ISA Server 2004 welcome page

header graphic
Microsoft® Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition introduces multi-networking support, easy-to-use and highly integrated virtual private networking configuration, extended and extensible user and authentication models, and improved management features. ISA Server includes array support, integrated Network Load Balancing (NLB), and Cache Array Routing Protocol (CARP). Because you can have more than one ISA Server computer in an array, you have the advantages of high availability, failover, and redundancy.
branding bullet About this Help
This documentation is designed to assist you in performing day-to-day ISA Server administration tasks. It contains the following sections:
  • Introducing ISA Server
  • Installation and Upgrade
  • Administration and Security
  • Networking
  • Firewall Policy
  • Clients
  • Virtual Private Networking
  • Caching
  • Monitoring
  • Add-ins
  • Deployment Scenarios
  • Additional Resources
branding bullet ISA Server Guidance
Your primary source for in-depth technical information about ISA Server is the set of Web-based ISA Server Guidance. New documents are added to the library periodically, ensuring that you always have the latest ISA Server technical information.

ISA Server Help may be updated after ISA Server is released.

To download and install any Help updates, and to get additional, up-to-date content, go to ISA Server Guidance.
branding bullet ISA Server Community
Whether you are a novice or an experienced user, Community is your place to share ideas, get answers to your questions, read expert advice, and more. Join peer-to-peer discussions about ISA Server issues and solutions at ISA Server Community.


Introducing ISA Server

Microsoft® Internet Security and Acceleration (ISA) Server 2004 is an extensible enterprise firewall and Web cache server built on the Microsoft Windows Server™ 2003 operating system security, management, and directory for policy-based access control, acceleration, and management of internetworking.

The Internet provides organizations with opportunities to connect with customers, partners, and employees. Although this offers opportunities, it also presents risks and concerns about security, performance, and manageability. ISA Server is designed to address the needs of today's Internet-enabled businesses. ISA Server provides a multilayered enterprise firewall that helps protect network resources from viruses, hackers, and unauthorized access. The ISA Server 2004 Web cache enables organizations to save network bandwidth and provide faster Web access for users by serving objects locally rather than over a congested Internet.

Whether deployed as dedicated components or as an integrated firewall and caching server, ISA Server provides a unified management console that simplifies security and access management. Built for both the Windows Server 2003 and Windows® 2000 Server platforms, ISA Server provides secure and fast Internet connectivity with powerful, integrated management tools.

This section introduces you to ISA Server.

  • ISA Server overview
  • New features: multi-networking
  • New features: security and firewall policy
  • New features: virtual private networking
  • New features: monitoring
  • New features: add-ins
  • New features: enterprise management
  • New features: load balancing

web link Get latest ISA Server content at ISA Server Guidance.
Send feedback about this page Send feedback about this page.


ISA Server overview

Microsoft® Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition offers secure, fast, and manageable Internet connectivity. ISA Server integrates a sophisticated, application layer aware, multiple layer enterprise firewall and a high performance Web cache. It builds on Microsoft Windows Server™ 2003 security and directory for policy based security, acceleration, and management of internetworking. ISA Server includes array support, integrated Network Load Balancing (NLB), and Cache Array Routing Protocol (CARP).

High availability, failover, and redundancy

With ISA Server 2004 Enterprise Edition, you can enforce policy on an enterprise level. The enterprise administrator has granular control over policy throughout the enterprise, including the level of policy authority granted to array administrators.

ISA Server computers can be grouped together in an array, to ensure a fault-tolerant, balanced network. In an array scenario, the Cache Array Routing Protocol (CARP) algorithm is used to ensure that client requests are serviced by the appropriate ISA Server computer in the array.

Furthermore, NLB is integrated with ISA Server, so that you can easily manage NLB between the various networks protected by ISA Server.

Secure Internet connectivity

Connecting networks and users to the Internet introduces security and productivity concerns. ISA Server 2004 provides your organization with the comprehensive ability to control access and monitor usage on a per-user basis. ISA Server protects networks from unauthorized access, performs stateful filtering and inspection, and alerts administrators to attacks against the firewall or protected network.

ISA Server is a firewall, featuring security with packet level, circuit level, and application level traffic screening, stateful filtering and inspection, broad network application support, a tightly integrated virtual private network (VPN), system hardening, integrated intrusion detection, intelligent layer 7 application filters, firewall transparency for all clients, advanced authentication, secure server publishing, and much more. ISA Server 2004 enables you to do the following:

  • Protect networks from unauthorized access.
  • Defend Web and e-mail servers from external attacks.
  • Inspect incoming and outgoing network traffic to ensure security.
  • Receive alerts of suspicious activity.

Fast Web access

The Internet offers organizations productivity benefits, but only if content is accessible, access is fast, and the cost is reasonable. The ISA Server 2004 cache minimizes performance bottlenecks and saves network bandwidth by serving locally cached Web content. ISA Server enables you to do the following:

  • Provide faster Web access for users, by serving objects from the Web cache rather than over a congested Internet.
  • Reduce Internet bandwidth costs, by reducing network traffic on the link.
  • Distribute Web server content and e-commerce applications, to reach customers worldwide efficiently and cost effectively.
  • Serve popular Web content from the ISA Server Web cache, to free up Internal network bandwidth for other content requests.

Unified management

By combining firewall and high performance Web cache functions, ISA Server 2004 delivers a common management infrastructure that reduces network complexity and costs. ISA Server is tightly integrated with Windows Server 2003 and Windows 2000 Server. This provides a consistent and powerful way to manage user access and configuration of firewall rules.

Extensible platform

Security policies and imperatives vary from organization to organization. Traffic volume and content formats pose unique concerns. No single product fits all security and performance needs, so ISA Server 2004 is built to be highly extensible. Available for ISA Server are a comprehensive software developers kit (SDK), a large selection of third-party add-on solutions, and an extensible administration option. More information about third-party add-on solutions is available on the ISA Server Partners Web site (http://www.microsoft.com/).

Using the ISA Server administration Component Object Model (COM), you can extend ISA Server functionality. The administration objects also allow for automation of all tasks that are done through ISA Server Management. This means that any task can be automated by an ISA Server administrator by using the administration objects. For more information, see the Microsoft SDK Web site (http://www.microsoft.com/).

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


New features: multi-networking

The following table lists features of the multi-networking functionality introduced by ISA Server 2004. These features are described in greater detail in Multi-Networking.

Feature | Description
Multiple network configuration | You can configure one or more networks, each with distinct relationships to other networks. Access policies are defined relative to the networks and not necessarily relative to a given Internal network. ISA Server extends the firewall and security features to apply to traffic between any networks or network objects.
Unique per-network policies | The new multi-networking features of ISA Server enable you to protect your network against internal and external security threats by limiting communication between clients, even within your own organization. Multi-networking functionality supports sophisticated perimeter network (also known as demilitarized zone, DMZ, or screened subnet) scenarios, so that you can configure how clients in different networks access the perimeter network. Access policies between networks can then be based on the unique security zone represented by each network.
Routed and NAT network relationships | You can use ISA Server to define routing relationship between networks, depending on the access and communication required. In some cases, you may want more secure, less transparent communication between the networks. For these scenarios, you can define a network address translation (NAT) relationship. In other situations, you may want to simply route traffic through ISA Server. In these cases, you can define a routed relationship. Packets moving between routed networks are fully exposed to ISA Server stateful filtering and inspection mechanisms.

Get latest ISA Server content at ISA Server Guidance.


New features: security and firewall policy

The following table lists features of the security and firewall policy functionality introduced by ISA Server 2004. These features are described in greater detail in Firewall Policy.

Feature | Description
Support for complex protocols requiring multiple primary connections | ISA Server supports complex protocols, including those required by many streaming media, voice applications, and video applications. These applications require that the firewall manage complex protocols.
Customized protocol definitions | You can control the source and destination port number for any protocol for which you create a firewall policy rule. You have a high level of control over what packets are allowed inbound and outbound through the firewall.
Authentication | Users can be authenticated using built-in Windows, RADIUS, RSA SecurID authentication, or other namespaces. Rules can be applied to users or user groups in any namespace. Third-party vendors can use the software development kit (SDK) to extend these built-in authentication methods, offering additional authentication mechanisms.
Network objects | You can define network objects, including computers, networks, network sets, address ranges, subnets, computer sets, and domain name sets. These network objects are used to define source and destination settings for firewall policy rules.
Firewall policy rules representing an ordered list | Firewall policy rules represent an ordered list in which connection parameters are first compared to the top listed rule. ISA Server moves down the list of rules until it finds a rule matching the connection parameters and enforces the matching rule's policy. This approach to firewall policy makes it easier to determine why a specific connection is allowed or denied.
Outlook Web Access Publishing Wizard | The ISA Server Outlook Web Access Publishing Wizard provides steps for creating the Secure Sockets Layer (SSL) virtual private network (VPN) for Outlook Web Access for your Exchange server.
FTP support | You can access Internet File Transfer Protocol (FTP) servers listening on alternate port numbers without requiring special configuration on the client or the ISA Server computer.
Port redirection for server publishing rules | You can receive a connection on one port number and redirect the request to a different port number on the published server.
Secure Web publishing | You can place servers behind the firewall, either on the corporate network or on a perimeter network, and securely publish their services. Using the secure Web Publishing Wizard, you can create a rule allowing remote users secure SSL remote access to published Web servers.
HTTP 1.1 support | ISA Server is an HTTP 1.1 client, when it is connected with an upstream server. In both forward (Web Proxy) and reverse (Web publishing) scenarios, ISA Server can receive and inspect chunked (transfer encoding) content. Also, it is possible to configure Web publishing rules to receive compressed content, but in this case, the response body cannot be inspected. Note that ISA Server does not perform compression.

Get latest ISA Server content at ISA Server Guidance.


New features: virtual private networking

ISA Server 2004 supports secure virtual private network (VPN) access that can connect branch offices or remote users to corporate networks. ISA Server firewall policy is applied to VPN connections to control what resources and protocols VPN users can access. VPN features are described in greater detail in Virtual Private Networking.

The following table lists VPN features supported by ISA Server.

Feature | Description
VPN administration | ISA Server includes a fully integrated virtual private networking mechanism, which is based on Microsoft® Windows Server™ 2003 and Windows® 2000 Server functionality.
Stateful filtering and inspection for VPN | Because VPN clients are configured as a separate network, you can create distinct policies for VPN clients. The firewall policy engine discriminately checks requests from VPN clients, statefully filtering and inspecting these requests and dynamically opening connections based on the access policy.
SecureNAT client support for VPN clients connected to ISA Server VPN server | ISA Server extends VPN client support by allowing SecureNAT clients to access the Internet, even without Firewall Client software installed on the client system. You can also enhance corporate network security by forcing user or group-based firewall policy on VPN SecureNAT clients.
Stateful filtering and inspection through site-to-site VPN tunnel | ISA Server introduces stateful filtering and inspection for all communications moving through a site-to-site VPN connection. You can control resources so that specific hosts or networks can access on opposite sides. User or group-based access policies can be used to gain granular control over resource utilization through the link.
VPN Quarantine Control | You can quarantine VPN clients on a separate network until they meet a predefined set of security requirements. VPN clients passing security tests are allowed network access based on VPN client firewall policies. VPN clients who fail security tests may be provided limited access to servers that will help them meet network security requirements.
IPSec tunnel mode support for site-to-site VPN links | ISA Server features site-to-site link support by allowing you to use IPSec tunnel mode as the VPN protocol. IPSec tunnel mode support greatly increases ISA Server interoperability with a wide array of third-party VPN solutions.
VPN monitoring and logging | You can monitor VPN client and remote VPN network activity, just as you monitor activity of any other ISA Server client.

Get latest ISA Server content at ISA Server Guidance.


New features: monitoring

The following table lists features of the monitoring functionality introduced by Microsoft Internet Security and Acceleration (ISA) Server 2004. These features are described in greater detail in Monitoring.

Feature | Description
Dashboard | The Dashboard view of ISA Server summarizes monitoring information about sessions, alerts, services, reports, connectivity, and general system health. The Dashboard provides you with a quick view on how your network is functioning.
Real-time monitoring in log viewer | You can view firewall and Web Proxy logs in real time. The monitoring console displays the log entries as they are recorded in the firewall log file.
Built-in log query (filtering) | You can query the log files using the built-in log query facility. Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) logs can be queried for information contained in any field recorded in the logs. You can limit the scope of the query to a specific time frame. The results appear in the ISA Server console and can be copied to the Clipboard and pasted into another application for more detailed analysis.
Real-time monitoring and filtering of sessions | You can view all active connections. From a session view, you can sort or disconnect individual or groups of sessions. In addition, you can filter the entries in the session's interface to focus on the sessions of interest using the built-in sessions filtering facility.
Connectivity verifiers | You can verify connectivity by regularly monitoring connections to a specific computer or Uniform Resource Locator (URL) from the ISA Server computer using connection verifiers. You can configure which method to use to determine connectivity: Ping, Transmission Control Protocol (TCP) connect to a port, or HTTP GET. You can select which connection to monitor by specifying an IP address, computer name, or URL.
Report publishing | You can configure ISA Server report jobs to automatically save a copy of a report to a local folder or network file share. The folder or file share the reports are saved in can be mapped to a Web site virtual directory so that other users can view the report. You can also manually publish reports that have not been configured to automatically publish after report creation.
Log to an MSDE 2000 database | Logs can now be stored in MSDE 2000 format. Logging to a local database enhances query speed and flexibility.

Get latest ISA Server content at ISA Server Guidance.


New features: add-ins

ISA Server 2004 supports many Internet protocols, including Hypertext Transfer Protocol/Secure Sockets Layer (HTTP/SSL), File Transfer Protocol (FTP), RDP, Telnet, RealAudio, RealVideo, Internet Relay Chat (IRC), H.323, Windows media streaming, e-mail protocols, and news protocols, with built-in add-ins. These add-ins are described in greater detail in Add-ins.

The following table lists add-in features of ISA Server.

Feature | Description
HTTP filtering on a per-rule basis | ISA Server HTTP policy allows the firewall to perform deep HTTP stateful inspection (application layer filtering). The extent of the inspection is configured on a per-rule basis. You can configure custom constraints for HTTP inbound and outbound access.
Block access to all executable content | You can configure ISA Server HTTP policy to block all connection attempts to Windows executable content, regardless of the file extension used on the resource.
Apply HTTP filtering to all ISA Server client connections | ISA Server could block content for Web Proxy client-based HTTP and FTP connections using MIME Enter (for HTTP) or file extension (for FTP). You can control HTTP access for all ISA Server client connections.
Control HTTP access based on HTTP signatures | You can create HTTP signatures that can be compared against the request URL, request headers, request body, response headers, and response body. You have precise control over what content internal and external users can access through ISA Server.
Force secure Exchange RPC connections from full Outlook MAPI clients | ISA Server Exchange Server publishing rules allow remote users to connect to Exchange using the fully functional Outlook® MAPI client over the Internet. However, the Outlook client must be configured to use secure RPC so that the connection is encrypted. Using ISA Server RPC policy, you can block all nonencrypted Outlook MAPI client connections.
FTP policy | ISA Server FTP policy can be configured to allow users to upload and download using FTP, or you can limit user FTP access to download only.
Link translation | Some published websites may include references to internal names of computers. Because only the ISA Server computer and external namespace, and not the internal network namespace, is available to external clients, these references will appear as broken links. ISA Server includes a link translation feature so that you can create a dictionary of definitions for internal computer names that map to publicly known names.
Granular control over IP options | You can configure IP options on a granular basis and allow only the IP options you require, while blocking all others.

Get latest ISA Server content at ISA Server Guidance.


New features: enterprise management

The following table lists features of the enterprise management functionality introduced by Microsoft Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition. These features are described in greater detail in Enterprise Management.

Feature | Description
Enterprise policy | With ISA Server 2004 Enterprise Edition, you can enforce policy on an enterprise level. The enterprise administrator has granular control over policy throughout the enterprise, including the level of policy authority granted to array administrators.
Enterprise networks | An enterprise network is a network defined on the enterprise level that is global to all the arrays in the enterprise. This enables you to create enterprise-level rules. It also allows communication between arrays, while simultaneously providing spoof detection support.
Centralized monitoring | A user with the proper credentials can monitor the ISA Server computers from any location.


New features: load balancing

The following table lists load balancing features introduced by Microsoft Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition. Using these features, you can create a networking environment that supports redundancy and failover. These features are described in greater detail in Network Load Balancing overview and CARP.

Feature | Description
Integrated Network Load Balancing (NLB) | NLB is integrated with ISA Server, so that you can easily manage NLB between the various networks protected by ISA Server.
Cache Array Routing Protocol (CARP) | Efficiently manages the storage and retrieval of cached information for an array of ISA Server computers.


Installation and Upgrade

This section explains the installation process and provides step-by-step instructions on how to install Microsoft Internet Security and Acceleration (ISA) Server 2004.

If you have ISA Server 2000 installed, you can upgrade that installation without removing it from the computer. Most configuration information is migrated. This section explains the upgrade and upgrade process.

  • Installation and Upgrade: Concepts
  • Installation and Upgrade: How To
  • Troubleshooting installation

Get latest ISA Server content at ISA Server Guidance.


Installation and Upgrade: Concepts

This section provides background information about the Microsoft Internet Security and Acceleration (ISA) Server 2004 installation process and information about upgrading from ISA Server 2000.

  • Installation of ISA Server
  • Upgrading from ISA Server 2000

web link Get latest ISA Server content at ISA Server Guidance.


Installation of ISA Server

This section provides background information about new installations of Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Planning the Installation
  • Unattended setup
  • Default settings


Planning the Installation

This section provides background information about planning for installation of Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Installation requirements
  • Capacity planning
  • Installation components
  • Installation process
  • Installing the Configuration Storage server on a domain controller
  • Deploying Configuration Storage servers across ADAM sites
  • Installation considerations for workgroup and untrusted domain deployment


Installation requirements

To use Microsoft Internet Security and Acceleration (ISA) Server 2004, you need:

  • A personal computer with a 550 megahertz (MHz) or higher Pentium II-compatible CPU.
  • The following operating systems:
    • Microsoft® Windows Server™ 2003 operating system for Configuration Storage server and ISA Server services.
    • Windows Server 2003 or Microsoft Windows® 2000 Server for Message Screener.
    • Windows Server 2003, Windows 2000 Server, or Microsoft Windows XP for Firewall Client Share and ISA Server Management.
  • 256 megabytes (MB) of memory.
  • One network adapter that is compatible with the computer's operating system, for communication with the Internal network.
  • An additional network adapter for each network connected to the ISA Server computer.
  • One local hard disk partition that has at least 150 MB of available hard disk space. This is exclusive of hard disk space you want to use for caching. If you install ISA Server services, the disk should be formatted with the NTFS file system.

In addition, we recommend that you allow a minimum of 4 gigabytes (GB) disk space for logging to the Microsoft SQL Server™ 2000 Desktop Engine (MSDE 2000) or to a text file.

If you are planning on configuring Network Load Balancing (NLB), you must allow for an additional network adapter for intra-array communication. Note that load balancing should not be configured for this network.

For installation instructions, see Install ISA Server.


Capacity planning

The minimum system requirements for Microsoft Internet Security and Acceleration (ISA) Server 2004 are described in Installation requirements. However, for improved performance, plan the ISA Server 2004 hardware and Internet connectivity to meet the expected load. When determining the hardware required for an ISA Server computer, consider the following questions:

  • How many processors are needed, and what types of processors are required?
  • How much RAM and disk space are needed, and how many network adapters are required?
  • What is the recommended Internet connection bandwidth?

The answers to these questions depend upon your specific security configuration needs and on the deployment scenario. Specifically, all of the following impact the hardware recommendations: the firewall policy configuration, logging requirements, peak total network throughput, and whether you are publishing servers or simply allowing Internet access. Of these, peak total throughput on the Internet connection has proven to be the most significant factor in determining computing needs, because in most cases, it represents the Internet capacity needs.

The following table provides general guidelines, depending on the Internet link bandwidth you use. Note that the recommendations listed here assume Web traffic and a policy configuration with several hundreds of rules. The recommendations also assume no special configurations such as caching, third party filters, and others. If you enable caching, an Internet link with twenty to thirty percent lower bandwidth may suffice. Furthermore, if you configure the clients to be proxy-aware, you can expect double throughput for the same hardware configurations.

Internet link bandwidth | Up to 5 T1 (7.5 Mbps) | Up to 25 Mbps | Up to T3 (45 Mbps) | Notes
Processors | 1 | 1 | 2 |
Processor type | Pentium III 550 MHz (or higher) | Pentium 4 2.0 - 3.0 GHz | Xeon 2.0 - 3.0 GHz | Alternatively, you can use other processors with comparable power that emulate the IA-32 instruction set. In deployments requiring only stateful inspection filtering (that is, no need for higher application level filtering), the Pentium 4 and Xeon processor recommendations reach LAN wire speeds.
Memory | 256 MB | 512 MB | 1 GB | With Web caching enabled, these requirements may be higher.
Disk space | 150 MB | 2.5 GB | 5 GB | This is exclusive of hard disk space you need to use for logging.
Network adapter | 10/100 Mbps | 10/100 Mbps | 100/1000 Mbps | These are the requirements for the network adapters not connected to the Internet.

For more detailed information, see the Capacity Planning (http://www.microsoft.com/) document, on the ISA Server Web site.

web link Get latest ISA Server content at ISA Server Guidance.


Installation components

Microsoft Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition is composed of the following components:

  • ISA Server Management. The console through which the administrator manages the enterprise.
  • Configuration Storage server. The repository of the enterprise layout and the configuration for each server in the enterprise. This repository is an instance of Active Directory Application Mode (ADAM). Each ISA Server computer has a local copy of its configuration that is a replica of the server’s configuration, which is located on the Configuration Storage server.
  • ISA Server services. This is the computer that runs the firewall, virtual private network (VPN), and caching functions of ISA Server. The computer running ISA Server services is connected to a Configuration Storage server, which stores the configuration information.
  • Additional components. Additional components (Advanced Logging, Firewall Client Share, and Message Screener) can be installed on separate computers. Note that the Advanced Logging component can only be installed on a computer running ISA Server services.

The following figure illustrates these components.

ISA Server components

As part of the installation process, you can install one or more of these installation components. Note that a Configuration Storage server must be available to install the ISA Server services component. This is because each computer running ISA Server services and ISA Server Management retrieves its configuration information from a Configuration Storage server.

If a Configuration Storage server fails, ISA Server Management will not provide access to any ISA Server functionality, because it requires a connection to a working Configuration Storage server. At the same time, the ISA Server 2004 computer will continue to provide firewall, VPN, and proxy services based on the last known configuration it received from the Configuration Storage server. However, you will not be able to monitor or change its configuration until the Configuration Storage server is restored, or until you connect the computer running ISA Server services and the ISA Server Management computer to a different Configuration Storage server in the enterprise. For instructions on specifying a Configuration Storage server after installation, see Specify a Configuration Storage server for this array.

Configuration Storage server

A Configuration Storage server is a server on which the configuration for all the arrays in the enterprise is stored. The Configuration Storage server uses ADAM for storage. When you install the Configuration Storage server, you also automatically install ADAM on the computer. When you configure arrays in the enterprise, you are changing the information in the Configuration Storage server. At a later time, the ISA Server 2004 Enterprise Edition computers will access the Configuration Storage server to check whether there is any configuration change, and update their local storage (registry based) to reflect the recent changes in the enterprise.

There can be multiple Configuration Storage servers in the enterprise, each holding an exact replica of the enterprise configuration.

Each array points to a specific Configuration Storage server from which it gets the updated configuration. You can also specify an alternate Configuration Storage server, which is used in case the first Configuration Storage server fails.

For installation instructions, see Install Configuration Storage server.

ISA Server Management

ISA Server Management is the management console used to manage the enterprise and the array members. Using ISA Server Management, you connect to a specific Configuration Storage server to manage the enterprise. For installation instructions, see Install ISA Server Management.

Computers running ISA Server services

The computer running the ISA Server services is the computer with the firewall, caching, and VPN functionality. By default, ISA Server Management is also installed on these computers. The configuration information displayed there is stored on the Configuration Storage server.

Computers running ISA Server services can be grouped in an array. Note that all computers grouped in an array must have the same:

  • Number of network adapters, connected to array-level networks with the same names.
  • Dial-up connections configured.
  • Time zone, with synchronized clocks (for logging).
  • Partitions (for logging).
  • Certificates installed on each array member.
  • Network services available to each array member (for example, DNS, CRL Verification connectivity, and Active Directory connectivity).
  • Language version of ISA Server and Windows Server 2003 installed, with the same locale set for the computer and for the logged-on user.
  • Updates installed.
  • Domain and site configuration (or belong to a workgroup).

If you are planning on configuring Network Load Balancing (NLB), you must allow for an additional network adapter for intra-array communication, if Windows Server 2003 is not installed. Note that load balancing should not be configured for this network.

For installation instructions, see Install a computer running ISA Server services. For more information about arrays, see Arrays and array members.


Installation process

Before you begin installation, consider the topology of your Microsoft Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition infrastructure. Consider the following:

  • Will you deploy ISA Server in a workgroup or in a trusted domain environment? For more information, see Installation considerations for workgroup and untrusted domain deployment.
  • Where will the Configuration Storage servers be installed?
  • Will all the Configuration Storage servers be installed in the same site? For more information about multi-site installations, see Deploying Configuration Storage servers across ADAM sites.
  • How many arrays will you install in the enterprise?
  • How many members in each array?
  • Will you manage the enterprise remotely?
  • How many remote management computers will you install?

Before you set up ISA Server, review Installation requirements. Then, deploy the computers in this order:

  1. Install a Configuration Storage server. The Configuration Storage server must be available to install the ISA Server 2004 component. When you install a Configuration Storage server, you can join the server to an existing enterprise. Alternatively, you can create a new enterprise. For the most effective deployment, we recommend that you create a single enterprise in your organization. With a single enterprise, you can manage all the arrays in your organization from a single ISA Server Management console. For installation instructions, see Install Configuration Storage server.
  2. (Optional) Create arrays, enterprise network rules, and enterprise policies on the Configuration Storage server. When you begin installing array members, as described in the next step, you can join them to arrays that already exist.
  3. Install ISA Server services on one or more computers. When you install a computer running ISA Server services as the first member of a new array, you will specify addresses in the Internal network. For information about the Internal network, see Default Internal network. For instructions, see Install a computer running ISA Server services.

As part of the installation process, ISA Server modifies the TCP/IP driver's dynamic port range, setting it to 65,535. This modification will take effect after the computer is restarted. Note that your computer is not automatically restarted after ISA Server is installed.

Note

  • When you select to install the Advanced Logging component (MSDE) during ISA Server Setup, a number of .dll files are installed, including Ds16gt.dll, and Odbc16gt.dll. The Advanced Logging component (MSDE) is an optional component, installed by default.

Stopping and disabling services

As part of the installation process, the following services are disabled:

  • Internet Connection Firewall or Internet Connection Sharing
  • IP Network Address Translation

In addition, the following services are stopped during installation:

  • SNMP service
  • FTP Publishing service
  • Network News Transfer Protocol (NNTP)
  • IIS Admin service
  • World Wide Web Publishing service

These services are restarted after installation completes.

Installing the Firewall Client Share

When you select to install the Firewall Client Share, the files that a computer requires to install the Firewall Client software are copied to a folder on the computer. The folder is shared with Read permissions for these groups: Administrators, System, and Authenticated Users.

When you install the share, the system policy rule named Allow access to firewall client share to trusted computers, which allows clients on the Internal network to access the share, is enabled. This rule allows the clients to install the software from the share. For more information, see System policy overview.


Installing the Configuration Storage server on a domain controller

In some scenarios, you may want to install the Configuration Storage server component of Microsoft Internet Security and Acceleration (ISA) Server 2004 on a domain controller. For example, you may want to try to conserve hardware and administrative resources in a branch office that requires firewall protection.

In most scenarios, the Configuration Storage server service runs under the Network Service account. However, when you install the ISA Server Configuration Storage server on a domain controller, you must specify a different account under which the Configuration Storage server service will run. This is because the Network Service account cannot be used when the Configuration Storage server runs on a domain controller.

You can run the Configuration Storage server service using the credentials of a user in the Domain Admins group (a domain administrator). However, for the most secure configuration, we recommend that you provide the credentials of a user who is not a domain administrator. If you do so, you must perform these steps to ensure that the user has the permissions required by the service:

  1. Install the Configuration Storage server, as described in Install Configuration Storage server.
  2. As part of the setup process, on the Configuration Storage Server Service Account page of the setup wizard, provide the credentials of the user who is not a domain administrator.
  3. In the Program Files\Microsoft ISA Server\ADAMData folder, locate the Dnsdomain.bat file, where Dnsdomain is the Domain Name System (DNS) name of the computer on which Active Directory Application Mode (ADAM) is running.
  4. At the command prompt, type Dnsdomain to run the file.

Note

  • The Dnsdomain.bat file appears in the directory approximately one minute after ADAM installation is complete.

web link Get latest ISA Server content at ISA Server Guidance.


Deploying Configuration Storage servers across ADAM sites

In a large, multiple branch scenario, you may have multiple Configuration Storage servers, geographically dislocated and connected by slow links. In these scenarios, you can optimize the replication of the configuration information stored on the Configuration Storage servers by establishing Active Directory Application Mode (ADAM) sites. Between sites, you can configure how often the configuration information is replicated.

To move a Configuration Storage server to a different site, perform the following steps:

  1. Install Microsoft Internet Security and Acceleration (ISA) Server 2004 (Configuration Storage server). For instructions, see Install Configuration Storage server.
  2. Use the AdamSites.exe tool (http://www.microsoft.com/) to create a new site. At a command prompt, type:
    AdamSites Site Create NewSite
     where NewSite is the name of the new site.
  3. Use the AdamSites.exe tool to move the server to a new site. At a command prompt, type:
    AdamSites MoveServer ConfigStgServer Site1 NewSite
     where Site1 is the name of the existing site and NewSite is the name of the new site.

Intersite replication

One Configuration Storage server in each site, called the intersite topology generator, is assigned to build the topology. Together, these intersite topology generators build an algorithm that eliminates redundant replication paths between sites. The intersite replication topology is updated regularly to respond to any changes that occur in the network.

For more information about replication between sites, see How Active Directory Replication Topology Works (http://www.microsoft.com/).

Using AdamSites.exe

When you run the AdamSites.exe tool, you can specify how often the site should replicate with other sites in the ADAM deployment.

Other configuration options are available by typing AdamSites.exe at a command prompt.

Firewall policy to allow replication

When a Configuration Storage server on one site replicates with a Configuration Storage server on another site, it must present appropriate credentials. To enable this, each Configuration Storage server will require access to an Active Directory domain controller and to appropriate Domain Name System (DNS) servers. You must configure an appropriate firewall policy that allows this access. You can configure this policy at the array level, for each array, or at the enterprise level.

To configure an array-level firewall policy, modify the following system policy configuration groups:

  • DNS. Modify this configuration group to include the specific DNS servers.
  • Active Directory. Modify this configuration group to include the specific Active Directory domain controller.

For instructions, see Edit destinations for a system policy rule.

To configure an enterprise-level policy, create two access rules:

  1. Access rule that allows the Configuration Storage server to use the DNS protocol to access the DNS server.
  2. Access rule that allows the Configuration Storage server to use the LDAP and LDAPS protocols to access the Active Directory domain controller.

For instructions, see Create an enterprise policy rule.


Installation considerations for workgroup and untrusted domain deployment

The computer running Microsoft Internet Security and Acceleration (ISA) Server 2004 services can be installed in a workgroup or in a domain that does not have a trust relationship with the domain of the Configuration Storage server to which it connects. In this case, authentication between the two computers can be established only by using certificates. The certificate files must be created and used through the Setup application of the Configuration Storage server and the computer running ISA Server services.

When you install the Configuration Storage server, do the following:

  1. Install a certification authority (CA), as described in Install a certification authority.
  2. Create and export a certificate, as described in Create a server certificate and in Export a server certificate.
  3. When you install the Configuration Storage server, specify this certificate as the certificate to use when communicating with the computer running ISA Server services.

When you install the computer running ISA Server services, do the following:

  1. Obtain a root certificate. For instructions, see Obtain a root certificate.
  2. Add the certificate to the certificate store on the computer running ISA Server services.
  3. During installation, specify this certificate on the Configuration Storage Server Authentication Options page.

When you install ISA Server in a workgroup, you must create a local user on each of the computers running ISA Server services. This account will later be used by ISA Server Management to communicate with these computers. You provide the credentials of a local user each time you connect ISA Server Management to an array. Each server in the array must have an identical local user (a mirrored account). For more information, see Roles for domain and workgroup.

Note

  • Certificates typically have an expiration period, usually no more than one year. ISA Server cannot use an expired certificate. Be sure to renew your certificates before they expire, so that ISA Server can continue to function.

Changing deployment environment after installation

After you install the ISA Server components, you may decide to change the deployment environment, placing one or more components in a workgroup or in an untrusted domain. In this case, you must ensure that appropriate certificates are installed on the ISA Server components.

On the Configuration Storage server, you can obtain a certificate by doing one of the following:

  • Run ISA Server Setup, selecting the Repair option. For instructions, see Specify a certificate on a Configuration Storage server. When you run the Repair option of ISA Server Setup, all existing certificates are removed from the ADAM_ISASTGCTRL local store.
  • Use the ISACertTool, available on the ISA Server Download Center (http://www.microsoft.com/). When you run the ISACertTool, all certificates in the ADAM_ISASTGCTRL local store are erased. By specifying the /keepcerts flag when you run the tool, you can retain all certificates.
  • Install the certificate directly on the Configuration Storage server. For instructions, see Obtain a server certificate.

When you install a certificate, a private key container is created on the Configuration Storage server in the Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys folder. The account running the ISASTGCTRL service (by default, the Network Service account) must have appropriate permissions to the private key container.


Unattended setup

You can install Microsoft Internet Security and Acceleration (ISA) Server 2004 by using the unattended server setup command. For instructions, see Run ISA Server unattended setup.

Note

  • To perform this procedure, you must be a member of the Administrators group.

You cannot perform an unattended installation on a computer with ISA Server 2000 installed. The following files in the FPC folder on the ISA Server CD contain the configuration information that can be used by server setup in unattended mode.

File name | Description
InstallJoinedServer.ini | Install a computer running ISA Server services, and join it to a specific array.
InstallNewArrayAndServer.ini | Install a computer running ISA Server services, and create a new array named ARRAY_NAME.
InstallNewManagementServer.ini | Install a Configuration Storage server.
InstallStandaloneServer.ini | Install ISA Server services and Configuration Storage server.
Uninstallserver.ini | Uninstall a server.

If a value is not specified in this file, a default value is used. The following table describes the entries and values in the configuration files. Note that not all parameters are used in each installation configuration.

Entry | Description | Scenario
ADDLOCAL= {MSFirewall_Management}, {MSFirewall_Services}, {Message_Screener}, {Publish_Share_Directory}, {MSDE}, {Storage_Server} | Specifies a list of components (delimited by commas) that should be installed on the computer. To install all the components, set ADDLOCAL=ALL. | Optional for all installation scenarios.
ARRAY_AUTHENTICATIONMETHOD Defines the array's authentication method.
Possible values: Windows (LDAP) or Certificate (LDAPS). When you set this value, you must also specify a value in CLIENT_CERTIFICATE_FULLPATH.
Default value: Windows. 		Optional when installing:
  • A server to a new array.
  • Combined ISA Server services and Configuration Storage server.
Must be set to Certificate in workgroup scenarios.
ARRAY_DESCR Array description.
Default: empty. 		Optional when installing:
  • A server to a new array (not used when joining an existing array).
  • Combined ISA Server services and Configuration Storage server.
ARRAY_DNS_NAME Specifies the name that Firewall and Web Proxy clients use when connecting to the array.
Default: computer name. 		Optional when installing:
  • A server to a new array (not used when joining an existing array).
  • Combined ISA Server services and Configuration Storage server.
ARRAY_ENTERPRISEPOLICY Specifies which enterprise policy to use. Default is Array Policy Only. Required when installing a server to a new array.
Should not be specified when installing ISA Server services and Configuration Storage server in a new enterprise.
ARRAY_INTERNALNET Specifies the range of IP addresses in the new array's Internal networks. Defines the description of the new array.

N From1-To1,From2-To2,... FromN-ToN, where N is the number of ranges, and FromI to ToI are the starting and ending addresses in each range.

 Required when installing:
  • A server to a new array.
  • Combined ISA Server services and Configuration Storage server.
  • Joining an existing array that does not have an Internal network defined.
Should not be specified when installing a server to an existing array that has an Internal network defined.
Optional when using ARRAY_INTERNALNET_ENTERPRISE_NETS.
ARRAY_INTERNALNET_ENTERPRISE_NETS Specifies the names of enterprise networks that are included in the array's Internal network.
Syntax: "network1" "network2"..."networkN".
If a network name contains quotation marks, replace them with double quotes (""). 		If ARRAY_INTERNALNET is specified, optional. Otherwise, required when installing a server to a new array.
Should not be specified when installing a Configuration Storage server for a new enterprise.
ARRAY_NAME Specifies the name of the new array or the name of an existing array, when joining an array.
Default: computer name (for new array installation). 		Optional when installing:
  • A server to a new array (not used when joining an existing array).
  • Combined ISA Server services and Configuration Storage server.
Required when installing a server to an existing array.
CLIENT_CERTIFICATE_FULLPATH Specifies which root certificate to use when connecting to the Configuration Storage server. Optional when installing:
  • A server to a new array.
  • Combined ISA Server services and Configuration Storage server.
  • A server to an existing array.
Required in workgroup scenarios.
COMPANYNAME=Company_Name | Specifies the name of the company installing the product. | Optional for all installation scenarios.
DONOTDELLOGS = {0|1} | If set to 1, log files on the computer are not deleted. The default is 0. | Optional for uninstalling.
DONOTDELCACHE = {0|1} | If set to 1, cache files on the computer are not deleted. The default is 0. | Optional for uninstalling.
ENTERPRISE_DESCR Specifies the enterprise description.
Default: Empty. 		Optional when installing:
  • Configuration Storage server in a new enterprise.
  • Combined ISA Server services and Configuration Storage server in a new enterprise.
ENTERPRISE_MODE Specifies if the Configuration Storage server is a new enterprise or a replica of an existing Configuration Storage server. Possible values: New or Replica.
Default: New. 		Optional when installing:
  • Configuration Storage server in a new enterprise.
  • Combined ISA Server services and Configuration Storage server in a new enterprise.
ENTERPRISE_NAME Specifies the name of the enterprise.
Default: Enterprise. 		Optional when installing:
  • Configuration Storage server in a new enterprise.
  • Combined ISA Server services and Configuration Storage server in a new enterprise.
IMPORT_CONFIG_FILE =Importfile.xml | Specifies a configuration file to import. For more information about importing a configuration file, see Importing and restoring the configuration. | Optional for all installation scenarios.
InstallDir={install_directory} Specifies the installation directory for ISA Server. If not specified, it defaults to the first disk drive with enough space. The syntax is:

Drive:\Folder

The default folder is: %Program Files%\Microsoft ISA Server 		Optional for all installation scenarios.
INTRA_ARRAY_ADDRESS_IP Defines the IP address used for communication by ISA Server computers that are in the same array. The IP address must be an IP address on the ISA Server computer. Optional when installing:
  • A server to a new array.
  • Combined ISA Server services and Configuration Storage server.
  • A server to an existing array.
PIDKEY | Specifies the product key. This is the 25-digit number located on the back of the ISA Server CD-ROM case. | Required for all installation scenarios.
REMOVE={MSFirewall_Management}, {MSFirewall_Services}, {Message_Screener}, {Publish_Share_Directory}, {MSDE}, {Storage_Server} | Specifies a list of components (delimited by commas) that should be removed from the computer. To remove all the components, set REMOVE=ALL. | Optional for all installation scenarios.
SERVER_CERTIFICATE_FULLPATH Specifies which server certificate to use. If you specify a certificate, you must set the ARRAY_AUTHENTICATIONMETHOD entry to Certificate. Optional when installing:
  • Configuration Storage server.
  • Combined ISA Server services and Configuration Storage server.
Required in workgroup or untrusted domains scenarios.
REMOVE={MSFirewall_Management}, {MSFirewall_Services}, {Message_Screener}, {Publish_Share_Directory}, {MSDE}, {Storage_Server} | Specifies a list of components (delimited by commas) that should be removed from the computer. To remove all the components, set REMOVE=ALL. | Optional for all installation scenarios.
SERVER_CERTIFICATE_PASSWORD Specifies the password for the server certificate. You must set SERVER_CERTIFICATE_PASSWORD when an encrypted certificate is specified in SERVER_CERTIFICATE_FULLPATH. Optional when installing:
  • Configuration Storage server.
  • Combined ISA Server services and Configuration Storage server.
Required in workgroup or untrusted domains scenarios.
STORAGESERVICE_ACCOUNT Specifies the user account name to use for the Configuration Storage server.
Default: NT AUTHORITY\NetworkService. 		Optional when installing:
  • Combined ISA Server services and Configuration Storage server.
  • Configuration Storage server (or replica only).
STORAGESERVER_COMPUTERNAME Specifies the fully qualified domain name (FQDN) of the Configuration Storage server to connect. The default value is localhost, in which case the Configuration Storage server installed on this computer is used. Required when installing:
  • A server to a new or existing array.
  • A replica Configuration Storage server (when ENTERPRISE_MODE is set to Replica, regardless of whether you are also installing ISA Server services).
STORAGESERVER_CONNECT_ACCOUNT Specifies the name of the user account that will be used to connect to the STORAGESERVER_COMPUTERNAME. Default value is the user account that is currently logged on. Optional when installing:
  • A server to a new array.
  • Combined ISA Server services and Configuration Storage server (when replicating).
  • A server to an existing array.
STORAGESERVER_CONNECT_PWD Specifies (plaintext) password for the STORAGESERVER_CONNECT_ACCOUNT. Default value is the password for the user who is currently logged on. Optional when installing:
  • A server to a new array.
  • Combined ISA Server services and Configuration Storage server (when replicating).
  • A server to an existing array.
STORAGESERVICE_PWD Specifies the password for STORAGESERVICE_ACCOUNT account.
Default: No password. 		Optional when installing:
  • Combined ISA Server services and Configuration Storage server.
  • Configuration Storage server (or replica only).
SUPPORT_EARLIER_CLIENTS Specifies whether clients running earlier versions of Firewall Client or on an earlier operating system version can connect to this ISA Server array. Possible values: 0 (default) or 1. Optional when installing:
  • A server to a new array.
  • Combined ISA Server services and Configuration Storage server.


Default settings

After installation, Internet Security and Acceleration (ISA) Server 2004 uses the default settings that are listed in the following table.

Feature | Default setting | For more information, see
User permissions | Members of the Administrators group on the local computer can configure firewall policy.
Internal network | For each array, the Internal network contains entries specified during the installation process. | Default Internal network
Network settings At the array level, the following network rules are created:
  • Local Host Access. Defines a routed network relationship between the Local Host network and all networks. This defines a network relationship to other networks, needed by services running on the ISA Server computer.
  • Internet Access. Defines a network address translation (NAT) network relationship from the Internal network, the Quarantined VPN Clients network, and the VPN Clients network, to the External network. Access will be allowed only if you configure the appropriate access policy.
  • VPN Clients to Internal Network. Defines a routed network relationship between the VPN Clients network and the Internal network. Access will be allowed only if you enable virtual private network (VPN) client access.
Network rules
Enterprise policy | The enterprise policy specified during setup is applied. If this is the first array in the enterprise, the default enterprise policy is applied. The default enterprise policy includes a default rule (named Default rule) that denies traffic between all networks. | Enterprise policy
System policy | ISA Server is secure by default, while allowing certain critical services to function. Upon installation, some system policy rules are enabled to allow necessary services. We recommend that you review the system policy configuration, and customize it so that only services that are critical to your specific deployment are enabled. | System Policy
Web chaining | A default rule (named Default rule) specifies that all Web Proxy client requests are retrieved directly from the Internet. | Web chaining rules
Caching | The cache size is set to 0. All caching is therefore disabled. | Cache overview
Alerts | Most alerts are active. We recommend that you review and configure the alerts in accordance with your specific networking needs. | Alerts
Client configuration | When installed or configured, Firewall and Web Proxy clients have automatic discovery enabled. Web browser applications on Firewall clients are configured when the Firewall client is installed. | Automatic discovery overview


Upgrading from ISA Server 2000

Microsoft Internet Security and Acceleration (ISA) Server 2004 supports a full upgrade path for ISA Server 2000 users. Most ISA Server 2000 network settings, monitoring configuration, and cache configuration will be upgraded to ISA Server 2004.

ISA Server 2004 introduces many new features and changes. These changes affect the server configuration and upgrade scenarios. This section provides information about the key items to consider as part of the upgrade process.

  • Upgrade Scenarios
  • What Gets Upgraded
  • New ways to do familiar tasks


Upgrade Scenarios

Before upgrading to Microsoft Internet Security and Acceleration (ISA) Server 2004 Enterprise Edition, carefully review the Upgrade process.

Depending on which ISA Server 2004 component you are installing, you perform different steps to upgrade from ISA Server 2000, as described in this section.

  • Upgrading to a computer running ISA Server services
  • Upgrading to a Configuration Storage server
  • ISA Server 2000 Routing and Remote Access upgrade
  • Upgrading add-ins

web link Get latest ISA Server content at ISA Server Guidance.


Upgrade process

The Microsoft® Internet Security and Acceleration (ISA) Server 2004 Migration Tool provides a full upgrade path for ISA Server 2000 users to ISA Server 2004. Most ISA Server 2000 configuration information will be upgraded to ISA Server 2004. ISA Server 2004 introduces many new features and changes. These changes affect the server configuration and upgrade scenarios. These changes also impact which elements can be upgraded.

Notes

  • ISA Server 2000 Service Pack 1 (SP1) or Service Pack 2 (SP2) must be installed on the computer.
  • You can only upgrade from ISA Server 2000 Enterprise Edition.
  • We recommend that when upgrading from ISA Server 2000 to ISA Server 2004 on a different computer, you install all necessary certificates on that computer before importing the ISA Server 2000 configuration file.
  • You must install the same language version of ISA Server 2004 when upgrading from ISA Server 2000.
  • If ISA Server 2000 is currently installed on a computer running Microsoft Windows® 2000 Server, verify that ISA Server 2000 with SP1 or ISA Server 2000 with SP2 is installed. Then, upgrade the operating system to Microsoft Windows Server™ 2003.

Upgrading from an array of ISA Server 2000 computers

The upgrade process from an array of ISA Server 2000 computers involves these steps:

  1. Create an ISA Server 2004 Configuration Storage server, as described in Upgrading to a Configuration Storage server. The Configuration Storage server should be created on a computer that does not belong to the original ISA Server 2000 array.
  2. After you create the Configuration Storage server, upgrade the ISA Server 2000 array members, as described in Upgrading to a computer running ISA Server services.

If you do not want to dedicate an additional computer to the ISA Server 2004 array, do the following:

  1. On one of the ISA Server 2004 computers, install the Configuration Storage server component, as described in Install Configuration Storage server. Be sure to select Create a replica.
  2. On each ISA Server 2004 array member, connect to the computer on which you installed the Configuration Storage server. For instructions, see Specify a Configuration Storage server for this array.
  3. Uninstall the Configuration Storage server from the computer that did not originally belong to the ISA Server 2000 array. For instructions, see Uninstall server software.

The figure illustrates this process.

Upgrade process

Upgrading from a stand-alone ISA Server 2000 computer

The upgrade process from a stand-alone ISA Server 2000 computer is similar to the upgrade process for an ISA Server 2000 array. As with the array upgrade, you will require an additional computer on which to install the ISA Server 2004 Configuration Storage server component.

Upgrading from ISA Server 2004 Standard Edition

The upgrade process from ISA Server 2004 Standard Edition involves these steps:

  1. Export the ISA Server 2004 Standard Edition configuration. For instructions, see ISA Server 2004 Standard Edition Help.
  2. Install the Configuration Storage server component of ISA Server 2004 Enterprise Edition. For instructions, see Install Configuration Storage server.
  3. Install one array member (either on the Configuration Storage server or on a separate computer).
  4. Import the configuration file that you exported in step 1 to the array you created in step 3.
  5. Install ISA Server array members.

The array must have only one member server when you import the configuration information.


Upgrading to a computer running ISA Server services

The components of Microsoft Internet Security and Acceleration (ISA) Server 2004 can be installed on separate computers. The upgrade from ISA Server 2000 Enterprise Edition to ISA Server 2004 differs, depending on which ISA Server 2004 component is installed.

When you install only the ISA Server services, the upgrade process from ISA Server 2000 is straightforward, in that you perform an in-place upgrade.

After you upgrade, carefully review the migrated rule elements. The upgrade process is automated, and although the migration is accurate, the resulting rule elements may not be optimal. Tweak the rule elements as appropriate.

For instructions, see Upgrade ISA Server 2000 configuration.


Upgrading to a Configuration Storage server

The components of Microsoft Internet Security and Acceleration (ISA) Server 2004 can be installed on separate computers. The upgrade from ISA Server 2000 Enterprise Edition to ISA Server 2004 differs, depending on which ISA Server 2004 component is installed.

When you upgrade from ISA Server 2000 to a Configuration Storage server component of ISA Server 2004, perform the following steps:

  1. Run the ISA Server Migration Wizard on the ISA Server 2000 computer. The wizard creates an .xml file with the configuration information.
  2. Install Microsoft ISA Server 2004 Enterprise Edition, selecting the option to install the Configuration Storage server.
  3. Import the .xml file to the ISA Server 2004 computer. Before you import the .xml file, we recommend that you perform a full backup of the current settings on the ISA Server 2004 computer.

We recommend that when upgrading from ISA Server 2000 to ISA Server 2004 on a different computer, you install all necessary certificates on that computer before importing the ISA Server 2000 configuration file.

After you upgrade, carefully review the migrated rule elements. The upgrade process is automated, and although the migration is accurate, the resulting rule elements may not be optimal. Tweak the rule elements as appropriate.

For instructions, see Upgrade ISA Server 2000 configuration.


ISA Server 2000 Routing and Remote Access upgrade

When you install Microsoft Internet Security and Acceleration (ISA) Server 2004, you can upgrade the Routing and Remote Access configuration. You can upgrade the configuration to ISA Server 2004, regardless of whether ISA Server 2000 is installed on the computer.

When you upgrade, note that the .xml file generated as part of the migration process can be imported only at the array level (and not at the enterprise level).

Note the following limitations to the Routing and Remote Access configuration upgrade:

  • The maximum number of remote virtual private network (VPN) clients allowed to connect to ISA Server 2004 is set to whichever is larger on Routing and Remote Access: the number of PPTP ports or the number of L2TP ports. For more information, see Configure maximum number of simultaneous remote client connections.
  • If the number of IP addresses statically assigned is smaller than the number of VPN clients, the number of VPN clients is reduced to fit the size of the static address pool. A warning is issued to the user during the Routing and Remote Access upgrade process.
  • The static address pool is not migrated.
  • Preshared keys configured for Routing and Remote Access are not exported. A warning message is issued.
  • If an invalid IP address is configured for the primary DNS server, it is not exported. The DHCP settings are used instead, and a warning message is issued. If an invalid IP address is configured for the backup DNS server, it is not exported. A warning message is issued.
  • If an invalid IP address is configured for the primary WINS server, it is not exported. The DHCP settings are used instead, and a warning message is issued. If an invalid IP address is configured for the backup WINS server, it is not exported. A warning message is issued.
  • If a site-to-site connection on Routing and Remote Access is configured as PPTP first (and then L2TP), it is upgraded to a remote site network on ISA Server 2004 that uses PPTP only. A warning message is issued.
  • If a site-to-site connection on Routing and Remote Access is configured as L2TP first (and then PPTP), it is upgraded to a remote site network on ISA Server 2004 that uses L2TP only. A warning message is issued.
  • Preshared keys configured for site-to-site connections in Routing and Remote Access are not exported. A warning message is issued.
  • Credentials configured for site-to-site connections in Routing and Remote Access are not exported. On ISA Server 2004, outgoing VPN connections are disabled until you reconfigure them. A warning message is issued.

The configuration information stored in the .xml file can be imported only to an empty array in ISA Server 2004 Enterprise Edition.

web link Get latest ISA Server content at ISA Server Guidance.


Upgrading add-ins

Application filters and Web filters supplied by third-party vendors for Microsoft Internet Security and Acceleration (ISA) Server 2000 are not compatible with ISA Server 2004. Some third-party vendors have created new versions for ISA Server 2004. To upgrade to the new versions, perform the following steps:

  1. Uninstall the application filters and Web filters from the ISA Server 2000 computer.
  2. Perform the upgrade to ISA Server 2004.
  3. Install the new versions of the upgraded application filters and Web filters.

For more information about how add-ins are upgraded, see ISA Server 2000 add-in configuration upgrade.

Upgrading the Message Screener

The upgrade process from ISA Server 2000 Message Screener is straightforward, in that you perform an in-place upgrade.


What Gets Upgraded

Microsoft Internet Security and Acceleration (ISA) Server 2004 supports a full upgrade path for ISA Server 2000 users. Most ISA Server 2000 network settings, monitoring configuration, and cache configuration will be upgraded to ISA Server 2004.

ISA Server 2004 introduces many new features and changes. These changes affect the server configuration and upgrade scenarios. This section provides information about the key items to consider as part of the upgrade process.

  • ISA Server 2000 administration and monitoring configuration upgrade
  • ISA Server 2000 array and enterprise upgrade
  • ISA Server 2000 access policy configuration upgrade
  • ISA Server 2000 publishing policy configuration upgrade
  • ISA Server 2000 policy elements upgrade
  • ISA Server 2000 network and client configuration upgrade
  • ISA Server 2000 dial-up, chaining, and routing configuration upgrade
  • ISA Server 2000 add-in configuration upgrade
  • ISA Server 2000 cache configuration upgrade
  • ISA Server 2000 Feature Pack 1 and hotfix configuration upgrade
  • What is not upgraded


ISA Server 2000 administration and monitoring configuration upgrade

Some administration and monitoring configuration settings are migrated to Microsoft Internet Security and Acceleration (ISA) Server 2004, as detailed in the following sections.

System access control lists

In ISA Server 2000, you can use ISA Server Management to reconfigure a system access control list (SACL) on certain objects. In addition, the SACL for any element could be changed, using the Admin COM object model.

SACLs are not migrated to ISA Server 2004. Instead, the default SACLs are applied.

Monitoring

All ISA Server 2000 alert definitions are migrated directly to ISA Server 2004, with the following exceptions:

  • Alert definitions that reference Web Proxy are created for the Microsoft Firewall service instead, because there is no Web Proxy service in ISA Server 2004.
  • The following ISA Server 2004 alert definitions are not modified: DNS intrusion, POP intrusion, RPC filter connectivity changed, and SOCKS configuration failure.

No log configuration settings are migrated from ISA Server 2000. ISA Server 2004 log settings are set to the post-installation default settings. After migration, ISA Server 2004 logs are stored as Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) logs or in text format.

Report jobs, reports, and report configuration are not migrated.


ISA Server 2000 array and enterprise upgrade

When you upgrade an Internet Security and Acceleration (ISA) Server 2000 enterprise, most settings are migrated to ISA Server 2004, as detailed in the following sections.

Enterprise policy

When you upgrade an ISA Server 2000 array, the enterprise policy applied to the ISA Server 2000 array is upgraded, but as an empty policy. That is, the enterprise policy does not contain any rules.

Enterprise policy elements

Enterprise policy elements are upgraded to ISA Server 2004 enterprise policy elements, as detailed in ISA Server 2000 policy elements upgrade.

Similarly, ISA Server 2000 array-level policy elements are upgraded to ISA Server 2004 array-level policy elements.


ISA Server 2000 access policy configuration upgrade

Microsoft Internet Security and Acceleration (ISA) Server 2000 access policy rules are not upgraded to ISA Server 2004. Specifically, the following rules are not upgraded as part of the upgrade process:

  • Site and content rules
  • Protocol rules
  • Packet filters

Bandwidth rules

Bandwidth rules (and associated policy elements) are not supported in ISA Server 2004. They are not upgraded.

Packet filtering

If packet filtering is disabled on ISA Server 2000, all traffic to the Local Host and perimeter networks is allowed, in accordance with the configured system policy.


ISA Server 2000 publishing policy configuration upgrade

Microsoft Internet Security and Acceleration (ISA) Server 2000 publishing rules are not upgraded to ISA Server 2004. Specifically, the following rules are not upgraded as part of the upgrade process:

  • Server publishing rules
  • Web publishing rules


ISA Server 2000 policy elements upgrade

Most Microsoft Internet Security and Acceleration (ISA) Server 2000 policy elements are upgraded to ISA Server 2004, as detailed in the following sections. Enterprise-level policy elements on ISA Server 2000 are upgraded to ISA Server 2004 enterprise-level policy elements. Similarly, array-level policy elements on ISA Server 2000 are upgraded to ISA Server 2004 array-level policy elements.

Client address sets

In ISA Server 2000, client address sets include IP addresses and IP address ranges. Client address sets are used in site and content rules, and in protocol rules (and not in publishing rules).

In ISA Server 2004, client address sets are replaced by computer sets. For each ISA Server 2000 rule that applies to a client address set that is upgraded, a new computer set is created on ISA Server 2004. The upgraded rule applies to the new computer set, which includes the same IP addresses as the original client address set on ISA Server 2000.

Content groups

ISA Server 2000 content groups are upgraded directly to ISA Server 2004. If a content group with the same name exists on ISA Server 2004, the content group from ISA Server 2000 is not imported.

Destination sets

ISA Server 2000 destination sets can include computer names, IP addresses, IP address ranges, domain names, and paths on computers. The destination sets are used in site and content rules, and in publishing rules.

ISA Server 2004 does not use destination sets. Instead, other network elements are introduced, which can be used flexibly with access rules and publishing rules.

The following table describes how ISA Server 2000 destination sets are mapped to various ISA Server 2004 network objects.

ISA Server 2000 policy element | ISA Server 2004 network object
Destination set with wildcard characters | Domain name set
Destination set with path | URL set
Destination set with single IP address | URL set
Destination set with single IP address and with path | URL set
Destination set with IP address range | Computer set
Destination set with IP address range and path URL set

Note

  • If the ISA Server destination set includes more than five IP addresses, no URL set is created. A warning is included in the log file. If a rule applies to this destination set, the rule is not upgraded, and a message is included in the log file.

The following table shows examples of how ISA Server 2000 destination sets are upgraded.

Destination set on ISA Server 2000 | Network object on ISA Server 2004
Destination set with mayah.microsoft.com | Domain name set with mayah.microsoft.com
Destination set with eitanh.microsoft.com and with path moo | Domain name set with eitanh.microsoft.com and URL set with http://eitanh.microsoft.com/moo/
Destination set with IP address range 192.168.123.134 (single IP) and path moo | Computer set with range 192.168.123.134 to 192.168.123.134 URL set with http://192.168.123.134/moo/
Destination set with yairh.microsoft.com and path /moo, with IP address 1.2.3.4 and path boo, and with IP address range 1.2.3.4 to 1.2.3.5 and path /home | Computer set with IP address ranges 1.2.3.4 to 1.2.3.4 and IP address ranges 1.2.3.4 to 1.2.3.5. Domain name set with yairh.microsoft.com URL set with http://yairh.microsoft.com/moo, http://1.2.3.4/boo, http://1.2.3.4/home, and http://1.2.3.5/home

Destination sets and rules

The following table describes the ISA Server 2004 rule settings for the destination sets originally used in rules upgraded from ISA Server 2000.

