Add to open the Add Protocols dialog box. Expand Web, click FTP, and click Add. Click Close to close the Add Protocols dialog box. On the Protocols page, click Next.
  6. On the Access Rule Sources page, click Add to open the Add Network Entities dialog box, expand Networks, select Internal, click Add, and then click Close. On the Access Rule Sources page, click Next.
  7. On the Access Rule Destinations page, click Add to open the Add Network Entities dialog box, expand Networks, select the External network (representing the Internet), click Add, and then click Close. On the Access Rule Destinations page, click Next.
  8. On the User Sets page, because your rule applies to all users, you can leave the user set All Users in place and then click Next.
  9. Review the information on the wizard summary page, and then click Finish.
  10. In the Firewall Policy details pane, click Apply to apply the new access rule.

Creating a Web publishing rule for the main array

Perform this procedure on any member server of the main array, logged on as an array administrator.

  1. In ISA Server Management, expand Arrays, expand Main, and click Firewall Policy.
  2. In the task pane, on the Tasks tab, select Publish a Web Server. Note that you receive an error message, because the enterprise administrator did not enable you to create Web publishing rules on this array.


Procedure 10: Testing your policy

To test your configuration, try the following.

  • From Main-Client1, the client in the Main Internal network, try to download from an Internet FTP server. This should be allowed.
  • From Branch-Client1, try to download from an Internet FTP server. This should be denied.


Procedure 11: Configuring and testing NLB

Follow this procedure to configure and test Network Load Balancing (NLB) for an array. NLB will be automatically configured in unicast mode and single affinity. Single affinity ensures that all network traffic from a particular client be directed to the same host. This procedure takes place on a computer in the main array, logged on as an array administrator.

Configuring NLB on the main array

  1. On one of the ISA Server computers, such as FW-A1, expand Arrays, expand Main , expand Configuration, and click Networks.
  2. In the details pane, verify that the Networks tab is selected.
  3. In the task pane, on the Tasks tab, click Enable Network Load Balancing Integration to start the Network Load Balancing Integration Wizard. On the Welcome page, click Next.
  4. On the Select Load Balanced Networks page, select the networks for which NLB will be enabled. For example, if you are going to publish Web sites through ISA Server, you would want NLB on the External network, to balance traffic from the Internet. If you want to load balance requests from Internal clients, select Internal. In this exercise, you will configure NLB for the External network, so select External. Do not click Next.
  5. Before you click Next, you have to set the virtual IP address for the External network. To set the virtual IP address, after you select the External network, click Set Virtual IP. In the Set Virtual IP Address dialog box, provide the IP address and subnet mask for the virtual IP address you will use. Note that this IP address must be a valid static IP address (that cannot be assigned by your DHCP server), and must belong to the network you are configuring. In this solution, use the IP address 157.54.1.4 and the subnet mask 255.255.0.0, and click OK. Click Next.
  6. On the summary page, click Finish.
  7. In the details pane, click Apply.

Testing NLB

To test the NLB configuration on the External network, you would have to publish a server on the Internal network to the External network. Publishing is not described in this walk-through. For information about Web publishing, see Publishing Web Servers Using ISA Server 2004 Enterprise Edition. (http://www.microsoft.com/) For an example of server publishing, see Publishing a SQL Server Computer with ISA Server 2004.(http://www.microsoft.com/) If you have a published server, follow these steps to test your NLB configuration.

  1. On an External client computer, connect to the published server.
  2. On one of the firewall array servers, in ISA Server Management, expand Arrays, expand Main, and click Monitoring.
  3. Select the Sessions tab, and locate the client session. (Client Host Name is a column to the far right of the display pane.)

    Note

    • You can rearrange the columns by right-clicking any column, selecting Add/Remove Columns, selecting an item from Displayed columns, and clicking Move Up or Move Down.
  4. Identify the server that is hosting the session. Remove that server from the array by stopping the Microsoft Firewall service on that computer. To stop the Firewall service, click the Services tab, right-click Microsoft Firewall, and select Stop service.
  5. Return to the Sessions tab and find the client session. You will see that it moved over to another server because you stopped the Firewall service on the server that was hosting the session.
  6. You can now start the Firewall service on the server for which you stopped it. To start the Firewall service, click the Services tab, right-click Firewall service, and select Start service.