ISA Server 2000 | ISA Server 2004
All destinations | To property is set to Anywhere.
All Internal destinations | To property is set to Internal Network. Destination network is set to Internal.
All External destinations | To property is set to External Network. Destination network is set to External.
Selected destination | To property is set to computer sets, domain names, and URL sets, corresponding to the original destination set.

Protocol definitions

ISA Server 2000 includes two types of protocol definitions:

  • Explicitly defined protocol definitions. Protocol elements created upon installation, by ISA Server, or created subsequently by a user.
  • Implicitly defined protocol definitions. Used by specific application filters or by an IP packet filter.

The Migration Tool creates corresponding protocol definitions in ISA Server 2004 for all explicitly defined protocol elements. If ISA Server 2004 already has a protocol definition with the same name, the ISA Server 2000 protocol definition is not imported.

Implicitly defined protocol definitions, created by third-party application filters, are not upgraded. A warning message indicates this in the migration log file. Implicitly defined protocol definitions, used with IP packet filters, are upgraded.

Protocol definitions that cannot be identified by the Migration Tool are not upgraded. Any rules that apply to unidentified protocol definitions are deleted.

Schedule

ISA Server 2000 schedules upgrade directly to ISA Server 2004. Any ISA Server 2000 rule that does not have a specifically named schedule will reference the schedules created (with the same name) in ISA Server 2004.

A new schedule may be created on ISA Server 2004 when two schedules are used by a site and content rule, and by a protocol rule on ISA Server 2000.

Web listeners

ISA Server 2000 includes incoming listeners and outgoing listeners on a specific IP address. In ISA Server 2004, Web listeners can be assigned an entire network, or to a specific IP address.

The incoming listeners on ISA Server 2000 are upgraded to ISA Server 2004 as Web listeners on the External network.

The default outgoing listeners on ISA Server 2000 are upgraded to ISA Server 2004 as Web listeners on the Internal network. If the default listener is not being used, no listener is upgraded. This is noted in the log file.

Naming conventions

The following table details the naming conventions for the new rule elements.

ISA Server 2000 policy element | ISA Server 2004 rule element
Destination set (creates computer set) | Computer set with Destination_Set_Name
Destination set (creates URL set) | URL set with Destination_Set_Name
Default Web listener | External default Web listener
Merged schedule | ScheduleName1_ScheduleName2


ISA Server 2000 network and client configuration upgrade

Microsoft Internet Security and Acceleration (ISA) Server 2000 network and client configuration settings are upgraded to ISA Server 2004, as detailed in the following sections.

Networks

ISA Server 2000 supports only two networks: Internal and External. A perimeter network (also known as DMZ, demilitarized zone, and screened subnet) could be implied by creating packet filters to route traffic from the External network to the perimeter network.

ISA Server 2004 supports multiple networks. The following networks are created by default on ISA Server 2004:

  • Internal, derived from the ISA Server 2000 local address table (LAT). The Internal network on ISA Server 2004 does not include IP addresses in the VPN static address pool configured on ISA Server 2000. It also does not include the broadcast address.
  • External
  • Local Host
  • VPN Clients

The Migration Tool creates the following network rules on ISA Server 2004:

  • A network rule that defines a route relationship between the Local Host and Internal network.
  • A network rule that defines a route relationship between the VPN Clients, Quarantine, and Internal network.
  • A network rule that defines a network address translation (NAT) relationship between the Internal, VPN Clients, Quarantine, and External network.

Local domain table

The local domain table (LDT) is migrated to ISA Server 2004. If the ISA Server 2000 LDT includes IP addresses, these are not migrated to ISA Server 2004.

Client settings

In ISA Server 2004, client settings are per network. ISA Server 2000 client settings are upgraded directly to the client settings on the ISA Server 2004 Internal network.

As in ISA Server 2000, ISA Server 2004 Firewall Client application settings apply to all client requests. Firewall Client application settings are upgraded directly to ISA Server 2004.

web link Get latest ISA Server content at ISA Server Guidance.


ISA Server 2000 dial-up, chaining, and routing configuration upgrade

Most ISA Server 2000 dial-up, chaining, and routing configuration settings are upgraded to ISA Server 2004, as detailed in the following sections.

Dial-up connections

In ISA Server 2000, multiple dial-up connections could be created, but only one dial-up connection could be active at a time. In ISA Server 2004, only a single dial-up can be created.

In ISA Server 2000, the dial-up connection was defined per Firewall client and per Web Proxy client. In ISA Server 2004, the dial-up connection is defined per network.

As part of the upgrade process, only the active dial-up connection is upgraded. It is assigned to the External network.

All other dial-up connections are not upgraded. This is noted in the upgrade log file.

Firewall chaining

ISA Server 2000 chaining configuration is upgraded directly to ISA Server 2004. The only exception is the dial-up connection specified on ISA Server 2000. On ISA Server 2004, the dial-up connection is created on the External network.

Routing rules

Each ISA Server 2000 routing rule is duplicated on ISA Server 2004, as a cache rule and as a routing rule.

The ISA Server 2004 routing rule is created with identical properties to those of the original ISA Server 2000 routing rule. The destinations specified for the ISA Server 2000 routing rule are mapped to specific networks on the To property page of the ISA Server 2004 routing rule properties.

If the ISA Server 2000 routing rule used a dial-up entry, a dial-up entry with the same properties is created on the External network of ISA Server 2004.

A new caching rule is created based on the original ISA Server 2000 routing rule. The destinations specified for the ISA Server 2000 routing rule are mapped to specific networks on the To property page of the ISA Server 2004 routing rule properties.

The following properties are not supported on ISA Server 2004 caching rules and are therefore not upgraded from the original ISA Server 2000 routing rule: bridging and action.


ISA Server 2000 add-in configuration upgrade

In Microsoft Internet Security and Acceleration (ISA) Server 2000, application filters were applied unconditionally to specific traffic. In ISA Server 2004, some filtering can be applied on a per-rule basis. The following table describes how ISA Server 2000 application filter functionality is upgraded to ISA Server 2004.

Note

  • Be sure to remove any application filters or Web filters supplied by third-party vendors before upgrading. If these application or Web filters are also available for ISA Server 2004, you can reinstall them after you upgrade.
Application filter or rule | ISA Server 2000 | ISA Server 2004
H.323 filter | Allow incoming call | Filter listens on the External network
 | Allow outgoing calls | Filter listens on the Internal network
 | All other configurations | Same as in ISA Server 2000
HTTP redirection | All configurations | Not supported
RPC filter | All configurations | Replaced with per-rule filtering
SMTP filter | SMTP commands | Same as in ISA Server 2000
SOCKS V4 filter | Enabled | Listen for SOCKS requests initiated from the Internal network
Streaming media | MMS filter, PNM filter, and RTSP filter: any configuration | Configuration same as ISA Server 2000 MMS stream splitting not supported

Configuration settings for the following application filters are upgraded directly to ISA Server 2004:

  • DNS intrusion detection filter
  • POP intrusion detection filter

If Message Screener is not installed on the computer being upgraded to ISA Server 2004, any traffic from the Message Screener computer is blocked unless you specifically configure ISA Server 2004, allowing all traffic to and from the Internal network to and from the Local Host network. Similarly, you can add a rule that allows MS Firewall Control traffic from the Message Screener computer to the Local Host computer.

Some application filter properties are configured differently in ISA Server 2004 than in ISA Server 2000. For more information about how to use ISA Server 2004, see New ways to do familiar tasks.

Note that third-party application filters are not upgraded. Similarly, any protocol definitions that are installed with the application filter are not upgraded. Any rules that apply to these protocol definitions are not upgraded.

HTTP redirector filter

ISA Server 2000 HTTP redirector filter settings are not migrated to ISA Server 2004. To configure ISA Server 2004, do the following:

  • If you configured the HTTP redirector in ISA Server 2000 to Send to requested Web server, configure the Web Proxy filter in ISA Server 2004 to not apply to the HTTP protocol. (By default on ISA Server 2004, all requests are directed to the Web Proxy filter.) For more information, see Web Proxy filter.
  • If you configured the HTTP redirector in ISA Server 2000 to Reject HTTP requests from Firewall and SecureNAT clients, in ISA Server 2004, create a new protocol definition that uses port 80. Then, create an access rule that denies use of the protocol.

Link translation

User-defined content types used for link translation are migrated to array-level content types. However, in ISA Server 2004 Enterprise Edition, the link translation filter can be applied only to enterprise-level content types. For the link translation filter to function correctly, you should copy the migrated content types to the enterprise level. For instructions, see Copy array rule elements to enterprise.

web link Get latest ISA Server content at ISA Server Guidance.


ISA Server 2000 cache configuration upgrade

Most ISA Server 2000 cache configuration settings are upgraded to ISA Server 2004, as detailed in the following sections.

Caching

Most ISA Server 2000 cache properties are upgraded directly, with no change, from ISA Server 2000 to ISA Server 2004. Note the following exceptions:

  • General cache properties specifying whether cache objects should be updated are set to the ISA Server 2004 default.
  • General cache properties specifying whether objects exceeding a certain size should be cached are not upgraded.
  • General cache properties specifying whether dynamic content is cached are set in the ISA Server 2004 default cache rule.

The cache drive configuration is retained in ISA Server 2004. If the migration is done to a different computer, the ISA Server 2004 computer should have similar hardware and drive configuration to the original ISA Server 2000 computer.

If ISA Server 2000 was installed in cache mode, the Migration Tool does the following:

  • Configures the Internal network on ISA Server 2004 to include all addresses associated with the single network adapter specified on the ISA Server 2000 computer.
  • Creates an access rule allowing HTTP, HTTPS, and FTP access from the Internal network to the Internal network.

Schedule content download jobs

ISA Server 2000 scheduled content download jobs are upgraded directly to ISA Server 2004.


ISA Server 2000 Feature Pack 1 and hotfix configuration upgrade

Microsoft Internet Security and Acceleration (ISA) Server 2000 Feature Pack 1 introduced several new features, which are included in ISA Server 2004. Most ISA Server 2000 Feature Pack 1 configuration information is migrated directly to ISA Server 2004. Note the following exceptions:

  • Link translation. Directly migrated to ISA Server 2004. Note the following:
    • A new content group is created for content groups to which the ISA Server 2000 link translation filter applied.
    • With ISA Server 2000 Feature Pack 1 link translation, you could configure whether caching of translated responses on external proxy should be prevented. This feature is not supported in ISA Server 2004.
  • SecurID authentication support. Note the following:
    • Web publishing rules that have SecurID enabled are migrated to ISA Server 2004. However, the new rule is disabled.
    • In ISA Server 2000 Feature Pack 1, SecurID authentication was configured per Web publishing rule. In ISA Server 2004, it is configured per Web listener. If ISA Server 2000 has two Web publishing rules with different configurations, the rules are migrated but SecurID authentication configuration is disabled.
    • To complete the migration of SecurID authentication configuration, do the following:
      1. Copy the Sdconf.rec file generated by the access control entry (ACE) server to %SystemRoot%\System32.
      2. Create an access rule allowing communication from the Local Host to the ACE server.
  • URLScan. This filter is renamed HTTP filter in ISA Server 2004. The Urlscan.ini file is saved in %windir%\temp\isa2k_upgrade. None of the settings are migrated to ISA Server 2004.

ISA Server 2000 hotfixes

All registry keys installed as part of ISA Server 2000 hotfixes are migrated directly to ISA Server 2004.


What is not upgraded

The following Internet Security and Acceleration (ISA) Server 2000 objects and configuration settings are not migrated to ISA Server 2004:

  • Bandwidth rules are no longer supported in ISA Server 2004.
  • Permission settings, such as system access control lists (SACLs), are not upgraded. For more information, see ISA Server 2000 administration and monitoring configuration upgrade.
  • Logging and reporting configuration and information are not migrated. For more information, see ISA Server 2000 administration and monitoring configuration upgrade.
  • No rules are migrated. Only the rule elements are upgraded. For more information, see ISA Server 2000 policy elements upgrade.

Note

  • When you upgrade, the H.323 gatekeeper installed with ISA Server 2000 is removed.

When you use the Migration Tool to install ISA Server 2004, the Firewall Client Share (with the Firewall Client for ISA Server 2004 software) is installed. We recommend that you install the Firewall Client Share. For instructions, see Create a shared folder for Firewall Client Installation.


New ways to do familiar tasks

The following table lists common tasks you can perform using ISA Server 2004, and compares these tasks to how they were performed using ISA Server 2000.

If you want to | In ISA Server 2000 | In ISA Server 2004
Publish co-located servers | Create a static packet filter allowing access to the specific server located on the ISA Server computer. | Create a server publishing rule. For more information, see Server publishing rules.
Enable an application on the ISA Server computer to access the Internet | Create a static packet filter allowing access to the specific port on the ISA Server computer. | Verify that the default network rule, which is created upon installation, accurately defines a relationship between the Local Host network and the External network. Then, create an access rule that allows access to the specific protocol. For more information, see Access rules.
Configure the local address table (LAT) | Click Local Address Table on any service's properties. | The Internal network replaces the local address table, and is configured as part of the setup process. You can subsequently reconfigure the Internal network. For more information, see Internal network.
Configure IP-based protocol support | IP-based protocols were supported in a limited fashion. | Create a protocol, specifying any of the following protocol types: TCP, UDP, ICMP, or IP-level. If you select IP-level, you can specify any low-level protocol. For more information, see Protocols.
Configure virtual private networking | Use the VPN wizards to configure client-to-router or router-to-router VPN. | Configure and enable VPN properties and monitor VPN connections. For more information, see Virtual Private Networking.
Configure outgoing Web request properties | On the array properties, click the Outgoing Web requests tab and configure listener properties. | Each network has its own listener, the network adapter that is responsible for listening for requests bound for that network. For information about configuring listeners for outgoing requests, see Configure authentication method for Web Proxy clients (outgoing requests).
Configure incoming Web request properties | On the array properties, click the Incoming Web requests tab and configure listener properties. | Web listeners are used as part of each Web publishing rule. When you configure a Web publishing rule, you specify which Web listener to use for that rule. For information about Web listeners, see Web listener overview.


Installation and Upgrade: How To

This section explains how to install Microsoft Internet Security and Acceleration (ISA) Server 2004 and Microsoft Firewall Client for ISA Server 2004 software.

  • Install ISA Server
  • Uninstall server software
  • Upgrade ISA Server 2000 configuration


Install ISA Server

This section provides step-by-step instructions on how to install Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Install Configuration Storage server
  • Install a computer running ISA Server services
  • Install ISA Server Management
  • Create a shared folder for Firewall Client installation
  • Change ISA Server installation options
  • Run ISA Server unattended setup
  • Check connectivity to the Configuration Storage server


Install Configuration Storage server

To install Configuration Storage server

  1. At a command prompt, type:
    Path\ISAAutorun.exe
    where Path is the path to the Microsoft Internet Security and Acceleration (ISA) Server 2004 installation files. The path may be the root folder of the ISA Server CD or a shared folder on your network that contains the ISA Server files.
  2. On the Welcome screen, click Next.
  3. On the License Agreement screen, click I accept the terms of the license agreement, and then click Next.
  4. On the Customer Information screen, fill in the information, and then click Next.
  5. On the Setup Scenarios screen, select Install Configuration Storage server, and then click Next.
  6. On the Component Selection screen, verify that the Configuration Storage server feature will be installed on the local hard drive. Then, click Next.
  7. Select one of the following options:
    • Create a new ISA Server enterprise. If you select this option, perform the following steps:
      1. On the New Enterprise Warning page, read the message explaining why we recommend that you do not create another enterprise in your organization, and then click Next.
      2. In Name, type a name for the new enterprise, and then click Next.
      3. On the Enterprise Deployment Environment page, choose one or more of the following:
        • I am deploying in a single domain or in domains with trust relationships. Select this option if all the array members and the Configuration Storage servers will be in the same domain or in trusted domains.
        • I am deploying in a workgroup or in domains without trust relationships. Select this option if all the array members and the Configuration Storage servers will be in a workgroup or in untrusted domains.
        Click Next.
    • Create a replica of the enterprise configuration. If you select this option, click Next. Then, in Configuration Storage server, type the fully qualified domain name (FQDN) of another Configuration Storage server in the enterprise.
  8. If the Configuration Storage server is running on an Active Directory domain controller, specify a user account (and not the Network Service account) on the Service Account page.
  9. Click Install.

Notes

  • To perform this procedure, you must be a member of the Administrators group.
  • Users that belong to the Administrators group on the Configuration Storage server essentially have Enterprise Administrator permissions. This is because they can directly modify any data on the Configuration Storage server.
  • Do not connect this computer to the Internet until you complete the installation process.
  • If you select to create a replica of the enterprise configuration, the computer on which you are setting up the Configuration Storage server must first belong to the Replicate Configuration Storage servers computer set. You must be an array administrator or an enterprise administrator to add this computer to that computer set. For instructions, see Modify a computer set.
  • The user account that you specify on the Service Account page must have permissions to log on as a service.
  • If you select to deploy in a workgroup (in step 7), you must specify a server certificate (.pfx file). For instructions on creating a certificate, see Create a server certificate.
  • Certificates typically have an expiration period, usually no more than one year. ISA Server cannot use an expired certificate. Be sure to renew your certificates before they expire, so that ISA Server can continue to function.
  • For more information about installing the Configuration Storage server on a domain controller, see Installing the Configuration Storage server on a domain controller.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Install a computer running ISA Server services

To install a computer running ISA Server services

  1. At a command prompt, type:
    Path\ISAAutorun.exe
    where Path is the path to the Microsoft Internet Security and Acceleration (ISA) Server 2004 installation files. The path may be the root folder of the ISA Server CD or a shared folder on your network that contains the ISA Server files.
  2. On the Welcome screen, click Next. Follow the on-screen instructions.
  3. On the License Agreement screen, click I accept the terms of the license agreement, and then click Next.
  4. On the Customer Information screen, fill in the information, and then click Next.
  5. On the Setup Scenarios screen, select Install ISA Server services, and then click Next.
  6. On the Component Selection screen, verify that the ISA Server feature will be installed on the local hard drive. Optionally select to install any of the following options:
    • Double-click ISA Server, click Advanced Logging, and then click This feature will not be available.
    • Click Firewall Client Installation Share, and then click This feature will not be available.
    • Click Message Screener, and then click This feature will not be available.
    Then, click Next.
  7. In Configuration Storage Server, type the fully qualified domain name (FQDN) of the Configuration Storage server for this array, and then click Next.
  8. Select one of the following options:
    • Create a new array. If you select this option, click Next. Then, on the Create New Array page, type the name of the new array.
    • Join an existing array. If you select this option, click Next. Then, on the Join Existing Array page, select the array to join.
  9. On the Configuration Storage Server Authentication Options page, select one of the following options:
    • Windows authentication. Select this option if this computer and the Configuration Storage server that it uses will be in the same domain or in trusted domains.
    • Authentication over SSL encrypted channel. Select this option if this computer and the Configuration Storage server that it uses will be in a workgroup or in untrusted domains.
    Click Next.
  10. If you selected to join an existing array that has an Internal network configured, skip this step.
    If you created a new array, on the Internal Network page, click Add. Then, add IP addresses to the Internal network for this array by doing one or more of the following:
    • Click Select to add enterprise networks to include in the Internal network for this array. On Networks, select the enterprise networks to include, and then click OK.
    • Click Add Adapter to include IP addresses associated with the network adapter on this computer. Select the applicable network adapter, and then click OK.
    • Click Add to add a specific range of IP addresses. In Start address, type the first address in the range and in End address, type the last address in the range. Click OK.
    Click Next.
  11. If the computer is joining an existing array, skip this step.
    If the computer is joining a new array, in Enterprise Policy, select the enterprise policy to apply to this array, and then click Next.
  12. On the Firewall Client Connection Settings page, select Allow computers running earlier versions of Firewall Client software to connect, if these clients should be allowed. Click Next.
  13. If you are performing a remote installation or if the domain controller is not in the specified Internal network, read the message, and then click Next.
  14. On the Services Warning page, read the message, and then click Next.
  15. Click Install.

Notes

  • To perform this procedure, you must be a member of the Administrators group. To create a new array, you must be an Enterprise Administrator.
  • When the Configuration Storage server specified in step 7 also has ISA Server services installed, the computer on which you are installing ISA Server services must first be added to the Managed ISA Server Computers computer set.
  • If you select to deploy in a workgroup (in step 9), you must specify a certificate. For instructions, see Obtain a root certificate. Install this certificate on the computer on which you are installing ISA Server services.
  • Certificates typically have an expiration period, usually no more than one year. ISA Server cannot use an expired certificate. Be sure to renew your certificates before they expire, so that ISA Server can continue to function.
  • If the computer recently joined a workgroup, verify that it has been assigned its new name before you begin the installation process.
  • If you plan to enable Network Load Balancing (NLB) on the array that this computer is joining, use a dedicated network adapter for intra-array traffic. A different network adapter should be used for NLB.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Install ISA Server Management

To install ISA Server Management

  1. At a command prompt, type:
    Path\ISAAutorun.exe
    where Path is the path to the ISA Server 2004 installation files. The path may be the root folder of the ISA Server CD or a shared folder on your network that contains the ISA Server files.
  2. On the Welcome screen, click Next. Follow the on-screen instructions.
  3. On the License Agreement screen, click I accept the terms of the license agreement, and then click Next.
  4. On the Customer Information screen, fill in the information, and then click Next.
  5. On the Setup Scenarios screen, select Install ISA Server Management, and then click Next.
  6. On the Component Selection screen, verify that the ISA Server Management feature will be installed on the local hard drive. Optionally select to install any of the following options:
    • Click Firewall Client Installation Share, and then click This feature will not be available.
    • Click Message Screener, and then click This feature will not be available.
    Then, click Next.
  7. Click Install.

Note

  • To perform this procedure, you must be a member of the Administrators group.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Create a shared folder for Firewall Client installation

To create a shared folder for Firewall Client installation

  1. At a command prompt, type:
    Path\ISAAutorun.exe
    where Path is the path to the ISA Server 2004 installation files. The path may be the root folder of the ISA Server CD or a shared folder on your network that contains the ISA Server files.
  2. On the Welcome screen, click Next. Follow the on-screen instructions.
  3. On the License Agreement screen, click I accept the terms of the license agreement, and then click Next.
  4. On the Customer Information screen, fill in the information, and then click Next.
  5. On the Component Selection screen, verify that the ISA Server feature will be installed on the local hard drive. Optionally select to install any of the following options:
    • Click Firewall Client Installation Share, and then click This feature will not be available.
    • Click Message Screener, and then click This feature will not be available.
    Then, click Next.
  6. Click Install.

Notes

  • To perform this procedure, you must be a member of the Administrators group.
  • You can install Firewall Client software on client computers that run Microsoft Windows Server 2003, Windows 2000 Server, Windows NT Server 4.0, Windows XP, or Windows Millennium Edition. You can also install Firewall Client software on computers running Windows 98 Second Edition with Microsoft Internet Explorer 5 or later installed.
  • When you install the Firewall Client Share, the system policy rule named Allow access from trusted computers to the Firewall Client installation share on ISA Server, which allows clients on the Internal network to access the share, is enabled. This rule must be enabled to allow clients to install the software from the share.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Change ISA Server installation options

To change ISA Server installation options

  1. On computers running Windows Server 2003, click Start, click Control Panel, and then double-click Add or Remove Programs.
  2. In Microsoft ISA Server 2004, click Change/Remove.
  3. On the Welcome page, click Next.
  4. On the Program Maintenance page, select Modify, and then click Next.
  5. In Click on an icon in the list to view or modify how a feature is installed, choose one or more of the following:
    • ISA Server. If you select this option, all the ISA Server services will be installed.
    • ISA Server Management. If you select this option, the management console used to centrally manage ISA Server will be installed.
    • Firewall Client Installation Share. If you select this option, a folder with all the files necessary to install the Firewall Client software will be created on the ISA Server computer. The folder will be shared to the Everyone group, thereby allowing anyone access to install the software.
    • Message Screener. If you select this option, the Message Screener will be installed. This component must be installed on an SMTP server, which is typically not your ISA Server computer.
    • Configuration Storage server. If you select this option, a Configuration Storage server, with replicated information from the other Configuration Storage servers in the enterprise, will be installed.
    Click Next.
  6. Select one of the following options:
    • Create a new ISA Server enterprise. Then, perform the following steps:
      1. On the New Enterprise Warning page, read the message explaining why we recommend that you do not create another enterprise in your organization and then click Next.
      2. In Name, type a name for the new enterprise and then click Next.
      3. On the Enterprise Deployment Environment page, choose one of the following:
        • I am deploying in a single domain or in domains with trust relationships. Select this option if all the array members and the Configuration Storage servers will be in the same domain or in trusted domains.
        • I am deploying in a workgroup or in domains without trust relationships. Select this option if all the array members and the Configuration Storage servers will be in a workgroup or in untrusted domains.
        Click Next.
    • Create a replica of the enterprise configuration. If you select this option, click Next. Then, in Configuration Storage server, type the fully qualified domain name of another Configuration Storage server in the enterprise.
  7. Click Install to begin the installation.

Notes

  • To perform this procedure, you must be a member of the Administrators group.
  • If you install only ISA Server Management, you can remotely administer another ISA Server computer. ISA Server will not run on the local computer.
  • When you install the Firewall Client Share, the system policy rule named Allow access to firewall client share to trusted computers, which allows clients on the Internal network to access the share, is enabled. This rule must be enabled to allow the clients to install the software from the share.
  • If you remove the Configuration Storage server as part of this process, you must specify a different Configuration Storage server to which this array can connect.
  • For security reasons, we do not recommend installing a Configuration Storage server on the same computer as the computer running ISA Server services. Rather, install the Configuration Storage server on a computer protected by ISA Server. In this way, you help further protect the security-sensitive configuration information.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Run ISA Server unattended setup

To run ISA Server unattended setup

  1. Modify one of the sample answer files. The following sample answer files are provided on the CD, in the FPC folder: UninstallServer.ini, InstallJoinedServer.ini, InstallNewArrayAndServer.ini, InstallNewManagementServer.ini, and InstallStandaloneServer.ini.
  2. At a command prompt, type:

    PathToISASetup\Setup.exe /V" /q[b|n] FULLPATHANSWERFILE=\"PathToINIFile\INI_filename\""

Parameters

PathToISASetup
The path to the ISA Server 2004 installation files. The path may be the root folder of the ISA Server CD-ROM or a shared folder on your network that contains the ISA Server files.
INI_filename
The name of an answer file.
/Q [b|n]
Performs quiet unattended setup. If you specify b, a progress bar indicates the setup process. If you specify n, no dialog boxes are displayed. Error messages are saved to the setup log file.
PathToINIFile
The path to the folder containing the unattended installation information.

Notes

  • To perform this procedure, you must be a member of the Administrators group.
  • For example, CD\FPC\setup.exe /v" /qn FULLPATHANSWERFILE=\"C:\InstallStandaloneServer.ini\"" performs an unattended installation of a computer running ISA Server services and the Configuration Storage server, using the InstallStandaloneServer.ini file located in c:\.
  • To modify which components are installed in unattended mode, type:
     PathToISASetup\Setup.exe ADDLOCAL=NewFeature or REMOVE=FeatureToRemove
  • To repair an installation in unattended mode, type:
    PathToISASetup\Setup.exe REINSTALL=ALL
  • The Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) component, required for many monitoring features, is not properly installed when you remotely install ISA Server, using Terminal Services in application server mode. Use Terminal Services in administration mode to properly install MSDE 2000.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Check connectivity to the Configuration Storage server

To check connectivity to the Configuration Storage server

  1. Run AdamSetup.exe, located in the \FPC\Program Files\Microsoft ISA Server\adam folder of the Microsoft Internet Security and Acceleration Server 2004 CD.
  2. Run the Ldp.exe tool, which was installed to the %windir%\ADAM folder.
  3. On the Connection menu, click Connect.
  4. In Server, type the fully qualified domain name (FQDN) of the Configuration Storage server.
  5. In Port, type 2172.
  6. Select the SSL check box.

Note

  • We recommend that you check connectivity to the Configuration Storage server before you install an array member.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Install in Workgroup Environment

When you install Microsoft Internet Security and Acceleration (ISA) Server 2004 in a workgroup environment, you must create the appropriate certificates, which will be used to authenticate communication between the Configuration Storage server and the array members. This section provides instructions on obtaining and installing certificates.

  • Specify a certificate on a Configuration Storage server
  • Install a certification authority
  • Create a server certificate
  • Export a server certificate
  • Obtain a server certificate
  • Obtain a root certificate

web link Get latest ISA Server content at ISA Server Guidance.


Specify a certificate on a Configuration Storage server

To specify a certificate on a Configuration Storage server

  1. On computers running Windows Server 2003, click Start, click Control Panel, and then double-click Add or Remove Programs.
  2. In Microsoft ISA Server 2004, click Change/Remove.
  3. On the Welcome page, click Next.
  4. On the Program Maintenance page, select Repair.
  5. On the Enterprise Deployment Environment page, choose the I am deploying in a workgroup or in domains without trust relationships. Then, do the following:
    • In Server certificate, type the path and file name of the certificate.
    • In Certificate password, type the password of the certificate file.
    Click Next.
  6. Click Install.

Notes

  • Before removing ISA Server, be sure to close ISA Server Management and ISA Server Performance Monitor.
  • To perform this procedure, you must be a member of the Administrators group.
  • Perform this procedure when the Configuration Storage server or the computer running ISA Server services joins an untrusted domain or a workgroup.
  • If the storage is corrupted, as part of the procedure, you will also have to specify the array membership and Internal network configuration.
  • When you install a certificate, a private key container is created on the Configuration Storage server in the Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys folder. The account running ISASTGCTRL service (by default, the Network Service account) must have appropriate permissions to the private key container.
  • Certificates typically have an expiration period, usually no more than one year. ISA Server cannot use an expired certificate. Be sure to renew your certificates before they expire, so that ISA Server can continue to function.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Install a certification authority

To install a certification authority

  1. Click Start, click Control Panel, click Add or Remove Programs, click Add/Remove Windows components, and then click the Certificate Authority component.
  2. In the wizard, on the CA Type page, select Stand-alone root CA. Leave all other default options and click Next.
  3. Type the name of the CA. Click Next.
  4. On the Certificate Database Settings page, click Next.
  5. Click Finish.
  6. Do the following to enable automatic certificate enrollment:
    1. Click Start, click Programs, click Administrative Tools, and then click Certification Authority.
    2. Click Certification Authority, right-click the certification authority name, click Properties. Then, on the Policy Module tab, click Properties.
    3. Select the option Follow the settings in the certificate template.

Notes

  • This topic describes how to install a certificate using the Microsoft certification authority. However, you can use any certification authority to create a certificate.
  • We recommend that you install IIS before you install the certification authority.
  • If more than one computer running Internet Security and Acceleration (ISA) Server 2004 services will connect to the Configuration Storage server using different network adapters, you should obtain a single certificate that is mapped to multiple DNS names. For more information, see Advanced Certificate Enrollment and Management (http://www.microsoft.com/).
  • If the automatic certificate enrollment is not enabled, the administrator of the certification authority computer must explicitly issue every certificate request.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Create a server certificate

To create a server certificate

  1. On a computer running Windows Server 2003 that has access to the certification authority (CA) computer, use a Web browser to open the following Web page: http://ca_computer_name/certsrv.
  2. Click Request a certificate.
  3. Click Advanced certificate request.
  4. Click Create and submit a request to this CA.
  5. In Name, type the name of the Configuration Storage server, as it is known by the computer running the ISA Server services that connects to it.
  6. In Type of Certificate Needed, select Server Authentication Certificate.
  7. In Key Options, select Mark keys as exportable. These keys must be exportable, as they will be included in the certificate.
  8. Select Store certificate in the local computer certificate store.
  9. Click Submit. You may be prompted that the Web site is requesting a server certificate. Click Yes.
  10. If the certification authority server is not configured to automatically issue a certificate request, the request id number will be displayed. To issue the request:
    1. On the certification authority computer, click Start, click Programs, click Administrative Tools, and then click Certificate Authority.
    2. Click Pending Requests, click Request id, and then click Issue.
    3. On the computer that requested the certificate, access the Web page http://ca_computer_name/certsrv.
    4. Click View the status of a pending certificate request.
    5. Click the applicable certificate request.
  11. Click Install this certificate. When you are prompted that the Web site is requesting a server certificate, click Yes. This action will install the certificate to the local computer certificate store.
  12. To use the certificate, you must first export it to a .pfx file. For instructions, see Export a server certificate.

Notes

  • Before you create a certificate, you must install a certification authority server as described in Install a certification authority.
  • Certificates typically have an expiration period, usually no more than one year. ISA Server cannot use an expired certificate. Be sure to renew your certificates before they expire, so that ISA Server can continue to function.
  • These instructions apply to certification authorities installed on computers running Windows Server 2003.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Export a server certificate

To export a server certificate

  1. Click Start, click Run, type mmc.exe, and then click OK.
  2. On the File menu, click Add/Remove Snap-in, and then click Add.
  3. Click Certificates, and then click Add.
  4. Click Computer account, and then click Next.
  5. Click Local computer, and then click Finish.
  6. Click Close, and then click OK.
  7. Click Console Root, click Certificates, click Personal, and then click Certificates.
  8. Right-click the name of the applicable certificate, point to All Tasks, and then click Export.
  9. Click Next.
  10. On the Export Private Key page, click Yes, export the private key.
  11. On the Export File Format page, click Next.
  12. On the Password page, type a password. You will use this password when you install ISA Server. Click Next.
  13. On the File to Export page, in File name, type a file name to save the certificate. Click Next, and then click Finish.

Notes

  • Before you create a certificate, you must install a certification authority as described in Install a certification authority.
  • Certificates typically have an expiration period, usually no more than one year. ISA Server cannot use an expired certificate. Be sure to renew your certificates before they expire, so that ISA Server can continue to function.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Obtain a server certificate

To obtain a server certificate

  1. On the Configuration Storage server, click Start, click Run, type MMC.exe and then click OK.
  2. On the File menu, click Add/Remove Snap-in.
  3. Click Add.
  4. In Available Standalone Snap-ins, click Certificates, and then click Add.
  5. Select Service account, and then click Next.
  6. Select Local computer, and then click Next.
  7. In Service account, select ISASTGCTRL, and then click Finish.
  8. Click Close, and then click OK.
  9. In the MMC console, double-click Certificates.
  10. Right-click ADAM_ISASTGCTRL, click All Tasks, and then click Import.
  11. In the wizard, specify the server certificate (.pfx file).

Note

  • Certificates typically have an expiration period, usually no more than one year. ISA Server cannot use an expired certificate. Be sure to renew your certificates before they expire, so that ISA Server can continue to function.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Obtain a root certificate

To obtain a root certificate

  1. On a computer running Windows Server 2003 that has access to the certification authority (CA) computer, use a Web browser to open this Web page \\ca_computer_name\certsrv.
  2. Click Download a CA certificate, certificate chain, or CRL.
  3. Click Download CA certificate.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Uninstall server software

To uninstall server software

  1. Click Start, click Control Panel, and then double-click Add or Remove Programs.
  2. In Microsoft ISA Server, click Change/Remove.
  3. Follow the on-screen instructions.

Notes

  • If you downloaded the ISA Server installation files from the Web, or if you copied the contents of the ISA Server CD, run the ISAautorun.exe file at a command prompt to begin the ISA Server installation. Then, click Install ISA Server.
  • Before removing ISA Server, be sure to close ISA Server Management and ISA Server Performance Monitor.
  • If you cannot connect to the Configuration Storage server used by the array member when you uninstall the ISA Server services, any configuration information stored there will not be deleted.
  • The array is deleted when you uninstall the last array member.
  • Uninstall one array member at a time.
  • When you configure ISA Server, some Routing and Remote Access settings may be modified. When you uninstall ISA Server, the Routing and Remote Access configuration is reconfigured as follows:
    • The Routing and Remote Access service is disabled.
    • The remote access policy configured by ISA Server is deleted.
    • Routing and Remote Access is reset to its default settings and disabled. To configure Routing and Remote Access, use the Configure and Enable Routing and Remote Access Wizard, accessible from the Routing and Remote Access snap-in.
  • When you configure Integrated NLB mode, Windows Server 2003 Network Load Balancing (NLB) settings are modified. When you uninstall ISA Server, the NLB configuration is reconfigured as follows:
    • The network adapters are still bound to NLB.
    • ISA Server does not uninstall the NLB network service, even if it was installed by ISA Server.
  • When you uninstall ISA Server, some files are not completely removed from the computer. The following table lists the files that remain and their location.
Folder | File name
%windir% | IsUninst.exe
%windir%\MUI | muisetup.exe
%windir%\System32 | DBmsLPCn.dll, PJLMON.DLL, SET14.tmp, cliconfg.rll, dbmsgnet.dll, dbmsqlgc.dll, dbmsvinn.dll, dbnetlib.dll, ds16gt.dll, mscpxl32.dll, msdart.dll, msorc32r.dll, odbc32.dll, odbc32gt.dll, odbcad32.exe, odbctrac.dll, simpdata.tlb, sqlsrv32.rll, sqlunirl.dll

web link Get latest ISA Server content at ISA Server Guidance.


Upgrade ISA Server 2000 configuration

To upgrade ISA Server 2000 configuration

  1. At a command prompt, type

    Path\ISA2KExport.exe

    where Path is the path to the ISA Server 2004 installation files. The path may be the root folder of the ISA Server CD or a shared folder on your network that contains the ISA Server files.
  2. On the Welcome page of the ISA Server Migration Tool, click Next.
  3. On the Exported File Location page, type a file name and location for the .xml file that will be created to contain the ISA Server 2000 configuration information. Then, click Next.
  4. On the Start Migration Process page, click Create. When the status bar indicates that the migration process completed, click Next.
  5. Click Finish to close the wizard.

Notes

  • To perform this procedure, you must be a member of the Administrators group.
  • You can use ISA Server 2004 import functionality to import the generated .xml file. For instructions, see Import a configuration.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Troubleshooting installation

Issues during installation

I am trying to install the ISA Server services, but cannot connect to the applicable Configuration Storage server.

Cause: The Configuration Storage server may not be accessible.

Solution: Check connectivity. For instructions, see Check connectivity to the Configuration Storage server.

During installation, "The Internal Network must contain at least one of the ISA Server computer's IP" error message appears.

Cause: ISA Server installation uses name resolution to determine the local IP addresses, required for constructing the Internal network. However, a line in the HOSTS file also contains that information.

Solution: Check the HOSTS file, located in the %windir%\system32\drivers\etc\hosts folder. Remove the following line: IP ISA_Server_Name.

Installation did not complete successfully.

Cause: Installation may not complete successfully for various reasons.

Solution: Check the setup logs for possible explanations. Three setup logs are created each time you try to install ISA Server. These files are created in the %windir%\%temp% folder and are named isa*.log.

Post-installation issues

After installation, the Microsoft Firewall service cannot start.

Cause: This error happens when ISA Server cannot resolve the name of the ISA Server computer. The following error message may appear:

Cannot load an application filter Web Proxy Filter ({4CB7513E-220E-4C20-815A-B67BAA295FF4}).
FilterInit failed with code 0x80072afc.
To attempt to activate this application filter again, stop and restart the Firewall service.

Solution: Configure the DNS server so that the name of the ISA Server computer can be resolved.

Workgroup and domain membership issues

The computer running ISA Server services belongs to a workgroup. However, there is no certificate installed on the Configuration Storage server to which it will connect.

Cause: When the computer running ISA Server services belongs to a workgroup or to an untrusted domain, certificate authentication must be enabled on the Configuration Storage server.

Solution: Run Repair, as detailed in Specify a certificate on a Configuration Storage server.
Alternatively, use the ISACertTool, available on the ISA Server Download Center (http://www.microsoft.com/).

I changed the domain or workgroup membership of the computer running ISA Server services, and ISA Server is no longer functional on that computer.

Cause: You cannot change domain membership or join a workgroup after you install ISA Server.

Solution: Repair the ISA Server installation.


Administration and Security

Because Microsoft Internet Security and Acceleration (ISA) Server 2004 can be deployed at the edge of the network, it is critical that the computer on which you run ISA Server is fully secured.

Because of its sensitive role, ISA Server should be carefully administered, with permissions delegated carefully. Regular backups of the configuration should be performed. If you deploy more than one ISA Server computer, consider exporting configurations so that the configuration process is more automated.

This section describes security and administration considerations and provides step-by-step instructions on how to secure and administer ISA Server.

  • Administration and Security: Concepts
  • Administration and Security: How To


Administration and Security: Concepts

This section provides background information about administering and securing Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Security
  • ISA Server console
  • Enterprise Management
  • Administrative Roles
  • Remote administration
  • Exporting and backing up the configuration
  • Importing and restoring the configuration
  • Error reporting and feedback


Security

This section describes security considerations.

  • Security best practices
  • Security best practices for enterprise management
  • Lockdown mode

web link Get latest ISA Server content at ISA Server Guidance.


Security best practices

Because the computer on which Microsoft Internet Security and Acceleration (ISA) Server 2004 is running is often the primary interface to the External network, we recommend that you secure the computer. In addition to the information in this Help file, you should periodically review the Security Best Practices (http://www.microsoft.com/) document that is available on the ISA Server Web site, because it is updated periodically with new information.

Securing the computer

To secure the ISA Server computer, perform the following:

  • Install critical updates for the following:
    • Operating system
    • ISA Server (latest updates available on the ISA Server Web site (http://www.microsoft.com/))
    • Additional components installed by ISA Server, including Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) and OWC
  • We strongly recommend that you run MBSA on computers running ISA Server. When you run MBSA, it will alert you that MSDE 2000 (an optional component installed by ISA Server) uses the local system account. You can safely ignore the message, because ISA Server only allows MSDE 2000 local access. It does not allow access to any other network services.
  • Ensure that the ISA Server computer is stored in a physically secure location. Physical access to a server is a high security risk. Physical access to a server by an intruder could result in unauthorized access or modification, as well as installation of hardware or software designed to circumvent security. To maintain a secure environment, you must restrict physical access to the ISA Server computer.
  • If you suspect that the ISA Server computer was compromised, reinstall ISA Server.
  • If a user unknowingly executes hostile code, and that hostile code has been packaged with additional files including modified versions of system DLLs, the hostile code could load its own versions of those DLLs potentially increasing the type and degree of damage the code can render. Configure MSS: Enable Safe DLL search mode (recommended) to a value of Enabled. For more information about this registry key, see Additional Registry Settings (http://www.microsoft.com/).
  • Do not run unnecessary applications and services on the ISA Server computer.

Securing the network environment

To secure the network environment, perform the following:

  • Protect against Layer 2 attacks by deploying security solutions such as Layer 2 IDS and static MAC or port associations on switches.
  • Where possible, configure Internet Protocol security (IPsec) in the network.
  • To help protect from man-in-the-middle attacks on the Windows Address Resolution Protocol (ARP) cache, we recommend that you place a router before the ISA Server computer. This is because ARP packets are not routable through a router. When ISA Server shares a physical network with an untrusted network, we recommend that you configure ISA Server to perform static ARP. For optimal security, we recommend that you add a static ARP entry for the default gateway and on other hosts on the same physical network.

Securing the configuration

To secure the configuration, perform the following:

  • Apply the principle of least privilege, where a user has the minimum privileges necessary to perform a specific task. This helps ensure that, if a user account is compromised, the impact is minimized by the limited privileges held by that user. Administrators should use an account with restrictive permissions to perform routine, nonadministrative tasks, and use an account with broader permissions only when performing specific administrative tasks. Consider this when you assign ISA Server administrative roles. For more information, see Administrative Roles.
  • Carefully determine who should have permission to log on to the ISA Server computer. Then, configure the logon rights accordingly. For more information, see Windows Help.
  • Apply the principle of reduced attack surface, disabling services and functions not critical to the current task. Disable ISA Server features that you do not use. Configure a system policy suited specifically to your network needs, disabling unnecessary functionality. For more information about system policy, see System policy overview.
  • When requested to present credentials, use strong passwords. A password is considered strong if it provides an effective defense against unauthorized access. A strong password does not contain all or part of the user account name, and contains at least three of the four following categories of characters: uppercase characters, lowercase characters, base 10 digits, and symbols found on the keyboard (such as !, @, or #).
  • When configuring firewall chaining, we recommend that you use IPsec to secure the communication channel between the ISA Server computer and the upstream server.
  • After applying configuration changes, test them. For example, use port scanning to verify that only the applicable ports are actually open.

RADIUS server configuration recommendations

We recommend that you configure the RADIUS server as follows:

  • If you are using a RADIUS server for authentication, create a connectivity verifier that monitors the server status. Configure the alerts so that an appropriate action is taken when the RADIUS server is not functioning. For more information about connectivity verifiers, see Connectivity.
  • Untrusted users should not have access to the network between a RADIUS server and ISA Server. If untrusted users must have access, use IPsec on this network.

Logging and alerting recommendations

We recommend that you configure logging and alerts as follows:

  • Review the logs regularly and carefully, checking for suspicious access and usage of network resources.
  • Configure alerts to send notifications to administrators. Implement a rapid response procedure.
  • Use the log maintenance feature to ensure that the disk on which log information is stored does not become full. For more information about the log maintenance feature, see Log storage format.
  • Configure the Log Storage Limits alert definition to stop the ISA Server services. In this way, you only allow access when the access can be appropriately audited. For more information about alerts, see Alerts.
  • If log information cannot be saved for any reason, lock down the ISA Server computer. To do so, configure an alert definition for the Log Failure event which stops the Microsoft Firewall service. For instructions, see Add an alert definition.
  • When you configure an alert to run an executable file or a script, verify that the executable file or the script are trusted and that you have set appropriate permissions.
  • Save the logs to a separate NTFS disk partition for maximum security. Only Administrators of the ISA Server computer should have access to the logs.
  • When you save log information to an SQL database, use Windows authentication (and not SQL Server authentication).
  • If you are logging the information to a remote database, configure encryption and data signature for the log information being copied to the remote database.
  • Network issues, such as floods or congestion, may cause connectivity failure between the ISA Server computer and the logging server. Such connectivity issues will cause ISA Server to enter lockdown mode. To avoid such issues, do the following:
    • Use a private network between the ISA server computer and the logging server.
    • Protect the logging servers from receiving traffic from untrusted sources.
    • Configure IPsec for the communication between the ISA Server computer and the logging server.

Additional recommendations

Follow the security recommendations for the operating system running on the ISA Server computer. Study and apply the security practices described in the following documentation:

  • For Windows Server 2003, see the Windows Server 2003 Security Guide (http://www.microsoft.com/).
  • For Windows 2000 Server, see the Security Operations Guide for Windows 2000 (http://www.microsoft.com/).
  • For more information about security in an enterprise deployment, see the guidelines detailed in Security best practices for enterprise management.
  • For virtual private network (VPN) deployments, see Security recommendations for a VPN.

Note

  • If you do not require MSDE 2000 logging, uninstall the Advanced Logging feature.


Security best practices for enterprise management

Microsoft Internet Security and Acceleration (ISA) Server 2004 introduces a multi-tiered architecture, in which configuration information is stored on the Configuration Storage server. Array members communicate with the Configuration Storage server to get up-to-date configuration information. In addition, array members communicate with each other. To help secure this deployment model, follow the security best practices listed in this topic. In addition, to help secure computers running ISA Server services, follow the guidelines listed in Security best practices.

Securing the Configuration Storage server

To secure the Configuration Storage server, follow these guidelines:

  • We recommend that you install the Configuration Storage server on a dedicated computer, which is not used for additional tasks.
  • Safeguard the security of the Configuration Storage server. Ensure that the computer is physically secure.
  • After you create administrator roles, avoid performing any tasks on the Configuration Storage server. Changes to the Configuration Storage server should be done using enterprise administrator credentials on an ISA Server array computer, or remote management computer.
  • Users that belong to the Administrators group on the Configuration Storage server essentially have Enterprise Administrator permissions. This is because they can directly modify any data on the Configuration Storage server.
  • We recommend that you do not place the Configuration Storage server at the edge of the network. Rather, place it behind a computer running ISA Server services, which will help protect it from potential attacks.
  • Audit changes to permissions on the Configuration Storage server. For instructions, see Enable auditing of Configuration Storage server permission settings.

Securing intra-array communication

To secure intra-array communication, follow these guidelines:

  • Upon installation, a pair of private and public keys are created for each array member. These keys are used to transfer confidential data between array members. If you believe that the keys have been compromised, create a new key pair by uninstalling and then installing ISA Server.
  • We recommend that you use a dedicated network adapter in a network used only for intra-array communication. This network should include all the array member's intra-array addresses. For more information, see Configuring and securing intra-array communication.

Network Load Balancing

For Network Load Balancing (NLB), follow these guidelines:

  • When you enable NLB, follow the security best practices detailed in Network Load Balancing: Security Best Practices for Windows 2000 and Windows Server 2003 (http://www.microsoft.com/).
  • When you enable NLB, place a router in front of the NLB-enabled array. Configure the router so that it blocks raw IP traffic. Otherwise, all the array members will handle the traffic simultaneously.
  • When NLB is enabled, it synchronizes array members by using pure Ethernet protocol communication. This low-level traffic is not protected by ISA Server. To help secure that traffic, we strongly recommend that you place a Layer-3 router between the Internet and the NLB-enabled array. This Layer-3 router will not allow the low-level Ethernet protocol to pass, thereby helping protect the array from potentially malicious Ethernet traffic from the Internet, intended to disrupt the operation of NLB.

Cache Array Routing Protocol

When you enable Cache Array Routing Protocol (CARP), follow these guidelines:

  • Use a dedicated network for CARP communication. Configure Internet Protocol security (IPsec) for this network.
  • Networks for which CARP is enabled should be accessible only to array members.


Lockdown mode

A critical function of a firewall is to react to an attack. When an attack occurs, it may seem that the first line of defense is to disconnect from the Internet, isolating the compromised network from malicious outsiders. However, this is not the recommended approach. Although the attack must be handled, normal network connectivity must be resumed as quickly as possible, and the source of the attack must be identified.

The lockdown feature introduced with Microsoft Internet Security and Acceleration (ISA) Server 2004 combines the need for isolation with the need to stay connected. Whenever a situation occurs that causes the Microsoft Firewall service to shut down, ISA Server enters the lockdown mode. This occurs when:

  • An event triggers the Firewall service to shut down. When you configure alert definitions, you decide which events will cause the Firewall service to shut down. Essentially, you configure when ISA Server enters lockdown mode.
  • The Firewall service is manually shut down. If you become aware of malicious attacks, you can shut down the Firewall service, while configuring the ISA Server computer and the network to handle the attacks.

Affected functionality

When in lockdown mode, the following functionality applies:

  • The packet filter driver (fweng) applies the firewall policy.
  • The following system policy rules are still applicable:
    • Allow ICMP from trusted servers to the local host.
    • Allow remote management of the firewall using MMC (RPC through port 3847).
    • Allow remote management of the firewall using RDP.
  • Outgoing traffic from the Local Host network to all networks is allowed. If an outgoing connection is established, that connection can be used to respond to incoming traffic. For example, a DNS query can receive a DNS response, on the same connection.
  • No incoming traffic is allowed, unless a system policy rule (listed previously) that specifically allows the traffic is enabled. The one exception is DHCP traffic, which is allowed by default system policy rules. The UDP Send protocol on port 68 is allowed from all networks to the Local Host network. The corresponding UDP Receive protocol on port 67 is allowed.
  • VPN remote access clients cannot access ISA Server. Similarly, access is denied to remote site networks in site-to-site VPN scenarios.
  • Any changes to the network configuration while in lockdown mode are applied only after the Firewall service restarts and ISA Server exits lockdown mode. For example, if you physically move a network segment and reconfigure ISA Server to match the physical changes, the new topology is in effect only after ISA Server exits lockdown mode.
  • ISA Server does not trigger any alerts.

If the Configuration Storage server is installed on the computer running ISA Server services, a system policy rule, named Allow access from trusted servers to the local Configuration Storage server, is enabled. This system policy rule allows the use of Microsoft CIFS (TCP), Microsoft CIFS (UDP), and MS Firewall Storage protocols from all array members to the Local Host. This rule is applied even in lockdown mode. Traffic using those protocols is allowed, even in lockdown mode.

Leaving lockdown mode

When the Firewall service restarts, ISA Server exits lockdown mode and continues functioning, as previously. Any changes made to the ISA Server configuration are applied after ISA Server exits lockdown mode.


ISA Server Management console

ISA Server Management features three panes: the scope pane, the details pane, and the task pane.

ISA Server Management includes accessibility features that make it more accessible for people with disabilities. For more information, see Accessibility for ISA Server Management.

Note

  • To best view ISA Server Management, we recommend that you set your screen resolution to 800x600 or higher.

Scope pane, details pane, and task pane

The figure illustrates the ISA Server Management console.

ISA Server console

The scope pane displays the console tree (labeled 1 in the figure). The console tree shows the nodes that are available in the console. The middle pane contains the details pane (labeled 2 in the figure). The details pane shows information about, and functions pertaining to, the selected console tree item. As you click different items in the console tree, the information in the details pane changes. The details pane can display many types of information including Web pages, graphics, charts, tables, and columns.

The right pane contains the task pane (labeled 3 in the figure). The task pane can include a Tasks tab and a Help tab. On the Enterprise Policies and Firewall Policy nodes, the task pane also includes the Toolbox tab. On the Networks node, the task pane also includes the Templates tab.

You can close the task pane. In the split bar (labeled 4 in the figure), click the Open/Close Task Pane button (it looks like a tall rectangle with a right-pointing arrow). To reopen the task pane, click the Open/Close Task Pane button again (it looks like a tall rectangle with a left-pointing arrow). Note that closing the task pane allows you to see more of the details pane content, however, some tasks are available only from the task pane. Furthermore, with the task pane closed, the Help tab that provides information about how to perform most tasks using the task pane links is unavailable.

Each console tree node has its own menus and toolbar, separate from those of the main window, that help you perform tasks.

Apply Changes bar

After you create or configure objects, an Apply Changes bar appears above the details pane. You have an opportunity to review the changes, and then apply or discard those changes. To apply the changes, click the Apply button on the Apply Changes bar. To discard the changes, click the Discard button on the Apply Changes bar.

Toolbox

The Toolbox tab is available only on the Enterprise Policies and Firewall Policy nodes. It includes a list of rule elements, which can be used in the firewall policy rules: protocol definitions, users, content types, schedules, and network objects.

Drag-and-drop editing

In the Enterprise Policies and Firewall Policy details pane, you can edit rules by opening the property sheets for the specific rule. Alternatively, you can drag applicable rule elements from the Toolbox into a rule listed in the details pane, thereby modifying the rule.


Enterprise Management

By grouping Microsoft Internet Security and Acceleration (ISA) Server 2004 computers into arrays, you can centrally manage network policy for the entire enterprise. You can select a centralized enterprise policy that applies to all arrays in the enterprise or a more flexible policy where each array administrator can define a local policy. The centralized administration can mean greater security. All the administrative tasks can be performed from one computer and the configuration is applied to all, ensuring that all the servers have the same access policies configured. This is particularly useful in large organizations, where arrays can include many ISA Server computers.

This section describes enterprise management.

  • Enterprise
  • Enterprise policies
  • Arrays and array members
  • Creating arrays
  • Array communication
  • Configuring and securing intra-array communication


Enterprise

The Internet Security and Acceleration (ISA) Server enterprise includes all the arrays in your organization. When you set up the enterprise, you specify the enterprise policy management. You can select a centralized enterprise policy that applies to all arrays in the enterprise or a more flexible policy where each array administrator can define a local policy.

Each enterprise is associated with one or more Configuration Storage servers. Each Configuration Storage server contains identical configuration information, which is periodically replicated. The array members in each array obtain configuration information from a specified Configuration Storage server in the enterprise.

When you install a Configuration Storage server in the enterprise, you can select to create a new enterprise. Each enterprise (each set of replication Configuration Storage servers) can manage only its member arrays. Only arrays that belong to a specific enterprise can be managed by the administrators of that enterprise.

Enterprise networks

Before deploying arrays and array members in the enterprise, the enterprise administrator configures enterprise networks. An enterprise network is a network defined on the enterprise level that is global to all the arrays in the enterprise. An enterprise network is composed of IP ranges, and does not have any of the other properties that you would define for array networks.

An IP address can be included in only one enterprise network. IP addresses that are defined at the enterprise level, which are included in some enterprise network, are considered the address range for the enterprise. Typically, after you create an enterprise network, the network will be included in one or more array-level networks.

For more information, see Enterprise networks.

Enterprise policy

As enterprise administrator, you can create one or more enterprise policies, which include access rules, rule elements, and add-ins. When an array is created, an enterprise policy can be applied to the array, thereby enhancing the firewall policy created at the array level.

For more information, see Enterprise policy.


Enterprise policies

The enterprise policy of Internet Security and Acceleration (ISA) Server enhances centralized management introduced by arrays, allowing you to implement and apply policy to the arrays in your corporate network. The enterprise policy includes access rules. The enterprise policy can be applied to any array, and can be augmented by the array's own policy. This enables administrators at branch and departmental levels to adopt governing enterprise policies, while allowing them to further restrict access, if necessary.

An enterprise policy is a policy defined on the enterprise level that can be applied to arrays. The policy contains an ordered set of policy rules. An enterprise policy also contains a placeholder for where the array policy should appear within that enterprise policy's rules. For more information, see Enterprise policy.

You can create one or more enterprise policies and a single set of enterprise-level rule elements. The enterprise-level rule elements can be used when configuring rules for any enterprise policy and when creating array-level rules.

The enterprise administrator can define several enterprise policies, such as an enterprise policy that blocks known vulnerabilities, an enterprise policy that allows baseline traffic (such as HTTP), and an enterprise policy for the VPN servers. Then the administrator can assign the enterprise policies to the relevant arrays.

Each rule in the policy can be defined so that it applies either before or after the array policy. This is important because policy rules are ordered. The first allow rule to match a request received by ISA Server will be used, and subsequent rules will not be checked.

For instructions about creating enterprise policies, see Create an enterprise policy.


Arrays and array members

An array is a group of Microsoft Internet Security and Acceleration (ISA) Server 2004 computers. An array includes:

  • One or more Configuration Storage servers that store ISA Server information, such as the arrays and servers that are part of the enterprise, and for each array and server, its current configuration.
  • One or more array members, which are computers with ISA Server services installed.
  • One or more remote management computers, with ISA Server Management installed.

Array members share the same configuration, easing management and administration. When you modify the array configuration, all the ISA Server computers in the array are also modified, including all the access policies and cache policies.

The configuration information for the array is stored on the Configuration Storage server. All array members use the same Configuration Storage server. For instructions on specifying the Configuration Storage server for an array, see Specify a Configuration Storage server for this array.

Centralized administration can also mean greater security. All administrative tasks can be performed from one computer, and the configuration is applied to all, ensuring that all the servers have the same access policies configured. This is particularly useful in large organizations, where arrays can include many ISA Server computers.

You can create access and publishing rules at the array level. Together, these rules compose an array policy. The array policy determines how the ISA Server clients communicate and what communication is permitted. As the name implies, the array policy applies only to the ISA Server computers in the array.

Same computer configuration

All array members must have identical configurations. This means that all array members should have the same:

  • Number of network adapters, connected to array-level networks with the same names.
  • Mirrored accounts with Basic Monitoring permissions (for workgroup deployments).
  • Application and Web filter configuration.
  • Certificates installed.

Changing array member's IP address

Array members communicate with each other, using an Internet Protocol (IP) address that is configured when you install ISA Server. You can configure this intra-array address after installation. This intra-array address is used in various system policy rules, allowing communication between the array members. The IP address of the array member might be used for communication between other ISA Server components, including for communication with the Configuration Storage server, and for remote management. For more information about intra-array communication, see Array communication.

If you change the IP address of the array member, be sure to check the following:

  • If the IP address that you changed was used for intra-array communication, reconfigure the intra-array address. For instructions, see Configure intra-array address.
  • If the IP address that you changed was used by remote management computers to connect to this computer, update the IP address used for remote communication. For instructions, see Configure computer name to use for remote management.
  • Verify that the IP address is in the Managed ISA Server Computers computer set. For instructions, see Modify a computer set.


Creating arrays

You can create an array when you install Microsoft Internet Security and Acceleration (ISA) Server 2004 services. In this case, as part of the installation process, you specify the following:

  • How the array authenticates to the Configuration Storage server.
  • Internal network.
  • Enterprise policy to apply.
  • Firewall Client connection settings.
  • Array name and description.

After installation, you can modify these settings.

Alternatively, you can use ISA Server Management to create an empty array. For instructions, see Create an array.

As enterprise administrator, you may want to create an empty array. Then, array administrators will join that already configured array. When you create an empty array, you may want to configure the following properties:

  • Configuration Storage server information. For instructions, see Specify a Configuration Storage server for this array.
  • Firewall Client connection settings. For instructions, see Allow connections from clients running previous versions of Firewall Client.
  • Enterprise policy. For instructions, see Apply an enterprise policy.

Moving servers

After you install ISA Server services on a computer, you can move the server to another array by uninstalling, and then reinstalling ISA Server services.

Note that you can do the following:

  • If the array is no longer accessible (it has been deleted, or you do not have permission to access it), you can reinstall ISA Server, selecting to repair the installation.
  • Similarly, if the server is not accessible, you can reinstall ISA Server, selecting to repair the installation.
  • You can move the server to a new enterprise, and then specify a new array by reinstalling ISA Server and selecting to repair the installation.

web link Get latest ISA Server content at ISA Server Guidance.


Array communication

The servers that comprise a Microsoft Internet Security and Acceleration (ISA) Server 2004 array communicate with each other on secure, sealed channels. This includes intra-array communication, as well as communication from each array member to the Configuration Storage server.

Computers running ISA Server services are listed in the Servers node of ISA Server Management for each array. These are referred to as the array members. Array members communicate with the Configuration Storage server, using the MS Firewall Storage protocol. Computers running ISA Server Management also use the MS Firewall Storage protocol to read from and write to the Configuration Storage server.

All monitoring communication is done using remote procedure calls (RPC). ISA Server Management computers use RPC to query real-time and local information from the computers running ISA Server services.

All communication channels between firewalls, management consoles, and configuration servers are sealed.

Intra-array address

Communication between array members is passed using the intra-array address, which is initially set to the default IP address of the array member's network adapter on the Internal network. As array administrator, you can modify the intra-array address. For more information, see Configuring and securing intra-array communication.

Array communication in workgroup scenarios

In a workgroup scenario, computers running ISA Server services access the configuration storage (on the Configuration Storage server) using the LDAP over SSL (LDAPS) protocol. The Configuration Storage server, which runs an instance of Active Directory Application Mode (ADAM) supports the LDAPS protocol. To enable this communication, you must install a certificate (from a certification authority), which is trusted by the computers running ISA Server services. Then, install server certificates on the Configuration Storage servers.

ISA Server Management computers authenticate to the Configuration Storage server and to the computers running ISA Server services using domain accounts or local mirrored accounts. Local mirrored accounts must be created on each array member.

In a workgroup environment, computers running ISA Server services use ADAM accounts to authenticate to the Configuration Storage server. The LDAPS channel seals the authentication sequence. An ADAM account is generated for each array member during setup, while the server object is created in the central storage, on the Configuration Storage server.

System policy rules

ISA Server includes the following predefined system policy rules, which enable communication between the array members, Configuration Storage servers, and management consoles.

Scenario group | Configuration group | Rule name | Rule description
Configuration Storage server | Remote Configuration Storage Server Access | Allow remote access to Configuration Storage server | Allows access from Local Host to the Enterprise Configuration Storage Server computer set, using the MS Firewall Storage protocol.
Configuration Storage server | Local Configuration Storage Server Access | Allow access from trusted servers to the local Configuration Storage server | Allows access to Local Host from the Array Servers, Enterprise Remote Management Computers, Managed ISA Server Computers, Remote Management Computers, and Replicate Configuration Storage Servers computer sets, using CIFS (TCP and UDP) and MS Firewall Storage protocols.
Configuration Storage server | Replicate Configuration Storage Server Access | Allow replication between Configuration Storage servers | Allows communication to and from the Replicate Configuration Storage Servers computer set, using MS Firewall Control and RPC protocols.
Intra-array communication | Array Member Communication | Allow intra-array communication | Allows intra-array communication using MS Firewall Control and RPC protocols to and from the Array Servers computer set.
Remote management | Microsoft Management Console (MMC) | Allow remote management from selected computers using MMC | Allows communication from the Array Servers, Enterprise Remote Management Computers, and Remote Management Computers computer sets to Local Host, using the MS Firewall Control, NetBIOS Datagram, NetBIOS Name Service, NetBIOS Session, and RPC (all interfaces) protocols.
Remote management | Terminal Server | Allow remote management from selected computers using Terminal Server | Allows communication from the Enterprise Remote Management Computers and Remote Management Computers computer sets to Local Host, using the RDP (Terminal Services) protocol.
Remote management | ICMP | Allow ICMP (PING) requests from selected computers to ISA Server | Allows communication from the Enterprise Remote Management Computers and Remote Management Computers computer sets to Local Host, using the ICMP protocol.

Computer sets and domain name sets

The following computer sets should be modified, as necessary, depending on the array configuration:

  • Enterprise Remote Management Computers. This computer set includes any computer which manages the enterprise configuration and all the arrays in the enterprise.
  • Remote Management Computers. For each array, this computer set includes computers that can manage the array remotely.
  • Array Servers. For each array, this computer set includes the IP addresses of array members. Computers are added during installation. If you subsequently change the address of an array member, be sure to update this computer set accordingly.
  • Replicate Configuration Storage Servers. This computer set includes all Configuration Storage servers in the enterprise.
  • Managed ISA Server Computers. For each array, this computer set includes IP addresses of array members allowed to access the Configuration Storage server.

In addition, the Enterprise Configuration Storage Server domain name set is automatically configured to include the name of the Configuration Storage server for the array. If you specify an alternate Configuration Storage server, it is also included in this domain name set.

Protocols

The following proprietary protocols are defined to allow intra-array communication:

  • MS Firewall Storage. This protocol is an outbound TCP protocol on ports 2171 and 2172. It is an LDAP-based and LDAPS-based protocol.
  • MS Firewall Storage Replication. This protocol is an outbound TCP protocol on port 2173, used for configuration replication between Configuration Storage servers.
  • MS Firewall Control. This protocol is an outbound TCP protocol, used for communication between ISA Server Management and computers running ISA Server services.


Configuring and securing intra-array communication

As part of the installation process, an intra-array address is assigned to the array member. This address is set by default to an IP address on the Internal network. However, in a multi-server array, a dedicated network adapter is required on each array member for intra-array communication in Network Load Balancing (NLB) deployments. Furthermore, a dedicated network adapter provides enhanced security in other deployment scenarios, by isolating the network from malicious traffic.

The dedicated network adapter should use a dedicated hub or a virtual LAN (VLAN), to help further secure the intra-array communication.

After you install a dedicated network adapter, perform the following steps:

  1. Specify the IP address of this network adapter to be used for intra-array communication. For instructions, see Configure intra-array address.
  2. Create a dedicated array-level network, which should include each array member’s intra-array address. For instructions, see Create an array-level network. When you create the network, specify its type as Internal.
  3. After you create the network, configure the following:
    • Enable Web Proxy clients. For instructions, see Listen for Web Proxy client requests.
    • Do not listen for requests from Firewall clients. For instructions, see Listen for Firewall Client requests.

The Array Servers computer set is automatically updated to include all the intra-array addresses. System policy rules allow communication between members of the Array Servers computer set and the Local Host. For more information, see Array communication.

When you apply a network template, all user-defined networks, including the intra-array network you create, is overwritten. For this reason, we suggest that you export the intra-array network. For instructions, see Export a configuration. After you apply a network template, import the intra-array network. For instructions, see Import a configuration.

web link Get latest ISA Server content at ISA Server Guidance.


Administrative Roles

You can use role-based administration to organize your Microsoft Internet Security and Acceleration (ISA) Server 2004 enterprise administrators into separate, predefined roles, each with its own set of tasks. When you assign a role to a user, you allow that user permissions to perform specific tasks. Role-based administration involves Windows users and groups. These security permissions, group memberships, and user rights are used to distinguish which users have which roles.

Users with administrator permissions on the ISA Server computer do not automatically have ISA Server array-level or enterprise-level permissions. Rather, you must specifically assign these users the appropriate roles. Note, however, that users that belong to the Administrators group on the Configuration Storage server can essentially control the enterprise configuration. This is because they can directly modify any data on the Configuration Storage server.

This section describes administrative roles.

  • Array-level administrative roles
  • Enterprise-level administrative roles
  • Enterprise policy administrative roles
  • Roles for domain and workgroup


Array-level administrative roles

As with enterprise-level role-based administration, you can organize your array-level administrators into separate, predefined roles, each with its own set of tasks. The following table describes the Microsoft Internet Security and Acceleration (ISA) Server 2004 array-level roles.

Role | Description
ISA Server Array Monitoring Auditor | Users and groups assigned this role can monitor the ISA Server computer and network activity, but cannot configure specific monitoring functionality.
ISA Server Array Auditor | Users and groups assigned this role can perform all monitoring tasks, including log configuration, alert definition configuration, and all monitoring functions available to the ISA Server Basic Monitoring role.
ISA Server Administrator | Users and groups assigned this role can perform any ISA Server task, including rule configuration, applying of network templates, and monitoring.

Notes

  • Administrators with ISA Server Array Monitoring Auditor permissions can export and import secret configuration information, which means they can decrypt secret information.
  • Administrators with ISA Server Array Monitoring Auditor permissions can configure all report properties with the following exceptions:
    • Cannot configure a different user account when publishing reports
    • Cannot customize report contents
  • A user assigned the ISA Server Administrator role can run highly privileged processes on the ISA Server computer.

Roles and activities

Each ISA Server role has a specific list of ISA Server tasks associated with it. The following table lists some ISA Server administration tasks along with the roles in which they are performed.

Activity | ISA Server Array Monitoring Auditor | ISA Server Array Auditor | ISA Server Administrator
View Dashboard, alerts, connectivity, sessions, and services | X | X | X
Acknowledge and reset alerts | X | X | X
View log information |  | X | X
Create alert definitions |  |  | X
Create reports |  | X | X
Stop and start sessions and services |  | X | X
View firewall policy |  | X | X
Configure firewall policy |  |  | X
Configure cache |  |  | X
Configure VPN |  |  | X

Removing administrator permissions

To remove administrator permissions, remove the user from the specific administrator group.

To remove ISA Server administrators, who are logged on, from a security group and add them into a new group, perform the following steps:

  1. Add the administrator account into the new group.
  2. Log off and on with the administrator account, so that the new settings take effect.
  3. Remove the administrator account from the original group.


Enterprise-level administrative roles

You can use role-based administration to organize your Microsoft Internet Security and Acceleration (ISA) Server 2004 enterprise administrators into separate, predefined roles, each with its own set of tasks. When you assign a role to a user, you allow that user permissions to perform specific tasks. Role-based administration involves Windows users and groups. These security permissions, group memberships, and user rights are used to distinguish which users have which roles.

ISA Server distinguishes between enterprise-level roles and array-level roles. For more information about array-level administrative roles, see Array-level administrative roles. The following table describes the ISA Server roles for enterprise administration.

Role | Description
ISA Server Enterprise Administrator | Users and groups assigned this role have full control over the enterprise and all array configurations. The Enterprise Administrator can also assign roles to other users and groups.
ISA Server Enterprise Auditor | Users and groups assigned this role can view the enterprise configuration and all array configurations.

Note

  • A user assigned the ISA Server Enterprise Administrator role can run highly privileged processes on the ISA Server computers in the enterprise.

Roles and activities

Each ISA Server role has a specific list of ISA Server tasks associated with it. The following table lists some ISA Server administrative tasks along with the roles in which they are performed.

Activity | ISA Server Enterprise Administrator | ISA Server Enterprise Auditor
View enterprise policies | X | X
Create enterprise policies | X |
Apply enterprise policies to an array | X |
View array-level firewall policy | X | X
View array configuration | X | X
Modify array configuration | X |
Create an array | X |

For instructions about assigning roles, see Assign administrative roles for enterprise administrators.

Removing administrator permissions

To remove administrator permissions, remove the user from the specific administrator group.

To remove logged-on ISA Server administrators from a security group, and add them into a new group, perform the following steps:

  1. Add the administrator account into the new group.
  2. Log off and on with the administrator account, so that the new settings take effect.
  3. Remove the administrator account from the original group.


Enterprise policy administrative roles

You can use role-based administration to organize your Microsoft Internet Security and Acceleration (ISA) Server 2004 enterprise administrators into separate, predefined roles, each with its own set of tasks. When you assign a role to a user, you allow that user permissions to perform specific tasks. Role-based administration involves Windows users and groups. These security permissions, group memberships, and user rights are used to distinguish which users have which roles.

As an enterprise administrator, you can assign administrators permissions for specific enterprise policies. In this way, you can limit enterprise-level administration to a specific policy, without allowing these administrators broad enterprise permissions. The ISA Server Enterprise Policy Editor role allows the specified user or group to modify that enterprise policy.

Roles and activities

Each ISA Server role has a specific list of ISA Server tasks associated with it. The following table lists some ISA Server administrative tasks and indicates which tasks the Enterprise Policy Editor is allowed to perform.

Activity | ISA Server Enterprise Policy Editor
Create enterprise policies | No
View the enterprise policy | Yes (only the specific enterprise policy for which the role is assigned, and only on the Configuration Storage server or remote management computer)
Create enterprise policy rules | Yes (only for the specific enterprise policy for which the role is assigned)
Create enterprise-level rule elements | No
Apply enterprise policies to an array | No
View array-level configuration | No
Modify array configuration | No
Create an array | No

For instructions about assigning roles, see Assign administrative roles for enterprise administrators.

Removing administrator permissions

To remove administrator permissions, remove the user from the specific administrator group.

To remove logged-on ISA Server administrators from a security group, and add them into a new group, perform the following steps:

  1. Add the administrator account into the new group.
  2. Log off, and then log on with the administrator account, so that the new settings take effect.
  3. Remove the administrator account from the original group.


Roles for domain and workgroup

Depending on the specific topology of your network, different permissions should be configured for the roles accessing the Configuration Storage server.

For instructions, see Assign administrative roles for array administrators and Assign administrative roles for enterprise administrators.

Computer running ISA Server services belongs to a workgroup

If the computer running the Microsoft Internet Security and Acceleration (ISA) Server 2004 services belongs to a workgroup, but the Configuration Storage server belongs to a domain, user accounts configured on the domain should be used to access the Configuration Storage server.

Create mirrored accounts on each array member, for intra-array communication and administration. That is, create accounts with the same settings as the user account specified on this array member.

For example, suppose that the Configuration Storage server belongs to the microsoft.com domain. Two computers running ISA Server services each belong to a workgroup. The enterprise administrator, with a user name Amaya, will administer this enterprise. Amaya must belong to the Enterprise Administrators group. For this example, the following actions are required:

  • Create mirrored accounts for Amaya on both computers running ISA Server services. (The accounts must have identical credentials.)
  • Add Amaya's domain user name to the users allowed to access the Configuration Storage server.
  • Add the user name (specified in the mirrored account) to the list of mirrored accounts used for monitoring this array.

When Amaya connects to the enterprise, she does the following:

  1. Specifies the logged-on user's credentials when specifying how to connect to the Configuration Storage server.
  2. Specifies different credentials when specifying how to connect to each array member.
  3. Specifies Amaya as the user name for array member credentials.

Computer running ISA Server services belongs to a domain

If the computer running the ISA Server services belongs to a domain, but the Configuration Storage server belongs to a workgroup, create an administrative account on the Configuration Storage server.

Note that in this scenario, only one Configuration Storage server can be used for the enterprise. Create domain accounts for intra-array communication and administration.

Computer running ISA Server services and Configuration Storage server belong to a workgroup

If both the computer running the ISA Server services and the Configuration Storage server belong to the same workgroup, create a single administrative account.

Note that in this scenario, only one Configuration Storage server can be used for the enterprise. You do not have to create domain accounts for intra-array communication and administration.

Create mirrored accounts on each array member for intra-array communication and administration. You may want to create mirrored accounts for each administrator. Alternatively, create mirrored accounts for each role.

web link Get latest ISA Server content at ISA Server Guidance.


Remote administration

Microsoft Internet Security and Acceleration (ISA) Server 2004 enables you to administer ISA Server computers from other computers. You can perform all ISA Server administrative tasks remotely, either from a computer running Remote Desktop Connection or from a Microsoft Management Console (MMC) installed on the remote computer.

Remote administration policy

Remote administration is enabled by default when you install ISA Server services, although it is only enabled for computers that are listed in a remote management computers computer set, on the array or enterprise level. The computer sets, which are empty by default, are:

  • Enterprise Remote Management Computers (enterprise level)
  • Remote Management Computers (array level)

If you add a computer to the Enterprise Remote Management Computers computer set, a user (with appropriate permissions) on that computer can manage and monitor any ISA Server array in the enterprise.

If you add a computer to the Remote Management Computers computer set, you can manage any ISA Server array from that computer (assuming appropriate permissions), but you can only monitor the array that owns that computer set. If you want to connect to a Configuration Storage server that is part of an array (where ISA Server services and the Configuration Storage server are installed on the same computer), you will only be able to do so for the array that owns the computer set.

Remote administration with Remote Desktop Connection

Terminal Server and ISA Server Management can be used to administer ISA Server computers. Using Terminal Server, you can view the desktop of any computer on which the ISA Server Management console is installed. You can then administer ISA Server, depending on the permissions that you have.

Note

  • When managing ISA Server from a virtual private network (VPN) client, we recommend that you use Terminal Server rather than ISA Server Management. Some administrative actions in ISA Server require you to restart services. When you do so, Routing and Remote Access is among the services that are stopped, thereby ending your remote ISA Server Management connection before the services can be started again. This is not an issue in Terminal Server remote management.

Remote administration with ISA Server Management

ISA Server Management is part of the installation of the Configuration Storage server and of ISA Server services, but can also be installed as a stand-alone component for administration of ISA Server computers.

You connect a remote ISA Server Management console to a Configuration Storage server. When you request server-specific information from the remote console, it automatically connects to the arrays to obtain that information. Note that a physical or VPN connection is required to enable connectivity with the Configuration Storage server and the arrays.

As an enterprise administrator, you can use ISA Server Management to remotely manage any array in the enterprise. The computer must belong to the Enterprise Remote Management Computers computer set or to the Remote Management Computers computer set of the managed array. You can also remotely manage from a computer running ISA Server services, if it is in the same array you are managing. You can also manage computers in different arrays from a computer running ISA Server services, if you add an access rule that allows outbound MS Firewall control protocol to these computers.

Role-based remote administration

Depending on the administrative role of the user remotely administering the ISA Server array or enterprise, different tasks can be performed. For example, a user with ISA Server Administrator permissions for a specific array can remotely administer that array, but cannot manage the enterprise. Only a user with ISA Server Enterprise Administrator permissions can manage the enterprise. Although a computer might be recognized by ISA Server as being allowed to connect, the user may not have the required privileges to administer ISA Server. After the computer is connected, the user would not be able to perform any ISA Server tasks or monitor array or Configuration Storage server status.

For more information about ISA Server roles, see Administrative Roles.

Remote monitoring

By default, all remote monitoring and remote logging (except SMTP) is disabled when you install ISA Server. You can enable the relevant system policy configuration groups:

  • Remote Logging (NetBIOS)
  • Remote Logging (SQL)
  • Remote Performance Monitoring
  • Microsoft Operations Manager
  • SMTP (enabled by default)


Exporting and backing up the configuration

Microsoft Internet Security and Acceleration (ISA) Server 2004 includes an export and import feature that enables you to save and restore array configuration information. The configuration parameters can be exported and stored locally in an .xml file. You can save your configuration to any directory and file name.

We recommend that you save the backup files to an NTFS disk partition for maximum security. Only administrators of the ISA Server computer should have read permissions to the directory.

Exporting the configuration

You can export the entire ISA Server configuration, or just parts of it, depending on your specific needs. You can export the following objects:

  • Entire ISA Server configuration
  • All the connectivity verifiers, or one selected connectivity verifier
  • All the networks, or one selected network
  • All the network sets, or one selected network set
  • All the network rules, or one selected network rule
  • All the Web chaining rules, or one selected Web chaining rule
  • Cache configuration
  • All the content download jobs, or one or more selected content download jobs
  • Entire firewall policy, or one selected rule
  • One or more (or all) enterprise policies
  • Enterprise configuration
  • Array configuration

The system policy rules are not exported when you export the firewall policy. To export the system policy, select the Export System Policy task.

When you export an entire enterprise configuration, all general configuration information is exported. This includes the configuration for all the arrays in the enterprise, and the access rules, publishing rules, rule elements, alert configuration, cache configuration, and ISA Server properties configured for the array and its members. The export information also includes all enterprise policy information and all other enterprise-specific information.

In addition, you can select to export user permission settings and confidential information, such as user passwords. Confidential information included in the exported file is encrypted, using the password specified as part of the export process. Confidential information includes user credential passwords (for example, used for logging to a computer running SQL Server), RADIUS shared secrets, or preshared IPsec keys.

You can also export user permission settings. Typically, you will select to export these settings when you clone configuration information within the same corporate network.

When you select a specific object to export, the following is exported:

  • Specified object, including all property values
  • All descendant objects that are contained within the hierarchy, starting at the specified object
  • All referenced objects, even when outside the object hierarchy of the selected object

For instructions, see Export a configuration.

Backing up the configuration

ISA Server backs up the configuration information for the selected object: entire enterprise, specific enterprise policy, or the array. To back up the configuration, you must select to back up the confidential information and the user permission settings.

We recommend that you back up the configuration after any major modifications, including:

  • Changing cache size or location
  • Changing firewall policy
  • Changing the rule base
  • Changing system rules
  • Changing the networks, such as changing the network definition or network rules
  • Delegating administrative rights or removing delegation

For instructions, see Back up the enterprise configuration.

Using Windows Backup utility to back up the configuration

When you have a complex, large enterprise configuration, with more than one hundred arrays in the enterprise, we recommend that you use the Windows Backup utility to back up the configuration.

For instructions, see Use Windows Backup utility to back up a large enterprise configuration.


Importing and restoring the configuration

During the import process, the configuration saved in the exported .xml file is copied to the designated location. This file includes server-specific configuration information, such as cache drives and Secure Sockets Layer (SSL) certificates. When confidential details, such as user passwords, have been exported with the file, a password is required to open and decrypt the secure information. This password is set when the file is exported.

When you export an entire configuration, certificate settings are also exported. However, if you import the configuration to a Microsoft Internet Security and Acceleration (ISA) Server 2004 computer with different certificates, the Microsoft Firewall service will fail to start, and an event message will be logged.

When you import a file with confidential information, a password may be required to open and decrypt this information. This is the password that was specified when the file was created during the export process.

You can use the importing functionality to clone configurations from one array to another. For example, you might create a policy on an array in your corporate headquarters. Subsequently, you can export the configuration, and then import the configuration information to the ISA Server arrays in various branch offices.

Caution

  • When a file originally exported from a specific computer is imported to the same computer, previously defined rule elements, policy rules, publishing rules, alert configuration, cache configuration, and ISA Server properties are overwritten, if the object also exists in the file being imported. This applies to the level at which the import is invoked and below.

The configuration file must be imported at the appropriate node. For example, after you export a rule, you must import the configuration file at the Firewall Policy node or by selecting another rule.

For configuration instructions, see Import a configuration.

Restoring the configuration

The restore process reconstructs most configuration information. To restore the configuration, you must select the Overwrite (restore) option in the Import Wizard.

For instructions, see Restore the enterprise configuration.

Using Windows Backup utility to restore the configuration

If you used the Windows Backup utility to back up the configuration, you should use this utility to restore the configuration. The restoration process differs, depending on your network deployment (whether you have one or more than one Configuration Storage server).

Restoring in a single Configuration Storage server environment

Perform the following steps to restore a configuration file, which was previously backed up, to a single Configuration Storage server. Note that these steps assume that there are no other Configuration Storage servers replicating from this Configuration Storage server.

  1. Stop the ISASTGCTRL service.
  2. Follow the instructions detailed in Use Windows Backup utility to restore a large enterprise configuration.
  3. Restart the ISASTGCTRL service.

Restoring in an environment with multiple Configuration Storage servers

Perform the following steps to restore a configuration file, which was previously backed up, to a Configuration Storage server, which replicates with other Configuration Storage servers. When you complete these steps, the restored configuration information will be replicated to all the Configuration Storage servers in the enterprise.

  1. Stop the ISASTGCTRL service.
  2. Run the DelISAConfig script. At a command prompt, type:
    cscript DelISAConfig.vbs Configuration_Storage_Server
    where Configuration_Storage_Server is the name of some other Configuration Storage server in the enterprise (not the Configuration Storage server on which you are running the restoration process).
  3. Use the Windows Backup utility to restore the configuration. For instructions, see Use Windows Backup utility to restore a large enterprise configuration.
  4. Perform the following steps to configure the Configuration Storage server as the replication authority:
    1. Run Dsdbutil.exe, located in the %windir%\ADAM folder.
      A prompt should indicate the Active instance is set to "ISASTGCTRL".
    2. At the Dsdbutil prompt, type authoritative restore.
    3. At the authoritative restore prompt, type restore database.
    4. At the prompt, type quit.
    5. At the prompt, again type quit.
  5. Restart the ISASTGCTRL service.

The DelISAConfig.vbs file is available on the ISA Server Download Center (http://www.microsoft.com/).


Error reporting and feedback

ISA Server 2004 introduces Microsoft Error Reporting. This feature allows you to send information to Microsoft about errors you may encounter when running ISA Server.

When you log on as Local Administrator on the ISA Server computer, you might see a dialog box called Microsoft Error Reporting. This dialog box shows errors that have been encountered while using Windows applications, including ISA Server. Sending ISA Server error reports to Microsoft provides technical information for the product team, and helps us track and address specific issues. Error reporting data is used for quality control purposes only. It is not used for tracking individual users or installations for any marketing purpose. You can send ISA Server error reporting information as follows:

  • Send directly over the Internet to Microsoft using HTTPS. To do this, click Send Reports Now in the Microsoft Error Reporting dialog box. ISA Server has a system policy rule enabled by default to allow HTTP/HTTPS traffic from the Local Host network to the Microsoft error reporting site. For more information about the system policy, see System policy overview.
  • Use the Corporate Error Reporting tool. If your organization has configured Group Policy, administrators can use Corporate Error Reporting to collect and selectively report errors to Microsoft. When this is enabled, errors are automatically redirected to the server on which Corporate Error Reporting is installed.

Documentation feedback

In addition, the online Help included with ISA Server has a content rating system built into the document. You can rate each page and send comments to the ISA Server documentation team. The ISA Server documentation team welcomes your suggestions and comments about the documentation.

Note that to send e-mail messages from the ISA Server computer using an SMTP server located on the Internal network, you must enable the system policy rule that allows the Local Host network to access the Internal network using the SMTP protocol. In the System Policy Editor, in the Remote Monitoring configuration group, select SMTP and then click Enable. The Allow SMTP protocol from firewall to trusted servers rule is enabled.

Get latest ISA Server content at ISA Server Guidance.


Administration and Security: How To

This section provides steps for administering Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • View the task pane
  • View ISA Server computer details
  • Manage the Enterprise
  • Manage Arrays
  • Back Up and Restore
  • Assign administrative roles for array administrators
  • Assign administrative roles for enterprise administrators


View the task pane

To view the task pane

  • On the View menu of ISA Server Management, click Task Pane.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


View ISA Server computer details

To view ISA Server computer details

  1. In the console tree of ISA Server Management, click Servers.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Servers
  2. In the details pane, click the applicable server.
  3. On the Tasks tab, click Configure Selected Server.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.


Manage the Enterprise

This section provides steps for managing the Microsoft Internet Security and Acceleration (ISA) Server 2004 enterprise.

  • Connect to a Configuration Storage server
  • Disconnect from the enterprise
  • Copy array rule elements to enterprise


Connect to a Configuration Storage server

To connect to a Configuration Storage server

  1. In the console tree of ISA Server Management, click Microsoft Internet Security and Acceleration Server 2004.
  2. On the Tasks tab, click Connect to Configuration Storage Server.
  3. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can connect to a local or a remote Configuration Storage server. If you select a local Configuration Storage server, you must install the Configuration Storage server on this computer. For instructions, see Install Configuration Storage server.
  • If you select a remote Configuration Storage server, you must have appropriate permissions to access the server.
  • You can use the ADAM ADSI Edit tool to configure replication frequency. For instructions, see "Configure replication frequency within a site" in Active Directory Application Mode (ADAM) Help, on the Configuration Storage server.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Disconnect from the enterprise

To disconnect from the enterprise

  1. In the console tree of ISA Server Management, click Microsoft Internet Security and Acceleration Server 2004.
  2. On the Tasks tab, click Disconnect.
  3. In the message box, click Yes.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you disconnect from the enterprise, you will not be able to view or manage the ISA Server enterprise or array configuration from this computer.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Copy array rule elements to enterprise

To copy array rule elements to enterprise

  1. In the console tree of ISA Server Management, click the applicable array.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
  2. On the Tasks tab, click Copy Array Rule Elements to Enterprise.
  3. Follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Manage Arrays

This section provides steps for managing Microsoft Internet Security and Acceleration (ISA) Server 2004 arrays.

  • Create an array
  • Rename an array
  • Delete an array
  • Specify a Configuration Storage server for this array
  • Specify an alternate Configuration Storage server
  • Specify credentials for communication with the Configuration Storage server
  • Configure intra-array address
  • Specify intra-array credentials
  • Configure computer name to use for remote management
  • Apply an enterprise policy


Create an array

To create an array

  1. In the console tree of ISA Server Management, click Arrays.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
  2. On the Tasks tab, click Create New Array.
  3. Follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Rename an array

To rename an array

  1. In the console tree of ISA Server Management, right-click the ISA Server array, and then click Properties.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
  2. On the General tab, in Name, type the name used to manage the ISA Server configuration.
  3. In DNS Name, type the DNS name representing the array. This is the name used by Firewall and Web Proxy clients connecting to the array.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You must click the Apply button to save this configuration change.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Delete an array

To delete an array

  1. In the console tree of ISA Server Management, click Array_Name.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
  2. On the Tasks tab, click Delete Selected Arrays.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Specify a Configuration Storage server for this array

To specify a Configuration Storage server for this array

  1. In the console tree of ISA Server Management, click Array_Name.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
  2. On the Tasks tab, click Configure Array Properties.
  3. On the Configuration Storage tab, in Configuration Storage server, type the computer name or IP address of the Configuration Storage server to be used by this array.
  4. (Optional). In Alternate Configuration Storage server, type the computer name of an alternate Configuration Storage server to use if the first Configuration Storage server becomes unavailable.
  5. In Check the Configuration Storage server for updates every, select one of the following options:
    • 15 seconds. This is a relatively high frequency, which helps ensure the freshest configuration information about the array members.
    • 10 minutes. This is a normal frequency.
    • 60 minutes. This is a relatively low frequency, recommended only when there are very infrequent changes to the configuration.
    • Custom. If you select this option, in the text box, type the number of seconds to use for an update frequency.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • We recommend that you configure the array to check the Configuration Storage server as frequently as possible, given the bandwidth constraints on your network.
  • After the primary Configuration Storage server is unavailable for thirty minutes, ISA Server switches to an alternate Configuration Storage server, if it is specified. After using the alternate Configuration Storage server for six hours, ISA Server periodically checks if the primary Configuration Storage server is available. After the primary server is available for ten minutes, the array switches back to the primary Configuration Storage server.
    The times specified here are the defaults. They can be configured using the ISA Server software development kit (SDK). For a sample script that configures these defaults, see Coding Corner (http://www.microsoft.com/).
  • After you change the Configuration Storage server, verify that the computer running ISA Server services is included in the Managed ISA Server computers computer set.
  • To install a Configuration Storage server as a replicate of a Configuration Storage server in a different site, first use the AdamSites.exe tool. For more information, see Deploying Configuration Storage servers across ADAM sites.
  • If the Configuration Storage server is not available, on a replicate Configuration Storage server, in ISA Server Management, change the Configuration Storage server for the array to this (replicate) Configuration Storage server. On each array member, run the script ChangeStorageServer.vbs, located in the ISA Server installation folder. For usage instructions, run cscript ChangeStorageServer.vbs ?.
  • To change the Configuration Storage server, you can reinstall ISA Server, specifying the Repair option. In this case, stop the Microsoft Firewall service on the computer. Then during reinstallation, specify the name of the new Configuration Storage server.
  • After you configure a new Configuration Storage server to use, the array will not immediately begin using the Configuration Storage server. Check Configuration Status to see when the Configuration Storage server change is applied. For instructions on viewing Configuration Status, see View the configuration status.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Specify an alternate Configuration Storage server

To specify an alternate Configuration Storage server

  1. In the console tree of ISA Server Management, click Array_Name.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
  2. On the Tasks tab, click Configure Array Properties.
  3. On the Configuration Storage tab, in Alternate Configuration Storage server, type the computer name or IP address of the alternate Configuration Storage server to be used by this array. This server will be used if the primary Configuration Storage server fails.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After using the alternate Configuration Storage server for six hours, ISA Server periodically checks if the primary Configuration Storage server is available. After the primary server is available for ten minutes, the array switches back to the primary Configuration Storage server.
    The times specified here are the defaults. They can be configured using the ISA Server software development kit (SDK). For a sample script that configures these defaults, see Coding Corner (http://www.microsoft.com/).
  • If the alternate server is unavailable for thirty minutes, the array will switch back to the primary Configuration Storage server, if it is available.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Specify credentials for communication with the Configuration Storage server

To specify credentials for communication with the Configuration Storage server

  1. In the console tree of ISA Server Management, click Array_Name.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
  2. On the Tasks tab, click Configure Array Properties.
  3. On the Configuration Storage tab, click Select.
  4. In Select Authentication Type, select one of the following:
    • Windows authentication. Select this option if the Configuration Storage server and the computer running ISA Server services are in a single domain or in domains with trust relationships.
    • Authentication over SSL encrypted channel. Select this option if the array members and the Configuration Storage servers will be in a workgroup or in untrusted domains.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you select Authentication over SSL encrypted channel, a certificate must be installed on the Configuration Storage server. You can use the ISACertTool, available on the ISA Server Download Center (http://www.microsoft.com/). When you run the ISACertTool, all certificates in the ADAM_ISASTGCTRL local store are erased. By specifying the /keepcerts flag when you run the tool, you can retain all certificates.
  • Certificates typically have an expiration period, usually no more than one year. ISA Server cannot use an expired certificate. Be sure to renew your certificates before they expire, so that ISA Server can continue to function.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure intra-array address

To configure intra-array address

  1. In the console tree of ISA Server Management, click Servers.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Servers
  2. In the details pane, select the applicable server.
  3. On the Tasks tab, click Configure Selected Server.
  4. On the Communication tab, in Use this IP address for communication between array members, select the IP address on the server to use for intra-array communication.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you reconfigure the intra-array address, the new address is added to the Array Servers computer set.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Specify intra-array credentials

To specify intra-array credentials

  1. In the console tree of ISA Server Management, click Array_Name.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
  2. On the Tasks tab, click Configure Array Properties.
  3. On the Intra-Array Credentials tab, select one of the following:
    • Authenticate using the computer account of the array member. Select this option if communication between the array members will be authenticated using the local computer accounts. Choose this option only if the array members are in a Windows domain.
    • Authenticate using this account (for workgroup configuration only). Select this option if communication between the array members will be authenticated using the specified account. Choose this option only if the array members are in a workgroup.
  4. If you select Authenticate using this account, click Set Account and specify a user account for communication authentication.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure computer name to use for remote management

To configure computer name to use for remote management

  1. In the console tree of ISA Server Management, click Servers.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Servers
  2. In the details pane, select the applicable server.
  3. On the Tasks tab, click Configure Selected Server.
  4. On the Communication tab, select one of the following options:
    • Use the full computer name. When you select this option, the full computer name will be used when connecting to this ISA Server computer for remote management.
    • Use this IP address or computer name. When you select this option, specify the IP address or the fully qualified domain name (FQDN) that should be used when connecting to this ISA Server computer for remote management.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The name you specify here is the name used by computers remotely managing the array.
  • If you change the IP address of the computer, be sure to update the IP address you specify here for remote management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Apply an enterprise policy

To apply an enterprise policy

  1. In the console tree of ISA Server Management, click Array_Name.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
  2. On the Tasks tab, click Configure Array Properties.
  3. On the Policy Settings tab, in Enterprise policy, select the enterprise policy to apply to this array.
  4. Select one or more of the following options:
    • "Deny" access rules. If you select this option, access rules that deny access can be created on this array.
    • "Allow" access rules. If you select this option, access rules that allow access can be created on this array.
    • Publishing rules ("Deny" and "Allow"). If you select this option, publishing rules can be created on this array.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Only users with the ISA Server Enterprise Administrator role can configure which types of rules can be created for an array.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Back Up and Restore

This section provides steps for administering Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Export a configuration
  • Import a configuration
  • Back up the enterprise configuration
  • Restore the enterprise configuration
  • Use Windows Backup utility to back up a large enterprise configuration
  • Use Windows Backup utility to restore a large enterprise configuration

web link Get latest ISA Server content at ISA Server Guidance.


Export a configuration

To export a configuration

  1. In the console tree of ISA Server Management, click the relevant object. For example, to export a rule:
    1. Click Firewall Policy.

      Where?

      • Microsoft Internet Security and Acceleration Server 2004
      • Arrays
      • Array_Name
      • Firewall Policy
    2. In the details pane, right-click the applicable rule, and then click Export Selected.
  2. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You must be an Enterprise Administrator or Enterprise Auditor to export the enterprise configuration. To export confidential information, you must be an Enterprise Administrator. You must be an ISA Server Array Administrator to export confidential array-level information.
  • The system policy rules are not exported when you export the firewall policy. To export the system policy, select the Export System Policy task.
  • To export confidential information, such as user passwords and certificates, select Export confidential information. This information will be encrypted during the export process.
  • You only have to specify a password when exporting confidential information.
  • Specify a strong password, to ensure proper protection of encrypted information. A password is considered strong if it provides an effective defense against unauthorized access. A strong password does not contain all or part of the user account name. It contains at least three of the four following categories of characters: uppercase characters, lowercase characters, base 10 digits, and symbols found on the keyboard (such as !, @, and #).

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Import a configuration

To import a configuration

  1. In the console tree of ISA Server Management, click the applicable array.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
  2. On the Tasks tab, click Import (Restore) Array Configuration.
  3. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To import user permissions, click Import user permission settings. This option is only available if user permissions were exported.
  • To import server specific details, such as cache drive settings, click Import server specific details. This option is only available if this information was exported.
  • If confidential information was exported with the file, specify the password required to decrypt the confidential information.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Back up the enterprise configuration

To back up the enterprise configuration

  1. In the console tree of ISA Server Management, click Microsoft Internet Security and Acceleration Server 2004.
  2. On the Tasks tab, click Export (Backup) Configuration.
  3. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You must be an Enterprise Administrator or Enterprise Auditor to export the enterprise configuration. To export confidential information, you must be an Enterprise Administrator.
  • Secure the exported configuration file, because it contains sensitive information. Specify a strong password, to ensure proper protection of encrypted information. A password is considered strong if it provides an effective defense against unauthorized access. A strong password does not contain all or part of the user account name. It contains at least three of the four following categories of characters: uppercase characters, lowercase characters, base 10 digits, and symbols found on the keyboard (such as !, @, and #).

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Restore the enterprise configuration

To restore the enterprise configuration

  1. In the console tree of ISA Server Management, click Microsoft Internet Security and Acceleration Server 2004.
  2. On the Tasks tab, click Import (Restore) Configuration.
  3. Follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Use Windows Backup utility to back up a large enterprise configuration

To use Windows Backup utility to back up a large enterprise configuration

  1. Click Start, point to All Programs, point to Accessories, point to System Tools, and then click Backup.
  2. On the Welcome page, click Advanced Mode.
  3. On the Backup tab, select the ADAMData folder, located under Program files\Microsoft ISA Server.
  4. In Backup media or file name, type the name of the backup file.
  5. Click Start Backup.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Use Windows Backup utility to restore a large enterprise configuration

To use Windows Backup utility to restore a large enterprise configuration

  1. In the details pane, click Start, point to All Programs, point to Accessories, point to System Tools, and then point to Backup.
  2. On the Welcome page, click Advanced Mode.
  3. On the Restore and Manage Media tab, select the item to restore.
  4. In Restore files to, select Original location.
  5. On the Tools menu, click Options.
  6. Click Always replace the file on my computer.
  7. Click Start Restore.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Assign administrative roles for array administrators

To assign administrative roles for array administrators

  1. In the console tree of ISA Server Management, click the applicable array.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
  2. On the Tasks tab, click Assign Administrative Roles.
  3. If the computer running the ISA Server services is in a domain, click the upper Add button. Then, do the following:
    1. In Group or User, type the name of the group or user that can access the Configuration Storage server.
    2. In Role, select one of the following:
      • ISA Server Array Administrator, to allow the specified group or user full control permissions for the array. The administrator can also view the enterprise policy applied to the array.
      • ISA Server Array Auditor, to allow the specified group or user monitoring permissions and to view the array configuration.
      • ISA Server Array Monitoring Auditor, to allow the specified group or user some monitoring permissions.
  4. If the computer running the ISA Server services is in a workgroup, click the lower Add button. Then, do the following:
    1. In Group or User, type the name of the group or user that can access the Configuration Storage server.
    2. In Role, select one of the following:
      • ISA Server Array Administrator, to allow the specified group or user full control permissions for the array. The administrator can also view the enterprise policy applied to the array.
      • ISA Server Array Auditor, to allow the specified group or user monitoring permissions and to view the array configuration.
      • ISA Server Array Monitoring Auditor, to allow the specified group or user some monitoring permissions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If the computer running the ISA Server services is in a workgroup, you must create identical (mirrored) accounts to those specified here on each array member.
  • In workgroup scenarios, you specify the user or group name in two locations:
    • When you click the upper Add button, in Group or User, use the following format to specify the group or user name: Configuration_Storage_Server_Name\UserName.
    • When you click the lower Add button, in Group or User, use the following format to specify the group or user name: UserName. Do not specify the Configuration_Storage_Server_Name.
  • If the Configuration Storage server is in a domain, a domain-level user should be specified. Do not specify a local user.
  • Do not delegate administrative roles to these security identifiers (SIDs): Creator Owner and Creator Group. This is because these SIDs do not exist on the Active Directory Application Mode (ADAM) on which the ISA Server configuration is stored.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Assign administrative roles for enterprise administrators

To assign administrative roles for enterprise administrators

  1. In the console tree of ISA Server Management, click Enterprise.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
  2. On the Tasks tab, click Assign Administrative Roles.
  3. If the computer running the ISA Server services is in a domain, click the upper Add button. Then, do the following:
    1. In Group or User, type the name of the group or user that can access the Configuration Storage server.
    2. In Role, select one of the following:
      • ISA Server Enterprise Administrator. Allows the specified group or user full control permissions.
      • ISA Server Enterprise Auditor. Allows the specified group or user to view the enterprise and array configurations.
  4. If the computer running the ISA Server services is in a workgroup, click the lower Add button. Then, do the following:
    1. In Group or User, type the name of the group or user that can access the Configuration Storage server.
    2. In Role, select one of the following:
      • ISA Server Enterprise Administrator. Allows the specified group or user full control permissions.
      • ISA Server Enterprise Auditor. Allows the specified group or user to view the enterprise and array configurations.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If the computer running the ISA Server services is in a workgroup, you must create identical (mirrored) accounts to those specified here on each array member.
  • In workgroup scenarios, you specify the group or user name in two locations:
    • When you click the upper Add button, in Group or User, use the following format to specify the group or user name: Configuration_Storage_Server_Name\UserName.
    • When you click the lower Add button, in Group or User, use the following format to specify the group or user name: UserName. Do not specify the Configuration_Storage_Server_Name.
  • Do not delegate administrative roles to these security identifiers (SIDs): Creator Owner and Creator Group. This is because these SIDs do not exist on the Active Directory Application Mode (ADAM) on which the ISA Server configuration is stored.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Assign administrative roles for enterprise policy administrators

To assign administrative roles for enterprise policy administrators

  1. In the console tree of ISA Server Management, click the applicable enterprise policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Policies
    • Enterprise_Policy
  2. On the Tasks tab, click Edit Enterprise Policy Properties.
  3. On the Assign Roles tab, click Add. Then, do the following:
    • In Group or User, type the name of the group or user that can access the Configuration Storage server.
    • In Role, select ISA Server Enterprise Policy Editor.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Do not delegate administrative roles to these security identifiers (SIDs): Creator Owner and Creator Group. This is because these SIDs do not exist on the Active Directory Application Mode (ADAM) on which the ISA Server configuration is stored.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Troubleshooting administration

What problem are you having?

Array members cannot connect to the Configuration Storage server.

Cause: The name of the Configuration Storage server was not specified correctly, or does not match the server certificate (if certificate authentication is used) or the service principal name (SPN) (if domain authentication is used).

Solution: Verify that the Configuration Storage server name is specified correctly for the array. For instructions, see Specify a Configuration Storage server for this array.

Cause: The name specified for the Configuration Storage server cannot be resolved.

Solution: Verify that the Configuration Storage server name is resolvable on the array member. Try to ping the Configuration Storage server. Also, verify that the IP address of the Configuration Storage server resolves to the specified name. If it does not resolve, modify the Hosts file or the Domain Name System (DNS) server, as necessary.

The primary and alternate (if applicable) Configuration Storage servers used by this array are not available.

Cause: The primary and alternate (if applicable) Configuration Storage servers used by this array are not available. However, a replicate Configuration Storage server exists.

Solution: On the replicate Configuration Storage server, in ISA Server Management, change the Configuration Storage server for the array to this (replicate) Configuration Storage server. For instructions, see Specify a Configuration Storage server for this array. On each array member, run the script ChangeStorageServer.vbs, located in the ISA Server installation folder.
For usage instructions, run cscript ChangeStorageServer.vbs ?.

Array members cannot authenticate to the Configuration Storage server.

Cause: The array member cannot authenticate to the Configuration Storage server using domain authentication. To check that this is the cause, perform the following steps:

  1. At a command prompt, type <now_+1 minute> /interactive ldp.exe, where:
    • now is the current time.
    • ldp.exe is a utility located in the %windir%\ADAM folder on the Configuration Storage server.
  2. On the Connection menu, click Connect.
  3. In Server, type the name of the Configuration Storage server. In Port, type 2171. Then, click OK.
  4. On the Connection menu, click Bind.
  5. Select Domain, and then click OK (to bind with NULL credentials).
  6. On the View menu, click Tree.
  7. In BaseDN, select CN=FPCConfiguration. In the name space, verify that you can read the configuration.
If you cannot browse the tree, but you can open ISA Server Management, there are likely authentication problems.

Solution: Verify that the required service principal names (SPNs) are registered. For instructions, see "Administering ADAM service principal names" topic in ADAM Help located on the Configuration Storage server.

Array members cannot authenticate with the Configuration Storage server, perhaps due to a certificate authentication problem.

Cause: The array member cannot authenticate with the Configuration Storage server using certificate authentication, because the certification authority (CA) certificate is not installed on the array member (or it is expired).

Solution: Install the CA certificate on the array member. Perform the following steps:

  1. On the Configuration Storage server, click Start, click Run, type MMC.exe and then click OK.
  2. On the File menu, click Add/Remove Snap-in and then click Add.
  3. In Available Standalone Snap-ins, click Certificates, and then click Add.
  4. Select Computer account, click Next, and then click Finish. Click Close and click OK.
  5. Click Console Root, click Certificates, click Trusted Root Certification Authorities, and then right-click Certificates.
  6. Click All Tasks, click Import, and then follow the on-screen instructions.

Array members cannot connect to the Configuration Storage server, perhaps due to a certificate expiration problem.

Cause: The array member cannot authenticate with the Configuration Storage server using certificate authentication because the server certificate expired or is not installed on the Configuration Storage server.

Solution: Check if a valid certificate is available on the Configuration Storage server. For instructions, see Obtain a server certificate. If no valid certificate is available, repair the ISA Server installation on the Configuration Storage server to install a new server certificate.

After changing the IP address of the ISA Server computer, ISA Server does not update its Local Host network configuration.

Cause: The intra-array address, used for communication between array members, is not automatically updated when you change the IP address of the ISA Server computer.

Solution: Change the intra-array address of this computer to the new IP address. For instructions, see Configure intra-array address.

I cannot see an array member after I added it to the array.

Cause: ISA Server Management was opened when the new server was added. Therefore, the list of servers will not be refreshed.

Solution: Close, and then reopen ISA Server Management.

I want to schedule more frequent replication times between Configuration Storage servers

Cause: You can schedule replication between Configuration Storage servers.

Solution: Use the ADAM ADSI Edit tool to configure replication frequency. For instructions, see "Configure replication frequency within a site" in Active Directory Application Mode (ADAM) Help, on the Configuration Storage server.

How do I use ADAM tools (ADAM ADSI Edit) to troubleshoot the ISA Server configuration?

Cause: The ISA Server configuration is stored in Active Directory Application Mode (ADAM). You can use ADAM ADSI Edit to view the ISA Server configuration.

Solution: Perform the following steps:

  1. On the Configuration Storage server, click Start, point to All Programs, point to ADAM, and then click ADAM ADSI Edit.
  2. In the ADAM ADSI Edit tool, right-click ADAM ADSI Edit, and then click Connect to.
  3. In Server name, select localhost.
  4. In Port, type 2171.
  5. Click Distinguished name (DN) or naming context. Then, in the text box, type CN=FPCConfiguration.


Networking

Microsoft® Internet Security and Acceleration (ISA) Server 2004 introduces a multi-networking model, which enables you to define relationships between networks secured by ISA Server. This section describes the multi-networking feature and provides step-by-step instructions on how to configure networking for ISA Server.

  • Networking: Concepts
  • Networking: How To
  • Troubleshooting networking issues


Networking: Concepts

This section provides information about the networking features of Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Multi-networking overview
  • Networks
  • Network Templates
  • Network rules
  • Chaining and Routing
  • Network Load Balancing


Multi-networking overview

Microsoft Internet Security and Acceleration (ISA) Server 2004 introduces the concept of multi-networking. You can use the multi-networking features of ISA Server to protect your network against internal and external security threats, by limiting communication between clients, even within your own organization. You can group computers in your Internal network into network sets, and configure an access policy specific to each network set. You can also define relationships between the various networks, thereby determining how computers on each network communicate with each other, by way of ISA Server.

In a common publishing scenario, you might want to isolate the published servers on their own network, such as a perimeter network. The ISA Server multi-networking functionality supports such a scenario, so that you can configure how clients on the corporate network access the perimeter network, and how external clients access the network. You can configure the relationships between the various networks, defining different access policies between each network.

The following figure illustrates a multi-networking scenario.

Multi-networking

In the figure, the ISA Server computer connects between the Internet (External network) and the Internal network, corporate network, and perimeter network. Each network adapter on the ISA Server computer is connected to each of the networks. Using ISA Server, you can configure different access policies between any pair of networks. You can determine if and how computers on each of the networks communicate with each other. Each network is isolated from the other, and is only made accessible when you configure rules to allow communication.

You can use the multi-networking features of ISA Server to identify, configure, and define the connectivity and relationships between computers, both internal and external to your organization. To configure the multi-networking environment, you identify networks, optionally grouping them into network sets, and define relationships between the networks. For more information, see Network and network set configuration.

Enterprise networks

Like array-level networks, enterprise networks also support the multi-networking model. Enterprise networks expand the multi-networking model, so that a single policy can be applied across multi-networked arrays. For more information, see Enterprise networks.

Built-in networks

ISA Server includes several built-in network elements. The following are some examples:

  • The built-in External network automatically includes any address that does not belong to any other network. For more information about the External network, see External network.
  • The built-in VPN Clients network automatically includes all the addresses assigned to VPN clients. For more information on the VPN Clients network, see VPN clients and firewall policy.
  • The built-in Local Host network includes the addresses on the ISA Server computer.

Access between networks

After you define networks, you create network rules, which determine if and how the networks are connected. You can use ISA Server to define network rules, thereby allowing access between the networks. When you do so, you define not only whether the networks are connected, but also how they are connected. In this way, you establish the network access policy between the networks. For more information, see Network rules.


Networks

This section provides information about networks.

  • Network and network set configuration
  • Enterprise networks
  • Local Host network
  • Default Internal network
  • External network
  • Spoof detection
  • Network configuration steps


Network and network set configuration

In Microsoft Internet Security and Acceleration (ISA) Server 2004, a network is a rule element, which can contain one or more ranges of Internet Protocol (IP) addresses. Networks include one or more computers, typically corresponding to a physical network. You can apply rules to one or more networks, or to all addresses except those in the specified network.

You can create array-level networks and enterprise networks. Array-level networks are used in the scope of a specific array, whereas enterprise networks can be used by any array in the enterprise. For more information about enterprise networks, see Enterprise networks.

At the array level, each network adapter on the computer can be mapped to a single network. A network can include addresses associated with one or more network adapters. A network also determines whether Firewall clients and Web Proxy clients are supported on the network.

ISA Server comes preconfigured with the following array-level networks:

  • Local Host. This network represents the ISA Server computer. The Local Host network cannot be modified or deleted. For more information, see Local Host network.
  • External. This network includes all computers (IP addresses) that are not associated with any other network. The Default External network cannot be modified or deleted. For more information, see External network.
  • Internal. Upon installation, this network includes all computers (IP addresses) specified during the installation process. The default Internal network cannot be deleted. For more information, see Default Internal network.
  • VPN Clients. This network contains addresses of currently connected clients. The range of possible addresses is configured when you configure the virtual private network (VPN) properties. The VPN Clients network cannot be deleted. For more information, see VPN clients and firewall policy.
  • Quarantined VPN Clients. This network contains addresses of VPN clients that have not yet cleared quarantine. The Quarantined VPN Clients network cannot be deleted. For more information, see Firewall policy for quarantined VPN clients.

For access rules, you specify a destination network and a source network to which the rule is to be applied. Array-level access rules can apply to enterprise networks or to array-level networks. Enterprise-level access rules can apply only to enterprise networks. The source network indicates which networks are allowed or denied access to the specified destination networks. For more information, see Access rules.

For server publishing rules, you specify a source network, which is allowed access to a specific computer.

Creating networks

In addition to the preinstalled networks, you can create networks. Array-level and enterprise networks include a range of IP addresses. In addition, an array-level network can include an enterprise network, thereby including IP addresses that are not necessarily physically connected to the array. For instructions on including an enterprise network in an array-level network, see Include enterprise networks in an array-level network.

Note the following guidelines when you create networks:

  • A host may have zero or more adapters.
  • An adapter may have zero or more addresses. Each address can be associated with exactly one network adapter.
  • An address belongs to one, and only one, network.
  • All addresses on a single network adapter must belong to the same network.

Array-level network types

At the array level, you can select which type of network to create: internal, external, or perimeter. For instructions, see Create an array-level network.

When you select one of these network types, you can specify the IP addresses that are included in the network. Note that each IP address can be included in only one network. For instructions, see Configure network addresses.

After you create an array-level network, you can configure the following properties:

  • Domains. (Firewall clients only.) Specify which domains will be included in the network. For domains in the network, client requests are not forwarded through ISA Server. For instructions, see Configure domains included in a network.
  • Web browser. Specify how Web browsers will be configured. These properties determine how Web browsers that specify ISA Server in the configuration script will be configured. For instructions, see Specify configuration URL for Web browser on Firewall Client.
  • Automatic discovery. Specify if and how clients in this network will automatically attempt to find the ISA Server computer. For instructions, see Publish automatic discovery information.
  • Firewall client support. Specify if this network listens on port 1745 for requests from Firewall clients. For instructions, see Listen for Firewall Client requests.
  • Web Proxy client support. Specify if this network listens for TCP requests from Web Proxy clients. For instructions, see Listen for Web Proxy client requests.

At the array level, you can also create a new site-to-site VPN. For more information about site-to-site networks (also called remote site networks), see Site-to-site VPN and firewall policy.

Network sets

After you create networks, you can group one or more networks into network sets. Network sets can include one or more networks, or explicitly exclude one or more networks. Rules can be applied to networks or to network sets.

You can create array-level network sets and enterprise-level network sets. Array-level network sets can include only array-level networks from that array. Similarly, enterprise-level network sets can include only enterprise networks. Enterprise-level network sets can be used in array-level and enterprise-level rules.

When you install ISA Server, two network sets are created, both at the array level and at the enterprise level. These network sets cannot be modified or deleted:

  • All Networks (and Local Host). At the array level, this network set includes all networks defined for the array. When you create a new network, the new network is automatically included in this network set. All Networks is the same as Anywhere. Every IP address is included in both Anywhere and in All Networks.
  • All Protected Networks. This network set includes all networks except the built-in External network. When you create a new network, the new network is automatically included in this network set.

For instructions, see Create a network set.


Enterprise networks

The Microsoft Internet Security and Acceleration (ISA) Server 2004 enterprise represents all the IP addresses in your organization’s network. As an ISA Server enterprise administrator, you can create enterprise networks, which include IP address ranges in your network topology. Traffic within an enterprise network does not cross any security boundary, such as a firewall or a virtual private network (VPN) connection.

An IP address can be included in only one enterprise network. IP addresses that are defined at the enterprise level—that are included in some enterprise network—are considered the address range for the enterprise.

Using enterprise networks at the enterprise level

As an enterprise administrator, you use enterprise networks to create access rules at the enterprise level. This eases policy maintenance, because a single change at the enterprise level can be propagated to multiple arrays. Enterprise networks also provide a mechanism for arrays to reference each other across the enterprise.

An enterprise network does not have any of the other properties that you would define for array networks. For example, you cannot configure Network Load Balancing (NLB) or Cache Array Routing Protocol (CARP) for an enterprise-level network.

Using enterprise networks at the array level

As an array administrator, you can use enterprise networks at the array level, by using them to define address ranges of array-level networks.

Consider for example, two arrays: a front-end array and a back-end array, both connected to a network with an IP address range from 10.0.0.0/8. Suppose also that the enterprise administrator has defined an enterprise network called ENT-Perimeter with the IP address range from 10.0.0.0 through 10.255.255.255. Each array administrator can then define an array-level network called Perimeter, and include the IP range of the enterprise network ENT-Perimeter in it. They can then create array-level firewall policy rules based on the network Perimeter.

At the array level, each array-level network may include more than one enterprise network.

In some cases, the array administrator might want to create only an array-level network, thereby effectively creating a network visible and usable only for that array. The rest of the enterprise cannot use this network. For example, array-level networks might be useful in these scenarios:

  • The array-level network should not be impacted by changes made at the enterprise level.
  • If the array-level network is unused and unneeded at the enterprise level, create an array-level network.

Traffic from an IP address that is not in an array-level network is, by default, considered spoofed. This is true even if the IP address is included in an enterprise network. You can configure how ISA Server determines if traffic from a specific IP address should be considered spoofed. For more information, see Spoof detection.