Procedure 12: Configuring CARP load factor

You can configure the member servers so that different servers have different loads. The load factor determines how to divide the load among members of an array. Changing this value increases or decreases the load on an ISA Server computer. For example, if one server in the array has a disk four times as large as all the other member servers, you can configure that server to receive a proportionate amount of the cache load, by configuring its load factor relative to that of the other servers. The load factor is a fraction of the total load factors that you configure. For example, if you have two servers, and you want one to handle 4/5 of the requests, you would assign that server a load factor of 4, and the second server a load factor of 1. The server with a load factor of 1 will then handle 1/5 of the requests.

Before you configure the Cache Array Routing Protocol (CARP) load factor, you must first activate the cache and enable CARP on the Internal network (so that requests from the Internal network to the Internet are handled using CARP). By default, there are no cache drives defined when you install ISA Server, so no caching takes place.

Activating the cache

To activate the cache, follow these steps.

  1. On one of the ISA Server computers, such as FW-A1, expand Arrays, expand Main, expand Configuration, and click Cache.
  2. In the details pane, click the Cache Drives tab.
  3. In the details pane, select the server on which you want to define cache drives.
  4. In the task pane, on the Tasks tab, click Define Cache Drives.
  5. Select one of the NTFS drives listed in the list box.
  6. In Maximum cache size, type the amount of space on the selected drive to allocate for caching, and then click Set.
  7. Click OK to close the Cache Drives properties.

    8. Note

    • This change will not be applied until you click Apply, but you can do so after configuring CARP.

Enabling CARP

Before you configure the CARP load factor, you have to enable CARP on the network. This procedure takes place on a computer in the ISA Server array, logged on as an array administrator.

  1. On one of the ISA Server computers, such as FW-A1, expand Arrays, expand Main, expand Configuration, and click Networks.
  2. In the details pane, select the Internal network. In the task pane, on the Tasks tab, select Edit Selected Network. Alternatively, right-click the Internal network in the details pane, and select Properties.
  3. On the CARP tab, select Enable CARP on this network, and then click OK.

Configuring CARP

To configure the CARP load factor, follow these steps. This procedure takes place on a computer in the ISA Server array, logged on as an array administrator.

  1. On one of the ISA Server computers, such as FW-A1, expand Arrays, expand Main, expand Configuration, and click Servers.
  2. In the details pane, select a server. In the task pane, on the Tasks tab, select Configure Selected Server. Alternatively, right-click a server in the details pane, and select Properties.
  3. On the CARP tab, adjust the Load factor up or down, and then click OK.
  4. In the details pane, click Apply to apply your changes. You will receive a notice that you have to restart the firewall service for this change to be applied. Select Save the changes and restart the services and then click OK.


Procedure 13: Backing up your configuration

You can back up an ISA Server configuration, or any part of the configuration, using the ISA Server export functionality. You can export a rule element, a single rule, a policy, an array configuration, or an enterprise configuration. The configuration information is exported as an XML document, which you can later import to copy a configuration element to another array, or to restore a previous configuration.

You might want to export a rule to use it on another array. In that case, you can import that rule from its XML document into the firewall policy of the other array.

In this exercise, you will export the configuration of the entire enterprise or of a specific array, so that the resultant XML file will serve as a backup. A configuration backup is important in the case of a catastrophic system failure, or to allow you to revert to a previous configuration if changes you make result in unexpected behavior.

If you want to back up an enterprise or an array, perform this operation on the Configuration Storage server or an ISA Server Management computer that is connected to the Configuration Storage server. If you want to back up an array, you can also do so from an array member or from an ISA Server Management computer connected to an array member.