Predefined enterprise networks

ISA Server includes predefined enterprise networks that act as a placeholder for array-level networks of the same name. Predefined enterprise networks cannot be explicitly used when creating array-level firewall policy rules. Instead, they are typically used in the enterprise policy. Any rule applied by the enterprise administrator to the predefined enterprise network will be applied to the array-level network of the same name. For example, a rule that applies to the enterprise network named Local Host would apply to the IP addresses in the Local Host network for that array. ISA Server includes the following predefined enterprise networks:

  • External
  • Local Host
  • Quarantined VPN Clients
  • VPN Clients

Consider another scenario, in which an enterprise-level rule applies to the enterprise-level VPN Clients network. At the array level, this rule is applied only to VPN clients for that array. For example, suppose that this enterprise policy is applied to two arrays in the enterprise. In this scenario, one array is at the front-end of a perimeter network and is configured to allow roaming client access (VPN). The second array is at the back end, and does not have VPN client access enabled. If a VPN client connects to the front-end array, the enterprise rule applies to the VPN client. However, if a request from this client is passed to the back-end array, the enterprise rule is not applied on this array, because the client is not considered a VPN client of the back-end array.


Local Host network

At the array level, the Local Host network represents Microsoft Internet Security and Acceleration (ISA) Server 2004. All traffic that comes from or to ISA Server is considered to have passed by way of the Local Host network.

As with any network, a relationship must be defined between the Local Host network and the other networks. The default Local Host Access network rule defines a route relationship between the Local Host network and every other network.

The access from the Local Host network to basic services that typically reside on other networks is only allowed when a combination of firewall policy and network rules are defined. Because many of these services are critical to the basic functioning of ISA Server, a set of default system policy rules, created when you install ISA Server, enables access to these services. For more information about system policy, see System policy overview.

Enterprise-level Local Host network

A predefined enterprise-level Local Host network is also created upon installation. The predefined enterprise networks implicitly define the same Internet Protocol (IP) address sets as their array-level counterparts. In particular, the enterprise-level Local Host network implicitly defines a set of IP addresses that will include all the IP addresses bound to network adapters on the local ISA Server computer and 127.0.0.1. The IP addresses actually included in this network vary from server to server within an array.


Default Internal network

The default Internal network is used by Microsoft® Internet Security and Acceleration (ISA) Server 2004 to represent the primary default protected network. By default, system policy rules protect resources on the Internal network from all other networks (other than the Local Host network). You might create access rules to allow traffic from the default Internal network to other networks and publishing rules to allow access to servers located on the Internal network.

The Internal network is generally considered to contain trusted IP address ranges. For this reason, the default system policy allows the ISA Server computer to access services on the Internal network. For more information about system policy, see System policy rules.

For configuration instructions, see Configure network addresses.

You can specify multiple additional internal networks. At least one default Internal network is configured at installation.

Configuring the default Internal network

ISA Server can construct the Internal network, based on your Microsoft Windows Server™ 2003 routing table. You can also select the private IP address ranges, as defined by IANA in RFC 1918. These three blocks of addresses are reserved for private intranets only and are never used on the public Internet.

Additional internal networks

When you create an array-level network, you can specify network type as internal. Note that the predefined system policy rules do not apply to these user-defined internal networks. You might create a user-defined internal network type, if you have additional network adapters connected to other internal networks.

Enterprise networks and the default Internal network

Although a default Internal network is created at the array level, there is no corresponding, predefined Internal network at the enterprise level. Instead, an array administrator may include in the array-level default Internal network one or more enterprise networks.

For example, consider the following enterprise, with three arrays, NetA, NetB, and NetC. NetA includes addresses in the 10.x range, NetB includes the 20.x address range, and NetC includes the 30.x address range. At the enterprise level, as enterprise administrator, you create three enterprise networks:

  • EntNet_A, with addresses 10.x
  • EntNet_B, with addresses 20.x
  • EntNet_C, with addresses 30.x

Then, for each array, you configure the default Internal network to include the three enterprise networks, EntNet_A, EntNet_B, and EntNet_C.


External network

When Microsoft Internet Security and Acceleration (ISA) Server 2004 is installed, five networks are configured. The External network is one of these networks.

The External network includes all Internet Protocol (IP) addresses not explicitly included in any other network. Upon installation, the External network includes all addresses not in the Internal network, the IP address of the Local Host network (127.0.0.1), and the IP addresses of all other network adapters on the ISA Server computer.

The External network is generally considered an untrusted network. For this reason, the network relationship to the External network would typically be configured as network address translation (NAT). This would allow clients on the source network to access the destination External network, but prevent the External network from accessing the source network. For more information about network rules, see Network rules.


Spoof detection

Every time a network adapter receives a packet, whether the packet arrives from a specific IP address or is destined for a specific IP address, Microsoft Internet Security and Acceleration (ISA) Server 2004 checks whether the packet is spoofed. ISA Server checks whether the IP address from which the packet originates (or to which it is destined) is a valid IP address, for the specific network adapter. If the address is not considered valid, ISA Server alerts that an IP spoofing attack has occurred.

ISA Server checks the routing table for the network adapter, and the array-level network. Based on this information, ISA Server determines whether the packet should be considered spoofed, and therefore dropped.

Note

  • Spoof detection is not applied to traffic from an intra-array address. All traffic from the intra-array addresses passes directly to the engine for a policy check.

In summary, ISA Server drops packets as spoofed if one of the following is true:

  • They contain source IP addresses that, according to the routing table, are not reachable through any network adapter that is associated with this network.
  • They contain source IP addresses that do not belong to the address range of the array network to which the network adapter belongs.

Consider this scenario, in which an array network includes IP addresses in the range 10.x. The network adapters associated with the array, with IP addresses 10.1.1.1 and 140.1.1.1, have the following routing table:

Network  Destination Netmask   Gateway Interface
10.0.0.0 255.0.0.0   10.0.0.1  10.1.1.1
20.0.0.0 255.0.0.0   20.0.0.1  10.1.1.1
0.0.0.0  0.0.0.0     140.0.0.1 140.1.1.1

Packets received on interface 10.1.1.1 with source IP addresses in the range from 10.0.0.1 through 10.255.255.255 will not be discarded as spoofed, because those addresses can be routed back through this interface, and they belong to the address range of the array network. However, packets with source IP addresses that are outside this range (including the range from 20.0.0.1 through 20.255.255.255, which can be routed through the interface 10.1.1.1) will be dropped as spoofed, because they do not belong to the array network.

Residual address ranges

IP addresses that belong to an enterprise network, but do not belong to any array-level network, are considered to be part of a residual address range. ISA Server creates a log entry every time traffic to or from an IP address on a residual address range is dropped.

The source or destination network field for the log entry will be prefixed Residual, with the name of the enterprise network to which the IP address belongs. Consider, for example, a scenario where IP address 10.1.1.1 belongs to an enterprise network named Ent1, but does not belong to an array-level network. Traffic from 10.1.1.1 will be dropped and a log entry with Source set to [Residual] Ent1 will be generated.

IP addresses that belong to an enterprise network, but do not belong to any array-level network are considered to be part of a residual network. ISA Server creates a log entry every time traffic to or from an IP address on a residual network is dropped. The source or destination network field for the log entry will be Residual Network.

Spoof detection alerts

When ISA Server detects a spoofed packet, ISA Server triggers an alert indicating the reason that the packet is considered spoofed. You should carefully review the alert, and attempt to address the issue by doing one of the following:

  • Fixing potential configuration errors. Verify that packets from the specific IP address should be considered spoofed. If not, determine why ISA Server considers these packets spoofed.
  • Blocking traffic from the IP address. If traffic from the IP address should be considered spoofed, block all access from that IP address.


Network configuration steps

For newly created networks to send or receive traffic, additional configuration steps must be completed. These steps depend on the type of network you created.

Enterprise networks

Enterprise networks can be used in enterprise rules and in array-level rules.

Enterprise networks can also be included in array-level networks. In this way, even networks that are not physically connected to the array can be included in an array-level network.

For more information about enterprise networks, see Enterprise networks.

Array-level networks

For clients on these networks to send and receive traffic, you must complete the following steps:

  1. Create a network rule allowing traffic to and from this network. For instructions, see Create a network rule.
  2. Create firewall policy rules allowing traffic to and from this network. For instructions, see Create an access rule, Create a Web publishing rule, Create a server publishing rule, or Publish a mail server.

Site-to-site VPN using IPsec

For clients to connect from the virtual private network (VPN) using Internet Protocol security (IPsec), you must complete the following steps:

  1. Create a network rule allowing traffic to and from this network.
  2. Create access rules allowing traffic to and from this network.
  3. Verify IPsec protocol settings using properties of the newly created network.

Site-to-site VPN using PPTP or L2TP

For clients to connect from the VPN using Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol (L2TP), you must complete the following steps:

  1. Create a user with the same name as the new network, and then set remote access permissions to Allow. For instructions, see Create users and groups for remote VPN clients.
  2. Create network rules allowing traffic to and from this network.
  3. Create access rules allowing traffic to and from this network.

web link Get latest ISA Server content at ISA Server Guidance.


Network Templates

ISA Server includes network templates, which correspond to common network topologies. You can use the network templates to configure the firewall policy for traffic between networks. ISA Server includes the following network templates:

  • Edge Firewall. This template assumes a network topology with ISA Server at the edge of the network. One network adapter is connected to the Internal network, the other is connected to an External network (Internet). When you select this template, you can allow all outgoing traffic, or limit outgoing traffic to allow only Web access. For more information, see Edge Firewall network template.
  • 3-Leg Perimeter. This template assumes a network topology with ISA Server connected to the Internal network, the External network, and a perimeter network (also known as a DMZ, demilitarized zone, or screened subnet). For more information, see 3-Leg Perimeter network template.
  • Front End. This template assumes a network topology with ISA Server at the edge of a network, with another firewall configured at the back end, protecting the Internal network. For more information, see Front End network template.
  • Back End. This template assumes a network topology with ISA Server deployed between a perimeter network and the Internal network, with another firewall configured at the back end, protecting the Internal network. For more information, see Back End network template.
  • Single Network Adapter. This template assumes a single network adapter configuration within a perimeter or corporate network. In this configuration, ISA Server is used as a Web proxying and caching server. For more information, see Single Network Adapter network template.


Edge Firewall network template

ISA Server includes network templates, which correspond to common network topologies. One basic scenario involves setting up ISA Server as the firewall at the edge of your network, thereby protecting the network from being accessed by others, while at the same time allowing specific access by users on the corporate network.

When you configure ISA Server by applying the Edge Firewall network template, ISA Server configures network rules and firewall policy, in accordance with the specific policy you select.

For instructions, see Apply a network template.

Firewall policy

As part of the process of applying network templates, you select a firewall policy that best matches your corporate security guidelines. The table below lists the firewall policies available when you select the Edge Firewall network template and also details the rules that are created when you select the policy.

Policy name | Description | Rules created
Block all | This policy blocks all network access through ISA Server. This option does not create any access rules other than the default rule which blocks all access. Use this option when you want to define firewall policy on your own. | None.
Block Internet access, allow access to ISP network services | This policy blocks all network access through ISA Server, except for access to External network services, such as DNS. This option is useful when services are provided by your ISP. Use this option when you want to define firewall policy on your own. | Allow DNS from Internal network and VPN Clients network to External network (Internet).
Allow limited Web access | This policy allows limited Web access using HTTP, HTTPS, and FTP only. All other network access is blocked. | Allow HTTP, HTTPS, and FTP from Internal network to External network. Allow all protocols from VPN Clients network to Internal network.
Allow limited Web access, allow access to ISP network services | This policy allows limited Web access using HTTP, HTTPS, and FTP, and allows access to ISP network services. All other network access is blocked. | Allow HTTP, HTTPS, and FTP from Internal network and VPN Clients network to External network (Internet). Allow DNS from Internal Network and VPN Clients Network to External Network (Internet). Allow all protocols from VPN Clients Network to Internal Network.
Allow access for all protocols | This policy allows unrestricted access to the Internet through ISA Server. ISA Server will prevent access from the Internet to protected networks. | Allow all protocols from Internal network and VPN Clients network to External network (Internet). Allow VPN Clients network to Internal network.

Get latest ISA Server content at ISA Server Guidance.


3-Leg Perimeter network template

ISA Server includes network templates, which correspond to common network topologies. One scenario involves setting up an ISA Server computer with three network adapters: one network adapter is connected to the Internet (External network), one is connected to the Internal network, and the third is connected to a perimeter network. The 3-Leg Perimeter network template applies to this scenario.

When you configure ISA Server by applying the 3-Leg Perimeter network template, ISA Server configures network rules and firewall policy, in accordance with the specific policy you select.

For instructions, see Apply a network template.

Firewall policy

As part of the process of applying network templates, you select a firewall policy that best matches your corporate security guidelines. The following table lists the firewall policies available when you select the 3-Leg Perimeter network template and also details the rules that are created when you select the policy.

Policy name | Description | Rules created
Block all | This policy blocks all network access through ISA Server. This option does not create any access rules other than the default rule which blocks all access. Use this option when you want to define firewall policy on your own. | None.
Block Internet access, allow access to network services on the perimeter network | This policy blocks all network access through ISA Server, except for access to network services (DNS) on the perimeter network. Use this option when you want to define the firewall policy on your own. | Allow DNS traffic from Internal network and VPN Clients network to perimeter network.
Block Internet access, allow access to ISP network services | This policy blocks all network access through ISA Server, except for access to external network services, such as DNS. This option is useful when network services are provided by your ISP. Use this option when you want to define firewall policy on your own. | Allow DNS traffic from Internal network, VPN Clients network, and perimeter network to External network (Internet).
Allow limited Web access | This policy allows limited Web access using only HTTP, HTTPS, and FTP. This policy blocks all other network access. | Allow HTTP, HTTPS, and FTP from Internal network and VPN Clients network to perimeter network and External network (Internet). Allow all protocols from VPN Clients network to Internal network.
Allow limited Web access, allow access to network services on perimeter network | This policy allows limited Web access using only HTTP, HTTPS, and FTP, and allows access to network services on the perimeter network. All other network access is blocked. This option is useful when network infrastructure services are available in the perimeter network. | Allow HTTP, HTTPS, and FTP from Internal network and VPN Clients network to perimeter network and External network (Internet). Allow DNS traffic from Internal network and VPN Clients network to perimeter network. Allow all protocols from VPN Clients network to Internal network.
Allow limited Web access, allow ISP network services | This policy allows limited Internet access and allows access to network services, such as DNS, provided by your ISP. All other network access is blocked. | Allow HTTP, HTTPS, FTP from Internal network and VPN Clients network to the External network (Internet). Allow DNS from Internal network, VPN Clients network, and perimeter network to External network (Internet). Allow all protocols from VPN Clients network to Internal network.
Allow all protocols | This policy allows unrestricted access to the Internet through ISA Server. ISA Server will prevent access from the Internet to protected networks. You can modify the access rules later to block specific types of network access. | Allow all protocols from Internal network and VPN Clients network to perimeter network and External network (Internet). Allow all protocols from VPN Clients network to Internal network.

Get latest ISA Server content at ISA Server Guidance.


Front Firewall network template

Internet Security and Acceleration (ISA) Server includes network templates, which correspond to common network topologies. One scenario involves the ISA Server computer deployed at the edge of a network, with another firewall configured at the back end, protecting the Internal network. In this scenario, ISA Server acts as the front line of defense in a back-to-back perimeter network configuration. The Front Firewall network template applies to this scenario.

When you configure ISA Server by applying the Front Firewall network template, ISA Server configures network rules and firewall policy, in accordance with the specific policy you select.

If the Configuration Storage server is located behind another ISA Server computer, you must create a server publishing rule to allow this array access to the Configuration Storage server. For more information, see Access to back-end Configuration Storage server.

For instructions, see Apply a network template.

Firewall policy

As part of the process of applying network templates, you select a firewall policy that best matches your corporate security guidelines. The following table lists the firewall policies available when you select the Front Firewall network template and also details the rules that are created when you select the policy.

Policy name | Description | Rules created
Block all | This policy blocks all network access through ISA Server. This option does not create any access rules other than the default rule that blocks all access. Use this option when you want to define firewall policy. | None.
Block Internet access, allow access to ISP network services | This policy blocks all network access through ISA Server, except for access to External network services, such as DNS. This option is useful when network services are provided by your ISP. Use this option when you want to define firewall policy. | Allow DNS from VPN Clients network and perimeter network to External network (Internet).
Block Internet access (network services are on the perimeter network) | This policy blocks all network access through ISA Server, except for access to network services, such as DNS, on the perimeter network. Use this option when you want to define the firewall policy. | Allow DNS from Internal network and VPN Clients network to perimeter network.
Allow limited Web access (network services are on the perimeter network) | This policy allows limited Web access. All other network access is blocked. | Allow HTTP, HTTPS, and FTP from VPN Clients network and perimeter network to External network (Internet). Allow all protocols from VPN Clients network to perimeter network.
Allow limited Web access, allow ISP network services | This policy allows limited Web access, and allows access to network services, such as DNS, provided by your ISP. All other network access is blocked. | Allow HTTP, HTTPS, and FTP from perimeter network and VPN Clients network to the External network (Internet). Allow DNS from Internal network, VPN Clients network, and perimeter network to External network (Internet). Allow all protocols from VPN Clients network to perimeter network.
Allow unrestricted access | This policy allows unrestricted access to the Internet through ISA Server. ISA Server will prevent access from the Internet to protected networks. You can modify the access rules later to block specific types of network access. | Allow all protocols from perimeter network and VPN Clients network to External network (Internet). Allow all protocols from VPN Clients network to perimeter network.


Back Firewall network template

Microsoft Internet Security and Acceleration (ISA) Server 2004 includes network templates, which correspond to common network topologies. One scenario involves the ISA Server computer deployed between a perimeter network and the Internal network, with another firewall configured at the back end, protecting the Internal network. In this scenario, ISA Server acts as the back line of defense in a back-to-back perimeter network configuration. The Back Firewall network template applies to this scenario.

When you configure ISA Server by applying the Back Firewall network template, ISA Server configures network rules and firewall policy, in accordance with the specific policy you select.

For instructions, see Apply a network template.

Firewall policy

As part of the process of applying network templates, you select a firewall policy that best matches your corporate security guidelines. The following table lists the firewall policies available when you select the Back Firewall network template and also details the rules that are created when you select the policy.

Policy name | Description | Rules created
No access: Block all | This policy blocks all network access through ISA Server. This option does not create any access rules other than the default rule which blocks all access. Use this option when you want to define firewall policy on your own. | None.
No access: Block Internet access (network services are in the perimeter network) | This policy blocks all network access through ISA Server, except for access to network services (DNS) on the perimeter network. Use this option when you want to define firewall policy on your own. | Allow DNS from Internal network and VPN Clients network to perimeter network.
No access: Block Internet access, allow access to ISP network services | This policy blocks all network access through ISA Server, except for access to External network services, such as DNS. This option is useful when network services are provided by your ISP. Use this option when you want to define the firewall policy access rules on your own. | Allow DNS from Internal network and VPN Clients network to External network (Internet), excluding perimeter address ranges.
Restricted access: Allow limited Web access | This policy allows limited Web access. All other network access is blocked. | Allow HTTP, HTTPS, and FTP from Internal network and VPN Clients network to External network (Internet). Allow all protocols from VPN Clients network to Internal network.
Restricted access: Allow limited Web access (network services are on perimeter network) | This policy allows limited Web access, and allows access to network services on the perimeter network. All other network access is blocked. | Allow HTTP, HTTPS, and FTP from Internal network and VPN Clients network to perimeter network and External network (Internet). Allow DNS from Internal network and VPN Clients network to perimeter network. Allow all protocols from VPN Clients network to Internal network.
Restricted access: Allow limited Web access, allow ISP network services | This policy allows limited Web access, and allows access to network services, such as DNS, provided by your ISP. All other network access is blocked. | Allow HTTP, HTTPS, and FTP from Internal network and VPN Clients network to External network (Internet). Allow DNS from Internal network and VPN Clients network to External network (Internet), except for perimeter address range. Allow all protocols from VPN Clients network to Internal network.
Unrestricted Internet access: Allow all protocols | This policy allows unrestricted access to the Internet through ISA Server. ISA Server will prevent access from the Internet to protected networks. You can modify the access rules later to block specific types of network access. | Allow all protocols from Internal network and VPN Clients network to External network (Internet) and perimeter address range. Allow all protocols from VPN Clients network to Internal network.

web link Get latest ISA Server content at ISA Server Guidance.


Single Network Adapter network template

You can install Microsoft Internet Security and Acceleration (ISA) Server 2004 on computers with a single network adapter. Typically, you will do so when another firewall is located on the edge of the network, connecting your corporate resources to the Internet. In this single adapter scenario, ISA Server typically functions as a cache server, caching content from the Internet, for use by clients on the corporate network.

When you apply the Single Network Adapter network template, the Internal network is configured to contain all IP addresses. The firewall policy named Allow Web proxy and caching is applied. This policy allows Web Proxy clients to access Web content on the Internet and accelerates Web performance through caching. No rules are created.

For instructions, see Apply a network template.

Internal network

One of the fundamental features of ISA Server is its ability to connect multiple networks. When ISA Server is installed on a single adapter computer, however, it recognizes only one network—the Internal network. The Internal network is comprised of all IP addresses, with the following exceptions: 0.0.0.0, 255.255.255.255, and the address range 127.0.0.0–127.255.255.255.

Installing ISA Server on a single adapter computer

As part of the setup process, you specify the addresses in the Internal network. When you install ISA Server on a computer with one network adapter, be sure to include all addresses except 0.0.0.0, 255.255.255.255, and the address range 127.0.0.0–127.255.255.255.

You can use the Single Network Adapter network template to configure your single adapter ISA Server computer. To use the template, in ISA Server Management, expand the Configuration node, and select Networks. In the task pane, on the Templates tab, select Single Network Adapter to start the Network Template Wizard. Follow the wizard steps to complete the configuration.

We recommend that you use the default settings provided by the Network Template Wizard.

Forward Web Proxy and caching

You can deploy ISA Server on a single adapter computer as a forward proxy and caching server, which provides clients with optimized access to the Internet. In this scenario, you can configure ISA Server to maintain a centralized cache of frequently requested Internet objects that can be accessed by any Web browser client, and use cache rules to manage the cache.

In this scenario, you will modify the default firewall policy to allow internal clients access to the Internet. Although all IP addresses are considered to be on the same Internal network, ISA Server may deny Web traffic due to the default Deny All rule. You therefore need to create a rule that allows traffic to pass between the networks.

In this scenario, ISA Server considers all IP addresses to be on the Internal network. However, traffic that passes through ISA Server is denied, by default. To enable this caching scenario, you must create an access rule that allows all clients to use Hypertext Transfer Protocol (HTTP), and possibly HTTPS and File Transfer Protocol (FTP). Because the Internal network is uniquely defined to include all addresses, the source and destination networks for this rule should be internal.

Web Proxy, Web, and Outlook Web Access publishing

You can deploy ISA Server on a single adapter computer as a reverse Web Proxy, and enable Web publishing and Outlook Web Access publishing scenarios.

Single adapter mode functionality

When you install ISA Server on a computer with a single adapter, the following ISA Server features cannot be used:

  • Firewall clients
  • Virtual private networking
  • Multi-network firewall policy
  • Server publishing
  • Application level filtering (except for protocols supported by Web Proxy: HTTP, HTTPS, and FTP over HTTP)
  • Stateful packet filtering
  • IP packet filtering

This results in a limited security role for ISA Server in your network.

web link Get latest ISA Server content at ISA Server Guidance.


Network rules

You can use Microsoft Internet Security and Acceleration (ISA) Server 2004 to configure network rules, thereby defining and describing a network topology. Network rules determine whether there is a relationship between two network entities, and what type of relationship is defined. Network relationships can be configured as follows:

  • Route. When you specify this type of connection, client requests from the source network are directly relayed to the destination network. The source client address is included in the request.
  • Network address translation (NAT). When you specify this type of connection, ISA Server replaces the Internet Protocol (IP) address of the client on the source network with its own IP address.

When no relationship is configured between networks, ISA Server drops all traffic between the two networks.

In a route network relationship, each network exposes its actual IP addresses. You should configure a route network relationship only when bidirectional traffic is required between the networks.

For instructions, see Create a network rule.

Enterprise-level network rules

Network rules can be created at the enterprise level and at the array level. Array-level network rules can apply to array-level network objects, to enterprise networks, and to other enterprise-level network objects. Enterprise-level network rules apply only to enterprise network objects.

Enterprise-level network rules are useful when you want to create a rule that is applicable to all arrays. For example, suppose that for all arrays in the enterprise, you want to define a NAT relationship from Internal to External.

Creating network rules

A route relationship indicates that no address translation is performed. Route networks are bidirectional. For example, if a route relationship is defined from network A to network B, a route relationship also exists from network B to network A. NAT relationships, however, are unique and unidirectional. If a NAT relationship is defined from network A to network B, no network relationship can be defined from network B to network A.

A NAT relationship is directional. It indicates that the addresses from the source network are always translated when passing through ISA Server. For example, assume a NAT network relationship from source network A to destination network B. IP addresses on source network A are replaced with an address on the ISA Server computer before the request is passed to the computer on destination network B. When a packet from network B is returned to the computer on network A, the address of the computer on network B is not translated. Computers on network A can see addresses of computers on network B. A NAT relationship ensures that the internal address structure of network A is not exposed and not accessible to network B.

The following figure illustrates the concept of network access policy.

Multi-networking: network view
  1. A route network relationship is defined between a branch office and headquarters. Route relationships are reciprocal.
  2. A NAT network relationship is defined from the corporate network to the perimeter network. NAT relationships are unidirectional and unique. No relationship can exist from the perimeter network to the corporate network.
  3. A NAT network relationship is defined from the corporate network to the Internet. No relationship exists from the Internet to the corporate network.
  4. A NAT network relationship is defined from the perimeter network to the Internet.

When you create network rules, you cannot define a network rule between a network and itself. Traffic between computers on the same network is defined as a route relationship. NAT is not supported for this traffic.

For both NAT relationships and route relationships, traffic can be permitted by configuring access rules. Publishing rules can be configured to allow traffic from the destination network to the source network.

For instructions, see Edit a network rule.

Default rules

When you create a new array, the following default array-level network rules are created:

  • Local Host Access. This rule defines a route relationship between the Local Host network and all other networks. In this way, connectivity is defined between the ISA Server computer and all networks connected to the ISA Server computer.
  • VPN Clients to Internal Network. This rule defines a route relationship between the Internal network and the Quarantined VPN Clients and the VPN Clients networks.
  • Internet Access. This rule defines a NAT relationship between the Internal network and the External network.

Processing order

Network rules are ordered. To determine the address relationship between two addresses, A and B, ISA Server processes network rules according to priority order, looking for a rule that matches the addresses. The first rule that matches defines the address relationship.

You could define a network rule with a route relationship between two networks, and then subsequently override this relationship for a particular address by creating a higher-order network rule.

ISA Server processes array-level network rules first, and then processes enterprise-level network rules. Array administrators can override enterprise-level network rules by creating array-level network rules.


Chaining and Routing

This section provides information about chaining and routing.

  • Web chaining rules
  • Firewall chaining
  • Dial-up connections
  • Network for automatic dialing
  • Dial-up connection configuration steps
  • PPTP or L2TP dial-up connections

Get latest ISA Server content at ISA Server Guidance.


Web chaining rules

Using Web chaining rules, you can conditionally route requests, depending on the destination. For example, an organization with headquarters in the United States and a branch office in the United Kingdom might set up a Microsoft Internet Security and Acceleration (ISA) Server 2004 computer at the branch office. The branch office server might be connected to an Internet service provider (ISP) in the United Kingdom. A Web chaining rule on the ISA Server computer at the branch office could direct requests for Internet hosts in the United Kingdom to the local ISP, with all other requests directed to the ISA Server computer at headquarters.

The downstream ISA Server computer at the branch office in the United Kingdom benefits from the ISA Server cache at headquarters. That benefit is augmented by additional caching of local objects—retrieved from the local ISP—on the ISA Server computer in the branch office.

The following figure illustrates how Web Proxy requests can be routed to different servers, depending on the requested destination.

Routing

In this figure, the ISA Server computer in the branch office routes client requests for sites in the United Kingdom (U.K.) to the ISA Server in the U.K. All other requests (marked "Request for international Web site" are routed directly to the Internet.

For instructions, see Create a Web chaining rule.

Routing Web requests

As part of the Web chaining rule configuration, you can specify how a Web Proxy client request should be routed:

  • Retrieving the object directly from the specified destination.
  • Routing the request to a specific upstream ISA Server computer. In this case, you can also specify a backup route if the primary route is unavailable.
  • Redirecting the request to a hosted site. In this case, the request is routed to the specified Web site.

We recommend that you encrypt the traffic to the upstream ISA Server computer by using Secure Sockets Layer (SSL) bridging.

For instructions, see Configure how Web chaining rules retrieve requests.

ISA Server uses the backup route when the primary route is unavailable. The ISA Server computer periodically polls the upstream server that is specified as the primary route, to determine if it is available. As soon as the primary route is available, requests are sent to that server, rather than the server on the backup route. For instructions, see Configure a primary route for Web requests and Configure a backup route for Web requests.

Authentication

In certain cases, the upstream server may require that the downstream proxy pass authentication. For those cases, credentials must be passed. These credentials are used by the upstream server to authenticate the downstream server.

When authentication is required, you can configure whether the Web server to which the request is redirected can authenticate the client. For instructions, see Allow delegation of credentials.

Important

  • When you pass credentials in plaintext to an upstream server, beware that the upstream server and network could potentially access those credentials. Over standard Hypertext Transfer Protocol (HTTP) connections, all information is passed as plaintext.

In a Web Proxy chaining scenario, user names and passwords can be specified using 7-bit characters only. Otherwise, Integrated Windows authentication will fail on the downstream proxy server.

Automatically poll upstream server for configuration option

In a chained scenario, an upstream array (with more than one member) might require Digest authentication. When the packets are always transferred to the same array member, the traffic will be successfully authenticated.

Consider a scenario in which a Web chaining rule is set to automatically poll the upstream server for configuration, and the upstream server requires Digest authentication. Typically, when a client request is chained to an upstream array, ISA Server automatically determines which array member should serve the request, and a request will always be served by the same array member. However, when the client sends an HTTPS request, ISA Server randomly determines which upstream array member serves the request; it might not be the same array member. In this case, Digest authentication may fail when the request is tunneled using SSL through a different upstream array member.

Bridging

For outgoing Web requests, ISA Server enhances standard routing functionality with an SSL bridging feature, which you can use to configure how traffic will be routed to the upstream server.

When you create a Web chaining rule, you can configure how HTTP and SSL requests will be redirected: as HTTP requests or as SSL requests. If requests are redirected as SSL requests, the ISA Server computer re-encrypts the packets before passing them on, and a new secure channel is established for the communication with the upstream server.

The upstream Web server may require a client certificate. In this case, configure ISA Server to authenticate with a specific client-side certificate.

For instructions, see Configure how to redirect HTTP requests and Configure how to redirect SSL requests.

web link Get latest ISA Server content at ISA Server Guidance.


Firewall chaining

For Firewall clients, you can use firewall chaining to configure how requests will be routed. You can select to route requests from Firewall clients to one of the following:

  • Directly to the Internet, with or without a dial-up connection.
  • To an upstream proxy server, with or without a dial-up connection.

Note

  • When client requests are routed, the objects are not cached.

Upstream proxy server

You can route client requests to an upstream ISA Server computer or a Microsoft Proxy Server 2.0 computer. In this case, you can specify a primary route.

Authentication

When Firewall client requests are sent to an upstream proxy server, you can enable password authentication. This specifies the authentication parameters that are used between ISA Server and an upstream server.

For instructions, see Configure firewall chaining.

Get latest ISA Server content at ISA Server Guidance.


Dial-up connections

Depending on how you configure routing and chaining, ISA Server uses a dial-up entry to dial out to the Internet. You can refine when ISA Server can use a dial-up connection, by specifying which networks can be accessed using a dial-up connection.

ISA Server can be configured to dial out for the following:

  • Firewall chaining. Use this option if you configure firewall chaining to access a network beyond the existing network, and it is necessary to dial out to access the chained network.
  • Web chaining rules. Use this option if the client requests an object, the route for the client request requires establishing a dial-up connection, and access policy allows the client request. ISA Server dials out to the Internet using the active dial-up entry.

In addition, ISA Server dials out to the Internet if a client requests an object and ISA Server cannot definitively determine whether the access policy allows the request, for example, if a Web chaining rule that applies to the request indicates that a dial-up connection should be established. This happens when the access policy rules specify a destination by name, while the client specifies the computer by Internet Protocol (IP) address.

ISA Server checks whether a Web chaining rule that applies to the client request requires establishing a dial-up connection. If such a Web chaining rule exists, ISA Server dials out to the Internet, either to resolve the name of the computer requested by the client or to do a reverse lookup. Then, ISA Server again checks the access policy rules to determine if the request is allowed. For more information about how rules are processed, see How firewall policy works.

Limiting when ISA Server dials out

You can limit when ISA Server dials out to the Internet by performing one or more of the following:

  • Configure the local domain table (LDT) so that it includes the names of all internal computers. In this way, ISA Server will not have to dial out to an external DNS server, only to determine that the requested computer is actually internal. Note that the LDT is checked only for requests from Firewall clients.
  • Allow dialing out only when accessing specific networks.

Closing dial-up connections

After ISA Server dials out to the Internet, the connection is maintained until one of the following occurs:

  • ISA Server dialed the connection, and the Microsoft Firewall service is subsequently stopped.
  • ISA Server dialed the connection, and while connected, you change the Internet service provider (ISP) used by ISA Server.
  • The dial-up entry reaches a predefined idle time and therefore terminates the connection.

Get latest ISA Server content at ISA Server Guidance.


Network for automatic dialing

Automatic dialing is configured per network. When Microsoft Internet Security and Acceleration (ISA) Server 2004 receives a request for the selected network, it uses the dial-up connection configured for the specific network.

Automatic dialing can be used for one network only.

If automatic dialing is used for connecting to the Internet, you should select the External network for the automatic dial-up connection. You may want to use automatic dialing for a network other than the Internet. For example, you can configure automatic dialing to connect to a branch office or to a specific location in your organization.

For instructions, see Configure automatic dialing. For instructions on creating networks, see Create an array-level network.


Dial-up connection configuration steps

The dial-up connection specifies the dial-up properties, such as Internet service provider (ISP), ISP phone number, and modem.

Dial-up connections are created in the Microsoft Windows Server New Connection Wizard.

After selecting a dial-up connection, you must specify the dial-up account details required by the ISP. These are the same account details used when creating the dial-up connection. The dial-up account details are used by ISA Server when connecting to the ISP.

To enable dial-on-demand, perform the following steps:

  1. Create a network connection on the operating system. For instructions on creating network dial-up connections, see Windows Help.
  2. Select the networks to which ISA Server will automatically dial out.
  3. Verify that a default gateway is not configured on any of the internal network adapters on the ISA Server computer.

Get latest ISA Server content at ISA Server Guidance.


PPTP or L2TP dial-up connections

For some cable modem connections, your Internet service provider (ISP) may support only Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol (L2TP) connections. In this case, you will need to perform the following steps to enable the dial-up connection from ISA Server:

  1. Use the New Connection Wizard to create a dial-up connection. On Network Connection Type, specify Connect to the network at my workplace. On Network Connection, select Virtual Private Network connection.
  2. Create an access rule allowing PPTP or L2TP (client protocol from the Local Host to the IP address of the ISP, or the External network). For instructions, see Create an access rule.
  3. Configure the dial-up preferences for ISA Server to use the network connection. For instructions, see Configure automatic dialing.

Get latest ISA Server content at ISA Server Guidance.


Network Load Balancing

This section provides information about the networking load balancing feature of Internet Security and Acceleration (ISA) Server 2004.

  • About Network Load Balancing
  • NLB integration modes
  • NLB configuration
  • How Integrated NLB Mode Works
  • NLB deployment
  • NLB best practices


NLB overview

Microsoft Internet Security and Acceleration (ISA) Server 2004 introduces a multi-networking model, which allows you to configure how policy should be applied between multiple networks. With this multi-networking model, ISA Server integrates Network Load Balancing (NLB) functionality, so that you can balance the load across all the array members on one or more networks.

You can use ISA Server to configure and manage the NLB functionality of Microsoft Windows Server 2003 running on ISA Server arrays. When you configure NLB through ISA Server, NLB is integrated with ISA Server functionality. This provides important functionality that is not available in Windows NLB alone.

In addition, ISA Server monitors NLB configuration, and discontinues NLB on a particular computer as necessitated by its status. This prevents the continued functioning of NLB when the state of the computer does not allow the passage of traffic. For example, if there is a failure of the network adapter on the computer, or if you stop the Microsoft Firewall service, ISA Server stops NLB-directed traffic from passing through that computer. When the issue is resolved, ISA Server will again allow traffic to pass through that computer.

ISA Server NLB is based on the NLB features of Windows Server 2003. Follow the Windows Server 2003 capacity guidelines when deploying NLB for ISA Server. For more information, see Network Load Balancing Clusters: Capacity Planning (http://www.microsoft.com/).

Benefits of Network Load Balancing

NLB provides high availability and scalability of servers using a cluster of up to 31 host computers working together. Clients access the cluster using either an IP address or a set of addresses. The clients are unable to distinguish the cluster from a single server. Server applications do not identify that they are running in a cluster. However, an NLB cluster differs significantly from a single host running a single server application because it can provide uninterrupted service even if a cluster host fails. The cluster can also respond more quickly to client requests than a single host.

NLB delivers high availability by redirecting incoming network traffic to working cluster hosts if a host fails or is offline. Existing connections to an offline host are lost, but the services remain available. In most cases, client software automatically retries the failed connections, and the clients experience a delay of only a few seconds in receiving a response.

NLB delivers scaled performance by distributing the incoming network traffic among one or more virtual IP addresses (the cluster IP addresses) assigned to the NLB cluster. The hosts in the cluster then concurrently respond to different client requests.

NLB employs a fully distributed algorithm to statistically map incoming clients to the cluster hosts based on their IP addresses. When inspecting an arriving packet, all hosts simultaneously perform this mapping to quickly determine which host should handle the packet. Although the mapping changes when the number of hosts changes, NLB continues to maintain the existing TCP connection.

NLB also maintains existing Point-to-Point Tunneling Protocol (PPTP) and Internet Protocol security (IPsec) tunnel connections. This implies that in virtual private network (VPN) scenarios, even if the mapping changes when the number of hosts changes, NLB will continue to maintain the tunnel.

ISA Server integrates the benefits of NLB into the product. When integrated NLB is enabled, each network in an array can be configured as an NLB cluster. The NLB algorithm is applied to the network, so that the load is balanced across the NLB-enabled network. Because NLB is enabled per network, the array administrator can configure, depending on functionality, how a specific network is load balanced, depending on the deployment scenario. For more information about NLB integration, see NLB integration modes.

web link Get latest ISA Server content at ISA Server Guidance.


NLB integration modes

Network Load Balancing (NLB) configuration is enabled per array. Each array can be configured in one of these modes:

  • Integrated NLB. In this mode, you use ISA Server Management to configure NLB. This mode allows you to configure whether a specific network should be load balanced. In this mode, you enjoy the benefits of integrated easy-to-manage configuration, array integrity maintenance, multi-networking, VPN support, and troubleshooting information. NLB configuration for the following is supported: unicast mode and single affinity.
  • Non-integrated NLB. In this mode, you use the Windows-based NLB tools to configure NLB.

By default, NLB integration is not enabled when you install Microsoft Internet Security and Acceleration (ISA) Server 2004. For instructions on enabling NLB integration, see Enable Network Load Balancing integration.

After NLB is enabled for the array, you can configure NLB on the array-level networks. You can enable NLB on any physical Ethernet network. On the other hand, do not enable NLB on networks that are not physically connected to the array. Specifically, we recommend that you enable NLB on all networks physically connected to the array (except for the intra-array network). For instructions, see Enable Network Load Balancing for a network.

When you enable NLB on a network, you specify the virtual IP address for that network. For instructions, see Configure a virtual IP address for a network.

ISA Server performs stateful inspection on all traffic. For this reason, ISA Server works with Windows NLB to ensure that incoming and outgoing traffic for each session is handled by the same array member. This is important, as this enables ISA Server to perform stateful inspection on the traffic.

Disabling NLB integration

When you disable integrated NLB mode, the existing Windows NLB settings remain configured on each array member. You can use Windows NLB tools on each array member computer to further modify these NLB configuration settings.

To completely disable NLB:

  1. Disable NLB for each network. For instructions, see Enable Network Load Balancing for a network.
  2. Apply changes. Check the Services tab and verify that the status for Network Load Balancing on each server is Not Configured. Also, verify that all array members are running.
  3. Disable NLB integration. For instructions, see Disable Network Load Balancing integration.

web link Get latest ISA Server content at ISA Server Guidance.


NLB configuration

For arrays with more than one member, and with more than one network adapter on each array member, you can configure Microsoft Internet Security and Acceleration (ISA) Server 2004 to work in integrated Network Load Balancing (NLB) mode. Alternatively, if integrated NLB mode is disabled, NLB can be configured for the operating system. In this mode, you receive none of the specific benefits of ISA Server load balancing.

After you enable NLB integration on an array, we recommend that you configure and enable NLB for each network in the array, except the intra-array network. The intra-array network is used for communication between array members and should not be load balanced.

When you enable a network for NLB, you specify its virtual IP address. You can monitor NLB for each array member, draining or stopping NLB on a specific array member, as appropriate.

Virtual IP addresses and dedicated IP addresses

When you configure NLB for a network, you must specify one virtual IP address for the network. With NLB integration enabled, ISA Server modifies both the network properties and the TCP/IP properties of the network adapter.

Each network adapter on each array member has a dedicated IP address. The dedicated IP address is actually the original primary IP address on the network adapter of the NLB-enabled network. In integrated NLB mode, each network adapter must have its own dedicated IP address.

When you specify the virtual IP address, ISA Server sets this IP address as the second IP address of all the network adapters attached to the applicable network in the array. ISA Server also sets the first IP address in the TCP/IP properties of these network adapters as the dedicated IP address, if it is not the same as the virtual IP address.

The network adapter used for NLB must have a dedicated IP address. Without this dedicated IP address, communication between array members and other hosts through this network adapter might not work properly. The dedicated IP address and the virtual IP address must belong to the same subnet and have the same subnet mask.

For instructions, see Configure a virtual IP address for a network.

Multiple virtual IP addresses

Using ISA Server Management, you can configure one virtual IP address for each load-balanced network. In some scenarios, you might want to have multiple virtual IP addresses. For example, consider a mail publishing scenario, where you may want to configure one virtual IP address on the External network for one mail server and a second virtual IP address for an additional mail server. To configure multiple virtual IP addresses, use the Windows-based IP properties.

You should configure the virtual IP addresses only after fully configuring NLB for that network. Similarly, be sure to remove the virtual IP addresses before you subsequently disable NLB on that network. Otherwise, the IP addresses may conflict.

Note

  • Additional virtual IP addresses should not be the same as the first dedicated IP address or second virtual IP address on the network adapter.

Stopping and starting NLB

In integrated NLB mode, ISA Server checks that all the servers in the NLB cluster are fully operational and that the traffic can flow appropriately through the various networks. Further, in integrated NLB mode, ISA Server is responsible for ensuring that either all NLB clusters are operational or that no NLB clusters are operational.

If NLB is not functioning on one network on a server, ISA Server will stop NLB on all the networks on this server. When the server becomes available, ISA Server adds it back to the array. Specifically, ISA Server determines that an array member is available for NLB clustering when the following is true:

  • ISA Server computer is available.
  • Microsoft Firewall service is running.
  • NLB is running on all network adapters of all NLB-enabled networks.
  • A network adapter can be assigned for each NLB-enabled network.

On each server, NLB is configured to start only when the Firewall service on that server is running.

In integrated NLB mode, NLB can have the following status:

  • Running. This status indicates that NLB is running on the specific array member server. The server will be subject to the NLB algorithm for load balancing.
  • Draining/Stopping. This status indicates that only active connections will be served by this array member. When load balancing all future connections to the array, this server will not be included in the NLB algorithm.
  • Stopped. This status indicates that no connections are served by this array member.
  • Suspended. This status indicates that NLB is stopped and will remain stopped even if ISA Server or the ISA Server computer is restarted.

You can manually suspend, stop, drain, or start the NLB service for each server in the array. For example, to remove a server from the NLB cluster, stop the NLB service on that server. In the situation where you want to suspend NLB while you do some maintenance work on a member server, suspend the NLB service on that server. Then, when you complete maintenance, resume NLB and the member server is again considered when balancing the load.

For instructions, see Drain and stop Network Load Balancing and Start or stop a service.

web link Get latest ISA Server content at ISA Server Guidance.


How Integrated NLB Mode Works

Network Load Balancing (NLB) enables all cluster hosts on a single subnet to concurrently detect incoming network traffic for the cluster IP addresses. On each cluster host, the NLB driver acts as a filter between the network adapter driver and the TCP/IP stack to distribute the traffic across the hosts. Microsoft Internet Security and Acceleration (ISA) Server 2004 takes over at this point, enabling NLB in complex deployment scenarios, including virtual private networking, Cache Array Routing Protocol (CARP), and Firewall Client.

By enabling integrated NLB mode on an array of Microsoft Internet Security and Acceleration (ISA) Server 2004 computers, you establish the framework for NLB configuration at the network level. That is, ISA Server load balances traffic on a per-network basis. After you enable NLB on the specific networks that you want load balanced, ISA Server determines the adapter that will be used for that network. There is one adapter selected per network.

Selecting the network adapter

When you configure integrated NLB mode, ISA Server load balances traffic on the specified networks. After you enable NLB on a specific network, ISA Server automatically determines which adapter in the network should be used for NLB. There can be only one such adapter per network.

ISA Server uses the following algorithm to select the network adapter to use for NLB:

  1. Identifies all the network adapters in the load balanced network that have a static IP address configuration (network adapters that are not assigned by DHCP).
  2. Removes the network adapter configured for intra-array communication from the NLB candidate list.
  3. Alphabetizes the network adapters by name.
  4. Selects the first network adapter that has an IP address on the same subnet as the specified virtual IP address.

This means that you can control which network adapter will be selected by renaming the adapter, and then restarting the Microsoft Firewall service.

Network rules and NLB

Network rules define the relationship between networks: network address translation (NAT) or route.

When traffic is configured as NAT from one network to another, the dedicated IP address is used for outgoing communication. The traffic always returns to the same array member.

When traffic is configured as routed, the destination computer sees the source computer IP address. For this reason, the destination computer must use the virtual IP address as its default gateway when communicating. Because NLB is integrated with ISA Server, NLB will know how to choose the appropriate array member.

web link Get latest ISA Server content at ISA Server Guidance.


NLB deployment

Depending on the specific deployment scenario, Microsoft Internet Security and Acceleration (ISA) Server 2004 performs Network Load Balancing (NLB) differently.

Publishing and NLB

When you configure NLB for published servers, the network is load balanced according to the clients' addresses, rather than according to the server's.

For example, suppose that you publish a server, which is located on an NLB-enabled network, to clients that are located on a different NLB-enabled network. When clients access the published server, the load is balanced according to the clients' addresses, not to the server's.

NLB and remote access VPN

When a remote access client initiates a VPN connection to an array, one of the array members establishes the VPN connection and allocates an IP address for that client. From then on, all traffic for that remote client passes through that array member.

NLB and site-to-site VPN

When NLB is enabled on a remote site network, ISA Server automatically assigns one array member to handle the VPN tunnel. In this way, parallel tunnels between two sites are not created. The tunnel is re-created on another server if the assigned server fails for any reason.

Two arrays might communicate using site-to-site VPN tunnels. However, each site must know the dedicated IP address of the other site. For Point-to-Point Tunneling Protocol (PPTP) and Layer Two Tunneling Protocol (L2TP) remote site networks, you must specify the dedicated IP addresses of the remote sites as additional remote gateways. For instructions, see Configure additional tunnel endpoints for the remote site.

You can use the NLB functionality of ISA Server to configure and manage the NLB functionality of Microsoft Windows Server 2003 running on ISA Server arrays.

In addition, the following is supported in integrated NLB mode, in a site-to-site VPN deployment:

  • Automatic routing of client requests to the array member that is hosting the VPN connection.
  • If the server that owns a site-to-site VPN connection fails, ISA Server automatically shifts the connection to another ISA Server array member.

web link Get latest ISA Server content at ISA Server Guidance.


NLB best practices

Follow these guidelines when configuring and deploying Network Load Balancing (NLB)-enabled networks with Microsoft Internet Security and Acceleration (ISA) Server 2004:

  • We strongly recommend that you do not use a layer 2 switch to connect the array members. Instead, use a hub and uplink that hub to the network switch.
  • For security reasons, we recommend that you protect the NLB cluster with a router. For more information, see Network Load Balancing: Security Best Practices for Windows 2000 and Windows Server 2003 (http://www.microsoft.com/).
  • When load balancing is enabled on all the networks in the array, you must add a network adapter. We recommend that you place this network adapter on a separate network subnet. In this way, all outgoing traffic to other array members will only pass through this network adapter, and not through load balanced networks.
  • If the Configuration Storage server is installed on an array member (a computer with ISA Server services), configure the name of the Configuration Storage server to resolve to the intra-array address of the array member.
  • When NLB is enabled, it synchronizes array members by using pure Ethernet protocol communication. This low-level traffic is not protected by ISA Server. To help secure that traffic, we strongly recommend that you place a Layer-3 router between the Internet and the NLB-enabled array. This Layer-3 router will not allow the low-level Ethernet protocol to pass, thereby helping protect the array from potentially malicious Ethernet traffic from the Internet that could disrupt the operation of NLB.
  • When you change the friendly name of an NLB-enabled network adapter, you must restart the Microsoft Firewall service.

web link Get latest ISA Server content at ISA Server Guidance.


Networking: How To

This section provides steps for setting network policy.

  • Apply a network template
  • Configure Networks
  • Configure Network Load Balancing
  • Configure Network Sets
  • Configure Network Rules
  • Configure Web Chaining Rules
  • Configure firewall chaining
  • Configure automatic dialing


Apply a network template

To apply a network template

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Templates tab, click the applicable network template.
  4. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you apply a network template, ISA Server overwrites all existing rules.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Networks

This section provides steps for configuring networks.

  • Create an enterprise network
  • Create an array-level network
  • Include enterprise networks in an array-level network
  • Configure network addresses
  • Configure domains included in a network
  • Delete a network


Create an enterprise network

To create an enterprise network

  1. In the console tree of ISA Server Management, click Enterprise Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Networks
  2. In the details pane, select the Networks tab.
  3. On the Tasks tab, click Create a New Network.
  4. When the New Network Wizard starts, follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • An IP address can be included in only one enterprise network.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Create an array-level network

To create an array-level network

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, select the Networks tab.
  3. On the Tasks tab, click Create a New Network.
  4. When the New Network Rule Wizard starts, follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Include enterprise networks in an array-level network

To include enterprise networks in an array-level network

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Addresses tab, click Add Network.
  5. In Select the enterprise networks included in this array network, select the enterprise networks.
    Click Select All to select all the defined enterprise networks.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Except for the Internal network, you cannot modify the addresses for any of the default networks created when ISA Server is installed.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure network addresses

To configure network addresses

  1. In the console tree of ISA Server Management, click Networks.

    For array-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks

    For enterprise networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Addresses tab, do one of the following:
    • To add a specific range of IP addresses, click Add Range. Then, type the first address of the network address range in Start Address and the last address of the network address range in End Address.
    • For array-level networks, to add IP addresses associated with a specific adapter, click Add Adapter, and then in Network adapter details, select one or more adapters.
    • For array-level networks, to add private address ranges, click Add Private, and then select a range from the list.
    • For array-level networks, to add an enterprise network, click Add Network, and then select one or more enterprise networks from the list.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Except for the Internal network, you cannot modify the addresses for any of the default networks created when ISA Server is installed.
  • You cannot include the following default enterprise networks in an array-level network: External, Local Host, Quarantined VPN Clients, and VPN Clients.
  • To remove an enterprise network, on the Networks tab, click Add Network. Then, clear the selection for the applicable enterprise network.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure domains included in a network

To configure domains included in a network

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Domains tab, click Add. Then, type the domain name in Enter a domain name to include.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To include a single computer, type its fully qualified domain name (FQDN). The server name should be unique. Using the FQDN will avoid any conflict with duplicated server names.
  • Domains cannot be configured for enterprise networks or for any of the default array-level networks, with the exception of the default Internal network.
  • To include an entire domain name, type *.domain_name.
  • To include all domains, type *.
  • To remove a domain from the network, on the Domains tab, select the applicable domain, and then click Remove.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Delete a network

To delete a network

  1. In the console tree of ISA Server Management, click Networks.

    For array-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks

    For enterprise networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Delete Selected Network, and then click Yes.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You cannot delete any of the default networks created when ISA Server is installed.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Network Load Balancing

This section provides steps for configuring Network Load Balancing (NLB).

  • Enable Network Load Balancing integration
  • Enable Network Load Balancing for a network
  • Configure a virtual IP address for a network
  • Disable Network Load Balancing integration
  • Drain and stop Network Load Balancing


Enable Network Load Balancing integration

To enable Network Load Balancing integration

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Enable Network Load Balancing Integration.
  4. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Network Load Balancing (NLB) should be enabled for the External network only if it is physically connected to the network.
  • When a virtual IP address is configured for a network, ISA Server adds the specified IP address to a network adapter on each server, and updates the routing table for that network adapter accordingly.
  • The combination of the virtual IP address and mask must yield the same subnet as the combination of the IP address and mask of the adapter in the network. That is, the virtual IP address must belong to the network.
  • When you enable or disable integrated NLB mode, all array members must be restarted.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Enable Network Load Balancing for a network

To enable Network Load Balancing for a network

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the NLB tab, select Enable load balancing on this network.
  5. In Virtual IP, type a virtual IP address to use for this network.
  6. In Mask, type the 32-bit value for the subnet mask of the specified virtual IP address.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Integrated Network Load Balancing (NLB) mode must be enabled to configure NLB for a network. For instructions, see Enable Network Load Balancing integration.
  • Network Load Balancing cannot be configured for enterprise-level networks and for the following default array-level networks: Local Host, Quarantined VPN Clients, and VPN Clients.
  • Network Load Balancing should be enabled for the External network only if it is physically connected to the network.
  • When a virtual IP address is configured for a network, ISA Server adds the specified IP address to a network adapter on each server, and updates the routing table for that network adapter accordingly.
  • The combination of the virtual IP address and mask must yield the same subnet as the combination of the IP address and mask of the adapter in the network. That is, the virtual IP address must belong to the network.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure a virtual IP address for a network

To configure a virtual IP address for a network

  1. In the console tree of ISA Server Management, click Networks.

    For array-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Load Balancing tab, in Virtual IP, type a virtual IP address to use for this network.
  5. In Mask, type the 32-bit value for the subnet mask of the specified virtual IP address.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Network Load Balancing (NLB) cannot be configured for enterprise-level networks and for the following default array-level networks: Local Host, Quarantined VPN Clients, and VPN Clients.
  • When a virtual IP address is configured for a network, ISA Server adds the specified IP address to a network adapter on each server, and updates the routing table for that network adapter accordingly.
  • The combination of the virtual IP address and mask must yield the same subnet as the combination of the IP address and mask of the adapter in the network. That is, the virtual IP address must belong to the network.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Disable Network Load Balancing integration

To disable Network Load Balancing integration

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Disable Network Load Balancing Integration.
  4. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you enable or disable integrated Network Load Balancing (NLB) mode, all array members must be restarted.
  • To disable NLB completely, first disable NLB for each network. For instructions, see Enable Network Load Balancing for a network. Then, apply changes and verify that the changes were applied to each array member. Finally, disable NLB integration.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Drain and stop Network Load Balancing

To drain and stop Network Load Balancing

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Services tab.
  3. In the details pane, select Network Load Balancing on the applicable array member (server).
  4. On the Tasks tab, click Drain and Stop Selected Service to start the selected service, or click Stop Selected Service to stop the selected service.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • This task is available only when the status of NLB is Running.
  • When you drain NLB on a server, only active connections will be served by this array member. For all future connections to the array, this server will not be included in the NLB algorithm.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Network Sets

This section provides steps for configuring network sets.

  • Create a network set
  • Edit a network set
  • Delete a network set

Get latest ISA Server content at ISA Server Guidance.


Create a network set

To create a network set

  1. In the console tree of ISA Server Management, click Networks.

    For array-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks

    For enterprise-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Networks
  2. In the details pane, select the Network Sets tab.
  3. On the Tasks tab, click Create a New Network Set.
  4. When the New Network Set Wizard starts, follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Array-level network sets can include (or exclude) only array-level networks. Enterprise-level network sets can include (or exclude) only enterprise networks.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Edit a network set

To edit a network set

  1. In the console tree of ISA Server Management, click Networks.

    For array-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks

    For enterprise-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Networks
  2. In the details pane, select the Network Sets tab, and then select the applicable network set.
  3. On the Tasks tab, click Edit Selected Network Set.
  4. On the Networks tab, select one or more networks to include in the network set.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Array-level network sets can include (or exclude) only array-level networks. Enterprise-level network sets can include (or exclude) only enterprise networks.
  • Enterprise network sets can be modified only at the enterprise level.
  • You cannot modify these default enterprise-level or array-level network sets: All Protected Networks and All Networks (and Local Host).

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Delete a network set

To delete a network set

  1. In the console tree of ISA Server Management, click Networks.

    For array-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks

    For enterprise-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Networks
  2. In the details pane, select the Network Sets tab, and then select the applicable network set.
  3. On the Tasks tab, click Delete Selected Network Sets, and then click Yes.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You cannot delete any of the default network sets created when ISA Server is installed.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Network Rules

This section provides steps for configuring network rules.

  • Create a network rule
  • Edit a network rule
  • Disable a network rule
  • Delete a network rule

Get latest ISA Server content at ISA Server Guidance.


Create a network rule

To create a network rule

  1. In the console tree of ISA Server Management, click Networks.

    For array-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks

    For enterprise-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Networks
  2. In the details pane, select the Network Rules tab.
  3. On the Tasks tab, click Create a Network Rule.
  4. When the New Network Rule Wizard starts, follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you create a network rule, you must click the Apply button in the details pane to save changes and update the configuration.
  • Because NAT relationships are directional, you should not create network rules that actually define bidirectional NAT relationships.
  • ISA Server processes array-level network rules first, and then processes enterprise-level network rules. Array administrators can override enterprise-level network rules by creating array-level network rules.
  • Enterprise-level network rules can apply only to enterprise network objects. Array-level network rules can apply to both array-level and enterprise-level networks.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Edit a network rule

To edit a network rule

  1. In the console tree of ISA Server Management, click Networks.

    For array-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks

    For enterprise-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Networks
  2. In the details pane, select the Network Rules tab, and then select the applicable network rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Source Networks tab, next to This rule applies to traffic from these sources, click Add, and then do the following:
    1. In Add Network Entities, select a network object, and then click Add.
    2. Repeat step a to add more network objects. Then, click Close.
    3. To exclude specific network objects, so that the rule does not apply, next to Exceptions, click Add.
    4. In Add Network Entities, select a network object, and then click Add.
    5. Repeat step d to add more network objects. Then, click Close.
  5. On the Destination Networks tab, next to This rule applies to traffic from these sources, click Add, and then do the following:
    1. In Add Network Entities, select a network object, and then click Add.
    2. Repeat step a to add more network objects. Then, click Close.
    3. To exclude specific network objects, so that the rule does not apply, next to Exceptions, click Add.
    4. In Add Network Entities, select a network object, and then click Add.
    5. Repeat step d to add more network objects. Then, click Close.
  6. On the Network Relationship tab, select one of the following:
    • Network Address Translation (NAT). To specify that a NAT relationship will be used from the source network to the destination network.
    • Route. To specify that a route relationship will be used between the source network and the destination network.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you edit a network rule, you must click the Apply button in the details pane to save changes and update the configuration.
  • In a NAT relationship, IP addresses of computers on the source network are replaced by an IP address of an adapter on the ISA Server computer that is connected to the destination network. NAT relationships are unique and unidirectional. If a NAT relationship is defined between Network A (source network) and Network B (destination network), do not define a network relationship between Network B (as the source) and Network A (as the destination).
  • In a route relationship, ISA Server routes the traffic between computers on the source and destination networks. IP addresses of computers on both networks are visible. Routed relationships are bidirectional. If a routed relationship is defined for traffic from Network A (source) to Network B (destination), a routed relationship also exists for traffic sent from Network B to Network A.
  • Because NAT relationships are directional, you should not create network rules that actually define bidirectional NAT relationships.
  • ISA Server processes array-level network rules first, and then processes enterprise-level network rules. Array administrators can override enterprise-level network rules by creating array-level network rules.
  • Enterprise-level network rules can apply only to enterprise network objects. Array-level network rules can apply to both array-level and enterprise-level networks.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Disable a network rule

To disable a network rule

  1. In the console tree of ISA Server Management, click Networks.

    For array-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks

    For enterprise-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Networks
  2. In the details pane, select the Network Rules tab.
  3. On the Tasks tab, click Disable Selected Rules.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you disable a network rule, you must click the Apply button in the details pane to save changes and update the configuration.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Delete a network rule

To delete a network rule

  1. In the console tree of ISA Server Management, click Networks.

    For array-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks

    For enterprise-level networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Networks
  2. In the details pane, select the Network Rules tab, and then select the applicable network rule.
  3. On the Tasks tab, click Delete Selected Network Rules, and then click Yes.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you delete a network rule, you must click the Apply button in the details pane to save changes and update the configuration.
  • You cannot delete the array-level Local Host Access rule that defines a routing relationship between the Local Host network and all other networks.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Web Chaining Rules

This section provides steps for configuring Web chaining rules.

  • Create a Web chaining rule
  • Configure how Web chaining rules retrieve requests
  • Configure a primary route for Web requests
  • Configure a backup route for Web requests
  • Allow delegation of credentials
  • Configure how to redirect HTTP requests
  • Configure how to redirect SSL requests
  • Delete a Web chaining rule

Get latest ISA Server content at ISA Server Guidance.


Create a Web chaining rule

To create a Web chaining rule

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab.
  3. On the Tasks tab, click Create New Web Chaining Rule.
  4. When the New Web Chaining Rule Wizard starts, follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure how Web chaining rules retrieve requests

To configure how Web chaining rules retrieve requests

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab, and then select the applicable Web chaining rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Action tab, select one of the following options:
    • To retrieve the requested object directly from the Internet, click Retrieving them directly from the specified destination.
    • If an upstream server should service the request, click Redirecting them to a specified upstream server. Then, do the following:
      • To allow the Web server to which the request is redirected to authenticate the client, select Allow delegation of basic authentication credentials.
      • Configure the backup route.
  5. If the request should be redirected to a different computer, click Redirecting them to a hosted site and configure the site, port, and Secure Sockets Layer (SSL) port.
  6. (Optional) If you route the request directly to the specified destination or to an upstream server, select the Use automatic dial-up for the primary route check box.
  7. (Optional) If you route the request directly to an upstream server and you specify a backup route, select the Use automatic dial-up for the backup route check box.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure a primary route for Web requests

To configure a primary route for Web requests

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab, and then select the applicable Web chaining rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Action tab, click Redirecting them to a specified upstream server, and then click Settings.
  5. In Server, type the name or Internet Protocol (IP) address of the ISA Server computer.
  6. In Port, type the port number on which the upstream server listens for Hypertext Transfer Protocol (HTTP) requests. This is typically port 8080.
  7. In SSL Port, type the port number on which the upstream server listens for Secure Sockets Layer (SSL) requests. This is typically port 8443.
  8. (Optional) If ISA Server should determine the configuration of the upstream server, to retrieve objects from the upstream server, click Automatically poll upstream server for the configuration and type the Uniform Resource Locator (URL) for the server.
  9. (Optional) If the upstream server is accessible only when the server supplies credentials, click Use this account, click Set Account, and type the user name, password, and authentication type.
  10. (Optional) If ISA Server should dial out for primary connections, on the Action tab under Automatic dial-up, select Use automatic dial-up for the primary route.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select Automatically poll upstream server for the configuration, ISA Server will determine the configuration of the upstream server. The local ISA Server computer uses this information to retrieve objects from the upstream server.
  • Because ISA Server supports pass-through authentication, the authentication information of the client requesting the object is passed to the upstream server. However, if the upstream server might not be able to identify the client, you can specify Use this account and supply which credentials to pass.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure a backup route for Web requests

To configure a backup route for Web requests

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab, and then select the applicable Web chaining rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Action tab, click Redirecting them to a specified upstream server, and then click Settings.
  5. In Server, type the name of the upstream server, and then click OK.
  6. In Backup route, select Upstream proxy server, and then click Settings.
  7. In Server, type the name of the upstream server and, then click OK.
  8. (Optional) Select Use automatic dial-up entry for the backup route if ISA Server dials out for backup connections.
  9. Click Settings.
  10. In Server, type the name of the ISA Server computer.
  11. In Port, type the port number of the upstream server. Typically, this is port 8080.
  12. In SSL Port, type the SSL port number of the upstream server. Typically, this is port 8443.
  13. (Optional) If the upstream server should supply configuration information, click Automatically poll upstream server for the configuration and type the URL of the server.
  14. (Optional) If the upstream server is accessible only when the server supplies credentials, click Use this account, and then click Set Account. Then, in User, type the user name, in Password, type the password, and then click OK. In Authentication, type the authentication method.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To use automatic dial-up entry for the backup route, you must configure a dial-up connection. For instructions, see Configure automatic dialing.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Allow delegation of credentials

To allow delegation of credentials

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab, and then select the applicable Web chaining rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Action tab, click Redirecting them to a specified upstream proxy server.
  5. Click Allow delegation of basic authentication credentials if the Web server to which the request is redirected can authenticate the client.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure how to redirect HTTP requests

To configure how to redirect HTTP requests

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab, and then select the applicable Web chaining rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Bridging tab, in Redirect HTTP requests as, select one of the following options:
    • If Hypertext Transfer Protocol (HTTP) requests should be routed to the upstream server using the HTTP protocol, click HTTP requests.
    • If HTTP requests should be routed to the upstream server using the Secure Hypertext Transfer Protocol (HTTPS) protocol, click SSL requests.
  5. (Optional) If you select SSL requests, select the Use a certificate to authenticate to the SSL Web server check box and click Select to select the certificate to use.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you select HTTP requests, ISA Server terminates the secure control channel.
  • If you select SSL requests, ISA Server opens a new secure control channel to the upstream server.
  • You only need to use a certificate if the Web server requires client certificate authentication.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure how to redirect SSL requests

To configure how to redirect SSL requests

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab, and then select the applicable Web chaining rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Bridging tab, in Redirect SSL requests as, select one of the following options:
    • If Secure Sockets Layer (SSL) requests should be routed to the upstream server using the Hypertext Transfer Protocol (HTTP) protocol, click HTTP requests.
    • If SSL requests should be routed to the upstream server using the Secure Hypertext Transfer Protocol (HTTPS) protocol, click SSL requests.
  5. (Optional) If you select SSL requests, select the Use a certificate to authenticate to the SSL Web server and click Select to select the certificate to use.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you select HTTP requests, ISA Server terminates the secure control channel.
  • If you select SSL requests, ISA Server opens a new secure control channel to the upstream server.
  • You only need to use a certificate if the Web server requires client certificate authentication.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Delete a Web chaining rule

To delete a Web chaining rule

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab, and then select the applicable Web chaining rule.
  3. On the Tasks tab, click Delete Selected Rule.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure firewall chaining

To configure firewall chaining

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • General
  2. In the details pane, click Configure Firewall Chaining.
  3. On the Firewall Chaining tab:
    • To use the primary connection method of ISA Server to access the Internet, click Use the primary connection.
    • To forward the request to an upstream ISA Server computer, click Chain to this computer and type the computer name in the text box.
  4. If you selected Chain to this computer, do the following:
    • If the requested application requires authentication, select the Use this account check box and click Set Account.
    • In User, type a domain name and user name using the following format:
      DomainName\UserName
    • In the Password and Confirm password text boxes, type the password.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • In a Web Proxy chaining scenario, user names and passwords can be specified using 7-bit characters only. Otherwise, Integrated Windows authentication will fail on the downstream proxy server.
  • We recommend that you specify the upstream computer's IP address, rather than its name.
    Also, on the upstream computer, configure the Firewall Client settings to manually select an ISA Server computer. Then, specify an IP address for the ISA Server computer, rather than a fully qualified domain name (FQDN).

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure automatic dialing

To configure automatic dialing

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • General
  2. In the details pane, click Specify Dial-Up Preferences.
  3. To allow automatic dialing, select Allow automatic dialing to this network.
  4. In the drop-down list box, select the applicable network.
  5. If the dial-up connection is your default gateway, select Configure this dial-up connection as the default gateway.
  6. In Use the following dial-up connection, provide the name of the dial-up connection, or click Select to select a connection.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Use the New Connection Wizard in Windows Server 2003 or Windows 2000 Server to create dial-up connections.
  • If you choose a dial-up entry that is a VPN connection, you will experience connectivity problems. This is because the PPTP and L2TP over IPSec protocols that are used to establish VPN connections are blocked by default in ISA Server. To avoid this, create access rules that allow PPTP and L2TP over IPSec traffic. For instructions, see Create an access rule.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Troubleshooting networking issues

What problem are you having?

Firewall clients cannot communicate.

Cause: Firewall clients cannot communicate when all the following conditions are true:

  • A route relationship is configured between the networks.
  • Firewall client support is enabled on the networks.
  • Network Load Balancing (NLB) integration is enabled on the networks.

Solution: Do one of the following:

  • Configure a network address translation (NAT) relationship between the networks. For instructions, see Edit a network rule.
  • Do not enable Firewall client support on the networks. For instructions, see Listen for Firewall Client requests.
  • Disable NLB integration on both networks. For instructions, see Enable Network Load Balancing for a network.

Some requests cannot be routed to an upstream ISA Server array, as specified in the routing rule.

Cause: When you configure a routing rule on a downstream ISA Server computer to route requests to an upstream ISA Server array, some requests may not succeed if one of the upstream server array nodes is not available. This occurs even though you have configured failover between the downstream server and the upstream server array by selecting Automatically poll upstream server for array configuration in the upstream server settings. This setting implements failover because the downstream server automatically and continuously sends requests to the upstream server array for information about array membership (http://upstream_server/array.dll?get.info.v2) and for the status and the availability of the upstream array nodes.
This problem occurs because the automatic request (array.dll?get.info.v2) has no credentials to provide for authentication. Credentials are required because Require all users to authenticate was enabled.

Solution: Disable the Require all users to authenticate option for the network. For instructions, see Configure authentication methods for Web Proxy clients.

Dial out to the Internet failed, although manual dial out works.

Cause: The dial-up entry credentials were not specified correctly, even though you may have specified credentials for the network dial-up connection correctly.

Solution: Reconfigure the dial-up entry credentials.

Cause: The ISA Server computer does not have permissions to use the dial-up connection.

Solution: Reconfigure the dial-up connection and allow Everyone to use the connection. For more information, see Windows Help.

Failed to dial out to the Internet because the connection is already being dialed.

Cause: Another service on the computer is connecting with this dial-up connection.

Solution: Wait for the connection operation to complete. ISA Server will attempt the connection again when a request is made. If the problem persists, restart the ISA Server services. For configuration instructions, see Start or stop a service.

The dial-up connection was dropped.

Cause: Someone may have inadvertently disconnected the dial-up connection.

Solution: Restart the ISA Server services. The services will automatically reestablish the connection. For configuration instructions, see Start or stop a service.

The dial-up connection never hangs up, even though there is no dialing activity.

Cause: Whenever a client request is made, even if for a computer on the local network, ISA Server sends name resolution requests to both the internal DNS server and an external DNS server.

Solution: Configure ISA Server to use only internal DNS servers. The internal DNS server should be configured as a client of ISA Server. Then, configure the internal DNS server to forward unresolved requests to an external DNS server.

The NLB failed to initialize alert was triggered.

Cause: When Network Load Balancing (NLB) integration is enabled, this alert is triggered when the Properties page for a network adapter (connection) is open on any array member.

Solution: Close all network adapter property pages. Then, restart the NLB service.

Cause: NLB was previously configured for the operating system.

Solution: Completely remove the NLB configuration. Then, restart the NLB service.


Firewall Policy

With Microsoft® Internet Security and Acceleration (ISA) Server 2004, you can maximize security with packet level, circuit level, and application level traffic filtering:

  • Stateful packet filtering determines which packets will be allowed to pass through to the secured network circuit and application layer proxy services. Stateful filtering opens ports automatically only as needed, and then closes the ports when the communication ends.
  • Circuit filtering provides application transparent circuit gateways for multiplatform access to many Internet protocols and services. Unlike other circuit layer proxies, ISA Server circuit layer security works together with dynamic packet filtering for enhanced security and ease of use.
  • Application filtering and stateful inspection handle commands within the application protocols (for example, HTTP and FTP) from client computers. ISA Server acts on behalf of the client computer, hiding the network topology and IP addresses from the outside network.

You can control inbound and outbound access by user and group, application, source and destination, and schedule. Firewall policy specifies which sites and content are accessible, whether a particular protocol is accessible for inbound and outbound communication, and allows or denies communication between specified IP addresses, using specified protocols and ports. This section explains the firewall policy.

  • Firewall Policy: Concepts
  • Firewall Policy: How To


Firewall Policy: Concepts

This section provides general background information about firewall policy and how it works in Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Enterprise policy
  • Effective array policy
  • How firewall policy works
  • Firewall Policy Rules
  • Publishing Rule Configuration
  • System Policy
  • Toolbox
  • Custom HTML error messages
  • Authentication
  • Network Protection


Enterprise policy

As enterprise administrator, you can define several enterprise policies. For example, you can create an enterprise policy that blocks known vulnerabilities, a second enterprise policy that allows baseline traffic (such as HTTP), and a third enterprise policy for VPN servers. Then, you can assign the enterprise policies to the relevant arrays.

The enterprise policy contains access rules, which specify whether traffic is allowed. Each enterprise policy consists of three categories of enterprise policy rules:

  • Enterprise policy rules that are processed before any array-level rules are processed.
  • Enterprise policy rules that are processed after the array-level rules are processed.
  • Default deny rule that is processed after all other enterprise and array-level rules are processed.

The enterprise policy contains only enterprise-level access rules. You can create array-level firewall policy rules only at the array level. For more information, see Firewall Policy Rules.

When configuring an enterprise policy, you can reorder the enterprise rules, moving them so that they are processed before the array rules or after the array rules. Only the default rule cannot be reordered. It is always processed last. For instructions, see Change the order of an enterprise policy rule.

Default enterprise policy

Upon installation of the first Configuration Storage server in the enterprise, a default enterprise policy is created, named Default, which contains only a default rule, named Deny All. The default rule denies all traffic. So, by default, no traffic will pass through Internet Security and Acceleration (ISA) Server computers to the enterprise.

The default enterprise policy cannot be modified or deleted.


Effective array policy

When an array is created, an enterprise policy is applied to the array. If the enterprise administrator did not create any other enterprise policies, the default enterprise policy is applied.

In addition to the enterprise policy rules that are applied to the array, as enterprise administrator, you can also determine how the enterprise policy should be used by the array administrators. You might decide on a very restrictive policy. In this case, no firewall policy rules will be configurable at the array level. On the other hand, you might decide on a very liberal policy, allowing the array administrators to define any rules.

Specifically, you can configure whether the following types of rules can be created at the array level:

  • Access rules that deny access ("Deny" access rules)
  • Access rules that allow access ("Allow" access rules)
  • Publishing rules

For instructions, see Apply an enterprise policy.

For example, an enterprise policy might only allow access to Hypertext Transfer Protocol (HTTP) addresses and deny communication using all other protocol definitions. An array that uses this enterprise policy can add a rule that limits who can use the HTTP protocol. But the array policy cannot allow communication using other protocols.

How effective array policy works

Effective array policy is the firewall behavior that results from the ordered set of rules that is the combination of the array-level and enterprise-level policy rules. Rules are processed in the following order:

  • Array system policy
  • Pre-array enterprise rules
  • Array firewall policy rules
  • Post-array enterprise rules

For example, if an enterprise administrator wants to allow File Transfer Protocol (FTP) access across the enterprise without exception, a pre-array enterprise access rule allowing FTP should be created. However, if it is desired to allow FTP access but give the array administrators the ability to deny FTP access, a post-array enterprise access rule allowing FTP should be created. If an array administrator then creates an array access rule denying FTP, the effective policy will be that FTP is denied. If the array administrator does not create a rule that denies FTP, the effective policy will be that FTP is allowed.

System policy rules are configured only at the array level. Note that because Internet Security and Acceleration (ISA) Server 2004 processes system policy rules first, the array administrator can override even pre-array enterprise policy rules by configuring the system policy.


How firewall policy works

Using Microsoft Internet Security and Acceleration (ISA) Server 2004, you can create a firewall policy, which includes a set of publishing rules and access rules. These rules, together with the network rules, determine how clients access resources across networks. For more information, see Firewall Policy Rules.

Outgoing requests

One of the primary functions of ISA Server is to connect between source and destination networks, while protecting from malicious access. To facilitate this connectivity, you use ISA Server to create an access policy that permits clients on the source network to access specific computers on the destination network. The access policy determines how clients access other networks.

When ISA Server processes an outgoing request, it checks network rules and firewall policy rules to determine if access is allowed. For Web Proxy client requests or HTTP, the network rule is ignored. Note that if the Web Proxy is disabled, the network rule would be required.

Some rules can be configured to apply to specific clients. In this case, the clients can be specified either by IP address or by user name. ISA Server processes the requests differently, depending on which type of client requests the object, and how you configure ISA Server.

First, ISA Server checks the network rules, to verify that the two networks are connected. If the network rules define a connection between the source and destination network, ISA Server processes the access policy rules. For more information, see Network rules.

Next, ISA Server checks the access rules, in order. If an allow rule applies to the request, ISA Server will allow the request. Specifically, ISA Server applies a rule if the request matches the following rule conditions, checking the rule elements in this order:

  1. Protocol
  2. From (source) address and port
  3. Schedule
  4. To (destination) addresses, names, URLs
  5. Users
  6. Content groups

Having applied a rule, ISA Server does not match the request to any other rule, and stops rule evaluation. Subsequently, ISA Server may actually deny the request, depending on the additional protocol filtering applied to the rule.

Finally, ISA Server checks the network rules again, to determine how the networks are connected. ISA Server checks the Web chaining rules (if a Web Proxy client requested the object) or the firewall chaining configuration (if a SecureNAT or Firewall client requested the object) to determine how the request will be serviced.

For example, assume that you installed ISA Server on a computer with two network cards: one connected to the Internet and the other connected to your local network. You have permissive corporate guidelines that allow all users access to all sites. In this case, your policy would consist of the following access policy rules:

  • A network rule that establishes connectivity between the source network (the local network) and the destination network (the Internet).
  • An access rule that allows all internal clients to access all sites at all times, using any protocol.

Access rules that deny traffic are processed before publishing rules. If a request matches an access rule, the request will be denied, even if a publishing rule would have allowed the request.

Incoming requests

ISA Server can make servers securely accessible to clients on another network. You use ISA Server to create a publishing policy to securely publish servers. The publishing policy, which consists of Web publishing rules, server publishing rules, secure Web publishing rules, and mail server publishing rules, together with the Web chaining rules, determines how published servers are accessed.

You can use one of the following ISA Server rules to publish servers:

  • Web publishing rules. To publish Web server content.
  • Server publishing rules. To publish any other content.
  • Secure Web publishing servers. To publish Secure Sockets Layer (SSL) content.

When ISA Server processes an HTTP or HTTPS request from a client, it checks publishing rules and Web chaining rules to determine whether the request is allowed, and which server will service the request.

For non-HTTP requests, ISA Server checks the network rules, and then checks the publishing rules to determine if the request is allowed.

For an incoming Web request, rules are processed in the following order:

  1. Web publishing rules.
  2. Web chaining rules. For more information, see Web chaining rules.

For example, consider a scenario, in which you have installed ISA Server on a computer with two network adapters: one connected to the Internet and the other connected to your local network. The following applies:

  1. If a Web publishing rule specifically denies the requests, the requests are denied.
  2. If a Web chaining rule specifies that the requests be routed to a specific upstream server or an alternate hosted site, the specified server handles the request.
  3. If a Web chaining rule specifies that the requests be routed to the specified server, the internal Web server returns the object.

Web publishing rules and Web chaining rules

Web publishing rules are processed in order, with the default Web publishing rule processed last. Web chaining rules are also processed in order.

When an external client requests an object from an internal Web server, rules are processed in the following order:

  1. Web publishing rules
  2. Web chaining rules

For example, consider the following rules:

  • A Web publishing rule that redirects requests from all clients for widgets.microsoft.com to a hosted site (Web server) specified as msweb.
  • A Web chaining rule that routes requests for a destination that includes msweb by servicing them directly.

When an external (Internet) user requests an object from widgets.microsoft.com, ISA Server intercepts the request. First, it processes the Web publishing rule, determining that the request will be redirected to the msweb computer. Next, it processes the Web chaining rule, determining that the request will be serviced directly by the specified server (msweb).

The following example illustrates what happens when you create a Web publishing rule, without creating an appropriate Web chaining rule:

  • A Web publishing rule that redirects requests from all clients for a destination set that includes example.microsoft.com to a hosted site specified as myinternalms.
  • A Web chaining rule that routes requests for all destinations to an upstream server.

In this case, the Web publishing rule is processed first. All requests for example.microsoft.com are redirected to myinternalms. However, the Web chaining rule specifies that the request will be routed to an upstream server (and not sent directly to the destination server). The request will always be routed to the upstream server.

Authentication

When rules requiring authentication are processed, ISA Server requires that the client present credentials. If the client cannot provide credentials, the request is dropped before the rule is evaluated. This implies that requests from SecureNAT clients are dropped if a matching rule requires authentication.

Enterprise-level rules can also be configured to require authentication. When an enterprise policy that includes such a rule is applied to an array, all Firewall clients must present credentials.

For more information, see Authentication.

web link Get latest ISA Server content at ISA Server Guidance.


Firewall Policy Rules

This section provides information about firewall policy rules.

  • Access rules
  • Web publishing rules
  • Secure Web publishing rules
  • Server publishing rules
  • Mail server publishing rules
  • Outlook Web Access server publishing

Get latest ISA Server content at ISA Server Guidance.


Access rules

Access rules determine how clients on a source network can access resources on a destination network. As an enterprise administrator, you can add an access rule to an enterprise policy. As an array administrator, you can create access rules for the specific array.

You can configure access rules to apply to all IP traffic, to a specific set of protocol definitions, or to all IP traffic except selected protocols.

For instructions, see Create an access rule.

Note

  • New rules apply only to new connections.

Traffic

Microsoft Internet Security and Acceleration (ISA) Server 2004 includes a list of preconfigured, well-known protocol definitions, including the Internet protocols which are most widely used. You can also add or modify additional protocols.

When a client requests an object using a specific protocol, ISA Server checks the access rules. A request is processed only if an access rule specifically allows the client to communicate using the specific protocol and also allows access to the requested object.

Access rules are processed in the context of primary connections that are outbound. This context is important for application and Web filters that may perform further processing on the traffic. Do not use protocols with an Inbound direction when creating access rules. Instead, use publishing rules.

For instructions, see Configure protocols for an access rule.

Access rules and application filters

Some application filters create and install new protocol definitions. When the application filter is disabled, all its protocol definitions are also disabled. Traffic that uses the protocol definition is blocked. For example, if you disable the streaming media filter, all traffic that uses the Windows Media® and RealNetworks protocol definitions is blocked.

Other application filters handle existing protocol definitions, either user-defined or configured by ISA Server. When these application filters are disabled, the protocol definitions that they filter are not disabled. For example, even if you disable the Simple Mail Transfer Protocol (SMTP) filter, SMTP protocol definitions might still be allowed to pass unfiltered.

When an access rule allows all IP traffic, ISA Server will pass any traffic that matches the rule to applicable application filters. If the traffic does not meet the application filter's criteria, ISA Server will reject the traffic and the connection will be closed.

Access rules apply to Firewall clients and SecureNAT clients when the protocol is defined by an application filter, or the access rule applies to a protocol that has only a primary connection—for example, Hypertext Transfer Protocol (HTTP).

If a protocol has secondary connections, and it is not defined by an application filter, the access rule applies only to the primary connection. If an application uses a protocol that has a secondary connection, this application will work only on Firewall clients.

For SecureNAT clients, if you configure an access rule to apply to all IP traffic, the rule will apply only to all defined protocols.

Per-rule filtering

Application filtering is applied on a per-rule basis. You can match the firewall policy best suited to your specific security needs. For example, suppose you allow all internal users access to the Internet, using all protocols. In this case, you may elect to have maximal filtering enabled. However, suppose also that you want to allow less-restrictive remote procedure call (RPC) access from the Internal network to a specific, trusted network. In this case, you may consider not applying the RPC filter's strict compliance, allowing DCOM traffic between the networks.

Per-rule filtering is available for access rules from the following application filters:

  • HTTP filter
  • RPC filter

For instructions, see Configure Per-Rule Filtering.

Logging requests that match a rule

An effective way to monitor which rules deny or allow specific traffic is to enable logging for each rule. However, the logging increases the load on the ISA Server computer, and can detrimentally impact performance. One way to work around this performance concern, while still maintaining security, is to identify which rules are being logged. Then, if a large amount of data is being logged from a specific protocol or source, you can create a new rule, which applies to that type of traffic, for which requests are not logged. For example, suppose your policy does not allow DHCP requests, and as a result, many DHCP requests are being denied. You can create a new access rule that denies DHCP requests, but does not log the requests.

By disabling logging for a specific rule, you reduce the load on the ISA Server computer if it is under attack. However, note that if you disable logging on the default deny rule, ISA Server cannot detect port scan attacks.

Default rule

A default rule, created when you install ISA Server, denies all access to and from all networks. This default rule cannot be modified or deleted.

Note

  • Because system policy rules are processed first by ISA Server, a system policy rule that allows the Local Host access to the External network will override any access policy rules you may specifically configure that deny such access.


Web publishing rules

Microsoft Internet Security and Acceleration (ISA) Server 2004 uses Web publishing rules to relieve the concerns associated with publishing Web content, without compromising network security. Web publishing rules determine how ISA Server will intercept incoming requests for Hypertext Transfer Protocol (HTTP) objects on a Web server, and how ISA Server will respond on behalf of the Web server. Requests are forwarded to the Web server, located behind the ISA Server computer. If possible, the request is serviced from the ISA Server cache.

Web publishing rules essentially map incoming requests to the appropriate Web servers. Web publishing rules also enable you to configure advanced filtering functionality, thereby publicizing your Web-based information, while securing it from malicious access.

For instructions, see Create a Web publishing rule.

Note

  • New rules apply only to new connections.

When you configure Web publishing rules, you specify the following:

  • Name (or IP address) of the Web server. You can limit whether the rule applies to all Web sites on the server, or to a specific Web site.
  • Path mapping. Before forwarding a request, ISA Server can modify the external path specified in the request and map it to a corresponding internal path. For more information, see Path mapping.
  • Users or computers that can access the published Web server. For instructions, see Configure users for a firewall policy rule.
  • Source. The network objects that can access the published Web server. For more information, see Network objects. Note that the network objects that you specify must also be included in the Web listener specified for this Web publishing rule. For instructions, see Configure source network objects for a firewall policy rule.
  • Web listener. The IP address on the ISA Server computer that listens for requests from clients. For more information, see Web listener overview.
  • Bridging. With bridging, you configure how HTTP requests are forwarded to the published server. For more information, see Bridging.
  • Link translation. With link translation, you configure how ISA Server scans Web pages for links and updates them with the external name and path. For more information about link translation, see Link Translation. For instructions on working with link translation, see Replace absolute links in Web pages and Add a link translation dictionary entry for a Web publishing rule.

You can further filter requests made to the Web server, by configuring HTTP filtering. For more information about the HTTP filter, see HTTP filter.

Important

  • We recommend that you do not enable directory browsing on the Web server that is published by ISA Server. Also, the Web server cannot require Digest authentication or Basic authentication. If it does, the internal name or IP address of the Web server may be exposed on the Internet.

Action

Web publishing rules specify which server (if any) will return the requested object. The request can be discarded or redirected to an alternate site, usually to a Web server on your corporate network.

When you configure the rule to redirect requests to a hosted site, ISA Server retrieves the object from the path specified in the request on the host computer. For example, suppose you specify that ISA Server redirect requests for example.microsoft.com/development to a host computer called Dev. When a client requests an object from example.microsoft.com/development, ISA Server retrieves the object from the development folder on Dev.

Web publishing rules determine the requested destination by reading the host header.

For instructions, see Configure an action for a firewall policy rule.

Logging requests that match a rule

An effective way to monitor which rules deny or allow specific traffic is to enable logging for each rule. However, the logging increases the load on the ISA Server computer, and can detrimentally impact performance. One way to work around this performance concern, while still maintaining security, is to identify which rules are being logged. Then, if a large amount of data is being logged from a specific protocol or source, you can create a new rule, which applies to that type of traffic, for which requests are not logged. For example, suppose your policy does not allow DHCP requests, and as a result, many DHCP requests are being denied. You can create a new access rule that denies DHCP requests, but does not log the requests.

By disabling logging for a specific rule, you reduce the load on the ISA Server computer if it is under attack. However, note that if you disable logging on the default deny rule, ISA Server cannot detect port scan attacks.

Path mapping

Before forwarding a request to the published Web server, ISA Server checks the (external) path specified in the request. If you configure path mapping, ISA Server will replace the path specified in the request with the corresponding path name. Note that each path you specify must be distinct and unique.

Follow these guidelines when specifying path mapping:

  • When you specify the internal path to which the request will be mapped, use this format: /mypath/*.
  • You cannot use a wildcard character in the path. For example, do not specify mypath*/ or /mypath*.
  • Avoid specifying a file name when you configure path mapping. Otherwise, only a request for the exact path will be served.

For instructions, see Configure path mapping.

Bridging

When you create a Web publishing rule, you can further secure HTTP communication. Even if the initial communication uses HTTP, after ISA Server receives the request, the communication can be redirected using Secure Sockets Layer (SSL). If the request is redirected as an SSL request, the packets are encrypted. This redirection is referred to as bridging.

You can set that HTTP or SSL requests will be passed as File Transfer Protocol (FTP) requests to the Web server. If the external client requests an object using HTTP or SSL, ISA Server can then redirect the request to the internal Web server using FTP. If you configure bridging in this way, you can specify which port will be used when bridging FTP requests.

The upstream Web server may require a client certificate. In this case, configure ISA Server to authenticate with a specific client-side certificate.

If you configure the Web publishing rule to require a secure channel, all client requests for the specified destinations must be on the port specified for SSL connections.

For instructions, see Configure how to redirect HTTP requests for Web publishing rules.

Publishing Web sites with the same domain name

Clients identify published Web sites by their fully qualified domain name (FQDN), as published by ISA Server. The FQDN for the Web site is the FQDN that you configure in the Web publishing rule. By publishing more than one Web server using the same FQDN, the client assumes that both published sites are actually the same. The Web client may send information intended for one Web server to the other Web server.

Rule order

Web publishing rules are processed together with all the firewall policy rules. They are processed in order, for each incoming Web request. When the rule matches a request, the request is routed and cached accordingly. If no rule matches the request, ISA Server processes the default rule and discards the request.


Secure Web publishing rules

With ISA Server, you can create secure Web publishing rules, to publish a website that hosts HTTPS content. Secure Web publishing rules determine how ISA Server will intercept incoming requests for HTTPS objects on an internal Web server and how ISA Server will respond on behalf of the Web server. Requests are forwarded to an internal Web server, located behind the ISA Server computer.

For instructions, see Create a secure Web publishing rule.

Note

  • New rules apply only to new connections.

Bridging

With bridging, you can configure how traffic will be passed to the Web server. For example, suppose a client uses Secure Sockets Layer (SSL) to communicate with the ISA Server computer, and a Web publishing rule maps the request to an internal Web server. The initial communication uses SSL. However, by default, all further communication uses a protocol that is not secure, such as HTTP.

When you create a secure Web publishing rule, you can configure how SSL requests will be redirected as HTTP requests or as SSL requests. If requests are redirected as SSL requests, ISA Server re-encrypts the packets before passing them on to the Web server. Therefore, a new secure channel is established for the communication with the SSL Web server. This redirection is also referred to as SSL bridging.

For more information, see SSL bridging.

Tunneling

When you configure a secure Web publishing rule to use tunneling mode, ISA Server relays unmodified, encrypted traffic to the published Web server. That is, ISA Server does not perform any additional filtering on the traffic.

Secure Web publishing rules that use tunneling mode (as opposed to bridging mode) are more similar to server publishing rules than to Web publishing rules. Many Web publishing features are not applicable to these rules, including link translation and path mapping. The rule cannot apply to specific users (only to network objects).

For more information, see SSL tunneling.

Listener

When you configure secure Web publishing rules, you are defining how HTTPS content on a published Web server will be accessed. An appropriate listener, configured to listen on an HTTPS port, should be specified for the secure Web publishing rule.

For more information, see Web Listeners.

Get latest ISA Server content at ISA Server Guidance.


Server publishing rules

Microsoft Internet Security and Acceleration (ISA) Server 2004 uses server publishing to process incoming requests to internal servers, such as File Transfer Protocol (FTP) servers, Structured Query Language (SQL) servers, and others. Requests are forwarded downstream to an internal server, located behind the ISA Server computer.

Server publishing allows virtually any computer on your Internal network to publish to the Internet. Security is not compromised because all incoming requests and outgoing responses pass through ISA Server. When a server is published by an ISA Server computer, the IP addresses that are published are actually the IP addresses of the ISA Server computer. Users who request objects think that they are communicating with the ISA Server computer—whose name or IP address they specify when requesting the object—while they are actually requesting the information from the publishing server. This is true when the network on which the published server is located has a network address translation (NAT) relationship from the network on which the clients accessing the published server are located. When you configure a route network relationship, the clients use the actual IP address of the published server to access it. For more information about network relationships, see Network rules.

Server publishing rules determine how server publishing functions, essentially filtering all incoming and outgoing requests through the ISA Server computer. Server publishing rules map incoming requests to the appropriate servers behind the ISA Server computer. These rules will grant access dynamically, as specified, from Internet users to the specific publishing server.

The published server is a SecureNAT client. Therefore, no special configuration of the published server is required after you create the server publishing rule on the ISA Server computer. Note that ISA Server must be configured as the default gateway on the published server.

Notes

  • Publishing IP-level and Internet Control Message Protocol (ICMP) primary protocols are not supported. An exception to this is Point-to-Point Tunneling Protocol (PPTP), which is a combination of a TCP connection and Generic Routing Encapsulation (GRE) packets, and is supported.
  • New rules apply only to new connections.

For instructions, see Create a server publishing rule.

Server publishing rules apply to one protocol. For instructions, see Configure protocols for a server publishing rule.

Logging requests that match a rule

An effective way to monitor which rules deny or allow specific traffic is to enable logging for each rule. However, the logging increases the load on the ISA Server computer, and can detrimentally impact performance. One way to work around this performance concern, while still maintaining security, is to identify which rules are being logged. Then, if a large amount of data is being logged from a specific protocol or source, you can create a new rule, which applies to that type of traffic, for which requests are not logged. For example, suppose your policy does not allow DHCP requests, and as a result, you see many DHCP requests that are being denied. You can create a new access rule that denies DHCP requests, but does not log the requests.

By disabling logging for a specific rule, you effectively reduce the load on the ISA Server computer if it is under attack. However, note that if you disable logging on the default deny rule, ISA Server cannot detect port scan attacks.

Per-rule filtering

Application filtering is applied on a per-rule basis. This means that you can match the firewall policy best suited to your specific security needs. Per-rule filtering is available for server publishing rules from the Exchange RPC filter.

Overriding default ports

When you use ISA Server to publish a server, by default, the firewall listens for incoming requests on the standard port of the respective protocol and passes incoming connections to the same standard port on the publishing server. For example, when you publish an FTP server, ISA Server listens for incoming requests on port 21, the port associated with the FTP protocol, and passes incoming connections to port 21 on the published server. You can override the standard port by specifying different ports in the publishing rule.

Note

  • When you publish a remote procedure call (RPC) interface where there is a route network relationship between networks, port overriding is ignored. The publishing rule will use the original IP address and port.

For instructions, see Override default ports for server publishing rules.

How server publishing works

ISA Server performs the following steps during server publishing:

  1. A client computer on the Internet requests an object from an IP address known as the publishing server. The IP address is actually associated with the ISA Server computer. It is the IP address of the external network adapter belonging to the ISA Server computer.
  2. The ISA Server computer processes the request, mapping the IP address to an internal IP address of an internal server.
  3. The internal server returns the object to the ISA Server computer, which passes it to the requesting client.

Server publishing rule usage

In many cases, you could use an access rule, rather than a server publishing rule, to make a server available to clients. Consider these issues:

  • You must use a server publishing rule when there is a NAT network relationship from the published server's network to the client's network.
  • A server publishing rule can only publish a single identified server. To publish several servers, you need several rules.
  • With server publishing rules, you can configure port overriding. For more information, see Overriding default ports.

Publishing DNS servers

ISA Server does not translate the IP address of DNS servers. To publish a DNS server, configure a route network relationship between the Local Host network and the network that includes the DNS server. Similarly, ISA Server must know the IP address of the DNS server.

Disabling rules

When you disable a server publishing rule, any attempt to connect to the server will be denied. Note, however, that ISA Server does not close active connections. For instructions, see Disable a firewall policy rule.

You can stop active connections by disconnecting the relevant sessions. For instructions, see Disconnect a session.


Mail server publishing rules

When you create mail server publishing rules, Microsoft Internet Security and Acceleration (ISA) Server 2004 creates the necessary publishing rules required to allow clients access to their mail servers. Depending on the type of mail server you specify, Web publishing or server publishing rules are configured, which allow access to the mail servers using the protocols you specify.

For instructions, see Publish a mail server.

You can select one of the following types of access that the published mail server provides:

  • Web client access. Allows clients access to Microsoft Outlook® Web Access, Outlook Mobile Access, or Exchange Application Services servers. If you select this option, ISA Server configures appropriate Web publishing rules. For more information, see Outlook Web Access server publishing.
  • Client access. Allows clients to use remote procedure call (RPC), Internet Message Access Protocol version 4rev1 (IMAP4), Post Office Protocol version 3 (POP3), or Simple Mail Transfer Protocol (SMTP) to access their mail. When you select this option, a server publishing rule is created for each selected protocol. For more information about server publishing rules, see Server publishing rules.
  • Server-to-server communication. Allows SMTP (mail) servers and NNTP (news) servers access.

When you publish a mail server, we recommend that you configure the fully qualified domain name (FQDN) of the mail server to the external Domain Name System (DNS) name of the ISA Server computer. In this way, the internal name of the mail server will not be made publicly available, and thereby open to attack.

To do this, in Internet Information Services (IIS), configure the domain name of the SMTP virtual server.

SMTP filtering

If the SMTP filter is installed and enabled, you can apply SMTP filtering. For more information, see SMTP Filtering.

RPC filtering

When you publish RPC type mail servers, you can apply RPC filtering. For more information, see RPC filter.

web link Get latest ISA Server content at ISA Server Guidance.


Outlook Web Access server publishing

Microsoft Internet Security and Acceleration (ISA) Server 2004 and Microsoft Outlook® Web Access work together, to enhance security for e-mail messages. You can securely publish Outlook Web Access servers with mail server publishing rules.

When you publish Outlook Web Access servers through ISA Server, you are protecting the Outlook Web Access server from direct external access because the name and IP address of the Outlook Web Access server are not accessible to the user. The user accesses the ISA Server computer, which then forwards the request to the Outlook Web Access server according to the conditions of your mail server publishing rule.

For instructions, see Publish a mail server.

The Mail Server Publishing Wizard takes you through the steps required to securely publish Outlook Web Access servers. Because the Outlook Web Access server requires the fully qualified domain name (FQDN) requested by the client, the wizard configures ISA Server to forward the original host header to the published Outlook Web Access server.

After completing the wizard, the following paths are specified for the resulting Web publishing rule:

  • /exchange/*
  • /exchweb/*
  • /public/*

Publishing Outlook Web Access servers

When you create the mail server publishing rule, note the following:

  • You must specify only standard ports, both on ISA Server and on the Outlook Web Access server. The standard port for HTTP is 80. The standard port for HTTPS is 443.
  • When you publish the Outlook Web Access server, you cannot configure bridging so that HTTP requests are forwarded as HTTPS requests.
  • When you configure bridging, specifying that HTTPS requests should be forwarded as HTTP requests to the Outlook Web Access server, do not enable link translation.

Publishing Outlook Mobile Access and Exchange Application Services

As part of the Mail Server Publishing Wizard, you can select to configure publishing of Outlook Web Access and Exchange Application Services, which like Outlook Web Access are Web-based mail servers. If you publish Outlook Mobile Access and Exchange Application Services, the following paths are specified for the resulting publishing rule:

  • /OMA/*
  • /Microsoft-Server-ActiveSync/*

Web listeners for Outlook Web Access publishing

The Web listener you configure for Outlook Web Access publishing could be configured to use forms-based authentication. If you configure secure connections to the clients, be sure that the listener listens for requests on an HTTPS port.

In this case, the authentication forms will be served from the ISA server computer, thus enabling forms-based authentication when publishing Exchange 2000 Server and Exchange Server version 5.5.

For more information about Web listeners, see Web Listeners.

Important

  • For security reasons, we recommend that the Web listener configured for Outlook Web Access publishing should not be used for any other publishing scenarios.

Forms-based authentication

As part of the wizard, you specify which listener to use for incoming Outlook Web Access requests.

When you configure Outlook Web Access publishing, we recommend that you use forms-based authentication. By using forms-based authentication, you avoid the danger inherent in caching client credentials on the client computer. Caching credentials is risky in kiosk scenarios. Because credentials are cached, even after the user logged off, if the browser window is left open, a malicious user can gain access to the original Outlook Web Access session.

To enable forms-based authentication, you must specify a listener configured to use this authentication type. For more information, see Forms-based authentication.

ISA Server supports forms-based authentication when publishing Exchange Server 2003, Exchange 2000 Server, and Exchange Server version 5.5.

Note

  • You cannot use forms-based authentication with Outlook Mobile Access clients.

Bridging mode

As part of the Outlook Web Access Publishing Rule Wizard, you can specify the bridging mode to use:

  • Secure connection to clients. When you select this option, ISA Server establishes a secure connection with the client computers and a standard connection to the mail server.
  • Secure connection to mail server and clients. When you select this option, ISA Server establishes a secure connection with both the mail server and the clients.
  • Standard connections only. When you select this option, ISA Server establishes a standard connection with both the mail server and the clients.

The recommended configuration for Outlook Web Access publishing is to use SSL-encrypted communication (HTTPS), both from the external client to the ISA Server computer and from the ISA Server computer to the Outlook Web Access server. This is because the credential information used in the authentication process must be protected, and should not be exposed even within the Internal network. For this reason, you must install digital certificates on both the ISA Server computer and the Outlook Web Access server.

Public (shared) and private computers

Outlook Web Access enables users to access their Exchange-based mailboxes from any computer. The computer might be a private computer or a public (shared) computer. The convenience afforded by the ability to access e-mail messages anywhere is countered by the dangers in leaving data on a public computer.

To combat these threats, ISA Server forms-based authentication helps you ensure that users will not leave their passwords cached on public computers.

Furthermore, you can configure a maximum idle time-out after which users are required to reauthenticate. For instructions, see Configure idle session time-out for Outlook Web Access clients.

Changing user passwords

Outlook Web Access includes optional functionality that allows users to change their passwords. If a user changes a password during an Outlook Web Access session, the cookie provided after the user initially logged on will no longer be valid. When forms-based authentication is configured on ISA Server, the user who changes the password during an Outlook Web Access session will receive the logon page the next time a request is made.

To allow users to change passwords, be sure to add the /IISADMPWD/* folder for the Outlook Web Access mail server publishing rule. Otherwise, the user will get an error each time the Change Password button is clicked in Outlook Web Access.

Blocking attachments

With ISA Server, you can block users from opening and saving attachments. Blocking can be configured for Outlook Web Access clients on a public computer, on a private computer, or on both.

Note that ISA Server attachment blocking differs from the attachment blocking performed by Exchange Server. The user can see that a message has an attachment, but will not be able to open or save the attachment.

For instructions, see Block attachments from Outlook Web Access clients.

Prefetching pages

Exchange Outlook Web Access servers include a prefetching feature, which enables files to be downloaded to the client computer while the client passes credentials. When using ISA Server forms-based authentication, to enable this feature, you must remove the comment marks from the following line in the logoff_msierich.htm file, typically located in the CookieAuthFilter subfolder (in the ISA Server installation folder):

"<IFRAME src="/exchweb/controls/preload.htm" style="display:none"></IFRAME>"

This prefetching functionality requires unauthenticated access to the /exchweb/* folder on the Outlook Web Access server. Therefore, if Web-based mail clients are required to authenticate on ISA Server, you should create a Web publishing rule allowing anonymous access to the /exchweb/* folder on the Outlook Web Access server. Subsequently, prefetching functionality should not be enabled if the Web listener is configured to require authentication.

RADIUS authentication and Outlook Web Access

If you change the RADIUS server policy while RADIUS-authenticated users are logged on, the new policy is not applied to users who are currently logged on. To apply the policy immediately, you can disconnect the session. This is because ISA Server caches the credentials of users who are logged on, when users accessing the published Outlook Web Access server authenticate using RADIUS authentication.


Publishing Rule Configuration

This section provides general background information about configuration common to all publishing rules that you can configure for Internet Security and Acceleration (ISA) Server 2004.

  • Network listeners
  • Default port overrides
  • Request forwarding
  • DNS website registrations
  • Host headers
  • SSL Bridging and Tunneling

Get latest ISA Server content at ISA Server Guidance.


Network listeners

When you create a server publishing rule to publish a server, you are actually configuring ISA Server to listen for requests from clients on behalf of that server. That is, you must configure a network listener on the ISA Server computer, which waits for requests from clients. When you configure a network listener, you specify the network corresponding to the network adapter on the ISA Server computer that will listen for incoming requests for the published service. The listener can listen on all IP addresses associated with a network or on specific IP addresses.

ISA Server listens on the specified network adapter, using the port number associated with the protocol that the server is publishing.

For instructions, see Configure network listeners for a server publishing rule.

Selecting listener networks (IP addresses)

The listener network, or networks, that you select depend on the networks from which clients will connect to the published server. For example, if the service you are publishing accepts client requests from the Internet (External network), you should select the External network for the listener. By selecting the External network, you are selecting the IP addresses on the ISA Server computer that are associated with the External network adapter. If you do not limit the IP addresses, all IP addresses associated with the selected network adapter will be included in the listener configuration.

In addition, for the rule to work, traffic sources (network entities) specified in the From tab of the publishing rule properties must be included in a network selected as a network listener.

Get latest ISA Server content at ISA Server Guidance.


Default port overrides

By default, when you create a firewall policy rule, ISA Server listens for requests on the specified port, but accepts requests from clients on any port. For access rules and for server publishing rules, you can limit the rule to accept requests only from specified source ports.

In addition, for server publishing rules, you can specify the port that ISA Server will use to accept incoming client requests for the published server. If you select to publish on a port other than the default port, ISA Server receives client requests for the published service on the nonstandard port, and then forwards requests to the designated port on the published server. For example, a server publishing rule may specify that client requests for File Transfer Protocol (FTP) services connect through port 22 on the ISA Server computer before being redirected to the default port 21 on the published server.

Also, for server publishing rules, you can specify that the published server will accept client requests for the published service on a port other than the default port. For example, if you are publishing two FTP servers, you can publish one FTP server on the default port for one set of users, and publish the other FTP server on another nonstandard port for a different set of users.

For instructions, see Override default ports for server publishing rules.

Get latest ISA Server content at ISA Server Guidance.


Request forwarding

When ISA Server receives a request for a published server, it determines whether the request is allowed, and then routes the request to the published server. For Web servers, by default, ISA Server does not pass the IP address of the original requesting client to the published server. Instead, ISA Server substitutes the original IP address that is specified in the packet, with its own IP address. As a result, all requests that are routed to the published server appear to have originated from the same IP address—that of the ISA Server computer.

For server publishing rules, ISA Server passes the IP address of the original requesting client to the published server.

Some applications require actual identification by the real requesting client. When you publish these applications, you can configure ISA Server to forward requests with the IP address of the requesting (source) client.

You can configure how ISA Server passes the client's IP address. For instructions, see Configure proxy requests for a firewall policy rule.

Get latest ISA Server content at ISA Server Guidance.


DNS website registrations

Domain Name System (DNS) is a TCP/IP naming resolution protocol that simplifies the process of connecting to hosts in complex networks, such as the Internet. A DNS server stores information that enables client computers to translate memorable, alphanumeric DNS names to IP addresses, which computers use to communicate with each other.

For example, most users prefer a friendly name, such as example.microsoft.com, to access a computer, such as a mail server or Web server on a network. A friendly name can be easier to learn and remember. DNS provides a way to map the user-friendly name for a computer or service to its numeric IP address.

If you register a domain name for your site, users can type your site's domain name in a browser to access your website.

Get latest ISA Server content at ISA Server Guidance.


Host headers

By default, when ISA Server receives an incoming Web request, it determines whether the request is allowed, and then routes the request to the appropriate location on the Web server as defined in the Web publishing rule. ISA Server does not pass the host header (for example, Host: example.microsoft.com) included in the client request to the published server. Instead, ISA Server substitutes the original host header in the request with the name of the server specified in the Web publishing rule. As a result, all requests that are routed to a particular Web server are sent to the same (default) website on that Web server.

You can configure ISA Server to pass the original host header information, thereby allowing client requests to be routed to a particular site on the Web server. For example, when you are publishing more than one website on the same Web server, the original host header is required for the request to be routed to the intended website.

For instructions, see Configure name of Web server to publish.

Get latest ISA Server content at ISA Server Guidance.


SSL Bridging and Tunneling

Secure Sockets Layer (SSL) bridging refers to the ability of ISA Server to encrypt or decrypt client requests, and pass the request to a destination Web server. SSL tunneling refers to the establishment of a tunnel directly from the client to the Web server, with no intervention by ISA Server.

  • SSL bridging is used when ISA Server ends or initiates an SSL connection. For more information, see SSL bridging.
  • SSL tunneling is used when a client browser (from the local, Internal network) requests an object using HTTPS on port 8080 through the ISA Server computer. For more information, see SSL tunneling.

Note

  • When possible, we recommend that you configure bridging for SSL requests.

Get latest ISA Server content at ISA Server Guidance.


SSL bridging

When you create a secure Web publishing rule, you specify the publishing mode: tunneling or bridging. For more information, see Secure Web publishing rules.

In both modes, ISA Server 2004 can read the contents of the Hypertext Transfer Protocol (HTTP) packets as they move through the firewall. Problems occur when the remote user connects to ISA Server using Secure Sockets Layer (SSL) protected HTTP connections. SSL encrypts the HTTP application layer information and prevents the firewall from performing stateful inspection on those packets.

The ISA Server SSL-to-SSL bridging feature allows stateful inspection of SSL connections and prevents attackers from hiding exploits inside the SSL channel. ISA Server decrypts the packets, inspects them for attack code, and then re-encrypts them. The re-encrypted packets are forwarded to the secure SSL Web server on the corporate network.

For example, in a publishing (or reverse proxy) scenario, ISA Server can service a client SSL request by terminating the SSL connection from a client and reopening a new connection with a Web server.

SSL bridging is used when ISA Server ends or initiates an SSL connection. Specifically, SSL bridging works in the following scenarios:

  • A client requests an HTTP object. ISA Server encrypts the request and forwards it to the Web server. The Web server returns the encrypted object to ISA Server. Then, ISA Server decrypts the object and sends it to the client. In other words, HTTP requests are forwarded as SSL requests.
  • A client requests an SSL object. ISA Server decrypts the request, and then encrypts it again and forwards it to the Web server. The Web server returns the encrypted object to ISA Server. ISA Server decrypts the object and then encrypts it again and sends it to the client. In other words, SSL requests are forwarded as SSL requests.
  • A client requests an SSL object. ISA Server decrypts the request and forwards it to the Web server. The Web server returns the HTTP object to ISA Server. ISA Server encrypts the object and sends it to the client. In other words, SSL requests are forwarded as HTTP requests.

For incoming Web requests, an external client uses HTTPS to request an object from a Web server located on your Internal network. The client connects to ISA Server on a port—by default, port 443. In this case, ISA Server responds with a server-side SSL certificate to the client.

For this scenario, ISA Server must be configured to listen for SSL requests on port 443, and a server certificate must be specified.

Having received the client's request, ISA Server decrypts it, terminating the SSL connection. The Web publishing rules determine how ISA Server communicates the request for the object to the publishing Web server (FTP, HTTP, or SSL).

If the secure Web publishing rule is configured to forward the request using HTTPS, ISA Server initiates a new SSL connection with the publishing server, sending a request to port 443. Because the ISA Server computer is now an SSL client, it requires that the publishing Web server responds with a server-side certificate. If the Web server requires a client certificate, ISA Server must respond with the appropriate certificate.

Bridging Mode

When you select bridging, you configure the bridging mode to use for the secure Web publishing rule:

  • Secure connection to clients. When you select this mode, ISA Server establishes a secure HTTPS connection with the client, but forwards the request as standard HTTP to the published Web server.
  • Secure connection to Web server. When you select this mode, ISA Server establishes a standard HTTP connection with the client, but forwards the request as secure HTTPS to the published Web server.
  • Secure connection to client and Web server. When you select this mode, ISA Server establishes a secure HTTPS connection with the client, and also forwards the request as secure HTTPS to the published Web server.

The following figure illustrates an SSL bridging scenario.

SSL bridging

The figure illustrates a reverse publishing scenario. In this scenario, the client requests objects from ISA Server, which forwards the request to the published Web server. In the figure, the Web Proxy client (browser) connects to ISA Server. ISA Server returns a server-side certificate, authenticating itself to the client. When the client and ISA Server complete the SSL negotiation, the client sends an encrypted HTTP request to ISA Server. ISA Server decrypts the request and checks whether the requested object is in its cache.

If the object is in the cache, ISA Server returns the object to the client.

If the object is not in the cache, ISA Server encrypts the request and sends the request to the Web server. The Web server returns a server-side certificate to ISA Server. When ISA Server and the Web server complete the SSL negotiation, ISA Server sends the encrypted HTTP request to the Web server. The Web server decrypts the request and returns it to ISA Server.

ISA Server receives the object, encrypts it, and passes it to the requesting client.

Get latest ISA Server content at ISA Server Guidance.


SSL tunneling

When you create a secure Web publishing rule, you specify the Secure Sockets Layer (SSL) publishing mode: SSL bridging or SSL tunneling. For more information, see Secure Web publishing rules.

In tunneling mode, a client can establish a tunnel through the ISA Server computer directly to the Web server with the requested Secure Hypertext Transfer Protocol (HTTPS) object. Whenever a client browser requests an HTTPS object through ISA Server, it uses SSL tunneling.

In tunneling mode, when the connection between the client and the server is encrypted, ISA Server does not inspect the contents of the connection. No policy or filtering is applied to those contents.

The following figure illustrates the SSL tunneling process.

SSL Tunneling
  1. A client requests an SSL object from a Web server on the Internet, by typing the following in the Address bar of the Web browser:
    https://URL_name
  2. The following request is sent to port 8080 on the ISA Server computer:

    CONNECT URL_name:443 HTTP/1.1

  3. ISA Server connects to the destination Web server on port 443.
  4. When the TCP connection is established, ISA Server returns:

    HTTP/1.0 200 connection established

From that point on, the client communicates directly with the external Web server.

Get latest ISA Server content at ISA Server Guidance.


System Policy

This section provides general background information about the system policy defined by Internet Security and Acceleration (ISA) Server 2004.

  • System policy overview
  • System policy rules
  • System policy defaults

Get latest ISA Server content at ISA Server Guidance.


System policy overview

Microsoft Internet Security and Acceleration (ISA) Server 2004 protects your network resources, while connecting them securely for specifically defined needs. ISA Server ensures a balance between security and the need to connect. This often requires defining specific firewall policy rules. It also requires that you put in place a networking infrastructure that allows for basic functionality. Authentication, network diagnostics and logging, and remote management are examples of services you may want to enable to effectively administer and monitor network activity and security. For more information, see System policy rules.

ISA Server introduces system policy, a set of firewall policy rules that controls how the ISA Server computer enables the infrastructure necessary to manage network security and connectivity. ISA Server is installed with a default system policy, designed to address the balance between security and connectivity.

Some system policy rules are enabled upon installation. These are considered the most basic and necessary rules for effectively managing the ISA Server environment. You can subsequently identify those services and tasks that you require to manage your network, and enable the appropriate system policy rules. For more information, see System policy defaults.

Limiting system policy

After you install ISA Server, you can configure the system policy. You identify those services and tasks not critical to how you manage your network, and then disable the associated system policy rules.

In general, from a security perspective, we strongly recommend that you disable all system policy rules that you do not require to manage your network. After installation, carefully review the system policy rules configured. After you perform major administrative tasks, review the system policy configuration again.

For instructions, see Enable system policy configuration group.

In addition to disabling unnecessary system policy rules, limit the applicability of the rules to required network entities only. For example, the Active Directory system policy configuration group, enabled by default, applies to all computers on the Internal network. You could limit this to apply only to a specific Active Directory group on the Internal network.

For instructions, see Edit destinations for a system policy rule.

Note

  • Many system policy rules apply to the Local Host network. However, the Local Host network in the context of system policy rules refers to communication with the Microsoft Firewall service, and not with the ISA Server computer. There are some exceptions, for example, the Remote Management configuration group.

System policy processing order

ISA Server processes system policy rules first, before any other array-level rule, and before pre-array enterprise rules. This means that the array administrator can override pre-array enterprise policy rules by configuring the system policy.

web link Get latest ISA Server content at ISA Server Guidance.


System policy rules

When you enable a system policy configuration group, one or more system policy rules are enabled. Upon installation, the rules apply to specific networks, as listed in the table that follows. You can subsequently modify the networks to which the rules apply.

When you disable a system policy configuration group, you are not necessarily preventing use of a particular protocol. This is because the same protocol may be specified in a different rule, which is enabled by a different configuration group.

You can show or hide the system policy rules, in the Firewall Policy details pane. For instructions, see Show system policy rules.

The following table lists the system policy scenario group, configuration group, the rule names associated with each category, and a brief description of each rule.