  1. In the ISA Server console, right-click the item you want to export and select Export:
    • You can export the entire enterprise configuration, by right-clicking the top node in the console, Microsoft Internet Security and Acceleration Server 2004 and selecting Export (Back Up). This will export all of the configuration details of the enterprise and the arrays in the enterprise, including the firewall policies and rule elements of all of the arrays.
    • You can export the enterprise configuration exclusive of the array configurations, by right-clicking the Enterprise node and selecting Export.
    • You can export the configuration of any array by right-clicking the array and selecting Export (Back Up).
  2. On the Welcome page, click Next.
  3. On the Export Preferences page, you can select the following options:
    • You can choose to export confidential information. If you do, it will be encrypted during export. If you want to export confidential information, select Export confidential information and provide a password.
    • You can choose to export user permission settings, by selecting Export user permission settings. User permission settings contain the security roles of ISA Server users, for example, indicating who has administrative rights.
  4. Click Next.
  5. On the Export File Location page, provide the location and name of the file to which you want to save the configuration. Choose a meaningful name, and consider including the date in the name of the file, such as Cleveland Array ISA Backup 15 October 2004. Click Next.
  6. On the Completing the Export Wizard page, click Finish.
  7. When the export has completed, click OK.


Procedure 14: Monitoring ISA Server

You can monitor the status of ISA Server arrays through the Monitoring node of ISA Server Management. The Monitoring details pane includes the following tabs:

  • Dashboard
  • Alerts
  • Sessions
  • Services
  • Configuration Status
  • Reports
  • Connectivity
  • Logging

Monitoring also includes a performance monitor that can be accessed through the Dashboard.

The monitoring feature is described in the ISA Server product Help. In this scenario, you will check the synchronization of the servers in the main array with the Configuration Storage server.

Perform this procedure on a main array ISA Server computer, such as FW-A1, logged on as array administrator.

  1. In ISA Server Management, expand Arrays, expand Main, and click Monitoring.
  2. Select the Configuration Status tab. This tab displays information regarding when your server was synchronized with the Configuration Storage server. The Status column indicates whether the server is synchronized. The Last Updated column indicates when the synchronization last took place.
  3. If the status is Not Synced, wait. After a few moments the status should change to Synced.
  4. Make a change in the configuration. For example, change the enterprise policy assigned to Main from FTP Always Allowed to FTP Optional:
    1. In ISA Server Management, select Arrays.
    2. In the details pane, double-click Main to open its properties, and select the Policy Settings tab.
    3. In Applied Enterprise Policy, from the Enterprise policy drop-down menu, select FTP Optional Access Policy.
    4. Click OK to close the array properties.
    5. In the details pane, click Apply to apply your changes. You will receive a notice that you have to restart the firewall service for this change to be applied. Select Save the changes and restart the services, and then click OK.
  5. In ISA Server Management, expand Arrays, expand Main, click Monitoring, and select the Configuration Status tab. Note that the Status column for the servers in the main array now reads Not-synced. After a few moments the status should change to Synced.


Effective array policy

Effective array policy is the firewall behavior that results from the ordered set of rules that is the combination of the array system policy, an array policy and enterprise policy that is assigned to the array. For example, if you want to allow FTP access across the enterprise without exception, an enterprise administrator should create a pre-array enterprise access rule allowing FTP. However, if you want to allow FTP access but give the array administrators the ability to deny FTP access, you should create a post-array enterprise access rule allowing FTP. If an array administrator then creates an array access rule denying FTP, the effective policy will be that FTP is denied. If the array administrator does not create a rule that denies FTP, the effective policy will be that FTP is allowed.

An example of how rules work together to create effective policy is provided in Enterprise Edition Walk-through Procedure 5: Creating Enterprise Policies.


ISA Server Management

ISA Server Management is the user interface (UI) console used to manage the enterprise. Through the UI console, the administrator connects to a specific Configuration Storage server to manage the enterprise. ISA Server Management will also perform specific RPC calls to various computers running ISA Server services to obtain computer specific information. For example, when performing monitoring, the management console makes calls directly to the computers to monitor their state.


Who Should Read This Document

Read this document if you:

  • Use ISA Server 2000 Enterprise Edition and want to learn about what is new in ISA Server 2004.
  • Use another firewall and are new to ISA Server.
  • Need an introduction to ISA Server 2004 Enterprise Edition features.
  • Want to set up ISA Server Enterprise Edition in a laboratory and use a guided walk-through to learn how to implement ISA Server in your company. For details, see Enterprise Edition Walk-through.

After you read this guide, for more information about ISA Server features and functionality, see ISA Server Enterprise Edition Help.