Scenario group | Configuration group | Rule name | Rule description
Network Services | DHCP | Allow DHCP requests from ISA Server to Internal Allow DHCP replies from DHCP servers to ISA Server | Allows the ISA Server computer to access the Internal network using the DHCP (reply) and DHCP (request) protocols.
Network Services (Name resolution using DNS) | DNS | Allow DNS from ISA Server to selected servers | Allows the ISA Server computer to access all networks using the DNS protocol.
Network Services (Time configuration) | NTP | Allow NTP from ISA Server to trusted NTP servers | Allows the ISA Server computer to access the Internal network using the NTP (UDP) protocol.
Authentication (Windows user authentication) | Active Directory | Allow access to directory services for authentication purposes Allow RPC from ISA Server to trusted servers Allow Microsoft CIFS from ISA Server to trusted servers Allow Kerberos authentication from ISA Server to trusted servers | Allows the ISA Server computer to access the Internal network using various LDAP protocols, RPC (all interfaces) protocol, various Microsoft CIFS protocols, and various Kerberos protocols, using Active Directory® directory service.
Authentication Services | RSA SecurID | Allow SecurID authentication from ISA Server to trusted servers | Allows the ISA Server computer to access the Internal network using the RSA SecurID® protocol.
Authentication Services | RADIUS | Allow RADIUS authentication from ISA Server to trusted RADIUS servers | Allows the ISA Server computer to access the Internal network using various RADIUS protocols.
Authentication Services | Certificate revocation list | Allow HTTP from ISA Server to all networks for CRL downloads | Authentication Services: Allow HTTP from ISA Server to selected networks for downloading updated certificate revocation lists (CRLs)
Remote management | Microsoft Management Console | Allow remote management from selected computers using MMC Allow MS Firewall Control communication to selected computers | Allows computers in the Array Servers, Enterprise Remote Management Computers, and Remote Management Computers computer sets to access the ISA Server computer using the MS Firewall Control, NetBIOS Datagram, NetBIOS Name Service, NetBIOS Session, and RPC (all interfaces) protocols.
Remote management | Terminal server | Allow remote management from selected computers using Terminal Server | Allows computers in the Enterprise Remote Management Computers and Remote Management Computers computer sets to access the ISA Server computer using the RDP (Terminal Services) protocol.
Remote management | ICMP (ping) | Allow ICMP (PING) requests from selected computers to ISA Server | Allows computers in the Enterprise Remote Management Computers and Remote Management Computers computer sets to access the ISA Server computer using the ICMP protocol, and vice versa.
Firewall Client (Access to Firewall Client Share) | Firewall client setup | Allow access from trusted computers to the Firewall Client installation share on ISA Server | Allows computers on the Internal network to access the ISA Server computer using various Microsoft CIFS and NetBIOS protocols. When you enable this rule, access is allowed to the ISA Server computer using server message block (SMB) from any network or computer specified here. Access is not limited only to the Firewall Client installation shared folder.
Diagnostic Services | ICMP | Allow ICMP requests from ISA Server to selected servers | Allows the ISA Server computer to access all networks using various ICMP protocols and the Ping protocol.
Diagnostic Services | Windows networking | Allow NetBIOS from ISA Server to trusted servers | Allows the ISA Server computer to access all networks using various NetBIOS protocols.
Diagnostic Services (Microsoft Error Reporting) | Communication to Microsoft | Allow HTTP/HTTPS from ISA Server to specified Microsoft error reporting sites | Allows the ISA Server computer to access members of the Microsoft Error Reporting sites URL set using HTTP or HTTPS protocols.
Logging | Remote logging (NetBIOS) | Allow remote logging to trusted servers using NetBIOS | Allows the ISA Server computer to access the Internal network using various NetBIOS protocols.
Logging | Remote Logging (SQL) | Allow remote SQL logging from ISA Server to selected servers | Allows the ISA Server computer to use Microsoft (SQL) protocols to access the Internal network.
Remote monitoring | Remote Performance Monitoring | Allow remote performance monitoring of ISA Server from trusted servers | Allows computers on the Internal network to access the ISA Server computer using various NetBIOS protocols.
Remote monitoring | Microsoft Operations Manager | Allow remote monitoring from ISA Server to trusted servers, using Microsoft Operations Manager (MOM) Agent | Allows the ISA Server computer to access the Internal network using the Microsoft Operations Manager agent.
Remote monitoring (Mail alerts) | SMTP | Allow SMTP from ISA Server to trusted servers | Allows the ISA Server computer to access the Internal network using the SMTP protocol.
Various (Cache) | Scheduled Download Jobs | Allow HTTP from ISA Server to selected computers for Content Download Jobs | Allows the ISA Server computer to access all networks using the HTTP protocol.
Various (Access to Microsoft sites) | Allowed sites | Allow HTTP/HTTPS requests from ISA Server to specified sites | Allows the ISA Server computer to access members of the System Policy Allowed Sites URL set using HTTP and HTTPS protocols.
Configuration Storage server | Remote Configuration Storage Server Access | Allow remote access to Configuration Storage server | Allows access from Local Host to the Enterprise Configuration Storage Server computer set, using the MS Firewall Storage protocol.
Configuration Storage server | Local Configuration Storage Server Access | Allow access from trusted servers to the local Configuration Storage server | Allows access to Local Host from the Array Servers, Enterprise Remote Management Computers, Managed ISA Server Computers, Remote Management Computers, and Replicate Configuration Storage Servers computer sets, using CIFS (TCP and UDP) and MS Firewall Storage protocols.
Configuration Storage server | Replicate Configuration Storage Server Access | Allow replication between Configuration Storage servers | Allows communication to and from the Replicate Configuration Storage Servers computer set, using MS Firewall Control and RPC protocols.
Intra-array communication | Array Member Communication | Allow intra-array communication | Allows intra-array communication using MS Firewall Control and RPC protocols to and from the Array Servers computer set.

In addition to the rules listed in the preceding table, the system policy includes the following rules that apply to a virtual private network (VPN) configuration:

  • Allow VPN site-to-site traffic to ISA Server
  • Allow VPN site-to-site traffic from ISA Server
  • Allow VPN client traffic to ISA Server

These rules are enabled when you enable virtual private networking. For instructions, see Enable remote VPN client access.

When you create an HTTP connectivity verifier, ISA Server checks for connectivity by sending HTTP GET requests to the specified computer. A system policy rule named Allow HTTP/HTTPS from firewall to all networks, for HTTP connectivity verifiers is configured as necessary, to allow these requests.

web link Get latest ISA Server content at ISA Server Guidance.


System policy defaults

The information that follows describes the system policy default settings, upon installation. For background information about system policy, see System policy overview.

Network services

When you install Microsoft Internet Security and Acceleration (ISA) Server 2004, basic network services are enabled. After installation, ISA Server can access name resolution servers and time synchronization services on the Internal network.

If the network services are available on a different network, you should modify the applicable configuration group sources to apply to the specific network. For example, suppose the DHCP server is not located on the Internal network, but on a perimeter network. Modify the source for the DHCP configuration group to apply to that perimeter network.

You can modify the system policy, so that only particular computers on the Internal network can be accessed. Alternatively, you can add additional networks, if the services are found elsewhere. For instructions, see Edit destinations for a system policy rule.

Authentication services

One of the fundamental capabilities of ISA Server is the ability to apply a firewall policy to specific users. To authenticate users, however, ISA Server must be able to communicate with the authentication servers. For this reason, by default, ISA Server can communicate with Active Directory® servers (for Windows authentication) and with RADIUS servers located on the Internal network.

Note that communication with RSA SecurID® authentication servers is not enabled by default. If your firewall policy requires RSA SecurID authentication, be sure to enable this configuration group. For more information about RSA SecurID authentication, see Authentication support for RSA SecurID.

You should consider limiting the destinations for these system policy configuration groups, so that they apply only to specific computers on the applicable network.

Remote management

By default, the system policy rules allowing remote management of ISA Server are enabled. ISA Server can be managed by running a remote Microsoft Management Console (MMC) snap-in, or by using Terminal Services.

By default, these rules apply to the built-in Remote Management Computers computer set. When you install ISA Server, this empty computer set is created. Add to this empty computer set all computers that will remotely manage ISA Server. Until you do so, remote management is not available from any computer. For more information about remote management, see Remote administration.

Firewall Client

If you installed the Firewall Client Share component when you installed ISA Server, the Firewall Client Installation Share configuration group is enabled, by default. All computers on the Internal network can access the shared folder.

If you did not install the Firewall Client Share component, this configuration group is not enabled.

Diagnostic services

By default, the system policy rules allowing access to diagnostics services are enabled, with the following permissions:

  • ICMP is allowed to all networks. This service is important for determining connectivity to other computers.
  • Windows networking. This allows NetBIOS communication, by default to computers on the Internal network.
  • Microsoft error reporting. This allows HTTP access to the Microsoft Error Reporting sites URL set, to allow reporting of error information. By default, this URL set includes specific Microsoft sites.

Logging and monitoring

By default, remote logging and monitoring is disabled. The following configuration groups are disabled by default:

  • Remote Logging (NetBIOS)
  • Remote Logging (SQL)
  • Remote Performance Monitoring
  • Microsoft Operations Manager

SMTP

By default, the SMTP configuration group is enabled, allowing SMTP communication from ISA Server to computers on the Internal network. This is required, for example, when you want to send alert information in an e-mail message.

Scheduled download jobs

By default, the scheduled download jobs feature is disabled. When you create a content download job, you will be prompted to enable this system policy rule. ISA Server will be able to access the sites specified in the content download job.

Allowed sites

By default, the allowed sites configuration group is enabled, allowing ISA Server to access content on specific sites that belong to the System Policy Allowed Sites URL set. This URL set includes various Microsoft Web sites, by default. You can modify the URL set to include additional Web sites, which ISA Server will be allowed to access.

Configuration Storage server

By default, the Configuration Storage server configuration group is enabled. You cannot disable this configuration group, because it is critical to the proper functioning of the array. The configuration group includes three sets of rules:

  • Access to remote Configuration Storage servers. This includes the enterprise Configuration Storage server domain name set. You cannot modify the destinations to which the rules are applied.
  • Access to local Configuration Storage servers. This rule is enabled on the Configuration Storage server and allows access from array servers, managed ISA Server computers, enterprise remote management computers, and replicate Configuration Storage servers. That is, access from all the enterprise components is allowed.
  • Access to replicate Configuration Storage servers. This rule is enabled on the Configuration Storage server and allows access to replicate Configuration Storage servers.

Intra-array communication

By default, the Intra-array Communication configuration group is enabled, allowing access between all array members (Array Servers computer set). For more information about how array members communicate, see Array communication.


Toolbox

Microsoft Internet Security and Acceleration (ISA) Server 2004 includes a Toolbox, a set of rule elements that you can use when creating firewall policy rules. The Toolbox includes these types of rule elements:

  • Protocols
  • User sets
  • Content types
  • Schedules
  • Network objects
  • Domain name sets and URL sets
  • Web Listeners

Rule elements can be created at the enterprise level and at the array level. Rule elements that are defined on the array level can be used only in array-level rules. Enterprise-level rule elements can be used in enterprise policies and array-level policies. Only enterprise administrators can create and modify enterprise-level rule elements.

This section provides general background information about the Toolbox elements.

web link Get latest ISA Server content at ISA Server Guidance.


Protocols

Microsoft Internet Security and Acceleration (ISA) Server 2004 includes a variety of preconfigured protocols, which you can use when you create access rules or server publishing rules.

You can further expand the set of protocols by using ISA Server Management to create your own. User-defined protocols can be edited or deleted. Protocols included with ISA Server cannot be modified or deleted. Protocols installed with application filters cannot be modified, although they can be deleted. However, you can configure a protocol so that an application filter does not apply to the protocol. For more information, see Application filters and protocols.

When you create a protocol, you specify the following:

  • Protocol Type. This includes TCP, UDP, ICMP, or IP-level.
  • Direction. For UDP, this includes Send, Receive, Send Receive, or Receive Send. For TCP, this includes Inbound and Outbound. For ICMP and IP-level, this includes Send and Send Receive.
  • Port range. For TCP and UDP, this is a range of ports between 1 and 65535 that is used for the initial connection.
  • Protocol number. For IP-level protocols, this is a number between 0 and 254.
  • ICMP properties. For ICMP, this is the ICMP code and type.
  • (Optional) Secondary connections. This is the range of ports, protocol types, and direction used for additional connections or packets that follow the initial connection. You can configure one or more secondary connections.

Note

  • You cannot define secondary connections for IP-level primary protocols.

For instructions, see Create a protocol.

Enterprise-level protocols

Enterprise administrators can create and modify enterprise-level protocols. Enterprise-level protocols can be used in array-level access rules and in enterprise-level access rules. Array-level protocols can only be used in access rules for that array.

ISA Server is preconfigured with a large set of enterprise-level protocols.

Ports

More than one protocol can be associated with the same port.

If you create a rule denying access to a specific protocol, be sure to include all protocols that use the same port in the exception list. Alternatively, you can create a rule denying any one of the protocols that use the port, and place the deny rule before the access rule in the rules order.

Consider for example this scenario. If you create a protocol to be used in a rule that denies access to a virus, do not create an access rule that allows access to everything except the new protocol. Instead, create a rule that denies access to the new protocol. Place this rule before any other access rules that allow protocols on the same ports as the new protocol.

Direction

ISA Server uses protocol direction to specify whether traffic is considered outbound or inbound.

For access rules, protocol direction is usually defined as outbound. This allows traffic from the network entities specified as the rule sources (From) to the network entities specified as the rule destinations (To). Generally, this means that a client behind ISA Server is allowed to send traffic to other network objects or networks, such as the External network (Internet).

For server publishing rules, protocol definition must be defined as inbound. This allows traffic from the network entities specified as the network sources to the published service on the server.

For server publishing rules, predefined protocols are always identified with the suffix, Server. For example, DNS Server protocol allows requests for DNS services to reach the published DNS server. When you define protocols for server publishing, you are not required to add the suffix. However, you must define the protocol as inbound.

For more information, see Access rules and Server publishing rules.

Application filters and protocols

Protocol definitions with attached application filters usually do not have predefined secondary connections. The following describes the process:

  1. The client opens a primary connection to a server on the Internet.
  2. The ISA Server computer notifies the filter about the connection.
  3. The filter examines the data that is flowing through the primary connection and determines which secondary connection the client is going to use.
  4. The filter informs the ISA Server computer to allow that particular secondary connection.
  5. The ISA Server computer opens the specific port, as indicated by the application filter.

Some application filters create and install new protocols. These protocols are complex protocols, meaning that they have secondary connections. By translating the ports used by these complex protocols, the application filter enables them, allowing traffic that uses these protocols to pass. The primary connections for these protocols function, whether the application filter is enabled or not.

Other application filters filter traffic of existing protocols, either user-defined or configured by ISA Server. When these application filters are disabled, the protocols that they filter are not disabled. For example, even if you disable the Simple Mail Transfer Protocol (SMTP) filter, SMTP protocols might still be allowed to pass (unfiltered).

You can apply one or more application filters to a protocol, to control how this protocol is used. For example, the Web Proxy application filter applies to the HTTP protocol. When you disable the Web Proxy application filter, Web filters will not apply to traffic that matches this rule.

For more information, see Application Filters. For instructions, see Apply an application filter to a protocol.

RPC protocols

When you install ISA Server, an outbound remote procedure call (RPC) protocol is defined. All universally unique identifier (UUID) interfaces are used for this protocol definition.

You can create access rules that allow use of this outbound RPC protocol definition. This can allow internal clients to use the RPC protocol to access external resources. For example, you can allow clients on the Internal network access to an external Exchange server. Similarly, you can create outgoing RPC protocol definitions, and use these in access rules, to allow internal clients access to external resources.

Outbound RPC protocols can be configured on a per-rule basis, to enforce strict RPC compliance. By default, strict compliance is enforced for RPC protocols. By enforcing strict compliance, RPC-type protocols, such as DCOM, will not be allowed through ISA Server.

When you install ISA Server, two default RPC protocol definitions are provided for incoming requests:

  • Any RPC server. If this protocol definition is allowed in a server publishing rule, ISA Server will map any inbound RPC requests to the published RPC server. If the UUID is registered on the RPC server, access to the procedure is given. If the UUID is not registered on the RPC server, the request is dropped.
  • Exchange RPC server. A list of UUID interfaces used for Exchange is defined as an RPC protocol definition. You can use this protocol definition in server publishing rules to deny or allow access to specific Exchange functions.

The RPC (any interface) protocol is defined for outgoing requests.

You can create additional RPC protocol definitions. Using the wizard, you can select UUID interfaces from a list of interfaces available on the RPC server. Or, you can define the interfaces manually. If you do not specify any interfaces for the incoming RPC protocol definition, server publishing rules that allow this protocol definition do not allow any traffic.

After you create incoming RPC protocol definitions, you can use them in a server publishing rule.

Protocol categories

In the Toolbox, protocols are categorized in functional groups. These categories were created to facilitate selection of the appropriate protocol for your specific scenario. Some protocols are listed in more than one category. All protocols are listed in the All Protocols category. Protocols that you define are listed in the User-Defined category.

Protocol category | Description
Infrastructure | This category includes protocols used for common networking infrastructural needs, such as address assignment (DHCP), Active Directory (LDAP), and name resolution (DNS).
Mail | This category includes protocols used by mail servers, such as SMTP, IMAP4, POP3, and others.
Instant Messaging | This category includes protocols required for instant messaging, including MSN Messenger, ICQ, H.323, and others.
Remote Terminal | This category includes protocols required to allow remote management, including RDP, Telnet, and others.
Streaming Media | This category includes protocols required for streaming media, including MMS, RTSP, and others.
VPN and IPsec | This category includes protocols required for VPN connections, such as IKE Client, IKE Server, L2TP, and others.
Web | This category includes protocols used to access Web sites, such as HTTP, HTTPS, FTP, and others. You can select protocols only from this category when creating Web publishing rules.
Authentication | This category includes protocols required for authentication, such as RADIUS, RSA SecurID, and Kerberos.
Server Protocols | This category includes server protocols, used in server publishing rules, such as RPC server, Microsoft SQL Server, FTP server, and others.

For a full list of protocols used by Microsoft Windows products and subcomponents, see Port Requirements for the Microsoft Windows Server System (http://www.microsoft.com/).


User sets

When you create firewall policy rules, you can apply them to specific Internet Protocol (IP) addresses or to users. When you apply a rule to a user, the user will have to authenticate, presenting authentication credentials, as required for the specific rule.

Often, you will want to apply rules to a group of users, to facilitate the rule configuration process.

Using Microsoft Internet Security and Acceleration (ISA) Server 2004, you can group users together in user sets. User sets can include one or more users from any authentication scheme (mechanism). For example, a user set might include a Windows user, a user from a RADIUS namespace, and another user from the SecurID namespace.

ISA Server comes preconfigured with the following enterprise-level user sets:

  • All Authenticated Users. Predefined user set representing all authenticated users. A rule defined using this set will apply to authenticated users. (Note that SecureNAT clients are not authenticated, unless they are also virtual private network (VPN) clients. In this case, credentials of a VPN will be used for authorization.)
  • All Users. Predefined user set representing all users. A rule defined using this set will apply to all users, both authenticated and unauthenticated.
  • System and Network Service. Predefined user set representing the Local System service and the Network service on the ISA Server computer. This user set is used in some system policy rules.

For instructions, see Create a user set.


Content types

Content types specify Multipurpose Internet Mail Extensions (MIME) types and file name extensions. When you create an access rule, you can limit the rule application to specific content types. You can be more specific when you configure security policy, because you can limit access not only to a particular destination, but also to specific content.

Content types apply only to Hypertext Transfer Protocol (HTTP) and tunneled File Transfer Protocol (FTP) traffic, which passes through Internet Security and Acceleration (ISA) Server 2004.

When a client requests FTP content, ISA Server checks the file name extension of the requested object. ISA Server determines if a rule applies to a content type that includes the requested file name extension, and processes the rule accordingly.

When a client requests HTTP content, ISA Server sends the request to the Web server. When the Web server returns the object, ISA Server checks the object's MIME type or its file name extension, depending on the header information returned by the Web server. ISA Server determines if a rule applies to a content type that includes the requested file name extension, and processes the rule accordingly.

Content types do not apply to any other protocol (for example, HTTPS).

When you create content types, we recommend that you specify the content's MIME type and file name extension. For example, to include all director files in a content type, select the following file name extensions and MIME types:

  • .dir
  • .dxr
  • .dcr
  • application/x-director

When you configure a content type and specify the MIME type, you can use an asterisk (*) as a wildcard character. For example, to include all application types, type application/*. The asterisk wildcard character can be used only with MIME types (and not with file extensions). The asterisk can be specified only once, at the end of the MIME type after the slash mark (/).

For configuration instructions, see Create a content type.

Enterprise-level content types

Enterprise administrators can create and modify enterprise-level content types. Enterprise-level content types can be used in array-level access rules and in enterprise-level access rules. Array-level content types can only be used in access rules for that array.

ISA Server is preconfigured with the following enterprise-level content types: Application, Application data files, Audio, Compressed files, Documents, HTML documents, Images, Macro documents, Text, Video, and VRML.

MIME types and file name extensions

Depending on the Web server, different MIME types are associated with different file name extensions. The following table lists the Internet Information Services (IIS) default associations.

File name extension | MIME type
.hta | application/hta
.isp | application/x-internet-signup
.crd | application/x-mscardfile
.pmc | application/x-perfmon
.spc | application/x-pkcs7-certificates
.sv4crc | application/x-sv4crc
.bin | application/octet-stream
.clp | application/x-msclip
.mny | application/x-msmoney
.p7r | application/x-pkcs7-certreqresp
.evy | application/envoy
.p7s | application/pkcs7-signature
.eps | application/postscript
.setreg | application/set-registration-initiation
.xlm | application/vnd.ms-excel
.cpio | application/x-cpio
.dvi | application/x-dvi
.p7b | application/x-pkcs7-certificates
.doc | application/msword
.dot | application/msword
.p7c | application/pkcs7-mime
.ps | application/postscript
.wps | application/vnd.ms-works
.csh | application/x-csh
.iii | application/x-iphone
.pmw | application/x-perfmon
.man | application/x-troff-man
.hdf | application/x-hdf
.mvb | application/x-msmediaview
.texi | application/x-texinfo
.setpay | application/set-payment-initiation
.stl | application/vndms-pkistl
.mdb | application/x-msaccess
.oda | application/oda
.hlp | application/winhlp
.nc | application/x-netcdf
.sh | application/x-sh
.shar | application/x-shar
.tcl | application/x-tcl
.ms | application/x-troff-ms
.ods | application/oleobject
.axs | application/olescript
.xla | application/vnd.ms-excel
.mpp | application/vnd.ms-project
.dir | application/x-director
.sit | application/x-stuffit
.* | application/octet-stream
.crl | application/pkix-crl
.ai | application/postscript
.xls | application/vnd.ms-excel
.wks | application/vnd.ms-works
.ins | application/x-internet-signup
.pub | application/x-mspublisher
.wri | application/x-mswrite
.spl | application/futuresplash
.hqx | application/mac-binhex40
.p10 | application/pkcs10
.xlc | application/vnd.ms-excel
.xlt | application/vnd.ms-excel
.dxr | application/x-director
.js | application/x-javascript
.m13 | application/x-msmediaview
.trm | application/x-msterminal
.pml | application/x-perfmon
.me | application/x-troff-me
.wcm | application/vnd.ms-works
.latex | application/x-latex
.m14 | application/x-msmediaview
.wmf | application/x-msmetafile
.cer | application/x-x509-ca-cert
.zip | application/x-zip-compressed
.p12 | application/x-pkcs12
.pfx | application/x-pkcs12
.der | application/x-x509-ca-cert
.pdf | application/pdf
.xlw | application/vnd.ms-excel
.texinfo | application/x-texinfo
.p7m | application/pkcs7-mime
.pps | application/vnd.ms-powerpoint
.dcr | application/x-director
.gtar | application/x-gtar
.sct | text/scriptlet
.fif | application/fractals
.exe | application/octet-stream
.ppt | application/vnd.ms-powerpoint
.sst | application/vndms-pkicertstore
.pko | application/vndms-pkipko
.scd | application/x-msschedule
.tar | application/x-tar
.roff | application/x-troff
.t | application/x-troff
.prf | application/pics-rules
.rtf | application/rtf
.pot | application/vnd.ms-powerpoint
.wdb | application/vnd.ms-works
.bcpio | application/x-bcpio
.dll | application/x-msdownload
.pma | application/x-perfmon
.pmr | application/x-perfmon
.tr | application/x-troff
.src | application/x-wais-source
.acx | application/internet-property-stream
.cat | application/vndms-pkiseccat
.cdf | application/x-cdf
.tgz | application/x-compressed
.sv4cpio | application/x-sv4cpio
.tex | application/x-tex
.ustar | application/x-ustar
.crt | application/x-x509-ca-cert
.ra | audio/x-pn-realaudio
.mid | audio/mid
.au | audio/basic
.snd | audio/basic
.wav | audio/wav
.aifc | audio/aiff
.m3u | audio/x-mpegurl
.ram | audio/x-pn-realaudio
.aiff | audio/aiff
.rmi | audio/mid
.aif | audio/x-aiff
.mp3 | audio/mpeg
.gz | application/x-gzip
.z | application/x-compress
.tsv | text/tab-separated-values
.xml | text/xml
.323 | text/h323
.htt | text/webviewhtml
.stm | text/html
.html | text/html
.xsl | text/xml
.htm | text/html
.cod | image/cis-cod
.ief | image/ief
.pbm | image/x-portable-bitmap
.tiff | image/tiff
.ppm | image/x-portable-pixmap
.rgb | image/x-rgb
.dib | image/bmp
.jpeg | image/jpeg
.cmx | image/x-cmx
.pnm | image/x-portable-anymap
.jpe | image/jpeg
.jfif | image/pjpeg
.tif | image/tiff
.jpg | image/jpeg
.xbm | image/x-xbitmap
.ras | image/x-cmu-raster
.gif | image/gif


Schedules

When you create rules, you can apply a schedule to the rule to determine when it is in effect.

ISA Server 2004 is preconfigured with the following two schedules:

  • Weekends. Permits access at all times on Saturday and Sunday.
  • Work Hours. Permits access between 09:00 (9:00 A.M.) and 17:00 (5:00 P.M.) on Monday through Friday.

For instructions, see Create a schedule.

Get latest ISA Server content at ISA Server Guidance.


Network objects

When you create a rule, you specify the source and destination for which the rule is applied. The source and destination are always a network object. To provide you greater flexibility, you can categorize computers into different types of network objects. At the array level, you can create the following types of network objects:

  • Networks. A network is a range of Internet Protocol (IP) addresses. For more information about networks, see Network and network set configuration.
  • Network sets. A network set includes one or more networks.
  • Computer. A computer represents a single IP address.
  • Address ranges, subnets, and computer sets. Address ranges and subnets represent a range of IP addresses.
  • Web listeners. Web listeners determine which IP addresses and ports on the specified networks will listen for Web requests. For more information, see Web Listeners.

The following network objects can be created at the enterprise level: enterprise networks, network sets, computers, address ranges, subnets, computer sets, URL sets, and domain name sets. For more information, see Enterprise networks.

Networks

All network objects describe a range of IP addresses. Networks, however, are different than other network objects, in that they also describe physical boundaries. Within these physical boundaries that the network describes, traffic can flow freely. ISA Server policy is not applied within the ISA Server network.

Predefined array-level network objects

When you install ISA Server, the following computer sets are created:

  • Anywhere. A predefined computer set of all IP address ranges.
  • Remote Management Computers. A computer set that includes computers to manage ISA Server remotely. Initially, this computer set is empty. You should configure it to include IP addresses of all computers that can manage ISA Server remotely. For more information, see Remote administration.
  • IPsec Remote Gateways. A computer set that includes IP addresses of the Internet Protocol security (IPsec) remote virtual private network (VPN) gateways, when they are configured. For more information, see Site-to-site VPN and firewall policy.

Predefined enterprise-level network objects

When you install ISA Server, the following enterprise-level computer sets are created:

  • Anywhere. A predefined computer set of all IP address ranges.
  • Enterprise Remote Management Computers. A computer set that includes computers allowed to remotely manage all ISA Server computers in the enterprise.
  • Replicate Configuration Storage servers. A computer set that includes all Configuration Storage servers that are replicated with the local Configuration Storage server.


Domain name sets and URL sets

Domain name sets define one or more domain names as a single set, so that you can apply firewall policy to the specified domains.

Uniform Resource Locator (URL) sets specify one or more URLs grouped together to form a set. URL sets can be used in access rules to allow or deny access to specified Web sites.

Rules applied to domain name sets and URL sets are enforced in accordance with domain information stored in the Domain Name System (DNS). If DNS is not configured correctly, rules may not be applied as expected.

Specifying domain names

When specifying the domain name, you can use an asterisk (*) to specify a set of computers. For example, to specify all computers in the microsoft.com domain, type the domain name as *.microsoft.com. Note that the asterisk can appear only at the start of the domain name, and can be specified only once in the name.

When you specify a domain name, specify the computer name using the fully qualified domain name (FQDN). For example, write computer_name.microsoft.com, and not \\computer_name.

When you apply a rule to a domain name set, Microsoft Internet Security and Acceleration (ISA) Server 2004 checks whether the request matches the specified domain name set. ISA Server checks the exact name that you specified, including port numbers. For example, consider a Web publishing rule that allows access to a domain name set that includes fabrikam.put:1111. Requests to fabrikam.put will be denied. Requests to fabrikam.put will be allowed only if the domain name set is changed to include fabrikam.put. For this reason, do not specify a port number in a domain name set.

Specifying URLs

When you create a URL set, you can specify one or more URLs in URL format. You can also specify a protocol and port, as follows:

Protocol:address/path:Port

Possible protocols are Hypertext Transfer Protocol (HTTP), HTTPS, and File Transfer Protocol (FTP). However, when ISA Server processes a rule that applies to a URL set, the protocol specified is ignored—only the host name and path are considered.

Although the URL can include a specific port number, ISA Server ignores that port number when processing the rule.

You can also specify a path. Wildcard characters can be used in the path, but only at the end. For example, www.microsoft.com/* is acceptable. However, www.microsoft.com/*/sales is not.

When ISA Server checks the URL sets configured for a rule, text after a question mark (?) is ignored. URLs with ?, which are included in a URL set, are ignored.

ISA Server processes rules that apply to URL sets only for Web traffic (for client requests for HTTP or FTP over HTTP). When a client uses any other protocol, ISA Server does not process rules that apply only to a URL set.

Predefined URL sets

ISA Server 2004 includes the following predefined URL sets:

  • Microsoft Error Reporting Sites. A predefined URL set used to allow error reporting.
  • System Policy Allowed Sites. A predefined URL set used to allow access to trusted sites for maintenance and management.

For instructions, see Create a URL set and Create a domain name set.

web link Get latest ISA Server content at ISA Server Guidance.


Web Listeners

This section provides general background information about Web listeners.

  • Web listener overview
  • Port specification

Get latest ISA Server content at ISA Server Guidance.


Web listener overview

When you create a Web publishing rule, you specify a Web listener to be used when applying the rule. The Web listener properties determine the following:

  • Which Internet Protocol (IP) addresses and ports on the specified networks will listen for Web requests.
  • Which authentication method will be used, when authentication is required.
  • Number of connections that are allowed.

Web listeners can be used by more than one Web publishing rule.

Web listener network (IP address) selection

The Web listener network, or networks, that you select depend on which network clients will use to connect to the published Web server. For example, if the Web site you are publishing allows client requests from the Internet (External network), you should select the External network for the Web listener. By selecting the External network, you are selecting the IP addresses on the Microsoft Internet Security and Acceleration (ISA) Server 2004 computer that are associated with the External network adapter. If you do not limit the IP addresses, all IP addresses associated with the selected network adapter will be included in the listener configuration.

Web listeners are used by a Web publishing rule. The rule specifies source network objects, in addition to specifying a Web listener. The network objects specified for the Web publishing rule must also be specified for the Web listener.

Authentication

You can create Web publishing rules, allowing or denying access to a set of computers or to a group of users. If the rule applies specifically to users, ISA Server checks the incoming Web request properties to determine how the user will be authenticated. For example, a Web publishing rule might allow access only to specific users. ISA Server will authenticate the user requesting the object, to determine if the Web publishing rule allows the requesting user access. The user must authenticate, using one of the authentication methods specified for the incoming Web requests.

ISA Server provides a secure, encrypted logon environment for browsers that support Microsoft® Windows NT® Challenge/Response authentication, and for other browsers that use Basic authentication. Authentication methods can be set for all IP addresses on the server, or separately for each IP address.

For more information, see Authentication.

Limiting concurrent connections

By limiting the number of connections allowed simultaneously to the ISA Server computer, you can prevent attacks that overwhelm the system's resources. This is particularly useful when publishing servers. You can limit the number of computers that connect, while allowing for specific clients to continue connecting, even when the limit is surpassed.

For instructions, see Configure maximum number of concurrent connections allowed.

web link Get latest ISA Server content at ISA Server Guidance.


Port specification

By default, ISA Server listens on port 80 for Hypertext Transfer Protocol (HTTP) requests. If, however, connecting clients are expected to use a different port, you should change the port number accordingly. You can also enable the Web listener to listen for Secure Sockets Layer (SSL) requests, on the default port 443. If you choose SSL, an appropriate certificate must first be installed on the ISA Server computer. You must select a server certificate to be used by the Web listener so that the ISA Server computer can authenticate itself to the client.

Get latest ISA Server content at ISA Server Guidance.


Custom HTML error messages

ISA Server includes a set of Hypertext Markup Language (HTML) error messages that are returned to Web browser clients, when appropriate.

ISA Server distinguishes between external and internal client requests. For internal clients, the files are named Error_number.htm. For external clients, the files are named Error_numberR.htm (where R indicates reverse).

The following table lists the error messages included with ISA Server.

File names | Description
10060.htm and 10060R.htm | The specified Web server could not be contacted.
11001.htm and 11001R.htm | The specified host could not be found.
11002.htm and 11002R.htm | The DNS name server for the specified host could not be contacted.
11004.htm and 11004R.htm | The host was not found.

You can create additional HTML error messages that are customized for your organization. You can use the default HTML error files as a basis for creating additional HTML error message pages. The files are named Default.htm for internal client errors and DefaultR.htm for external client errors, and they are located in the \ErrorHtmls folder. Error message pages are named Errorcode.htm.

You can edit the Default.htm file just as you would any HTML page:

  • Replace [ERRORNUM] with the appropriate error code.
  • Replace [ERRORTEXT] with the appropriate error message text.
  • Replace [SERVERNAME] with the name of the server that returns the HTML page.
  • Replace [VIAHEADER] with the Via header message string that the ISA Server computer receives.

You can use inline graphics in the form of .gif or .jpg files in your custom HTML error messages. However, these files must be stored in a separate, shared directory on the ISA Server computer, and fully qualified URLs must be used in the HTML error message files to point to inline graphics.

Get latest ISA Server content at ISA Server Guidance.


Authentication

This section provides background information about authentication support for Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Authentication Methods for Web Requests
  • Authentication Processes

Get latest ISA Server content at ISA Server Guidance.


Authentication Methods for Web Requests

The access policy and publishing rules of Microsoft Internet Security and Acceleration (ISA) Server 2004 can be configured to allow or deny a set of computers or a group of users from accessing specific servers. If the rule applies specifically to users, ISA Server checks the Web request properties for listeners to determine how the user will be authenticated.

You can configure which authentication method to use. You can configure different authentication methods for incoming Web requests and outgoing Web requests.

ISA Server supports the following authentication methods: Basic authentication, Digest authentication, Integrated Windows authentication, client certificates, and server certificates.

Caution

  • Microsoft® Internet Explorer 5 and later support all the authentication methods. Other Web browsers may support only the Basic authentication method. Be sure that the client Web browsers can use at least one of the authentication methods that you specify for the incoming Web request and outgoing Web request properties. Otherwise, the client will not be able to access the requested object.

This section provides information about authentication methods for Web requests.

  • Basic authentication
  • Digest authentication
  • Integrated Windows authentication
  • RADIUS authentication
  • Authentication support for RSA SecurID
  • Configuration for ISA Server computer to enable authentication for RSA SecurID
  • Forms-based authentication
  • Digital certificates
  • Certificate revocation

web link Get latest ISA Server content at ISA Server Guidance.


Basic authentication

The Basic authentication method is a widely used, industry-standard method for collecting user name and password information.

The standard Hypertext Transfer Protocol (HTTP) method of authentication is Basic authentication. Basic authentication sends and receives user information as text characters that can be read. While passwords and user names are encoded, no encryption is used with Basic authentication.

Important

  • Passwords transmitted through Basic authentication are insecure and can be read during transmission. Use the Integrated Windows authentication whenever possible.

Client authentication process

The following steps outline how a client is authenticated using Basic authentication:

  1. The user is prompted to enter a Windows account user name and password, also known as credentials.
  2. ISA Server attempts to establish a connection, using the user's credentials. The clear text password is Base64-encoded before it is sent over the network.

    Important

    • Base64 encoding is not encryption. If a Base64-encoded password is intercepted over the network by a network sniffer, unauthorized users can decode and reuse the password.
  3. When ISA Server verifies that the user name and password correspond to a valid Microsoft Windows user account, a connection is established.

The advantage of Basic authentication is that it is part of the HTTP specification and is supported by most browsers. The disadvantage is that Web browsers using Basic authentication transmit passwords in an unencrypted form. By monitoring communications on your network, an attacker or malicious user can intercept and decode these passwords using publicly available tools. Therefore, Basic authentication is not recommended unless you are confident that the connection is secure, such as with a dedicated line or a Secure Sockets Layer (SSL) connection.

Get latest ISA Server content at ISA Server Guidance.


Digest authentication

Digest authentication offers the same features as Basic authentication but involves a different way of transmitting the authentication credentials. The authentication credentials pass through a one-way process, often referred to as hashing. The result of this process is called a hash or message digest, and it is not feasible to decrypt it—the original text cannot be deciphered from the hash.

Additional information is added to the password before hashing so that no one can capture the password hash and use it to impersonate the true user. Values are added that help to identify the user, the user's computer, and the domain that the user belongs to. A time stamp is added to prevent a user from using a password after it has been revoked. This is a clear advantage over Basic authentication because the password cannot be intercepted and used by an unauthorized person.

Digest authentication relies on the HTTP 1.1 protocol as defined in the RFC 2617 specification at the World Wide Web Consortium (W3C) Web site. Because Digest authentication requires HTTP 1.1 compliance, not all browsers support it. If a non-HTTP 1.1 compliant browser requests a file when Digest authentication is enabled, the request will be rejected because Digest authentication is not supported by the client.

Digest authentication can be used only in Windows domains.

Important

  • Digest authentication completes only if the domain controller has a reversibly encrypted (plaintext) copy of the requesting user's password stored in Active Directory. To allow passwords to be stored in plaintext, you need to activate the Store password using reversible encryption setting on the Account tab of the user in Active Directory. Alternatively, you can set a Group Policy to enable this capability. After making this setting, you need to set a new password to activate this feature because the old password cannot be determined.
    This is not required when WDigest authentication is used.

WDigest

WDigest is a new version of Digest authentication, also supported by ISA Server. Unlike regular Digest authentication, WDigest does not require that passwords be stored in reversible encryption. WDigest is supported only for ISA Server computers running on Windows Server 2003.

With WDigest, user name and domain name are case-sensitive. Users must type their user name (and domain name) exactly as it is written in Active Directory. This differs from Digest, Basic, and Integrated Windows authentication, where only the password is case-sensitive.

When both ISA Server and the domain are based on Windows Server 2003, the default authentication is WDigest. This means that when you select Digest authentication in a Windows Server 2003 environment, you are actually selecting WDigest.

Digest authentication works with Windows Server 2003 and Windows 2000 domain accounts only, and may require the accounts to store passwords as encrypted plaintext.

Selecting Digest authentication version

ISA Server, which runs on Windows Server 2003, always attempts to use WDigest authentication. However, when ISA Server is installed on a Windows Server 2003 computer in a Windows 2000 domain, the WDigest authentication fails, because it is not supported in Windows 2000 domains. We recommend that you either select a different authentication method, or install ISA Server in a Windows Server 2003 domain. Alternatively, do the following:

  1. Set the FPCWebProxy.UseDigestSSP property to False. For more information, see ISA Server SDK Help.
  2. On each array member, do the following:
    1. At a command prompt, type:
      rundll32 systemroot\system32\iissuba.dll,RegisterIISSUBA.
    2. Configure the Microsoft Firewall service to run using the local system account.
    3. Restart the Firewall service.

Client authentication process

The following steps outline how a client is authenticated using Digest authentication:

  1. The client makes a request.
  2. ISA Server denies the request and asks the client for authentication information.
  3. The domain controller informs ISA Server of the authentication results.
  4. If the client is authenticated, ISA Server checks the firewall policy, to determine whether the object should be obtained, as appropriate.


Integrated Windows authentication

Integrated Windows authentication represents NTLM, Kerberos, and Negotiate authentication mechanisms. Integrated Windows authentication is a secure form of authentication because the user name and password are hashed before being sent across the network. When you enable Integrated Windows authentication, the user's browser proves its knowledge of the password through a cryptographic exchange with your Web server, involving hashing. Integrated Windows authentication is the default authentication method used by members of the Windows 2000 and Windows Server 2003 family.

Client authentication process

The following steps outline how a client is authenticated using Integrated Windows authentication:

  1. Depending on browser configuration, Integrated Windows authentication does not initially prompt for a user name and password. The current Windows user information on the client computer is used for Integrated Windows authentication.
  2. If the authentication exchange initially fails to identify the user, the browser prompts the user for a Windows account user name and password, which it processes using Integrated Windows authentication.
  3. The Web browser continues to prompt the user until the user either enters a valid user name and password or closes the prompt dialog box.

Security considerations

Note that Integrated Windows authentication depends on an Active Directory server to validate client credentials. That is, ISA Server will communicate with the Active Directory server whenever client authentication is required. For this reason, we recommend that you create a protected network for the Active Directory and ISA Server, to prevent users (both external and internal) from accessing the communication.

Get latest ISA Server content at ISA Server Guidance.


RADIUS authentication

Remote Authentication Dial-In User Service (RADIUS) is an industry standard protocol described in RFC 2865, "Remote Authentication Dial-in User Service (RADIUS)." RADIUS is used to provide authentication. A RADIUS client (typically a dial-up server, virtual private network (VPN) server, or wireless access point) sends user credentials and connection parameter information in the form of a RADIUS message to a RADIUS server. The RADIUS server authenticates the RADIUS client request, and sends back a RADIUS message response.

Because RADIUS servers authorize client credentials, in addition to authenticating them, the response that ISA Server receives from the RADIUS server, indicating that the client credentials are not approved, might actually indicate that the RADIUS server does not authorize the client. Even if the credentials have been authenticated, ISA Server may reject the client request, based on the RADIUS server authorization policy.

Note

  • When RADIUS users provide credentials to ISA Server, the credentials must be passed as domain\user (and not as user@domain.

You can configure ISA Server to use specific RADIUS servers, which will be responsible for performing RADIUS user authentication.

RADIUS authentication for outgoing requests

When using Internet Authentication Service (IAS) as your RADIUS server, be sure to enable unencrypted authentication, which is Password Authentication Protocol (PAP) or Shiva Password Authentication Protocol (SPAP), in the dial-in profile of IAS remote access policy. Enabling IAS for PAP or SPAP is a per-profile IAS setting. All RADIUS clients that match the policy conditions will be able to connect to the IAS server by using PAP or SPAP.

Configuring ISA Server for RADIUS authentication

When you configure ISA Server, select RADIUS authentication as the authentication provider. When you add a RADIUS server, you must configure the following:

  • Server name. The host name or IP address of the RADIUS server.
  • Secret. The server running Routing and Remote Access and the RADIUS server share a secret that is used to encrypt messages sent between them. You must configure both the remote access server and the RADIUS server to use the same shared secret.
  • Port. The remote access server must send its authentication requests to the User Datagram Protocol (UDP) port on which the RADIUS server is listening. The default value of 1812 does not need to be changed when you are using a RADIUS server.

Note

  • When configuring ISA Server for RADIUS authentication, the configuration of RADIUS servers applies to all rules or network objects that use RADIUS authentication.

For instructions, see Configure RADIUS servers.

Security considerations

RADIUS authentication includes the following security considerations:

  • The RADIUS User-Password hiding mechanism might not provide sufficient security for passwords. The RADIUS hiding mechanism uses the RADIUS shared secret, the Request Authenticator, and the use of the MD5 hashing algorithm to encrypt the User-Password and other attributes, such as Tunnel-Password and MS-CHAP-MPPE-Keys. RFC 2865 notes the potential need for evaluating the threat environment and determining whether additional security should be used.
    You can provide additional protection for hidden attributes by using Internet Protocol security (IPSec) with Encapsulating Security Payload (ESP) and an encryption algorithm, such as Triple DES (3DES), to provide data confidentiality for the entire RADIUS message. Follow these recommended guidelines:
    1. Use IPSec to provide additional security for RADIUS clients and servers.
    2. Require the use of strong user passwords.
    3. Use authentication counting and account lockout to help prevent a dictionary attack against a user password.
    4. Use a long shared secret with a random sequence of letters, numbers, and punctuation. Change it often to help protect your IAS server .
  • When you use password-based authentication, enforce strong password policies on your network to make dictionary attacks more difficult.

Get latest ISA Server content at ISA Server Guidance.


Authentication support for RSA SecurID

Internet Security and Acceleration (ISA) Server 2004 introduces the ability to authenticate users, based on authentication credentials from the RSA SecurID® product from RSA Security, Inc. ISA Server can secure Web sites requiring authentication credentials from RSA SecurID.

The SecurID product from RSA enforces a requirement that a remote user must have two factors of authentication to gain access to protected resources. These two factors are something that the user knows (a personal identification number or PIN), and something that a user has (a physical token). Neither the PIN nor the token will grant access in isolation from each other. Both are required.

When a user attempts to access Web pages that are protected by RSA SecurID, the ISA Server computer, on behalf of the server running Internet Information Services (IIS) that it secures, checks for a cookie. This cookie will only be present if the user has authenticated recently, and it is not persistent. If the user's cookie is missing, the user is prompted for a user name and passcode for SecurID. This challenge is rendered appropriately to the browser type. If the user is using Internet Explorer, the challenge content type will be Hypertext Markup Language (HTML). The passcode consists of a combination of the user's PIN and tokencode. The tokencode is displayed on the user's token and changes once every minute. The RSA ACE/Agent® on the ISA Server computer passes these credentials to the RSA ACE/Server® computer for validation. If the credentials are successfully validated, a cookie is delivered to the user's browser for subsequent activity during the session, and the user is granted access to the content.

If ISA Server is configured with multiple network adapters and you create a Web listener with RSA SecurID authentication enabled, you should explicitly configure the network adapter address through which ISA Server will connect to the RSA ACE/Server for authentication purposes. Otherwise, ISA Server may fail to perform SecurID authentication. Specify the IP address in registry key HKEY_LOCAL_MACHINE\SOFTWARE\SDTI\AceClient\PrimaryInterfaceIP, as a string value.

For additional information about RSA ACE/Server installation, configuration, and authentication concepts, see the documentation available on the RSA Web site (http://www.microsoft.com/).

Important

  • We recommend that you use Secure Sockets Layer (SSL) to encrypt the communication between the client and ISA Server.

Note

  • RSA SecurID is based on technology from RSA Security Inc.

How authentication for RSA SecurID functions

The RSA SecurID protocol uses standard Hypertext Transfer Protocol (HTTP) messages to authenticate a client. The protocol is a variation of a request-based protocol, where the client sends special data attached to each request.

The following terminology is used:

  • RSA ACE/Server. This computer retains information about users, groups, hosts, and tokens. For each user, the RSA ACE/Server maintains a list of hosts to which the user can log on, and a logon name, which can differ from one host to the other.
  • RSA ACE/Agent. This computer provides Web content, and requires the user to provide credentials for RSA SecurID.
  • Client. Usually, this is a Web browser that receives Web content.

When a client sends a GET /x request to ISA Server, the following process occurs:

  1. The Web filter for RSA SecurID ISAPI authentication intercepts the request, and returns an RSA SecurID authentication form to the client.
  2. The client is required to fill in the form with a logon name and a passcode.
  3. The browser uses the HTTP POST method to return the form to the Web filter.
  4. The Web filter for RSA SecurID authentication communicates these details to the RSA ACE/Server, to verify that the user is allowed to access using the ISA Server computer. If the answer is positive, the Web filter returns a response which includes a Set-Cookie header to the client.
  5. The Set-Cookie header writes a cookie to the browser's memory. When the browser is closed, the cookie will be lost. The cookie contains information about the user. This information is signed with a secret known only to ISA Server. This means that the cookie cannot be modified by other users.
  6. The response contains a Refresh header, which instructs the browser to resend the original GET /x request to the server.
  7. When the Web filter receives a request with a cookie, it verifies that the cookie is valid, by checking:
    • Expiration time
    • IP address (if specified)
    • Signature (to ensure that the data was not tampered)

    If all checks pass successfully, the request is passed to any other installed Web filters on ISA Server, and then passed to ISA Server.

  8. ISA Server tries to request the object, and the object is sent back to the client.


Configuration for ISA Server computer to enable authentication for RSA SecurID

After you set up RSA ACE/Server® on your network, you must perform the following steps to set up the ISA Server configuration:

  1. Set up the ISA Server computer as an RSA ACE/Agent®. For more information, see Set up the ISA Server as an RSA ACE/Agent.
  2. For the ISA Server computer to verify the authentication credentials for RSA SecurID®, verify that the system policy rule allowing communication with RSA SecurID is enabled. Be sure that the destination specified for the configuration group includes RSA ACE/Server. (By default, the Internal network is configured as the destination.) For more information, see System policy overview and Edit destinations for a system policy rule.
  3. Test connectivity between RSA ACE/Server and the ISA Server computer. For more information, see Verify that ISA Server can authenticate against the RSA ACE/Server.

When you enable SecurID authentication on a computer running Windows Server 2003, the Network Service account must have read/write access to the following registry key: HKLM\Software\SDTI\ACECLIENT. In addition, the Network Service account must have read permission for the Sdconf.rec file, located in %SystemRoot%\system32\.

The SecurID Web filter is enabled upon installation. For more information, see Enable or disable the Web filter for RSA SecurID authentication.

Get latest ISA Server content at ISA Server Guidance.


Forms-based authentication

Forms-based authentication is used when publishing Outlook Web Access servers.

After the user provides credentials, the system issues a cookie, identifying the user. On subsequent requests, the system first checks the cookie to see if the user was already authenticated, so that the user does not have to supply credentials again.

The credential information is not cached on the client computer, and is valid only during the current session. This is particularly important in a scenario where users are connecting to your Outlook Web Access server from public computers, where you would not want user credentials to be cached. Users are required to reauthenticate if they close the browser, log off from a session, or navigate to another website. Also, you can configure a maximum idle session time-out, so that if a user is idle for a prolonged period of time, reauthentication is required.

We recommend HTTPS for Outlook Web Access server publishing.

Note

  • ISA Server supports forms-based authentication for Exchange Server 5.5, Exchange 2000 Server, and Exchange Server 2003.

Outlook Web Access includes optional functionality that allows a user to change his password. If a user changes his password during an Outlook Web Access session, the cookie provided after the user initially logged on will no longer be valid. When forms-based authentication is configured on ISA Server, the user who changes his password during an Outlook Web Access session will receive the logon page the next time he makes a request.

For instructions on configuring forms-based authentication for outgoing requests, see Configure authentication method for Web Proxy clients (outgoing requests). For instructions on configuring forms-based authentication for Web publishing, see Configure authentication method for a Web listener.

Exchange 2000 and forms-based authentication

Configure the user principal name (UPN) in Exchange Manager so that users can log on using both the username@domain (unqualified user name) format and the domain\username (unqualified domain name) format. Do the following:

  1. In Exchange Manager, click Servers, click Server_Name, click Protocols, click ExchangeVirtualServer, right-click Exchange, and then click Properties.
  2. On the Access tab, click Authentication.
  3. In Default Domain, type \ (backslash) to accept the user's e-mail address and domain name. In any case, the user must supply credentials as domain\username.

Get latest ISA Server content at ISA Server Guidance.


Digital certificates

Digital certificates are the industry standard means of providing encryption of sensitive data that is sent within or between networks. A typical example of digital certificate use is in communication between a computer on the Internet and a Web server, in which credit card or bank account and password information may be transmitted. To prevent the reading of this information as it passes through the routers that connect the Internet, the HTTPS protocol, requiring digital certificates, is used. Microsoft Internet Security and Acceleration (ISA) Server 2004 enables the use of digital certificates for Web publishing rules, server publishing rules, and site-to-site virtual private network (VPN) connections.

Digital certificates are issued by a certification authority (CA). A CA can be a commercial firm that provides certificates for a fee, or it can be a computer running Microsoft Windows Server™ 2003 or Windows® 2000 Server in your organization on which you have installed Certificate Services.

Digital certificates require trust. Certificate trust is based on the presence of a root certificate from the CA that issued the certificate. When you install a certificate from a commercial CA, there is no need for root certificate distribution because the root certificates are installed with Windows. When you install Certificate Services on one of your organization's computers running Windows and issue your own, you must make arrangements to transfer the root certificate for your CA to any computer that you will allow connections secured with digital certificates. If there is no direct connectivity to the Certificate Services computer, information exchange can be done using a disk or CD, or by e-mail messages. (Be sure that your e-mail system is secure before doing so.) A CA can also be published using Internet Information Services (IIS) and Active Server Pages.

Digital certificates are used in a variety of scenarios. Using ISA Server 2004, there are two common publishing scenarios which may require digital certificate installation:

  • Publishing using Web publishing rules, including publishing Outlook® Web Access servers
  • Publishing using server publishing rules

For a detailed scenario, see "Digital Certificates for ISA Server 2004," available on the ISA Server Web site (http://www.microsoft.com/).


Certificate revocation

You can configure how Microsoft Internet Security and Acceleration (ISA) Server 2004 processes client requests when the client presents a certificate that has already been revoked and is on the certificate revocation list (CRL). You can configure ISA Server to deny requests from clients whose certificate is on the CRL. For instructions, see Configure client certificate validation.

Similarly, you can configure ISA Server to check if certificates from a server are on the CRL. If a server presents a certificate that is on the CRL, you can configure ISA Server to deny the request. This is relevant when ISA Server generates a Secure Sockets Layer (SSL) request for an upstream server, or to a published server. For instructions, see Configure client certificate validation.

When a secure connection is established with ISA Server, ISA Server checks the CRL. By default, the CRL check is enabled when ISA Server is configured to connect using SSL to an upstream Web proxy, or a Web server. Ensure that certificate revocation requests are not routed through a secure connection, so that they do not trigger a CRL check.

Certificate revocation and Web chaining rules

When ISA Server validates a certificate, it must use Hypertext Transfer Protocol (HTTP) to download the CRL. The request to download the CRL is subject to any Web chaining rules that may have been configured. If a Web chaining rule redirects traffic to an alternate destination, ISA Server will try to retrieve the CRL from the alternate destination, which does not have the CRL. This results in a certificate validation error.

To prevent this type of error, create a Web chaining rule that applies to the CRL. Set the destination to a URL set that includes the CRL and the action to connect directly to the Internet. Order this rule first in the list of Web chaining rules.

In some cases, identifying the CRL location is simple, for example, when the CRL is located on a Web site on your Intranet. In more complex scenarios, when you cannot identify the CRL location, add the specific URLs of commonly used certificate authorities, such as Microsoft, VeriSign®, and Thawte.

web link Get latest ISA Server content at ISA Server Guidance.


Authentication Processes

This section describes how ISA Server processes authentication.

  • Firewall policy and authentication
  • Pass-through authentication
  • Chained authentication
  • Basic authentication delegation
  • Certificates

Get latest ISA Server content at ISA Server Guidance.


Firewall policy and authentication

Authentication is an integral part of any firewall policy. Although rules can be applied to IP addresses, often you will allow access only to specific users who have authenticated themselves, using specifically configured authentication mechanisms.

Authentication is significant both for incoming requests—that is, requests from a destination—and for outgoing requests.

Outgoing requests

When a Firewall client requests content that is not HTTP, ISA Server determines if any rules have been configured to apply to specific users or groups. If so, ISA Server will require that the client authenticates itself, so that ISA Server can determine if the rule applies to the client requesting the object.

For outgoing Web requests, authentication is configured for the specific network on which the user is located. After enabling Web Proxy client access, you can configure the authentication mechanisms that will be used to authenticate Web Proxy clients. For instructions, see Configure authentication methods for Web Proxy clients.

When a Web Proxy client or Firewall client requests HTTP content (or HTTPS, in publishing scenarios), if Require all users to authenticate is selected (for the network on outgoing requests, or for the listener on incoming requests), ISA Server will always ask for user credentials before checking the firewall policy.

Otherwise, ISA Server will try to determine if the first rule (of the ordered firewall policy) matches the client request. If the rule seems to match, but ISA Server requires client authentication to validate the match, ISA Server will request that the client authenticate.

Otherwise, if the rule applies to the All Users user set, or the rule applies to the IP address of the specific client, ISA Server will not request user credentials and will try to apply the firewall policy.

For Web publishing rules that deny requests and that apply to users, by default, the client will be asked to reauthenticate each time ISA Server fails to match a rule.

For Firewall clients, ISA Server requests credentials when a session is established. Then, when the Firewall client requests an object, ISA Server does not ask that the client reauthenticate, because the session already has an identity.

When you configure access rules that apply to users (and not to IP addresses), you must specify at least one authentication mechanism, so that the users making the requests can actually authenticate themselves. If you do not, all requests will be denied.

Incoming requests

When you create a Web publishing rule, a secure Web publishing rule, or mail publishing rule for Outlook Web Access, you must specify a Web listener. The Web listener indicates which network (or which IP addresses on the network) accepts the incoming requests and also indicates the acceptable authentication mechanisms. For more information on Web listeners, see Web listeners overview.

Depending on the specified authentication mechanism, clients requesting objects from the published Web server must authenticate.

Using more than one authentication mechanism

These authentication mechanisms can be used simultaneously on a Web listener: Basic, Digest, Integrated, and client certificate authentication. When selected, RADIUS, SecurID, or forms-based authentication methods must be the only authentication mechanism configured.

When HTTPS is used, client certificate authentication is preferred over any other selected authentication mechanism. Other authentication mechanisms are used only if the client fails to authenticate with a client certificate.


Pass-through authentication

Pass-through authentication refers to the ability of ISA Server to pass a client's authentication information to the destination server. ISA Server supports pass-through authentication for both outgoing and incoming Web requests.

The figure illustrates an example of a pass-through authentication scenario for publishing.

Pass-through authentication

The client sends a Get request for an object on a Web server to ISA Server. ISA Server passes the request to the Web server. From there, the pass-through authentication works as follows:

  1. The Web server receives the Get request, and responds that authentication is required (401 error). The Web server also indicates the types of authentication that it supports.
  2. ISA Server passes the Authentication Required response to the client.
  3. The client returns authentication information to ISA Server.
  4. ISA Server passes the client authentication information to the Web server.
  5. After successful authentication, the client communicates directly with the Web server.

Get latest ISA Server content at ISA Server Guidance.


Chained authentication

Chained authentication refers to the authentication that Internet Security and Acceleration (ISA) Server provides when it routes requests to an upstream server. Requests are chained to an upstream server when ISA Server Web chaining rules are configured to route to an upstream server. Chained authentication is supported only when chaining to an upstream server running ISA Server. You can configure ISA Server so that client requests are routed to an upstream server by creating Web chaining rules.

When the upstream server requires credentials (but the downstream ISA Server computer does not), ISA Server passes the client's credentials to the upstream server.

When both the downstream ISA Server computer and the upstream server require authentication, the client authenticates to the downstream ISA Server computer. When the request is routed, the client is asked to reauthenticate to the upstream server. This is true except in scenarios where Basic authentication credentials are requested, and you use Basic authentication delegation. In this case, the downstream ISA Server computer passes the credentials to the upstream server. For more information, see Basic authentication delegation.

Sometimes, the upstream server might not be able to identify the clients requesting the object. In this case:

  • If the Web chaining rule specifies to use an account when connecting to the upstream server, the downstream ISA Server computer passes the authentication information for that account.
  • If the Web chaining rule does not specify to use an account, the downstream ISA Server computer passes the client's authentication information to the upstream server.

For instructions about configuring firewall chaining, see Configure firewall chaining.

Client certificates

In Web publishing scenarios, the upstream server may require client certificate authentication. In this case, a certificate must be configured on the ISA Server computer, which is a valid client certificate that can be used to authenticate on behalf of the client to the upstream server.

For Web Proxy clients, client certificates are configured on Web chaining rules.

For more information about using certificates, see Certificates.


Basic authentication delegation

You can configure Microsoft Internet Security and Acceleration (ISA) Server 2004 so that clients using Basic authentication can authenticate to the ISA Server computer, rather than to the computer being published. Users accessing the Web site benefit, because they only have to sign in once, and ISA Server authenticates on behalf of the server running Internet Information Services (IIS). ISA Server performs authentication of users, identifies them, and logs their activity. ISA Server also forwards user credentials to the server running IIS, thus allowing IIS to authenticate users without requesting credentials a second time.

By using authentication delegation, the Web server to which the request is redirected will authenticate the client. Because authentication delegation is configurable on a per-rule basis, you can decide which sites require single sign-on.

Important

  • Basic authentication data is passed in plaintext from the ISA Server computer to the internal published server. To further secure this traffic, you can use Secure Sockets Layer (SSL) to encrypt traffic between the client and ISA Server.

Basic authentication delegation for Web Proxy clients is configured on the Web chaining rule. For more information, see Web chaining rules.

Basic authentication for publishing scenarios is configured on the Web publishing rule. For instructions, see Forward credentials to published server.

web link Get latest ISA Server content at ISA Server Guidance.


Certificates

When using Web publishing rules to publish a server, and Secure Sockets Layer (SSL) communication from external clients is required, a server certificate must be installed on the Microsoft Internet Security and Acceleration (ISA) Server 2004 computer. In addition, you may have a certificate installed on the internal Web server. The listener configured for the Web publishing rule must be configured to use the server certificate.

To install SSL certificates in a Web publishing scenario, follow these steps:

  1. Install a trusted root certificate on computers that will be SSL clients of the ISA Server computer. If you are using a certificate from a commercial certification authority (CA) that is included in the Internet Explorer database of CAs, you do not have to perform this step.
  2. Generate a certificate request for the ISA Server computer. When you specify the common name for the certificate, type the fully qualified host name or Uniform Resource Locator (URL) that external clients will type in their Web browser to access the Web site (for example: news.adatum.com). This would be the same name specified in the Web publishing rule's public name.
  3. Process a certificate request file.
  4. Install the certificate on the published Web server.
  5. Export the certificate to a file and copy it to the ISA Server computer.
  6. Install the certificate on the ISA Server computer.

Note

  • Certificates typically have an expiration period, usually no more than one year. ISA Server cannot use an expired certificate. Be sure to renew your certificates before they expire, so that ISA Server can continue to function.

web link Get latest ISA Server content at ISA Server Guidance.


Network Protection

This section provides background information about how to provide security and monitoring support for Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Connection limits
  • IP preferences
  • Broadcast
  • Attack detection
  • DHCP protection
  • DNS cache poisoning prevention


Connection limits

ISA Server limits the number of connections at any given time. You can configure the limit, specifying a maximum number of concurrent connections. When the maximum number of connections has been reached, any new client requests for that Web listener will be denied.

You can limit the total number of UDP, ICMP, and other Raw IP connection creations allowed by a server publishing or access rule, per second. These limitations do not apply to TCP connections. When the specified number of connections is surpassed, new connections will not be created. Existing connections will not be disconnected. By default, up to 1000 new connections are allowed per rule, per second. When the specified limit is exceeded, an alert is triggered. A log entry with the following parameters is logged:

  • Action is Connection Denied
  • Result code is FWX_E_RULE_QUOTA_EXCEEDED_DROPPED

We recommend that you limit the number of connections, as this can help prevent flood attacks. When a UDP or raw IP flood attack occurs, many requests are sent from spoofed source IP addresses, eventually resulting in a denial of service.

When an alert occurs, determine whether your network is being attacked, or whether there is simply a heavy load of valid traffic. If the limit was exceeded due to malicious traffic, try the following:

  • If the malicious traffic appears to originate from the Internal network, this may indicate a virus on the Internal network. Identify the source IP address, and disconnect the computer from the network immediately.
  • If the malicious traffic appears to originate from a small range of IP addresses on an external network, then create a rule denying access to a computer set that includes the source IP addresses.
  • If the traffic appears to originate from a large range of IP addresses, then evaluate the overall status of your network. Consider setting a smaller connection limit, so that ISA Server can better protect your network.

If the limit has been exceeded due to heavy load, consider setting a higher per-rule connection limit.

In firewall chaining scenarios and in some back-to-back scenarios, specify customized connection limits for the IP addresses of the chained server or back firewall. Also, if your system publishes more than one UDP-based or raw IP-based service to the External network, you should configure smaller limits, to help keep your network secure from flood attacks.

Limiting client connections

Similarly, you can limit the total number of UDP, ICMP, and other Raw IP connections allowed per client. You can specify custom limits to apply to specific IP addresses. This is useful, for example, when you want to allow specific servers to establish more connections than allowed to other clients.

For TCP connections, no new connections are allowed after more connection limit is exceeded. For other connections (Raw IP and UDP), older connections are terminated when the connection limit is exceeded so that new connections can be created.

For instructions, see Limit the number of connections.

Get latest ISA Server content at ISA Server Guidance.


IP preferences

You can configure how ISA Server 2004 handles Internet Protocol (IP) packets, by configuring the following:

  • IP fragments
  • IP routing
  • IP options

IP fragments

A single IP datagram can be divided into multiple datagrams of a smaller size, known as IP fragments. These fragments can be filtered by ISA Server.

All fragmented packets are dropped when ISA Server filters packet fragments. The teardrop attack and its variants involve sending fragmented packets and then reassembling them in such a way that may cause harm to the system. The teardrop attack works a little differently from the Ping of Death attack, but with similar results. The teardrop program creates IP fragments, which are pieces of an IP packet into which an original packet can be divided as it travels through the Internet. The problem is that the offset fields on these fragments, which are supposed to indicate the portion (in bytes) of the original packet that is contained in the fragment, overlap.

For example, normally two fragments offset fields might appear as:

Fragment 1:  (offset) 100 - 300
Fragment 2:  (offset) 301 - 600

This indicates that the first fragment contains bytes 100 through 300 of the original packet, and the second fragment contains bytes 301 through 600.

Overlapping offset fields would appear something like this:

Fragment 1: (offset) 100 - 300
Fragment 2: (offset) 200 - 400

When the destination computer tries to reassemble these packets, it is unable to do so. It may fail, stop responding, or restart.

Fragment filtering can interfere with streaming audio and video. In addition, L2TP over IPSec connections may not be successfully established because packet fragmentation may take place during certificate exchange. Disable fragment filtering if you have problems with streaming media and IPSec based VPN connections.

For instructions, see Enable IP fragment filtering.

IP routing

When IP routing is disabled, ISA Server sends only the data (and not the original network packet) to the destination. Also, when disabled, ISA Server copies each packet, and then resends it through the driver in user mode.

When IP routing is enabled, ISA Server acts as a router. Some filtering is performed by the driver in user mode on the traffic passing through ISA Server.

For instructions, see Enable IP routing.

IP options

You can configure ISA Server to refuse all packets that have the flag IP Options in the header. The most problematic options are the source routing options. TCP/IP supports source routing, which is a means to permit the sender of network data to route the packets through a specific point on the network. There are two types of source routing:

  • Strict source routing. The sender of the data can specify the exact route (rarely used).
  • Loose source record route (LSRR). The sender can specify certain routers (hops) through which the packet must pass.

The source route option in the IP header allows the sender to override routing decisions that are normally made by the routers between the source and destination machines. You can use source routing to map the network or to troubleshoot routing and communications problems. Source routing can also be used to force traffic through a route providing the best performance. Unfortunately, source routing can be exploited by attackers.

For example, an intruder can use source routing to reach addresses on the Internal network that normally are not reachable from other networks, by routing the traffic through another computer that is reachable from both the other network and the Internal network.

For instructions, see Enable IP options filtering.

Get latest ISA Server content at ISA Server Guidance.


Broadcast

Broadcasting is the sending of a single message (datagram) to multiple recipients, using a connectionless protocol such as User Datagram Protocol (UDP). There are three types of broadcast addresses:

  • Limited broadcast address. The limited broadcast address is 255.255.255.255.
  • Network broadcast address. The network broadcast address has an IP address of all one bits and a specific network ID. For example, consider a class A network 22.0.0.0. Its network broadcast address is 22.255.255.255.
  • Subnet broadcast address. The subnet broadcast address has an IP address of all one bits and a specific subnet ID. For example, consider a class A network 22.0.0.0 with a subnet mask 255.255.0.0. The address 22.0.255.255 is a subnet broadcast.

ISA Server and broadcast

ISA Server does not allow any broadcast messages to be sent between network adapters on the ISA Server computer. ISA Server determines whether a rule applies to broadcast addresses:

  • If the destination address is not a subnet broadcast address, ISA Server considers the address as the subnet broadcast address of the network adapter on the ISA Server computer on which the packet was received.
  • If the packets are an incoming broadcast (to the Local Host network), ISA Server considers the destination as the network adapter on the ISA Server computer (Local Host).
  • If this is an outgoing broadcast (from the Local Host network), ISA Server considers the source as the network adapter on the ISA Server computer (Local Host).

For example, assume a service listens on UDP port 1500 of the Local Host network (the ISA Server computer) on the network adapter with subnet address 22.0.1.1. To allow broadcast traffic to that service from, for example, the Internal network, you must create an access rule that allows traffic on UDP port 1500 from the Internal network to the subnet broadcast address (22.0.255.255). Alternatively, you can create an access rule that allows UDP port 1500 traffic from the Internal network to the Local Host.

For instructions, see Create an access rule.

Get latest ISA Server content at ISA Server Guidance.


Attack detection

A common concern of any network administrator is the prevalence of attacks. Some common attacks include the following:

  • DNS cache poisoning
  • IP spoofing. For more information, see Spoof detection.
  • SYN flood attack
  • DHCP poisoning and invalid DHCP offers. For more information, see DHCP protection.

With Microsoft Internet Security and Acceleration (ISA) Server 2004, you can configure predefined alerts to warn you if such an attack occurs. For more information about alerts, see Alerts.

DNS cache poisoning

Domain Name System (DNS) cache poisoning occurs when the DNS server does not recognize that it has received unauthentic information. In DNS cache poisoning, an attacker corrupts your DNS server cache, so that your DNS server provides incorrect answers that include IP addresses of the attacker's choice, instead of the real IP addresses. For example, assume that an attacker has used DNS cache poisoning to insert an infected Web site for www.microsoft.com in your DNS server. A user that attempts to access the Microsoft Web site to download the latest Internet Explorer update is unknowingly redirected to the attacker's Web site and downloads a worm virus.

SYN flood attack

A SYN flood attack occurs when an attempt is made to deny services to legitimate users by intentionally overloading a network with illegitimate TCP connection requests.

In a normal TCP connection, a computer sends a SYN packet. SYN is short for synchronize, which occurs after the first packet is sent, when one computer tries to connect to another using TCP. The destination computer acknowledges the connection attempt, and returns a SYN packet. Upon receipt of the SYN packet, the source computer responds with an ACK. ACK is short for acknowledge.

In a SYN flood attack, the source computer never sends an ACK. The destination computer waits, until the connection times out and is dropped. When many such failures to send ACK packets occur, a computer is kept busy, thereby effecting a denial of service attack.

Alerts

To help you detect an attempted attack, ISA Server preconfigures and enables the following alerts:

  • Invalid DHCP offer. The DHCP offer IP address is not valid.
  • IP spoofing. The IP packet source address is not valid.
  • Oversized UDP packet. ISA Server dropped a User Datagram Protocol (UDP) packet because it exceeded the maximum UDP packet size, as specified in the registry key.
  • SYN attack. ISA Server detected a SYN attack.

Intrusion detection

You can configure the intrusion detection filters to detect specific attacks. For more information, see Intrusion detection filters.

The following alerts are configured:

  • DNS intrusion. A host name overflow, length overflow, or zone transfer attack occurred.
  • DNS zone transfer intrusion. A zone transfer attack occurred.
  • Intrusion detected. An intrusion was attempted by an external user.
  • POP intrusion. Post Office Protocol (POP) buffer overflow detected.

Common attack detection

In addition, the following common attacks can be detected:

  • Windows out-of-band (WinNuke)
  • Land
  • Ping of Death
  • IP half scan
  • UDP bomb
  • Port scan

For more information about these attacks, see Intrusion detection filters.

web link Get latest ISA Server content at ISA Server Guidance.


DHCP protection

Microsoft Internet Security and Acceleration (ISA) Server 2004 includes alerts which can help you identify when your network is under a Dynamic Host Configuration Protocol (DHCP) attack.

DHCP poisoning occurs when a malicious user assigns a wrong address to a network adapter on the firewall, thus causing the Internet Protocol (IP) spoof detection mechanism to work incorrectly.

DHCP offer protection

ISA Server can detect invalid DHCP offers. A DHCP offer is considered valid only if it is contained in the range of the network object associated with the network adapter on which the IP address was assigned. When an invalid DHCP offer is detected, ISA Server triggers an Invalid DHCP offer alert and ignores the invalid DHCP offer.

In some cases, you may want to move a network adapter from one network to another, using an address received from the DHCP server. You will want to accept an offer that ISA Server generally considers invalid. To accept this offer, do the following:

  1. At a command prompt, type ipconfig /renew. (You will receive an error message.)
  2. In ISA Server Management, configure the invalid DHCP offer alert. For instructions, see Configure invalid DHCP offer alert.
  3. Verify that the IP address for the network adapter is appropriately assigned.
  4. Check that the network object associated with the network adapter reflects the new IP address.

ISA Server continues to protect against DHCP offer attacks, even after you acknowledge this alert.

Note

  • If you accept a new IP address for the Internal network, verify that the Configuration Storage server can be accessed through this IP address.

How ISA Server counters DHCP poisoning attacks

ISA Server maintains a list of allowed IP addresses for each DHCP network adapter. The allowed addresses are the address set of a network that contains the adapter's address. When ISA Server receives a DHCP offer packet, it checks that the offer is within the range of allowed addresses. If the validation fails, the packet is dropped, and an Invalid DHCP offer alert is triggered.

If the network adapter receives the offered address, you can renew DHCP addresses, as described in Configure invalid DHCP offer alert. When you do this, the enforcement mechanism is temporarily disabled, and a new ipconfig /renew is issued. During this period, no offered addresses are dropped by ISA Server. After the adapters receive their addresses, ISA Server reactivates the mechanism.

DHCP offers may be dropped in the following scenarios:

  • If you switch between two DHCP adapters. For example, you switch between the adapter that is connected to the Internal network and the adapter that is connected to the External network.
  • A DHCP adapter was moved to a different network. For example, the ISA Server external network adapter was connected to a home network, where another router connected to the Internet. When you replace the router with the ISA Server external network adapter, you must renew the DHCP address, to allow the DHCP assignment.

After the assignment is allowed, you do not have to allow it again.

web link Get latest ISA Server content at ISA Server Guidance.


DNS cache poisoning prevention

Domain Name System (DNS) is the name resolution protocol for IP networks, such as the Internet. A DNS server hosts the information that enables client computers to resolve memorable, alphanumeric DNS names to the IP addresses that computers use to communicate with each other.

Microsoft Internet Security and Acceleration (ISA) Server 2004 includes a name resolution mechanism, similar to the DNS server name resolution mechanism. In this way, when a client makes a request to a host on another network, specifying the URL of the host computer, ISA Server can resolve the host computer name. ISA Server sends a name resolution request to the DNS server that you configure for its use.

To prevent DNS cache poisoning, we strongly recommend that you configure ISA Server to use a trusted DNS server (for example, a Windows DNS server), with the option to prevent cache pollution enabled. This DNS server should be located on the Internal network.

If you deploy a DNS server on an untrusted network (for example, on the External network), we recommend that you also install a DNS server on a trusted network (for example, a perimeter network). Then, configure the DNS server on the trusted network to forward requests to the DNS server on the untrusted network.

web link Get latest ISA Server content at ISA Server Guidance.


Firewall Policy: How To

This section provides steps for configuring firewall policy.

  • Configure Enterprise Policy
  • Configure Access Rules
  • Configure Web Publishing Rules
  • Configure Server Publishing Rules
  • Configure Firewall Policy Rules
  • Configure Per-Rule Filtering
  • Configure System Policy
  • Configure Toolbox Elements
  • Configure Authentication
  • Configure Network Protection

web link Get latest ISA Server content at ISA Server Guidance.


Configure Enterprise Policy

This section provides steps for configuring enterprise policy.

  • Create an enterprise policy
  • Create an enterprise policy rule
  • Change the order of an enterprise policy rule

web link Get latest ISA Server content at ISA Server Guidance.


Create an enterprise policy

To create an enterprise policy

  1. In the console tree of ISA Server Management, click Enterprise Policies.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Policies
  2. On the Tasks tab, click Create New Enterprise Policy.
  3. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • A newly created enterprise policy contains only the default deny rule, which is processed after any array-level firewall policy rules to which this enterprise policy is applied. For instructions on creating enterprise rules, see Create an enterprise policy rule.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Create an enterprise policy rule

To create an enterprise policy rule

  1. In the console tree of ISA Server Management, click the applicable enterprise policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Policies
    • Enterprise Policy
  2. On the Tasks tab, click Create Enterprise Access Rule.
  3. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • By default, when you create the first enterprise policy rule, it is applied after the array rules. As with any enterprise policy rule, you can change the order in which this rule is processed. For instructions, see Change the order of an enterprise policy rule.
  • You cannot create any enterprise rules in the default enterprise policy.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Change the order of an enterprise policy rule

To change the order of an enterprise policy rule

  1. In the console tree of ISA Server Management, click the applicable enterprise policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Policies
    • Enterprise Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Move Selected Rules Up or Move Selected Rules Down.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Enterprise policy rules are categorized into two groups: rules that are processed before the firewall policy rules configured at the array to which the enterprise policy is applied, and rules that are processed after the array-level firewall policy rules. You can move enterprise policy rules from one group to another, thereby changing the effective policy at the array level.
  • You can create and modify enterprise rules only at the enterprise level. At the array level, only array-level firewall policy rules can be created.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Access Rules

This section provides steps for configuring access rules. For instructions on configuring general firewall policy rule properties, see Configure Firewall Policy Rules.

  • Create an access rule
  • Configure destination network objects for an access rule
  • Configure protocols for an access rule
  • Configure content for an access rule
  • Allow specified source ports for an access rule


Create an access rule

To create an access rule

  1. In the console tree of ISA Server Management, click Firewall Policy (for array-level firewall policy) or the specific enterprise policy.

    For array-level firewall policy, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy

    For enterprise policy, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Policies
    • Enterprise_Policy
  2. Do one of the following:
    • For array-level firewall policy, on the Tasks tab, click Create Array Access Rule.
    • For the specific enterprise policy, on the Tasks tab, click Create Enterprise Access Rule.
  3. In the New Access Rule Wizard, follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you click Apply on the Apply Changes bar, the policy is updated. The new policy applies only to new connections.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure destination network objects for an access rule

To configure destination network objects for an access rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks

    For enterprise networks, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Networks
  2. In the details pane, click the applicable access rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the To tab, click Add.
  5. In Network entities, select the applicable network object, click Add, and then click Close.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To apply the rule to all network objects except specified network objects, click the lower Add button.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure protocols for an access rule

To configure protocols for an access rule

  1. In the console tree of ISA Server Management, click Firewall Policy (for array-level firewall policy) or the specific enterprise policy.

    2. For array-level firewall policy, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy

    For enterprise policy, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Policies
    • Enterprise_Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Protocols tab, do one of the following:
    • If the rule applies to all protocols, even those not explicitly defined by ISA Server, click All outbound traffic.
    • If the rule applies only to specific protocols, click Selected protocols.
    • If the rule applies to all IP traffic except specific protocols, click All outbound traffic except selected.
  5. If you chose Selected protocols or All outbound traffic except selected, click Add and select one or more protocols.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure content for an access rule

To configure content for an access rule

  1. In the console tree of ISA Server Management, click Firewall Policy (for array-level firewall policy) or the specific enterprise policy.

    For array-level firewall policy, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy

    For enterprise policy, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Policies
    • Enterprise_Policy
  2. In the details pane, click the applicable access rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Content Types tab, do one of the following:
    • To specify that the rule applies to all content, click All content types.
    • To specify that the rule only applies to certain content, click Selected content types, and then click one or more content groups.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you specify the Selected content types option, the rule will be applied only to HTTP traffic.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Allow specified source ports for an access rule

To allow specified source ports for an access rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Protocols tab, click Ports.
  5. Select one of the following:
    • Click Allow traffic from any allowed source port if traffic is allowed from any port on the allowed source clients, as specified on the From page.
    • Click Limit access to traffic from this range of source ports if traffic is only allowed from ports on the allowed source clients, as specified on the From page. Then, in From and To, type the range of source ports allowed.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can only limit access from specific ports for primary connections.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Web Publishing Rules

This section provides steps for configuring Web publishing rules. For instructions on configuring general firewall policy rule properties, see Configure Firewall Policy Rules.

  • Create a Web publishing rule
  • Create a secure Web publishing rule
  • Configure name of Web server to publish
  • Configure a public name for a Web publishing rule
  • Configure path mapping
  • Configure how to redirect HTTP requests for Web publishing rules
  • Configure a listener for a Web publishing rule
  • Forward credentials to published server
  • Replace absolute links in Web pages
  • Add a link translation dictionary entry for a Web publishing rule
  • Specify content types for link translation

web link Get latest ISA Server content at ISA Server Guidance.


Create a Web publishing rule

To create a Web publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Tasks tab, click Publish a Web Server.
  3. In the New Web Publishing Rule Wizard, follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you click Apply on the Apply Changes bar, the policy is updated. The new policy applies only to new connections.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Create a secure Web publishing rule

To create a secure Web publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Tasks tab, click Publish a Secure Web Server.
  3. In the SSL Web Publishing Rule Wizard, follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure name of Web server to publish

To configure name of Web server to publish

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the To tab, in Server, type the name or IP address of the computer (Web server) on which the Web site is located.
  5. Select Forward the original host header instead of the actual one if ISA Server should pass the original host header information. When ISA Server passes host header information, client requests are routed to a particular site on the published computer.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure a public name for a Web publishing rule

To configure a public name for a Web publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Public Name tab, in This rule applies to, select one of the following:
    • All requests. Select this option when the rule will apply to any request for the specified Web server.
    • Requests for the following websites. Select this option when the rule will apply to specific Web sites on the server.
  5. If you select Requests for the following websites, click Add and specify the names of the Web sites that can be accessed.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • We recommend that you publish only one Web site per rule. This is because personal data that belongs to one Web site may be visible when accessing another Web site published using the same public name.
  • Public Web sites must be registered with the Domain Name System (DNS). For more information, see DNS Web site registrations.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure path mapping

To configure path mapping

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Paths tab, click Add.
  5. In the text box, type the path on the (published) Web server.
  6. Select one of the following:
    • Same as published folder. If the path specified in the request is identical to the path on the published Web server.
    • The following folder. If the path specified in the request will be mapped to the path that you specify in the text box. Type the path to which requests on the published Web server will be mapped.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you specify the internal path to which the request should be mapped, use this format: /mypath/*.
  • You cannot use a wildcard character in the path. For example, do not specify mypath*/ or /mypath*.
  • Avoid specifying a file name when you configure path mapping. If a file name is specified, only a request for the full path will be served.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure how to redirect HTTP requests for Web publishing rules

To configure how to redirect HTTP requests for Web publishing rules

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Bridging tab, select whether the request will be forwarded to an FTP server or to a Web server. Select one of the following:
    • FTP server. If you select this option, in the text box, type the port on the FTP server to which the request will be redirected.
    • Web server.
  5. If you select Web server:
    • If HTTP requests will be passed to the Web server using the HTTP protocol, click Redirect requests to HTTP port.
    • If HTTP requests will be passed to the Web server using HTTPS, click Redirect requests to SSL port.
  6. (Optional) If you clicked Redirect requests to SSL port, click Use a certificate to authenticate to the SSL Web server and click Select to select the certificate to use.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you selected Redirect requests to SSL port, the ISA Server computer will open a new secure control channel to the published Web server.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure a listener for a Web publishing rule

To configure a listener for a Web publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Listener tab, select the applicable listener from the drop-down list box. Alternatively, click New to create a new Web listener for this rule.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • For security reasons, we recommend that the Web listener configured for Outlook Web Access publishing should not be used for any other publishing scenarios.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Forward credentials to published server

To forward credentials to published server

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Users tab, select Forward Basic authentication credentials (Basic delegation).

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Replace absolute links in Web pages

To replace absolute links in Web pages

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Link Translation tab, click Replace absolute links in Web pages.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select this option, a link translation dictionary is automatically created. In most cases, you will not need to add more entries to the default dictionary.
  • ISA Server only performs link translation on HTML document strings, such as internal computer names, that are specified in UCS Transformation Format 8 (UTF-8) format.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Add a link translation dictionary entry for a Web publishing rule

To add a link translation dictionary entry for a Web publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Link Translation tab, click Replace absolute links in Web pages.
  5. Click Add.
  6. In Replace this text, type a string. The Link Translation Web filter searches the internal (published) Web site for the string.
  7. In With this text, type a string that the Link Translation Web filter will use to replace occurrences in the response page returned to the client.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Typically, the name specified in Replace this text might contain names of internal sites and servers, which are inaccessible to external clients.
  • Typically, the name specified in With this text might contain names accessible to external clients, such as fully qualified domain names (FQDN) of ISA Server.
  • When a client requests a range from an HTML (translatable) page, the URL is not translated. That is, the response to the client will be a range of the original server's response.
  • All entries specified in the link translation dictionary must be explicit. For example, an entry that maps http://myInternal to http://www.microsoft.com does not map http://myInternal:8080 to http://www.microsoft.com:8080.
  • Dictionaries with a large number of entries, which are applied to Web sites that include many links that require translation, could detrimentally impact ISA Server performance.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Specify content types for link translation

To specify content types for link translation

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Link Translation tab, click Replace absolute links in Web pages.
  5. Click Content Types.
  6. On the Content Types tab, in Selected content types, click one or more content types.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • By default, link translation is applied only to HTML content: text/html, text/css, and text/webviewhtml.
  • To view the MIME types and file types included in a content group, view the content group properties.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Server Publishing Rules

This section provides steps for configuring server publishing rules. For instructions on configuring general firewall policy rule properties, see Configure Firewall Policy Rules.

  • Create a server publishing rule
  • Publish a mail server
  • Configure protocols for a server publishing rule
  • Configure network listeners for a server publishing rule
  • Override default ports for server publishing rules

Get latest ISA Server content at ISA Server Guidance.


Create a server publishing rule

To create a server publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the Tasks tab, click Create New Server Publishing Rule.
  3. In the New Server Publishing Rule Wizard, follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you click Apply in the details pane, the policy is updated. The new policy applies only to new connections.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Publish a mail server

To publish a mail server

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Tasks tab, click Publish a Mail Server.
  3. In the New Mail Server Publishing Rule Wizard, follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure protocols for a server publishing rule

To configure protocols for a server publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable server publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab, select the protocol (network traffic) to which the server publishing rule will be applied.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure network listeners for a server publishing rule

To configure network listeners for a server publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable server publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Networks tab, select the network adapter on which ISA Server should listen for client requests.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • For the rule to work, traffic sources (network entities) specified in the From tab of the publishing rule properties must be included in a network selected as a network listener.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Override default ports for server publishing rules

To override default ports for server publishing rules

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab, click Ports.
  5. In Firewall Ports, select one of the following:
    • Publish using the default port defined in the protocol definition. When you select this option, ISA Server will accept incoming client requests on the default port.
    • Publish on this port instead of the default port. When you select this option, ISA Server will accept incoming client requests on a port other than the default port. If an alternate port is selected, ISA Server receives client requests for the published service on the nonstandard port, and then forwards requests to the designated port on the published server.
  6. In Published Server Ports, select one of the following:
    • Send requests to the default port on the published server. When you select this option, ISA Server will accept requests for the published service on the default port as indicated in the protocol definition.
    • Send requests to this port on the published server. When you select this option, ISA Server will accept requests for the published service on a port other than the default port.
  7. In Source Ports, select one of the following:
    • Allow traffic from any allowed source port. When you select this option, ISA Server will accept requests from any port on allowed client computers.
    • Limit access to traffic from this range of source ports. When you select this option, ISA Server will accept requests only from the ports that you specify.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Firewall Policy Rules

This section provides steps for configuring properties common to all firewall policy rules for Internet Security and Acceleration (ISA) Server 2004.

  • Configure an action for a firewall policy rule
  • Configure users for a firewall policy rule
  • Configure schedule for a firewall policy rule
  • Configure source network objects for a firewall policy rule
  • Configure proxy requests for a firewall policy rule
  • Configure application filtering for a firewall policy rule
  • Change order of a firewall policy rule
  • Delete a firewall policy rule
  • Disable a firewall policy rule


Configure an action for a firewall policy rule

To configure an action for a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Action tab, do one of the following:
    • To allow client access, click Allow.
    • To deny client access, click Deny.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • For access rules, if you selected to deny access to sites, you can optionally select the Redirect HTTP request to the Web page check box, and then specify an alternate URL to which client requests should be redirected. Note that:
    • The URL specified must be accessible to the clients or users. Either the URL must be on an internal computer, or a rule must explicitly allow access to the URL.
    • When you specify the destination to which to redirect the request, you can specify a different location, by typing http://URL.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure users for a firewall policy rule

To configure users for a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing or access rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Users tab, click Add.
  5. In User sets, select the applicable user set, click Add, and then click Close.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To apply the rule to all users except specified user sets, click the lower Add button.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure schedule for a firewall policy rule

To configure schedule for a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing or access rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Schedule tab, in Schedule, select the schedule to apply.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you modify a rule so that it will be applied only at specific times (by configuring the schedule), the rule is applied only to new connections. Traffic from existing connections will continue to pass, even if it is not at an allowed time.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure source network objects for a firewall policy rule

To configure source network objects for a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the From tab, click Add.
  5. In Network entities, select the applicable network object, click Add, and then click Close.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To apply the rule to all network objects except specified network objects, click the lower Add button.
  • For Web publishing rules, the rule applies only to specified network objects that are also included in the networks specified for the Web listeners applied to the rule. For more information, see Web listeners.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure proxy requests for a firewall policy rule

To configure proxy requests for a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the To tab, select one of the following:
    • Requests appear to come from the ISA Server computer. When this is selected, the IP address making the request will appear to be the ISA Server computer. You hide the address of the client making the request.
    • Requests appear to come from the original client. When this is selected, the IP address making the request will appear to be the client. Some applications require actual identification by the real requesting client. When you publish these applications, you can configure ISA Server to forward requests with the IP address of the requesting (source) client.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select the Requests appear to come from the original client option, ISA Server must be configured as the gateway for the published Web server. Alternatively, ISA Server can be configured as the default gateway for the IP address of the original client.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure application filtering for a firewall policy rule

To configure application filtering for a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Protocols tab, click Filtering, and then select one of the following:
    • To configure HTTP filtering, click Configure HTTP.
    • To configure RPC filtering, click Configure RPC protocol. This applies for access rules only.
    • To configure FTP filtering, click Configure FTP.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can only configure application filtering if the rule applies to the specific protocol:
    • HTTP filtering. The rule must apply to HTTP.
    • RPC filtering. The rule must apply to an RPC protocol.
    • FTP filtering. The rule must apply to FTP.
  • You cannot configure application filtering for a firewall policy rule that denies traffic. This is true even for protocols that are specified in the Exceptions list on the Protocols tab.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Change order of a firewall policy rule

To change order of a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Move Selected Rules Up or Move Selected Rules Down.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The default firewall policy rule is always ordered last of the firewall policy rules.
  • System policy rules are processed before all firewall policy rules.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Delete a firewall policy rule

To delete a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Delete Selected Rules.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You cannot delete the default firewall policy rule (named Default rule).

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Disable a firewall policy rule

To disable a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, select the applicable rules.
  3. On the Tasks tab, click Disable Selected Rules.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To select adjacent rules, click the first rule, and then hold down SHIFT and click the last item.
  • To select nonadjacent rules, click the first rule, and then hold down CTRL and click additional items.
  • When you disable a rule, any attempt to connect will be denied. However, ISA Server does not close active connections. You can stop active connections by disconnecting the relevant sessions.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Per-Rule Filtering

This section provides steps for configuring per-rule filtering for firewall policy rules with Internet Security and Acceleration (ISA) Server 2004.

  • Configure FTP filtering
  • Configure HTTP Filtering
  • Configure RPC filtering

Get latest ISA Server content at ISA Server Guidance.


Configure FTP filtering

To configure FTP filtering

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click a server publishing rule or access rule that applies to FTP traffic.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for a server publishing rule) or on the Protocols tab (for an access rule), click Filtering, and then click Configure FTP.
  5. On the Protocol tab, select Read Only, if FTP uploads should be blocked.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure HTTP Filtering

This section provides steps for configuring Hypertext Transfer Protocol (HTTP) filtering for firewall policy rules that use HTTP.

  • Limit the maximum size of a header in HTTP requests
  • Limit request payload length
  • Limit URLs that can be specified in a request
  • Block responses containing Windows executables
  • Block specified HTTP methods
  • Block specified HTTP extensions
  • Block specified HTTP headers
  • Specify how HTTP headers are returned
  • Specify how HTTP Via headers are forwarded or returned
  • Block specified HTTP signatures

Get latest ISA Server content at ISA Server Guidance.


Limit the maximum size of a header in HTTP requests

To limit the maximum size of a header in HTTP requests

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the General tab, in Maximum headers length (bytes), type the maximum number of bytes that a request can have in its headers (URL and headers) before it is blocked.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • This setting is common for all rules to which the HTTP filter is applied.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Limit request payload length

To limit request payload length

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the General tab, verify that Allow any payload length is not selected.
  6. In Maximum payload length (bytes), type the maximum payload length allowed per request.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To allow requests, regardless of payload length, select Allow any payload length.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Limit URLs that can be specified in a request

To limit URLs that can be specified in a request

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the General tab, do the following:
    • In Maximum URL length (bytes), type the maximum URL length allowed. Requests with URLs exceeding this value will be blocked.
    • In Maximum query length (bytes), type the maximum length of a query allowed in a request. Requests with queries exceeding this value will be blocked.
    • Select Verify normalization to specify that URLs containing escaped characters after normalization will be blocked.
    • Select Block high bit characters to specify that URLs with high-bit characters will be blocked.

Important

  • When you select Block high bit characters, URLs that contain DBCS or Latin 1 characters will be blocked. This can impact scenarios such as Outlook Web Access publishing, SharePoint Portal Server publishing, and any scenario in which a GET request passes a parameter that includes a character from a double-byte character set.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Block responses containing Windows executables

To block responses containing Windows executables

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the General tab, click Block responses containing Windows executable content.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select this option, responses in which the first word of the downloaded binary file is MZ are blocked. For example, all .exe files are blocked, but .com and .pif files are not blocked.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Block specified HTTP methods

To block specified HTTP methods

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the Methods tab, select one of the following:
    • Allow all methods. Select this option when no methods will be blocked.
    • Allow only specified methods. Select this option when requests with specific methods will be allowed.
    • Block specified methods (allow all others). Select this option when requests will be allowed except those with specified methods.
  6. If you selected Allow only specified methods or Block specified methods (allow all others), click Add, and then type the HTTP method in Method.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Block specified HTTP extensions

To block specified HTTP extensions

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the Extensions tab, select one of the following:
    • Allow all extensions. Select this option when no extensions will be blocked.
    • Allow only specified extensions. Select this option when requests with specific extensions will be allowed.
    • Block specified extensions (allow all others). Select this option when all requests will be allowed except those with specified extensions.
  6. If you selected Allow only specified extensions or Block specified extensions (allow all others), click Add, and then type the HTTP extension in Extension.
  7. Select Block requests containing ambiguous extensions if requests whose file extension cannot be determined should also be blocked.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Block specified HTTP headers

To block specified HTTP headers

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the Headers tab, click Add.
  6. In Search in, select Request headers or Response headers.
  7. In HTTP header, type the header that will be blocked.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The length of the header is counted from the : (colon) to the last new line character (CRLF).

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Specify how HTTP headers are returned

To specify how HTTP headers are returned

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the Headers tab, in Server Header, select one of the following:
    • Send original header. If ISA Server should return the original header in the response.
    • Strip header from response. If ISA Server should not return any header in the response.
    • Modify header in response. If ISA Server should modify the header returned in the response.
      If you select this option, in Change to, type the value that will appear in the response.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • We recommend that you select Strip header from response when publishing Web servers. We do not recommend that you select this option when publishing Windows Media server.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Specify how HTTP Via headers are forwarded or returned

To specify how HTTP Via headers are forwarded or returned

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the Headers tab, in Via Header, select one of the following to configure how the Via header will be forwarded in the request or returned in the response:
    • Send default header. To use the default header.
    • Modify header in request and response. If ISA Server should replace the Via header with a modified header. If you select this option, in Change to, type the header that will appear instead of the Via header.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Block specified HTTP signatures

To block specified HTTP signatures

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the Signatures tab, click Add.
  6. On the Signature page, do the following:
    • In Name, type the name that you will use to identify the signatures.
    • In Search in, select Request URL, Request headers, Request body, Response headers, or Response body.
    • In Signature, type the signature string, which when found in the selected request header, request body, response header, or response body will be blocked.
    • If you selected Request body or Response body, in From and in To, type the range in the body to search.
    • If you selected Request body or Response body, in Format, select Text or Binary, to indicate the format of the search string.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you specify a signature search on a request body or a response body, for performance reasons, we recommend that you specify a small byte range (specified by From and To).
  • When you block specific signatures, you are essentially blocking applications that tunnel traffic over HTTP and can be characterized by specific patterns in request headers, request body, response headers, and response body (for example, Windows Messenger). HTTP signature blocking will not block applications that use different types of content-encoding or range requests.
  • All HTTP requests and responses must be UTF-8 encoded for text signature blocking to be performed.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Provides step-by-step instructions on how to Configure RPC filtering

To configure RPC filtering

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click any access rule that applies to remote procedure call (RPC) traffic.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Protocols tab (for an access rule), click Filtering, and then click Configure RPC protocol.
  5. On the Protocol tab, select Enforce strict RPC compliance, if no RPC protocols should be allowed.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you publish an RPC interface where there is a route network relationship between networks, port overriding is ignored. The publishing rule will use the original IP address or port.
  • When you disable the Enforce strict RPC compliance option, DCOM traffic and other RPC protocols will be allowed.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure System Policy

This section provides steps for configuring the system policy for Internet Security and Acceleration (ISA) Server 2004.

  • Enable system policy configuration group
  • Edit destinations for a system policy rule
  • Show system policy rules

Get latest ISA Server content at ISA Server Guidance.


Enable system policy configuration group

To enable system policy configuration group

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Tasks tab, click Edit System Policy.
  3. In Configuration Groups, select the applicable configuration group.
  4. On the General tab, click Enable.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Edit destinations for a system policy rule

To edit destinations for a system policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Tasks tab, click Edit System Policy.
  3. In the System Policy Editor, on the From tab, click Add.
  4. In Network entities, select a network object. Click Add, and then click Close.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To modify a destination, click a destination in the list, and then click Edit.
  • To delete a destination, click a destination in the list, and then click Remove.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Show system policy rules

To show system policy rules

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Tasks tab, click Show System Policy Rules.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Toolbox elements

This section provides steps for creating and configuring Toolbox elements for Internet Security and Acceleration (ISA) Server 2004.

  • Create a content type
  • Create a protocol
  • Apply an application filter to a protocol
  • Create a schedule
  • Create a URL set
  • Create a domain name set
  • Create a user set
  • Configure Web Listeners

Get latest ISA Server content at ISA Server Guidance.


Create a content type

To create a content type

  1. In the console tree of ISA Server Management, click Firewall Policy (for array-level content types) or Enterprise Policies (for enterprise-level content types).

    For enterprise-level content types, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Policies

    For array-level content types, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Content Types.
  3. On the toolbar beneath Content Types, click New.
  4. In Name, type the name of the content type.
  5. (Optional) In Description, type a description for the content type.
  6. In Available types, do one of the following:
    • To select an existing content type, click a file name extension or Multipurpose Internet Mail Extensions (MIME) type.
    • To add a new content type, type a new file name extension or a MIME type.
  7. Click Add.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you create content types, we recommend that you specify the content's MIME type and file name extension.
  • When you configure a content type and specify the MIME type, you can use an asterisk (*) as a wildcard character. For example, to include all application types, enter application/*. The asterisk wildcard character can be used only with MIME types (and not with file extensions). The asterisk can be specified only once, at the end of the MIME type after the slash mark (/).
  • To remove a file name extension or MIME type from the content type, in Selected types, click the file name extension or MIME type, and then click Remove.
  • Array-level content types can be used only for array-level access rules.
  • Enterprise-level content types cannot be modified at the array level. Furthermore, you must have Enterprise Administrator permissions to modify them.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Create a protocol

To create a protocol

  1. In the console tree of ISA Server Management, click Firewall Policy (for array-level protocols) or Enterprise Policies (for enterprise-level protocols).

    For enterprise-level protocols, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Policies

    For array-level protocols, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Protocols.
  3. On the toolbar beneath Protocols, click New, and then click Protocol.
  4. In the New Protocol Definition Wizard, follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you create a protocol, you can apply one or more application filters to the protocol. When you apply an application filter, that filter will perform additional filtering functionality.
  • Protocols that are defined or modified at the enterprise level can be used in array-level rules. However, these enterprise-level protocols cannot be modified at the array level.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Apply an application filter to a protocol

To apply an application filter to a protocol

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Protocols.
  3. Expand the appropriate folder, and then select the applicable protocol. On the toolbar beneath Protocols, click Edit.
  4. On the Parameters tab, in Application Filters, select the filters to apply to the protocol.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you apply an application filter, that filter will perform additional filtering functionality.
  • When you disable an application filter that typically applies to a protocol, you disable all application filter functionality. For example, by disabling the Web Proxy filter for the HTTP protocol, you disable all caching and proxying for that protocol.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Create a schedule

To create a schedule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Schedules.
  3. On the toolbar beneath Schedules, click New.
  4. In Name, type the name of the schedule.
  5. (Optional) In Description, type a description for the schedule.
  6. Use the schedule table to set the schedule.
    • Click a cell to select the specific hour on a specific day.
    • Click a day in the left column to select the entire day.
    • Click an hour in the top row to select the same hour on all days.
  7. Click Active, to enable the rule during the selected times or click Inactive to disable the selected times.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • In the table, a dark cell means the rule is in effect during that hour on that day. A white cell means the rule is not in effect.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Create a URL set

To create a URL set

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. On the toolbar beneath Network Objects, click New, and then click URL Set.
  4. In Name, type a name for the URL set.
  5. Click New, and then type a URL to include in the URL set.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When ISA Server checks the URL sets configured for a rule, text after a question mark (?) is ignored. URLs with ?, which are included in a URL set, are ignored.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Create a domain name set

To create a domain name set

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. On the toolbar beneath Network Objects, click New, and then click Domain Name Set.
  4. In Name, type a name for the domain name set.
  5. Click New, and then type a domain to include in the domain name set.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When specifying the domain name, you can use an asterisk (*) to specify a set of computers. For example, to specify all computers in the microsoft.com domain, type the domain name as *.microsoft.com. Note that the asterisk can appear only at the start of the domain name, and can be specified only once in the name.
  • When you specify a domain name, specify the computer name using the fully qualified domain name (FQDN). For example, type computer_name.microsoft.com, and not //computer_name.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Create a user set

To create a user set

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Users.
  3. On the toolbar beneath Users, click New.
  4. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When RADIUS or SecurID authentication is used, ISA Server compares the credentials passed by the user with the string specified on the Users tab.
    For example, if you apply the rule to a user set that includes only Domain\User and the user passes credentials as User@Domain, ISA Server will not apply this rule to the user.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Modify a domain name set

To modify a domain name set

  1. In the console tree of ISA Server Management, click Enterprise Policies (for enterprise-level domain name sets) or Firewall Policy (for array-level domain name sets).

    For enterprise-level domain name sets, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Policies

    For array-level domain name sets, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Select the applicable domain name set.
  4. On the toolbar beneath Network Objects, click Edit.
  5. Click New, and then type the domain name.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you apply a rule to a domain name set, ISA Server checks if the request matches the specified domain name set. ISA Server checks the exact name that you specified, including port numbers.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Modify a computer set

To modify a computer set

  1. In the console tree of ISA Server Management, click Enterprise Policies (for enterprise-level computer sets) or Firewall Policy (for array-level computer sets).

    For enterprise-level computer sets, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Policies

    For array-level computer sets, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Select the applicable computer set.
  4. On the toolbar beneath Network Objects, click Edit.
  5. To add a new computer to this set, Click Add, and then click Computer.
  6. In Name, type a name for the computer set.
  7. In Computer IP Address, type the IP address of the computer to include in this set.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure Web Listeners

This section provides steps for configuring Web listeners for Internet Security and Acceleration (ISA) Server 2004.

  • Create a Web listener
  • Configure a Web listener to listen for HTTP or SSL requests
  • Configure maximum number of concurrent connections allowed
  • Configure RSA SecurID
  • Configure Outlook Web Access Forms-Based Authentication

Get latest ISA Server content at ISA Server Guidance.


Create a Web listener

To create a Web listener

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. On the toolbar beneath Network Objects, click New, and then click Web Listener.
  4. In the New Web Listener Wizard, follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure a Web listener to listen for HTTP or SSL requests

To configure a Web listener to listen for HTTP or SSL requests

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Expand Web Listeners, and select the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the Preferences tab, select Enable HTTP if ISA Server should listen for HTTP requests.
    In HTTP port, type the port number on which ISA Server listens for requests.
  6. Select Enable SSL if ISA Server should listen for Secure Sockets Layer (SSL) requests.
    In SSL port, type the port number on which ISA Server listens for SSL requests.
  7. If you select Enable SSL, click Select to select a certificate to use for SSL requests.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The default HTTP port number for incoming Web requests is 80. The default port number for outgoing Web requests is 8080.
  • Most Web browsers can only use port 443 for SSL requests.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure maximum number of concurrent connections allowed

To configure maximum number of concurrent connections allowed

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Expand Web Listeners and select the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the Preferences tab, select Advanced.
  6. In Advanced Settings, select one of the following:
    • Unlimited. To allow an unlimited number of clients to connect to the server at any one time.
    • Maximum per server. To limit the maximum number of clients that can connect to the server at any one time.
      Type the maximum number of connections.
  7. In Advanced Settings in Connection timeout, type the number of seconds before the server disconnects an inactive user.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure RSA SecurID

This section provides steps for configuring RSA SecurID authentication.

  • Configure a Web listener to use authentication for RSA SecurID
  • Enable domain cookies for authentication for RSA SecurID
  • Export a domain secret
  • Expire idle cookies after the timeout period has elapsed
  • Ignore browser IP address when validating
  • Prevent caching of protected pages
  • Enable name locking


Configure a Web listener to use authentication for RSA SecurID

To configure a Web listener to use authentication for RSA SecurID

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the Preferences tab, click Authentication.
  6. In Method, click SecurID.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select RSA SecurID authentication, no other authentication method can be selected.
  • When RSA SecurID® authentication is used, all user requests are logged with their SecurID logon name in the cs-username field of the Web Proxy log.
  • Requests from users authenticated with RSA SecurID authentication can be identified by the prefix "(SecurID)" in the Client Username field. For example, (SecurID)Eitan.
  • If ISA Server is configured with multiple network adapters, and you create a Web listener with RSA SecurID authentication enabled, you should explicitly configure the network adapter address through which ISA Server should connect to the RSA ACE/Server for authentication purposes. Otherwise, requests requiring authentication may not be processed as expected by Web publishing rules using this listener. Specify the IP address in registry key HKEY_LOCAL_MACHINE\SOFTWARE\SDTI\AceClient\PrimaryInterfaceIP, as a string value.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Enable domain cookies for authentication for RSA SecurID

To enable domain cookies for authentication for RSA SecurID

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the RSA SecurID tab, click Manage domain configuration.
  6. Click Enable Domain Cookies.
  7. In Domain Name, type the fully qualified DNS name of the domain, for which you want the cookie to be valid.
  8. In Cookie Name, type a name for the domain's cookies (for example, mscookie).
  9. Click Manage Domain Secret to create, import, or export a domain secret.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When specifying the domain name in step 7, be sure to specify at least two levels. For example, .Microsoft.com and .sales.Microsoft.com are valid entries. However, .com is not a valid entry.
  • Cookie names can have a maximum of 30 characters. You can use any combination of letters, numbers, hyphens, and underscores. Do not use blank spaces or special characters.
  • By default, the SecurID Web filter distributes cookies that are valid only on the Web listener for which they are issued. To issue cookies that are valid on multiple publishing rules, you can enable domain cookies.
  • If you enable domain cookies, do not use shortcuts when referencing links to other servers in a WWW DNS domain. For the domain cookies to function properly, you must use the fully qualified domain name (FQDN) in the URLs.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Export a domain secret

To export a domain secret

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the RSA SecurID tab, click Manage domain configuration.
  6. Select Enable Domain Cookies.
  7. Click Manage Domain Secret.
  8. Click Export the Domain Secret to other servers or listeners, and then click OK.
  9. Select the destination drive where removable media is located, and click Save to store the domain secret file (Domain.sdi) on the media.
  10. In Password and Confirm, type the password that protects the domain secret file.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To import a domain secret, click Import the Domain Secret from another server or listener.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Expire idle cookies after the time-out period has elapsed

To expire idle cookies after the time-out period has elapsed

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the RSA SecurID tab, select Cookies always expire after the specified time.
  6. In Expiration time, type how many minutes must elapse before an idle cookie expires.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To expire unused cookies, select Cookies expire if not used within the specified time.
  • The minimum expiration time is 1 minute. The maximum time is 1440 minutes (one day).

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Ignore browser IP address when validating

To ignore browser IP address when validating

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the RSA SecurID tab, verify that the Ignore browser IP Address for cookie validation is not selected.

Important

  • Another way to further protect cookies is by minimizing the cookie expiration time.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you enable this option, the cookie retains and signs the client's IP address, thereby guaranteeing that a user cannot use the same cookie from a different IP address.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Prevent caching of protected pages

To prevent caching of protected pages

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the RSA SecurID tab, select Prevent caching of protected pages on clients.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Versions of Microsoft Internet Explorer earlier than 3.01 do not support this feature, even if you set the cache size to 0. Ensure that your users do not enable the setting in their Internet Explorer Web browsers that prevents protected pages from being cached by their browsers. If users download files or attempt to run an application on files from the protected resource, the files will be downloaded to the cache on their computers. However, the files will be cleared from the cache before users can open the files. As a workaround, instruct your users to enable the setting for clearing the cache in their browsers.
  • Enabling this option will only prevent caching of protected data on the browser. It does not prevent caching of protected pages on the ISA Server computer.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Forward RSA SecurID cookie to upstream server

To forward RSA SecurID cookie to upstream server

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the RSA SecurID tab, verify that Send SecurID cookie to upstream server is selected.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Enable name locking

To enable name locking

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the RSA SecurID tab, click Use RSA ACE/Server 5.0 Name Locking feature.
  6. Click Use separate user name and PASSCODE pages, if ISA Server (the RSA ACE/Agent) should prompt for the user name first, and then prompt for the PASSCODE only after the user enters the user name.

Caution

  • If the server requires name locking in the Agent Host record in the RSA ACE/Server database, you must enable name locking on the Agent Host. If the server requires name locking and the Agent Host does not use the name locking feature, all authentication requests from the Agent Host will be denied. If the server does not require name locking, but it is enabled on the Agent Host, the server can process the request without using name locking.
  • A malicious user can permanently lock a user with many logon attempts.

Note

  • This feature requires RSA ACE/Server 5.0 Patch 03 to be installed on the RSA ACE/Server.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Outlook Web Access Forms-Based Authentication

This section provides steps for configuring Outlook Web Access forms-based authentication with Internet Security and Acceleration (ISA) Server 2004.

  • Block attachments from Outlook Web Access clients
  • Configure idle session time-out for Outlook Web Access clients

Get latest ISA Server content at ISA Server Guidance.


Block attachments from Outlook Web Access clients

To block attachments from Outlook Web Access clients

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Expand Web Listeners, and select the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the Preferences tab, click Authentication.
  6. Verify that the Outlook Web Access forms-based authentication method is selected, and then click Configure.
  7. In Block e-mail attachments for, do the following:
    • Select Clients on public machines, if Outlook Web Access clients will not be allowed to receive attachments on public computers.
    • Select Clients on private machines, if Outlook Web Access clients will not be allowed to receive attachments on private computers.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The settings that you configure in this procedure apply to all Web listeners that use Outlook Web Access forms-based authentication.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure idle session time-out for Outlook Web Access clients

To configure idle session time-out for Outlook Web Access clients

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Expand Web Listeners and select the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the Preferences tab, click Authentication.
  6. Verify that OWA Forms-Based authentication is selected, and then click Configure.
  7. In Idle Session Timeout, do the following:
    • In Clients on public machines, type the amount of time that client sessions on public computers may remain idle before they time out.
    • In Clients on private machines, type the amount of time that client sessions on private computers may remain idle before they time out.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The settings you configure apply to all Web listeners that use Outlook Web Access forms-based authentication.
  • When a session reaches the time-out threshold, clients are required to log on to the session using their user credentials.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Authentication

This section provides steps for configuring authentication.

  • Configure RADIUS servers
  • Configure authentication method for a Web listener
  • Configure authentication method for Web Proxy clients (outgoing requests)
  • Configure client certificate validation
  • Configure server certificate validation

Get latest ISA Server content at ISA Server Guidance.


Configure RADIUS servers

To configure RADIUS servers

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • General
  2. In the details pane, click Define RADIUS Servers.
  3. On the RADIUS Servers tab, click Add.
  4. In Server name, type the name of the RADIUS server to use for authentication.
  5. Click Change and in New secret, type the shared secret that is used for secure communications between ISA Server and the RADIUS server. You must configure the same shared secret on both ISA Server and the RADIUS server for successful RADIUS communications to occur.
  6. In Port, type the User Datagram Protocol (UDP) port that is used by the RADIUS server for incoming RADIUS authentication requests. The default value of 1812 is based on RFC 2138. For older RADIUS servers, set the port value to 1645.
  7. In Time-out (seconds), type the amount of time (in seconds) that ISA Server will try to obtain responses from the RADIUS server before trying another RADIUS server.
  8. Select Always use message authenticator if a message authenticator based on the shared secret is sent with each RADIUS message.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When configuring ISA Server for RADIUS authentication, the configuration of RADIUS servers applies to all rules or network objects that use RADIUS authentication.
  • Shared secrets are used to verify that RADIUS messages, with the exception of the Access-Request message, are sent by a RADIUS-enabled device that is configured with the same shared secret.
  • Be sure to change the default preshared key on the RADIUS server.
  • Configure strong shared secrets and change them frequently to prevent dictionary attacks. Strong shared secrets are a long (more than 22 characters) sequence of random letters, numbers, and punctuation.
  • If you select Always use message authenticator, make sure that your RADIUS servers are capable of receiving, and configured to receive message authenticators.
  • For VPN clients, Extensible Authentication Protocol (EAP) messages are always sent with a message authenticator. For Web Proxy clients, only Password Authentication Protocol (PAP) is used.
  • You must select Always use message authenticator if your RADIUS server is running Internet Authentication Service (IAS), and the RADIUS client that is configured for this server has the Request must contain the Message Authenticator attribute option selected.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure authentication method for a Web listener

To configure authentication method for a Web listener

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the Preferences tab, click Authentication.
  6. In Method, select the applicable authentication method.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • These authentication mechanisms can be used simultaneously on a Web listener: Basic, Digest, Integrated Windows, and client certificate authentication. When selected, RADIUS, SecurID, or forms-based authentication methods must be the only authentication mechanism configured.
  • When you enable SecurID authentication on a computer running Windows Server 2003, the Network Service account must have read/write access to the following registry key: HKLM\Software\SDTI\ACECLIENT. In addition, the Network Service account must have read permission for the Sdconf.rec file, located in %SystemRoot%\system32\.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure authentication method for Web Proxy clients (outgoing requests)

To configure authentication method for Web Proxy clients (outgoing requests)

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, select the Networks tab, and then select the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Web Proxy tab, click Authentication.
  5. In Method, select the applicable authentication method.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • These authentication mechanisms can be used simultaneously on a Web listener: Basic, Digest, Integrated Windows, and client certificate authentication. When selected, RADIUS, SecurID, or forms-based authentication methods must be the only authentication mechanism configured.
  • When you enable SecurID authentication on a computer running Windows Server 2003, the Network Service account requires read/write access to the following registry key: HKLM\Software\SDTI\ACECLIENT. In addition, the Network Service account must have read permission for the Sdconf.rec file, located in %SystemRoot%\system32\.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure client certificate validation

To configure client certificate validation

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • General
  2. In the details pane, click Specify Certificate Revocation.
  3. Select Verify that incoming client certificates are not revoked.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select this option, ISA Server will automatically check whether incoming client certificates are in the certificate revocation list (CRL). If the certificate is in the CRL, the client request will be denied.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure server certificate validation

To configure server certificate validation

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • General
  2. In the details pane, click Specify Certificate Revocation.
  3. Select Verify that incoming server certificates are not revoked in a forward scenario, when ISA Server will check if server certificates from an upstream server are in the certificate revocation list (CRL).
  4. Select Verify that incoming server certificates are not revoked in a reverse scenario, when ISA Server will check if server certificates from a published server are in the CRL.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select these options, if the certificate is in the CRL, the request will be denied.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Network Protection

This section provides steps for configuring network protection features.

  • Limit the number of connections
  • Enable IP fragment filtering
  • Enable IP options filtering
  • Enable IP routing


Limit the number of connections

To limit the number of connections

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Array
    • Array_Name
    • Configuration
    • General
  2. In the details pane, click Define Connection Limits.
  3. On the Connection Limit tab, select Limit the number of connections. Then, do the following:
    • In Connections created per second, per rule (non-TCP), type the number of connections allowed per rule, per second.
    • In Connection limit per client (TCP and non-TCP), type the number of connections allowed per client.
  4. To override the default connection limit for specific IP addresses, in Custom connection limit, type the maximum number of connections allowed for specific users.
  5. Click Add to add computer sets to which these limits apply.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • For TCP connections, no new connections are allowed after more connection limit is exceeded. For other connections (Raw IP and UDP), older connections are terminated when the connection limit is exceeded so that new connections can be created.
  • In firewall chaining scenarios and in some back-to-back scenarios, specify customized connection limits for the IP addresses of the chained server or back firewall.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Enable IP fragment filtering

To enable IP fragment filtering

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • General
  2. In the details pane, click Define IP Preferences.
  3. On the IP Fragments tab, select Block IP fragments.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Enable IP options filtering

To enable IP options filtering

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • General
  2. In the details pane, click Define IP Preferences.
  3. On the IP Options tab, select Enable IP options filtering.
  4. Select one of the following:
    • Deny all packets with any IP option
    • Deny packets with the selected IP options
    • Deny packets with all except selected IP options
  5. If you select Deny packets with the selected IP options or Deny packets with all except selected IP options, select IP options.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Enable IP routing

To enable IP routing

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • General
  2. In the details pane, click Define IP Preferences.
  3. On the IP Routing tab, select Enable IP routing.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Although IP routing improves performance, disabling IP routing is considered more secure. When IP routing is disabled, ISA Server sends only the data (and not the entire packet) to the destination.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Troubleshooting firewall policy

What problem are you having?

Clients cannot access a specific domain, although a rule has been created allowing access to that domain name set.

Cause: When you apply a rule to a domain name set, ISA Server checks if the request matches the specified domain name set. ISA Server checks the exact name that you specified, including port numbers. For example, consider a Web publishing rule that allows access to a domain name set that includes fabrikam.put:1111. Requests to fabrikam.put will be denied. Requests to fabrikam.put will be allowed only if the domain name set includes fabrikam.put:1111.

Solution: Fix the domain name set to include the exact name of the domain. For instructions, see Modify a domain name set.

The array members cannot communicate with each other. (This may occur after creating a publishing rule that uses a remote procedure call (RPC) protocol.)

Cause: If you have a rule that publishes the RPC protocol, requests sent to an array member are forwarded to the published (RPC) server.

Solution: Verify that the array members are not included as the source (or the destination) for RPC publishing rules.

When remotely managing ISA Server, you cannot connect to the computers running ISA Server services. (This may occur after creating a publishing rule that uses an RPC protocol).

Cause: If you have a rule that publishes the RPC protocol, requests sent to an array member are forwarded to the published (RPC) server.

Solution: Apply the publishing rule to all applicable destinations except the Remote Management Computers and Array Servers computer sets. For instructions, see Configure source network objects for a firewall policy rule.

I recently applied and saved a new configuration. The array is not functioning as expected.

Cause: After you click Apply to save changes and update the configuration, the configuration is saved to the Configuration Storage server. However, the array members will be updated with this configuration only after several minutes. Until all the array members are updated, the array may not function as expected.

Solution: Check the Configuration Status view, to determine when status for all the array members is set to Synced. For instructions, see View the configuration status.


Clients

Microsoft Internet Security and Acceleration (ISA) Server 2004 supports several types of clients: Firewall clients, SecureNAT clients, and Web Proxy clients. This section describes the clients supported by ISA Server and provides step-by-step instructions on how to configure these clients.

  • Clients: Concepts
  • Clients: How To
  • Troubleshooting Firewall Client

Get latest ISA Server content at ISA Server Guidance.


Clients: Concepts

This section provides information about the clients for Internet Security and Acceleration (ISA) Server 2004.

  • Client overview
  • Client requirements assessment
  • Firewall Client
  • SecureNAT clients
  • Web Proxy clients
  • Automatic Discovery

Get latest ISA Server content at ISA Server Guidance.


Client overview

ISA Server uses various communication layers to protect the corporate network. At the packet layer, ISA Server implements a firewall policy. In this way, ISA Server controls data on the network interface, evaluating traffic before it reaches any resource. Data is allowed to pass only after the Microsoft Firewall service processes rules to determine whether the request will be serviced.

ISA Server architecture

As illustrated in the figure, ISA Server protects three types of clients: Firewall clients, SecureNAT clients, and Web Proxy clients.

Firewall clients. Computers that have Firewall Client software installed and enabled. Requests from Firewall clients are directed to the Firewall service on the ISA Server computer, to determine whether access is allowed. Subsequently, they may be filtered by application filters and other add-ins. The Firewall service may also cache the requested object or serve the object from the ISA Server cache.

SecureNAT clients. Computers that do not have Firewall Client software installed. Requests from SecureNAT clients are directed first to the network address translation (NAT) driver, which substitutes a global IP address that is valid on the Internet for the internal IP address of the SecureNAT client. The client request is then directed to the Firewall service to determine if access is allowed. Finally, the request may be filtered by application filters and other extensions. The Firewall service may also cache the requested object or deliver the object from the ISA Server cache.

Web Proxy clients. CERN-compatible Web application. Requests from Web Proxy clients are directed to the Firewall service on the ISA Server computer, to determine if access is allowed. The Firewall service may also cache the requested object or serve the object from the ISA Server cache.

Regardless of client type, when ISA Server receives an HTTP request, the client is treated as if it is a Web Proxy client. Even when a Firewall client or a SecureNAT client makes an HTTP request, the client is considered a Web Proxy client. This has specific implications for how the client is authenticated.

Both Firewall client computers and SecureNAT client computers may also be Web Proxy clients. If the Web application on the computer is configured explicitly to use ISA Server, all Web requests are sent directly to the Firewall service, including HTTP, FTP, and Secure HTTP (HTTPS). All other requests are handled first by the Firewall service.

The following table compares the ISA Server clients.

Feature | SecureNAT client | Firewall client | Web Proxy client
Installation | Yes, requires some network configuration changes | Yes | No, requires Web browser configuration
Operating system support | Any operating system that supports TCP/IP | Only Windows platforms | All platforms, but by way of a Web application
Protocol support | Application filters for multi-connection protocols | All Winsock applications | HTTP, Secure HTTP (HTTPS), and FTP
User-level authentication support | Yes, for VPN clients only | Yes | Yes

Get latest ISA Server content at ISA Server Guidance.


Client requirements assessments

Client requirements assessment

Before you deploy or configure client software, assess your organizational needs. Determine which applications and services your internal clients require. Assess how you will be publishing servers. Then map these needs to the client types supported by ISA Server:

  • SecureNAT clients
  • Firewall clients
  • Web Proxy clients

For more information, see Client overview.

To help map user needs to the client types that you will deploy in your organization, ask yourself the following types of questions:

Do you want to avoid deploying client software or configuring client computers?

Recommended: SecureNAT clients.

SecureNAT clients do not require any software or specific configuration. Firewall clients require that you deploy Firewall Client software and Web Proxy clients require that you configure Web applications on client computers.

Are you using ISA Server only for forward caching of Web objects?

Recommended: SecureNAT or Web Proxy clients.

If you use SecureNAT clients in this scenario, you will not have to deploy any special software or configure the client computers. Instead, client requests are transparently passed to ISA Server for caching.

Do you allow access only for authenticated clients?

Recommended: Firewall clients.

For Firewall clients, you can configure user-based firewall policy rules. You can also configure user-based rules for Web Proxy clients, but the rule will be effective only if the Web application can pass the authentication information.

Are you publishing servers that are located on your Internal network?

Recommended: SecureNAT clients.

Internal servers can be published as SecureNAT clients. This eliminates the need for creating special configuration files on the publishing server.

Get latest ISA Server content at ISA Server Guidance.


Firewall Client

This section describes Firewall Client for Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Firewall Client overview
  • Firewall Client configuration
  • Firewall Client local addresses
  • Advanced Firewall Client settings
  • Advanced Firewall Client configuration file settings
  • Advanced Firewall Client configuration file samples
  • Firewall Client distribution

Get latest ISA Server content at ISA Server Guidance.


Firewall Client overview

A Firewall client is a computer with Firewall Client software installed and enabled. The Firewall client computer runs Winsock applications that use the Microsoft Firewall service of Microsoft Internet Security and Acceleration (ISA) Server 2004. Setting up a Firewall client does not configure individual Winsock applications. Instead, it uses a common Winsock service provider that the other applications use. The Firewall client then intercepts the application calls and determines whether to route the request to the ISA Server computer.

You can specify whether Firewall client support is enabled for the specific network. If Firewall client support is enabled, ISA Server will accept incoming requests on port 1745. When a Firewall client uses a Winsock application to request an object from a computer, the client checks whether the specified computer is considered local. An address is considered local if it is in the range of addresses included in the specific network. For instructions, see Configure network addresses.

If the computer is not considered local, the request is sent to the Firewall service. The Firewall service handles the request, forwarding it to the appropriate destination, as permitted. The Firewall Client software can send Windows user information, which is required for authentication purposes, to the ISA Server computer.

Installing Firewall Client

After you install Firewall Client Share, client computers can connect to the share to install the Firewall Client software. For instructions on installing Firewall Client Share, see Create a shared folder for Firewall Client installation. To install the Firewall Client software, users connect to the share and run the setup program. Alternatively, they can run unattended setup. For instructions, see Run Firewall Client unattended setup.

After installing the client software, users can modify the server name to which the client connects by specifying a different name either on the ISA Server computer to which the client currently connects or by changing the name in the Firewall Client software. The configuration changes take effect after the firewall configuration is refreshed.

Get latest ISA Server content at ISA Server Guidance.


Firewall Client configuration

Firewall Client software is configured using ISA Server Management. You can use ISA Server Management to configure Firewall Client settings, which are periodically updated on the client computer. You can configure the following:

  • Application settings. How the Firewall client connects to Microsoft Internet Security and Acceleration (ISA) Server 2004 for specific applications. For more information, see Advanced Firewall Client configuration file settings.
  • Internal network and local domains. The set of IP addresses and domains that the Firewall client recognizes as local, for which no ISA Server computer is required. The Firewall client considers as local the addresses and domains configured for the network. For instructions, see Configure network addresses and Configure domains included in a network.
  • Automatic discovery. By enabling automatic discovery, Firewall clients will automatically discover the appropriate ISA Server computer. For more information, see Automatic discovery for Firewall clients.
  • Web browser settings for the Firewall client. The Firewall Client application can automatically update the Web browser settings on the Firewall client computer. These settings are obtained from ISA Server, when the Firewall Client settings are updated. You can configure how the Web browser will be set on the Firewall client computer. Note that these settings do not apply to dial-up or VPN connections. For more information, see Configure Web browser settings for Firewall Client.

Allowing earlier versions of Firewall Client software

ISA Server supports earlier versions of the Firewall Client software, including Firewall Client for ISA Server 2000 and the Winsock Proxy client (from Microsoft Proxy Server 2.0). ISA Server also supports Firewall clients running earlier operating systems, including Microsoft Windows NT® Server 4.0, Windows® Millennium Edition, or Windows 98. However, you may want to prevent earlier versions of the Firewall Client software and clients running earlier Windows operating systems from connecting to your ISA Server computer. This is because these clients cannot use encryption when connecting to ISA Server. For instructions, see Allow connections from clients running previous versions of Firewall Client.

Encrypted Firewall Client connections

ISA Server supports a more secure way of communication between the Firewall client and ISA Server, which involves the use of encryption using a TCP control channel. You can configure ISA Server to accept connections only from clients communicating in this secure way. However, this prevents earlier versions of Firewall Client software from connecting. It also prevents any Firewall client running Windows NT Server 4.0, Windows Millennium Edition, or Windows 98 from connecting.


Firewall Client local addresses

By default, Firewall Client considers addresses specified as local to be all addresses on the network for which it is configured, in addition to the addresses specified in the local routing table on the Firewall client computer. For example, if the Firewall client connects to the network adapter for the Internal network, all IP addresses configured on the Internal network are considered local. Each time a Winsock application on that client attempts to establish a connection to an IP address, the Locallat.txt file is used to determine whether the IP address is on the Internal network. If the address is considered local, the connection is made directly. If the address is not considered local, the connection is made through the Microsoft Firewall service on ISA Server.

A local version of this information can also be created. Using a text editor, you can create a custom client local address table (LAT) file named Locallat.txt and place it in the \Documents and Settings\All Users\Application Data\Microsoft\Firewall Client 2004 folder on the Firewall client computer. You can add additional IP address ranges that the client recognizes as part of the local network. The client uses its own routing table, the server-specific settings, and the Locallat.txt file to determine which IP addresses are part of the local network.

When you create the Locallat.txt file, enter IP address pairs in the file. Each address pair defines either a range of IP addresses or a single IP address. The following example shows a Locallat.txt file that has two entries. The first entry is an IP address range and the second entry is a single IP address. Note that the second entry is an IP address and not a subnet mask.

10.51.0.0      10.51.255.255
10.52.144.103  10.52.144.103


Advanced Firewall Client settings

Upon installation, the Firewall Client software adopts the settings configured by the ISA Server 2004 computer from which the Firewall Client application was installed. These server settings determine functionally such as: automatic Web Proxy configuration, ISA Server name, ISA Server automatic detection, and others. After the Firewall Client software is installed, ISA Server updates these client settings each time a client computer is restarted, and every six hours after an initial refresh is made.

In addition to these settings, ISA Server periodically updates the client with information about IP addresses that the client should consider local (computers to which the client connects without going through ISA Server).

For most Winsock applications, the default Firewall Client configuration works with no need for further modification. However, in some cases, you will need to add client configuration information. Firewall Client can be configured locally for each user and for each computer, on the Firewall Client computer. The configuration is done by making changes to .ini files, which are installed on the Firewall Client computer.

You can change the default settings for all components after installation. The new configuration settings take effect only when the client configuration is refreshed.

.ini files

The configuration information is stored in a set of files, which are installed on the Firewall client computer. Specifically, when Firewall Client is installed on the computer, the following files are created on the Firewall client computer:

  • Common.ini, which specifies the common configuration for all applications
  • Management.ini, which specifies Firewall Client Management configuration settings

These files are created at the operating system level, for all users logged on to the computer and may be created for each specific user on the computer. The per-user settings override the general configuration settings. These files are created in different locations, depending on the operating system. For example, on Windows XP computers, the files are copied to two locations:

  • \Documents and Settings\All Users\Application Data\Microsoft\Firewall Client 2004 folder
  • \Documents and Settings\user_name\Local Settings\Application Data\Microsoft\Firewall Client 2004 folder

In addition to these files, the user may create another file called Application.ini, which specifies configuration information for specific applications.

For more information about the Common.ini and Application.ini settings, see Advanced Firewall Client configuration file settings.

The settings in these files are applied as follows:

  1. The .ini files in the user's folder take precedence. Any configuration settings here are used by Firewall Client to determine how the application will function.
  2. Firewall Client looks next in the All Users folder. Any additional configuration settings are applied. If a configuration setting specified contradicts the user-specific settings, it is ignored.
  3. The Firewall Client application detects the ISA Server computer to which it should connect, in accordance with the settings specified in Firewall Client Management.
  4. Finally, Firewall Client examines the server-level settings. Any configuration settings specified on ISA Server are applied. If a configuration setting specified contradicts the user-specific or computer-specific settings, it is ignored.


Advanced Firewall Client configuration file settings

The user on the Firewall client computer can create and modify files that determine the Firewall Client configuration settings. The Common.ini file, which is created when Firewall Client is installed, specifies common configuration for all the applications. The Application.ini file specifies configuration settings for specific applications. For more information about these files, see Advanced Firewall Client settings.

These files can be created at the operating system level for all users logged on to the computer and may be created for each specific user on the computer. The per-user settings override the general configuration settings. These files are created in different locations, depending on the operating system. For example, on computers running Microsoft® Windows® XP, the files are copied to two folders:

  • \Documents and Settings\All Users\Application Data\Microsoft\Firewall Client 2004
  • \Documents and Settings\user_name\Local Settings\Application Data\Microsoft\Firewall Client 2004

You can use ISA Server Management to modify Firewall Client configuration settings. For instructions, see Configure application settings for Firewall Client.

When you manually change the Firewall Client configuration, you must restart the FWCAgent service.

Settings specified during Firewall Client Setup apply to all user accounts on the client computer. Subsequent modifications on the client computer, using the Firewall Client applet, are only applied to applications running under the logged-on account. Changes are not applied to applications running for other users, or to applications running under system accounts.

You can also modify Firewall Client settings using the Firewall Client Tool (http://www.microsoft.com/).

The following table lists the entries that you can include when configuring the Firewall Client software application settings. The first column lists the keys that can be included in the configuration files. The second column describes the values to which the keys can be set. Note that some settings can be configured only on the Firewall client computer. You cannot configure them using ISA Server Management.

Entry | Description
ServerName | Specifies the name of the ISA Server computer to which the Firewall client should connect. (Can only be set on a Firewall client computer.)
Disable | Possible values: 0 or 1. When the value is set to 1, the Firewall Client application is disabled for the specific client application.
DisableEx | Possible values: 0 or 1. When the value is set to 1, the Firewall Client application is disabled for the specific client application. Applies only to Firewall Client for ISA Server 2004. When set, overrides the Disable setting.
Autodetection | (Can be set only on the Firewall client computer.) Possible values: 0 or 1. When the value is set to 1, the Firewall Client application automatically finds the ISA Server computer to which it should connect.
NameResolution | Possible values: L or R. By default, dotted decimal notation or Internet domain names are redirected to the ISA Server computer for name resolution and all other names are resolved on the local computer. When the value is set to R, all names are redirected to the ISA Server computer for resolution. When the value is set to L, all names are resolved on the local computer.
LocalBindTcpPorts | Specifies a Transmission Control Protocol (TCP) port, list, or range that is bound locally.
LocalBindUdpPorts | Specifies a User Datagram Protocol (UDP) port, list, or range that is bound locally.
DontRemoteOutboundTcpPorts | Specifies an outbound TCP port, list, or range that is bound locally.
DontRemoteOutboundUdpPorts | Specifies an outbound UDP port, list, or range that is bound locally.
RemoteBindTcpPorts | Specifies a TCP port, list, or range that is bound remotely.
RemoteBindUdpPorts | Specifies a UDP port, list, or range that is bound remotely.
ServerBindTcpPorts | Specifies a TCP port, list, or range for all ports that should accept more than one connection.
Persistent | Possible values: 0 or 1. When the value is set to 1, a specific server state can be maintained on the ISA Server computer if a service is stopped and restarted and if the server is not responding. The client sends a keep-alive message to the server periodically during an active session. If the server is not responding, the client tries to restore the state of the bound and listening sockets upon server restart.
ForceCredentials | (Can be set only on the Firewall client computer.) Used when running a Windows service or server application such as a Firewall Client application. When the value is set to 1, it forces the use of alternate user authentication credentials that are stored locally on the computer that is running the service. The user credentials are stored on the client computer using the FwcCreds.exe application that is provided with the Firewall Client software. User credentials must reference a user account that can be authenticated by ISA Server, either local to ISA Server or in a domain trusted by ISA Server. The user account is normally set not to expire. Otherwise, user credentials need to be renewed each time the account expires.
NameResolutionForLocalHost | Possible values are L (default), P, or E. Used to specify how the local (client) computer name is resolved, when the gethostbyname API is called. The LocalHost computer name is resolved by calling the Winsock API function gethostbyname() using the LocalHost string, an empty string, or a NULL string pointer. Winsock applications call gethostbyname(LocalHost) to find their local IP address and send it to an Internet server. When this option is set to L, gethostbyname() returns the IP addresses of the local host computer. When this option is set to P, gethostbyname() returns the IP addresses of the ISA Server computer. When this option is set to E, gethostbyname() returns only the external IP addresses of the ISA Server computer—those IP addresses that are not in the local address table.
ControlChannel | Possible values: Wsp.udp or Wsp.tcp (default). Specifies the type of control channel used.
EnableRouteMode | Possible values are 0 and 1 (default). When EnableRouteMode is set to 1 and a route relationship is configured between the Firewall client computer and the requested destination, then the IP address of the Firewall client is used as the source address. When the value is set to 0, the IP address of the ISA Server computer is used. This flag does not apply to older versions of Firewall Client.


Advanced Firewall Client configuration file samples

This section lists sample files for the Firewall Client configuration on the local Firewall client computer. For more information about these settings, see Advanced Firewall Client configuration file settings.

Common.ini settings

The Common.ini file specifies common configuration for all applications. The following is an example of a typical Common.ini file.

[Common]
ServerName=ISA_1
Disable=0
Autodetection=0

Application.ini settings

The Application.ini file specifies configuration settings for specific applications. The following is an example of an Application.ini file, showing a sample [FW_Client_App] section in a client configuration file for the FW_Client_App.exe section.

[FW_Client_App]
Disable=0
NameResolution=R
LocalBindTcpPorts=7777
LocalBindUdpPorts=7000-7022, 7100-7170
RemoteBindTcpPorts=30
RemoteBindUdpPorts=3000-3050
ServerBindTcpPorts=100-300
ProxyBindIp=80:110.52.144.103, 82:110.51.0.0
Persistent=1
ForceCredentials=1
NameResolutionForLocalHost=L

Get latest ISA Server content at ISA Server Guidance.


Firewall Client distribution

You can use the Windows Software Installation snap-in to centrally manage distribution of Firewall Client software. You distribute and configure the client software of ISA Server to groups of computers, so that all users who require the applications automatically have them on their desktops. In this way, you will not need to set up the client software on each desktop.

When you assign an application to a computer, the application is installed the next time the computer restarts.

Get latest ISA Server content at ISA Server Guidance.


SecureNAT clients

Client computers that do not have Firewall Client software are SecureNAT clients. SecureNAT clients can benefit from many of the features of ISA Server. This includes most access control features, with the exception of high-level protocol support and user-level authentication.

Although SecureNAT clients do not require special software, you must configure the default gateway so that all traffic destined to the Internet is sent by way of ISA Server, either directly or indirectly, through a router. You can configure clients either by using the Dynamic Host Configuration Protocol (DHCP) service or manually.

Because requests from SecureNAT clients are handled by the Microsoft Firewall service, SecureNAT clients benefit from the Firewall service security features. Application filters can modify the protocol stream to allow handling of complex protocols. In Microsoft® Windows® network address translation (NAT), this mechanism is accomplished through the use of NAT editors, which are written as kernel-mode NAT editor drivers.

Note that ISA Server application filters replace the functionality generally available through Windows-based NAT editors. An application filter must be available for SecureNAT clients to use specific applications or protocols. For more information, see Application Filters.

SecureNAT and network address translation

ISA Server extends the network address translation (NAT) functionality by enforcing ISA Server policy for SecureNAT clients. All ISA Server rules can be applied to SecureNAT clients, even though NAT does not have an inherent authentication mechanism. Policies regarding protocol usage, destination, and content type are also applied to SecureNAT clients.

SecureNAT clients and server publishing

As with Firewall clients, SecureNAT clients can also be servers, such as mail servers, which publish information to the Internet. You configure server publishing rules to publish servers as SecureNAT clients.

Configuring SecureNAT clients

Although SecureNAT clients do not require specific software to be deployed on the client computers, you must configure the network appropriately. This section details network considerations for SecureNAT clients.

Setting up the default gateway for SecureNAT clients

SecureNAT clients do not require specific software to be deployed on the client computers. However, you must configure your network topology for the ISA Server computer to protect the SecureNAT clients and ensure that their requests are serviced.

The default gateway for the SecureNAT clients must be properly configured. When setting the default gateway property, identify which type of network topology you are configuring:

  • Simple network. A simple network topology does not have any routers configured between the SecureNAT client and the ISA Server computer.
  • Complex network. A complex network topology has one or more routers bridging multiple subnets that are configured between a SecureNAT client and the ISA Server computer.

Configuring SecureNAT clients on a simple network

To configure SecureNAT clients on a simple network, you should set the SecureNAT client's IP default gateway settings to the IP address of the ISA Server computer's Internal network address card. You can set this manually, using the TCP/IP settings on the client. (These settings can be accessed by clicking the Network icon in Control Panel.) Alternatively, you can configure these settings automatically for the client using the DHCP service.

Configuring SecureNAT clients on a complex network

To configure SecureNAT clients on a complex network, you should set the default gateway settings on the last router in the chain between the SecureNAT client and the ISA Server computer. In this case, you do not have to change the default gateway settings for the SecureNAT clients.

Optimally, the router should use a default gateway that routes along the shortest path to the ISA Server computer. Also, the router should not be configured to discard packets destined for addresses outside the corporate network. ISA Server will determine how to route the packets.

Resolving names for SecureNAT clients

SecureNAT clients will probably request objects both from computers in the local network and from the Internet. Thus, SecureNAT clients will require DNS servers that can resolve names both for external and internal computers.

Internet access only

For Internet access only, the SecureNAT clients should configure the TCP/IP settings to use the DNS servers on the Internet. You should create an access rule that allows the SecureNAT clients to use the DNS protocol and configure the DNS filter for the SecureNAT clients.

Internal network and Internet access

If the SecureNAT clients will request data both from the Internet and from the Internal network servers, the clients should use a DNS server located on the Internal network. You should configure the DNS server to resolve both internal addresses and Internet addresses.

Get latest ISA Server content at ISA Server Guidance.


Web Proxy clients

A Web Proxy client is a client computer that has a Web browser application, which complies with HTTP 1.1 (or lower), can be configured to use a proxy, and is configured to use ISA Server. Each Web Proxy client is configured through its own user interface. Web browsers are Web Proxy clients.

The Firewall Client software can configure the Web browser settings on the Firewall client computer. These settings can be configured automatically or disabled altogether. You can use ISA Server Management to configure the following Web browser properties:

  • ISA Server computer and port to which the client will connect.
  • Automatic discovery settings.
  • Computers that the Firewall client's Web browser will access directly.
  • Backup route, if the ISA Server computer is unavailable.

When the Firewall Client software is installed, and with every user logon, the Web browser on the client computer is configured with those settings. This automatic configuration can be disabled.

If Firewall Client software is not installed, the Web browser can be configured manually.

Web Proxy client configuration

You do not have to install any software to configure Web Proxy clients. However, you must configure the Web applications on the client computers to use the ISA Server computer as the proxy server.

The default configuration URL is:

http://ISA_Server/array.dll?Get.Routing.Script

where ISA_Server is the name or IP address of the ISA Server computer. This is the URL where the configuration script is located. ISA Server automatically generates this configuration script, based on the direct access and backup route options.

You can set an option by which ISA Server automatically downloads a client configuration script, located on the ISA Server computer, every time a Web browser is opened. The output of this script provides an ordered series of ISA Server computers, which the browser uses to retrieve the object that is specified by the URL.

The script is accessible from a specific URL on the ISA Server computer (although it is not actually stored there). You can easily update all Web browser settings, without having to reconfigure each individual Web browser. Microsoft® Internet Explorer version 3.02 and later, and Netscape 2.0 and later, support this feature.

Automatic Web browser configuration for Firewall clients

You can configure ISA Server so that the Firewall client's Web browser is configured during setup. This way, the client's Web browser will use the specified automatic configuration script. The script is based on the options set in Web Browser Configuration. For instructions, see Configure Web browser settings for Firewall Client.

Browser configuration on the ISA Server computer

If you use a Web browser on the ISA Server computer, you must configure the browser to use the IP address of the server network adapter that is connected to the Internal network. Do not use the server computer name or DNS name.

If you configure the server browser to use the computer or DNS name, the name is resolved to the IP address of the External network interface connected to the Internet. Consequently, you must configure the browser on the server to connect through ISA Server.

Get latest ISA Server content at ISA Server Guidance.


Automatic Discovery

This section provides information about the automatic discovery feature of ISA Server 2004.

  • Automatic discovery overview
  • Automatic discovery for Firewall clients
  • Automatic discovery for Web Proxy clients

Get latest ISA Server content at ISA Server Guidance.


Automatic discovery overview

At first, it may seem like a simple task to configure the Microsoft Internet Security and Acceleration (ISA) Server 2004 computer to which Firewall clients and Web Proxy clients connect. However, subsequent modifications can be time consuming, particularly for roaming clients, who may require constant adjustments. The automatic discovery feature of ISA Server allows you to configure clients so that they automatically discover the appropriate ISA Server computer. In this way, roaming clients can connect to the ISA Server computer, as appropriate and when necessary. By enabling automatic discovery, Web Proxy and Firewall clients all automatically discover the appropriate ISA Server computer.

Configuring WPAD and WSPAD on the DNS or DHCP server

When automatic discovery is enabled, the Firewall client or the Web Proxy client requests an object from the Web Proxy Automatic Discovery (WPAD) server—in this case, the ISA Server computer that is configured to service requests. This triggers the automatic discovery process.

For example, this occurs when the ISA Server computer does not respond or when a local network adapter is enabled or disabled.

For instructions, see Configure DNS for automatic discovery of ISA Server and Configure DHCP for automatic discovery of ISA Server.

How automatic discovery works

Automatic discovery is based on information that is stored in the Dynamic Host Configuration Protocol (DHCP) server or Domain Name System (DNS) server. First, the client retrieves the name of the WPAD server from the DNS or DHCP server. Then, the client queries the server (which should serve both WPAD and Winsock Proxy Autodetect (WSPAD) requests), to determine the actual ISA Server computer with which to work.

Modifying ISA Server for a client using automatic discovery

To change the ISA Server computer used by a client, you change the entry in the DHCP or DNS server. However, because information is cached on the DNS or DHCP server, the client may actually receive the name of the previous ISA Server computer.

To ensure that the client receives the correct information when automatically detecting a server, perform the following steps:

  1. Set automatic detection on the DHCP or DNS server to point to the computer running Internet Information Services (IIS) that acts as a WPAD server. Because the computer running IIS contains Wspad.dat and Wpad.dat files, you will not have to update the DHCP or DNS automatic discovery information.
  2. Change the automatic discovery information in the Wspad.dat file on the computer running IIS, which acts as the dedicated redirector. The computer running IIS is dedicated to act as the redirector.

The following is a sample of a Wspad.dat file on a computer running IIS:

[Common]
Port=1745
[Servers Ip Addresses]
Name=ISAServer.microsoft.com

Changes in the Wspad.dat redirector file are applied immediately, regardless of the DNS cache.

Get latest ISA Server content at ISA Server Guidance.


Automatic discovery for Firewall clients

When you configure a Firewall client, you indicate a particular ISA Server computer to which the client will connect. You can also configure the automatic discovery feature so that the Firewall client will automatically discover which ISA Server computer it will use.

If automatic discovery is configured, it performs the following steps:

  1. When the client makes a Winsock request, the client connects to the DNS or DHCP server.
  2. The DNS or DHCP server should have a Web Proxy Automatic Discovery (WPAD) entry, which points to a WPAD server that indicates the ISA Server computer.
  3. A Wspad.dat file must exist on the WPAD server. This file will redirect the request to the ISA Server computer.
  4. The client request is fulfilled by the ISA Server computer, as identified by the Winsock Proxy Autodetect (WSPAD) entry in the DNS or DHCP server.

Get latest ISA Server content at ISA Server Guidance.


Automatic discovery for Web Proxy clients

ISA Server provides support for Web Proxy clients. You can configure the automatic discovery feature so that roaming Web Proxy clients will always connect to the appropriate ISA Server computer when they log on to the Internet.

Automatic discovery is supported for Microsoft Internet Explorer 5 and later.

If automatic discovery is configured, ISA Server performs the following steps:

  1. When the client makes a Web request, the client connects to the DNS or DHCP server.
  2. The DNS or DHCP server should have a Web Proxy Automatic Discovery (WPAD) entry, which points to a WPAD server that indicates the proxy server (in this case, the ISA Server computer).
  3. The client request is fulfilled by the ISA Server computer, as identified by the WPAD entry in the DNS or DHCP server.

Get latest ISA Server content at ISA Server Guidance.


Clients: How To

This section provides steps for installing and configuring clients of Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Install Firewall Client
  • Configure Firewall Client
  • Configure Web Proxy Clients
  • Configure Automatic Discovery

Get latest ISA Server content at ISA Server Guidance.


Install Firewall Client

This section provides step-by-step instructions on how to install Firewall Client software on the client computer.

  • Install Firewall Client software
  • Run Firewall Client unattended setup

Get latest ISA Server content at ISA Server Guidance.


Install Firewall Client software

To install Firewall Client software

  1. At a command prompt on the Firewall Client computer, type:

    Path\Setup

    where Path is the path to the shared ISA Server client installation files.
  2. Follow the on-screen instructions.

Notes

  • The ISA Server client installation files are usually located in a folder on the ISA Server computer with the share name ISA_Server_name/MSPClnt.
  • To perform this procedure, you must be a member of the Administrators group on the client computer.
  • You cannot install Firewall Client software on a computer running any version of ISA Server.
  • Upon installation, the Firewall Client application is enabled.
  • You can install Firewall Client software on client computers that run Microsoft® Windows Server™ 2003, Windows 2000 Server, Windows XP, Windows Millennium Edition, or Windows NT® 4.0. You can also install Firewall Client software on computers running Windows 98 Second Edition with Microsoft Internet Explorer 5 or later installed.
  • To allow client computers to access the Firewall Client share, the Firewall Client Installation system policy configuration group must be enabled. This configuration group is enabled by default when you install the Firewall Client share.

Related Topics

Get latest ISA Server content at ISA Server Guidance.


Run Firewall Client unattended setup

To run Firewall Client unattended setup

  • At a command prompt on the Firewall Client computer, type

    Path\Setup /v"[SERVER_NAME_OR_IP=ISA_Server_Name] [ENABLE_AUTO_DETECT={1|0}] [REFRESH_WEB_PROXY={1|0}] /qn"

    where:

    • Path is the path to the shared ISA Server 2004 client installation files. These files are usually located in a folder on the ISA Server computer with the share name ISA\MSPclnt.
    • ISA_Server_Name is the name of the ISA Server computer to which the Firewall client should connect.
    • ENABLE_AUTO_DETECT=1 specifies that the Firewall client should automatically detect which ISA Server computer to connect to.
    • REFRESH_WEB_PROXY=1 indicates that the Firewall Client configuration should be updated with the Web proxy configuration specified on the ISA Server computer.

Notes

  • To run unattended uninstallation, type the following at a command prompt:

    MsiExec.exe /X {199B7F78-69B7-47C5-8D4B-A3ED1391FB6B} /qn

  • To perform this procedure, you must be a member of the Administrators group on the client computer.
  • The ISA Server client installation files are usually located in a folder on the ISA Server computer with the share name ISA_Server_name/MSPClnt.
  • You cannot install Firewall Client software on the ISA Server computer.
  • Upon installation, the Firewall Client application is enabled.
  • You can install Firewall Client software on client computers that run Microsoft® Windows Server™ 2003, Windows 2000 Server, Windows XP, Windows Millennium Edition, or Windows NT® 4.0. You can also install Firewall Client software on computers running Windows 98 Second Edition with Microsoft Internet Explorer 5 or later installed.
  • To allow client computers to access the Firewall Client share, the Firewall Client Installation system policy configuration group must be enabled. This configuration group is enabled by default when you install the Firewall Client share.

Get latest ISA Server content at ISA Server Guidance.


Configure Firewall Client

This section provides steps for configuring Firewall Client for Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Listen for Firewall Client requests
  • Specify configuration URL for Web browser on Firewall Client
  • Configure Web browser settings for Firewall Client
  • Configure application settings for Firewall Client
  • Allow connections from clients running previous versions of Firewall Client


Listen for Firewall Client requests

To listen for Firewall Client requests

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab and select the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Firewall Client tab, click Enable Firewall client support for this network.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Firewall Client properties cannot be configured for the following built-in networks: External, Quarantined VPN Clients, and VPN Clients.
  • If Internet Protocol security (IPsec) transport mode is enabled for a network, functionality for Firewall clients in that network may be impaired. If Firewall clients in the network do not behave as expected, disable IP routing. For instructions, see Enable IP Routing.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Specify configuration URL for Web browser on Firewall Client

To specify configuration URL for Web browser on Firewall Client

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then select the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Web Browser tab, optionally select the following:
    • Bypass proxy for Web servers in this network. Select this option if the Web browser on the Firewall client computer should bypass the ISA Server computer when accessing local Web servers.
    • Directly access computers specified in the Domains tab. Select this option if the Web browser on the Firewall client computer can directly access computers defined in the local domains.
    • If ISA Server is unavailable, use this backup route to connect to the Internet. Select this option if the Web browser on the Firewall client should use a backup route to service requests when the ISA Server computer is not available. If you select this option, specify either Direct access or Alternative ISA Server.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Click the Apply button in the details pane to save the changes and update the ISA Server configuration.
  • The options you specify are reflected in the configuration script used by the Web browser.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Web browser settings for Firewall Client

To configure Web browser settings for Firewall Client

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then select the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Firewall Client tab, select Enable Firewall client support for this network, if the Web browser on the Firewall client should use configuration information that is contained in the specified automatic configuration script.
  5. Select Automatically detect settings, if the client computer should automatically attempt to find the ISA Server computer.
  6. Select Use automatic configuration script, if the Web browser on the Firewall client computer should use configuration information that is contained in the specified automatic configuration script. If you select this option, specify one of the following:
    • Use default URL. Specifies that the default client configuration script will be used. During setup, ISA Server creates a default URL that points to the location of the automatic configuration script. This default configuration script will automatically be available to the Web browser, so that you can update all client Web browser settings without having to reconfigure each individual Web browser.
    • Use custom URL. Specifies that a custom client configuration script will be used. As an alternative to the default configuration script, you can manually construct your own configuration script. When the Web browser looks for the configuration script, your custom script will be returned to the browser.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Click the Apply button in the details pane to save the changes and update the ISA Server configuration.
  • The configuration script is created, based on options that you specify on the Web Browser tab. The configuration script is automatically made available to the Web browser on the Firewall client, so that you can update all Web browser settings without having to reconfigure each individual Web browser.
  • When Automatically detect settings is enabled, you can configure the DNS or DHCP server to include Web Proxy Automatic Discovery (WPAD). The Web Proxy client will use the WPAD feature to automatically discover which ISA Server computer to use for Web requests. This assures that roaming clients will always connect to the appropriate ISA Server computer when logging on to the Internet, reducing time-consuming adjustments. This is relevant only to Internet Explorer 5 and future supporting browsers.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure application settings for Firewall Client

To configure application settings for Firewall Client

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • General
  2. In the details pane, click Define Firewall Client Settings.
  3. On the Application Settings tab, click New.
  4. In Application, type a new application name.
  5. In Key, select the name of a key.
  6. In Value, type the value to set for the key.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To remove an existing application setting, on the Application Settings tab, select it and click Delete.
  • To modify an existing application setting, on the Application Settings tab, select it and click Edit.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Allow connections from clients running previous versions of Firewall Client

To allow connections from clients running previous versions of Firewall Client

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • General
  2. In the details pane, click Define Firewall Client Settings.
  3. On the Connection tab, click Allow non-encrypted Firewall client connections.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select this option, computers running earlier versions of Firewall Client software are allowed to connect. Also, any Firewall client running Microsoft Windows NT Server 4.0, Windows Millennium Edition, or Windows 98 can connect.
  • When you select this option, non-encrypted traffic from authenticated users will be blocked. Users are only authenticated if firewall policy rules specifically require authentication.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Web Proxy Clients

This section provides steps for configuring Web Proxy clients.

  • Listen for Web Proxy client requests
  • Configure authentication methods for Web Proxy clients
  • Configure maximum number of Web Proxy client connections

Get latest ISA Server content at ISA Server Guidance.


Listen for Web Proxy client requests

To listen for Web Proxy client requests

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab and select the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Web Proxy tab, click Enable Web Proxy clients.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Web Proxy client properties cannot be configured for the following built-in networks: External, Quarantined VPN Clients, and VPN Clients.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure authentication methods for Web Proxy clients

To configure authentication methods for Web Proxy clients

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Web Proxy tab, click Authentication.
  5. Select the authentication method that may be used to authenticate clients connecting to the selected network.
  6. Select Require all users to authenticate, to force clients from this network to authenticate using one of the selected authentication methods.
  7. If you select RADIUS, Digest, or Basic authentication, click Select Domain and type the name of the domain to use when authenticating clients.
  8. If you select RADIUS authentication, you must enable the system policy's RADIUS configuration group (in the Authentication Services category).
  9. If you select RADIUS authentication, click RADIUS Servers to configure the servers to use for RADIUS authentication.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Users who log on to the network with the Basic authentication methods must belong to a specific domain. Usually, the Windows domain that is used for Basic authentication is the local domain in which the Web server is active. A different domain can be specified, if required.
  • When no domain is explicitly specified, ISA Server uses its own domain.
  • If you select RADIUS authentication, you cannot select any other authentication method.
  • If you do not select an authentication method and if the firewall policy includes rules that require users to authenticate, authentication will fail and the request will be denied.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure maximum number of Web Proxy client connections

To configure maximum number of Web Proxy client connections

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Web Proxy tab, click Advanced.
  5. Select one of the following:
    • Unlimited. If an unlimited number of Web Proxy clients can connect to ISA Server at any one time.
    • Maximum per server. To limit the maximum number of Web Proxy connections that can connect to ISA Server at any one time. In the box, type the maximum number of connections.
  6. In Connection timeout, type the number of seconds before ISA Server disconnects an inactive user.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Web Proxy client properties cannot be configured for the following built-in networks: External, Quarantined VPN Clients, and VPN Clients.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure Automatic Discovery

This section provides steps for configuring the automatic discovery feature of Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Publish automatic discovery information
  • Configure DNS for automatic discovery of ISA Server
  • Configure DHCP for automatic discovery of ISA Server

Get latest ISA Server content at ISA Server Guidance.


Publish automatic discovery information

To publish automatic discovery information

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network (usually Internal).
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Auto Discovery tab, select Publish automatic discovery information.
  5. In Use this port for automatic discovery requests, type the port number on which the ISA Server computer should listen for Web Proxy Automatic Discovery (WPAD) and Winsock Proxy Autodetect (WSPAD) requests.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Click the Apply button in the details pane to save the changes and update the ISA Server configuration.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure DNS for automatic discovery of ISA Server

To configure DNS for automatic discovery of ISA Server

  1. Click Start, point to All Programs, point to Administrative Tools, and then click DNS.
  2. In the console tree, right-click the applicable forward lookup zone and click New Alias.

    Where?

    • DNS
    • DNS server
    • Forward Lookup Zones
    • Applicable zone
  3. In Alias name, type WPAD.
  4. In Fully qualified name for target host, type the fully qualified domain name of the ISA Server computer or array.

Notes

  • If DNS does not appear in Administrative Tools, it is not installed.
  • If the ISA Server computer or array already has a host (A) record defined, you can click Browse to search the DNS namespace for the ISA Server or array name.
  • When using DNS to publish WPAD, automatic discovery must be configured to use port 80. Alternatively, the outgoing Web requests must be configured to listen on port 80.

Related Topics

Get latest ISA Server content at ISA Server Guidance.


Configure DHCP for automatic discovery of ISA Server

To configure DHCP for automatic discovery of ISA Server

  1. Click Start, point to All Programs, point to Administrative Tools, and then click DHCP.
  2. In the console tree, right-click the applicable DHCP server, click Set Predefined Options, and then click Add.
  3. In Name, type WPAD.
  4. In Code, type 252.
  5. In Data type, select String and then click OK.
  6. In String, type:

    http://Computer_Name:AutoDiscoveryPortNumber/Wpad.dat

    where Computer_Name is the fully qualified domain name of the ISA Server computer or array and AutoDiscoveryPortNumber is the port number on which automatic discovery information is published. This port is either the outgoing Web request port number or an additional port used for automatic discovery publishing.

  7. Right-click Server options, and then click Configure options.
  8. Confirm that the Option 252 check box is selected.

Related Topics

Get latest ISA Server content at ISA Server Guidance.


Troubleshooting Firewall Client

What problem are you having?

Firewall Client software is not properly installed.

Cause: There can be many reasons why Firewall Client is not properly installed. The setup program in the Firewall Client software creates a log file on the client computer each time client software is installed. The log file contains information about the setup, including information about which client applications were installed and which services were started.

Solution: You can use the log file to troubleshoot problems with setup. The log file name is Firewallc.log, and it is located in the Firewall Client software installation directory. ISA Server overwrites this log file each time you install the Firewall Client software.

Firewall clients cannot access the External network..

Cause: If Internet Protocol security (IPsec) transport mode is enabled for a network, functionality for Firewall clients in that network may be impaired.

Solution: Disable IP routing. For instructions, see Enable IP routing.

web link Get latest ISA Server content at ISA Server Guidance.


Virtual Private Networking

Microsoft Internet Security and Acceleration (ISA) Server 2004 supports virtual private networking for remote access clients and for site-to-site networking. Remote access clients are also known as virtual private network (VPN) clients. This section describes the VPN feature of ISA Server and provides step-by-step instructions on how to configure a VPN.

  • Security recommendations for a VPN
  • VPN: Concepts
  • VPN: How To
  • Troubleshooting VPN

Get latest ISA Server content at ISA Server Guidance.


Security recommendations for a VPN

It is important to follow best practices for security when using Microsoft Internet Security and Acceleration (ISA) Server 2004 as a virtual private network (VPN) server. The following is a list of recommendations for securing your ISA Server computer in its role as a VPN server:

  • Follow these guidelines when determining which authentication methods to enable. For more information about authentication methods, see VPN Authentication.
    • Use authentication methods that provide adequate security. The most secure method of authentication is Extensible Authentication Protocol-Transport Level Security (EAP-TLS) when used in conjunction with smart cards. Despite the deployment challenges involved in using EAP-TLS and smart cards, which require a public key infrastructure (PKI), this is considered the most secure authentication method.
    • If you use password-based authentication, enforce strong password policies on your network to make dictionary attacks more difficult.
    • You should consider requiring your remote VPN clients to be authenticated with more secure authentication protocols, such as Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2) or Extensible Authentication Protocol (EAP), rather than allowing them to use protocols such as Password Authentication Protocol (PAP), Shiva Password Authentication Protocol (SPAP), and Challenge Handshake Authentication Protocol (CHAP).
    • We strongly recommend that PAP, SPAP, and CHAP are disabled. PAP, SPAP, and CHAP are disabled by default.
    • Enable EAP-TLS, which is disabled by default on the profile of a remote access policy. When you use the EAP-TLS authentication protocol, you must install a computer certificate on the Internet Authentication Service (IAS) server. For client and user authentication, you can install a certificate on the client computer, or you can use smart cards. Before you deploy certificates, you must design the certificate with the correct requirements.
  • Layer Two Tunneling Protocol (L2TP) over Internet Protocol security (IPsec) connections are recommended for the strongest encryption.
  • We recommend that you implement and enforce a strong password policy, thereby reducing the chance of a dictionary attack. When you implement such a policy, you can disable account lockout, thereby reducing the chance that an attacker will trigger account lockout.
  • Consider requiring your remote VPN clients to run particular operating systems (such as Microsoft® Windows Server™ 2003, Windows® 2000 Server, or Windows XP). Not all operating systems have equal levels of security in their file systems and in their user accounting. Also, not all remote access features are available on all operating systems.
  • Use the ISA Server Quarantine Control feature, to provide phased network access for remote VPN clients. With Quarantine Control, clients are restricted to a quarantine mode before allowed access to the network. Although Quarantine Control does not protect against attackers, computer configurations for authorized users can be verified and, if necessary, corrected before they can access the network. For more information, see VPN and Quarantine.
  • The quarantine feature does not protect against malicious users on the VPN Clients network.
  • Virus infected VPN client computers are not automatically blocked from flooding the ISA Server computer or the networks it protects with requests. To prevent this occurrence, implement monitoring practices to detect anomalies such as alerts or unusual peaks in traffic loads, and configure alert notification to use e-mail messages. If an infected VPN client computer is identified, either:
    • Restrict VPN access by user name by using the remote access policy to exclude the user from the VPN clients who are allowed to connect.
    • Restrict VPN access by IP address. Do this by creating a new network to contain external IP addresses that are blocked, and move the IP address of the client out of the External network to the new network.

web link Get latest ISA Server content at ISA Server Guidance.


VPN: Concepts

This section provides information about the virtual private network (VPN) feature of Internet Security and Acceleration (ISA) Server 2004.

  • VPN overview
  • How a VPN works
  • ISA Server and Routing and Remote Access interoperability
  • Remote VPN Clients
  • Site-to-Site VPN
  • Common VPN Configuration
  • VPN connection monitoring

Get latest ISA Server content at ISA Server Guidance.


VPN overview

A virtual private network (VPN) is the extension of a private network that encompasses links across shared or public networks like the Internet. With a VPN, you can send data between two computers across a shared or public network in a manner that emulates a point-to-point private link. Virtual private networking is the act of creating and configuring a virtual private network.

VPN connections allow users who work at home or travel to obtain a remote access connection to an organization server, using the infrastructure provided by a public internetwork such as the Internet. From the user's perspective, the VPN is a point-to-point connection between the computer, the VPN client, and an organization server (the VPN server). The exact infrastructure of the shared or public network is irrelevant, because it appears as if the data is sent over a dedicated private link.

VPN connections also allow organizations to have routed connections with other organizations over a public internetwork such as the Internet while maintaining secure communications, for example, for offices that are geographically separate. A routed VPN connection across the Internet logically operates as a dedicated wide area network (WAN) link.

With ISA Server 2004, you can configure a secure VPN, accessible by remote access clients and by remote sites, according to your specifications. By using the ISA Server computer as the VPN server, you benefit by protecting your corporate network from malicious VPN connections. Because the VPN server is integrated into the firewall functionality, VPN users are subject to the ISA Server firewall policy. Also, by using the ISA Server computer as the VPN server, you can manage site-to-site VPN connections and VPN client access to the corporate network.

ISA Server supports two types of VPN connections:

  • Remote access VPN connection. A remote access client makes a remote access VPN connection that connects to a private network. ISA Server provides access to the entire network to which the VPN server is attached. For more information, see Remote VPN Clients.
  • Site-to-site VPN connection. A router makes a site-to-site VPN connection that connects two portions of a private network. ISA Server provides a connection to the network to which the ISA Server computer is attached. For more information, see Site-to-site VPN.

With ISA Server, each type of VPN connection is configured slightly differently. When a single remote VPN client requires access, the configuration is for that single user. In a site-to-site network configuration, an entire network of remote users must be granted access, that is, a network of VPN users is configured.

However, much VPN configuration is common to both scenarios. For example, ISA Server perceives the initial connection request from a remote site network as it would any request from a single remote VPN client. Tunneling protocols, authentication methods, access network, and address assignment for the initial connection must be configured as they would be configured for a remote access client. For information about common VPN configuration, see Common VPN Configuration.

web link Get latest ISA Server content at http://www.microsoft.com/isaserver/techinfo/howto/default.asp.


How a VPN works

To emulate a point-to-point link, data is encapsulated, or wrapped, with a header that provides routing information, which allows the data to traverse the shared or public network to reach its endpoint. To emulate a private link, the data is encrypted for confidentiality. Packets that are intercepted on the shared or public network are indecipherable without the encryption keys. The link in which the private data is encapsulated and encrypted is a virtual private network (VPN) connection.

The following steps describe what happens during a call from a remote VPN client (or a remote site gateway) to ISA Server 2004:

  1. A remote access client or a remote site gateway dials the ISA Server computer.
  2. ISA Server sends a challenge to the client.
  3. The client (or remote site gateway) sends an encrypted response to the server that consists of a user name, a domain name, and a password.
  4. The server checks the response against the appropriate user accounts database.
  5. If the account is valid and the authentication credentials are correct, the server uses the dial-in properties of the user account and remote access policies to authorize the connection.

Notes

  • Steps 2 and 3 assume that the remote access client and ISA Server use the MS-CHAP v1 or CHAP authentication protocols. The sending of client credentials may vary for other authentication protocols.
  • If ISA Server is a member of a domain and the user response does not contain a domain name, the domain name of the ISA Server computer is used

Security after the connection is made

Credentials used for remote access only provide a communication channel to the target network. The client does not log on to the network as a result of a remote access connection. Each time the client attempts to access a network resource, it will be challenged for credentials. If it does not respond to the challenge with acceptable credentials, the access attempt will fail.

Microsoft® Windows Server™ 2003 and Windows® XP add a feature to simplify remote access. After a successful connection, Windows Server 2003 and Windows XP remote access clients will cache these credentials as default credentials for the duration of the remote access connection. When a network resource challenges the remote access client, the client provides the cached credentials without requiring the user to enter them again.

Get latest ISA Server content at ISA Server Guidance.


ISA Server and Routing and Remote Access interoperability

ISA Server 2004 depends on and enhances the basic virtual private network (VPN) functionality enabled by Routing and Remote Access, available with Microsoft® Windows Server™ 2003 and Windows® 2000. While most VPN configuration is done by using ISA Server Management, you may also configure some advanced settings using Routing and Remote Access. When you do use Routing and Remote Access to configure VPN, be careful not to override specific settings that should be configured only in ISA Server. In particular, note the following:

  • If you use Routing and Remote Access to enable network address translation (NAT), some ISA Server features may not function properly.
  • Do not use Routing and Remote Access to enable or disable IP routing. ISA Server always synchronizes Routing and Remote Access settings, but Routing and Remote Access does not check how ISA Server configures this functionality. You can, however, use Routing and Remote Access to configure the routing table.
  • Any packet filters you configure using Routing and Remote Access are never applied.
  • Routing and Remote Access packet filters are not applied when ISA Server is running. It is recommended that you copy the functionality defined by the packet filters used for quarantine in Routing and Remote Access to ISA Server.
  • ISA Server overwrites any RADIUS server and RADIUS server scores specified in Routing and Remote Access.

Get latest ISA Server content at ISA Server Guidance.


Remote VPN Clients

This section provides information about the virtual private network (VPN) feature of Internet Security and Acceleration (ISA) Server for remote VPN clients.

  • Remote VPN client access
  • VPN client computers
  • Users for remote VPN client access
  • RADIUS authentication for remote VPN clients
  • User mapping of VPN clients
  • VPN clients and firewall policy
  • Certificates for L2TP connections
  • VPN and Quarantine


Remote VPN client access

Using Microsoft Internet Security and Acceleration (ISA) Server 2004, you can enable part of your organization to connect to the Internal network from anywhere in the world, using a local Internet connection. For example, your offices are located in New York City, and your salesperson is working in Chicago. Rather than have the salesperson call in to New York City to connect directly to your Internal network (using Routing and Remote Access), you want the salesperson to connect to the Internet locally and use a virtual private network (VPN) connection to access the Internal network. This is the remote access VPN scenario.

With ISA Server, you can implement remote client access solutions using either the Point-to-Point Tunneling Protocol (PPTP) or the Layer Two Tunneling Protocol (L2TP). For more information about tunneling protocols, see VPN tunneling protocols.

Consider, for example, a typical network topology for roaming VPN clients, as illustrated in the figure. This figure shows three networks:

  • The Internet, where the VPN client is located.
  • The VPN gateway, which is an ISA Server computer.
  • The Internal network, which can include a DHCP server for dynamic IP address assignment and (optionally, if you are configuring L2TP) a certification authority.
Remote client access

VPN clients

Remote VPN clients that connect to ISA Server can be computers running Microsoft® Windows Server™ 2003, Windows® XP, Windows 2000, Windows NT® 4.0, Windows 98, Windows 95, or Windows Millennium Edition. The client must be able to send TCP/IP packets to the remote access server over the Internet. Therefore, either a network adapter or modem with an analog telephone line or other WAN connection to the Internet is required. For more information, see VPN client computers.

Enable remote VPN client access

To enable remote VPN client access to a network protected by ISA Server, you must perform the following steps:

  1. Identify and configure user accounts allowed to connect to ISA Server as remote VPN clients. Users can be identified as RADIUS users or as Windows users. For more information, see Users for remote VPN client access.
  2. Enable VPN client access on the ISA Server computer. For instructions, see VPN clients and firewall policy.
  3. Select which VPN tunneling protocol to use when connecting to ISA Server: PPTP or L2TP. For more information, see VPN tunneling protocols.
  4. Optionally, enable Quarantine Control. You may want to quarantine each VPN client when it connects, to ensure that it complies with your security policy. VPN clients that do not comply will be allowed to connect to resources on the Internal network from which they can retrieve the software or updates needed to achieve compliance, but will not be allowed general access to corporate resources. For more information, see VPN and Quarantine.

Note

  • Some properties are configurable both in Routing and Remote Access and in ISA Server. In this case, be sure to configure these only in ISA Server. Properties unique to Routing and Remote Access can be configured using Routing and Remote Access. For more details, see ISA Server and Routing and Remote Access interoperability.


VPN client computers

Virtual private network (VPN) client computers that connect to ISA Server 2004 can be computers running Microsoft® Windows Server™ 2003, Windows® 2000, Windows XP, Windows NT® 4.0, Windows 98, Windows 95, or Windows Millennium Edition. The client must be able to send TCP/IP packets to the remote access server over the Internet. Either a network adapter, modem with an analog telephone line, or other wide area network (WAN) connection to the Internet is required.

Note

  • ISA Server does not support configuring Routing and Remote Access to allow dial-up connections.

Tunneling protocols for VPN clients

Support for tunneling protocols for Microsoft VPN clients is outlined in the following table. For more information about tunneling protocols, see VPN tunneling protocols.

VPN client | Supported tunneling protocols | Unsupported tunneling protocols
Windows Server 2003 family, Windows 2000, and Windows XP | Point-to-Point Tunneling Protocol (PPTP) and Layer Two Tunneling Protocol (L2TP) | None
Windows NT version 4.0 | PPTP | L2TP
Windows Millennium Edition and Windows 98 | PPTP | L2TP
Windows 95 with the Windows Dial-Up Networking 1.3 Performance and Security Upgrade for Windows 95 | PPTP | L2TP
Windows Millennium Edition, Windows 98, Windows NT 4.0 Workstation, and Windows 95 with Microsoft L2TP/IPSec VPN Client installed | L2TP | PPTP

Authentication methods for remote VPN clients

Support for authentication protocols by remote VPN clients is outlined in the following table. For more information about authentication methods, see VPN Authentication.

Remote VPN Client | Supported Authentication Methods | Unsupported Authentication Methods
Windows Server 2003 family, Windows XP, and Windows 2000 | Microsoft Challenge Handshake Authentication Protocol (MS-CHAP), Challenge Handshake Authentication Protocol (CHAP), Shiva Password Authentication Protocol (SPAP), Password Authentication Protocol (PAP), MS-CHAP version 2 (MS-CHAP v2), and Extensible Authentication Protocol (EAP) | None
Windows NT version 4.0 | MS-CHAP, CHAP, SPAP, PAP, and MS-CHAP v2 (with the Windows NT 4.0 Service Pack 4 and later) | EAP
Windows 98 | MS-CHAP, CHAP, SPAP, PAP, and MS-CHAP v2 (with the Windows 98 Service Pack 1 and later) | EAP
Windows 95 | MS-CHAP, CHAP, SPAP, PAP, and MS-CHAP v2 (with the Dial-Up Networking 1.4 Upgrade) | EAP

Note

  • Windows 95 with the Dial-Up Networking 1.4 Upgrade supports MS-CHAP v2 over VPN connections, but not over dial-up connections.

Get latest ISA Server content at ISA Server Guidance.


Users for remote VPN client access

You can create users and groups that will be allowed to use the remote virtual private network (VPN) client access feature to connect to ISA Server 2004. You can create VPN users on the domain controller computer. This computer contains the user group and user information that is necessary to authenticate remote users.

Alternatively, you can create VPN users on a RADIUS server. For more information, see RADIUS authentication for remote VPN clients.

Dial-in properties of a user account

In Microsoft® Windows Server™ 2003, the user account contains a set of dial-in properties that are used when allowing or denying a connection attempt made by a user. You can set the dial-in properties on the Dial-in tab in the user account in Local Users and Groups or Active Directory Users and Computers. You must set the Remote Access Permission (Dial-in or VPN) to Allow access or Control access through remote access policy.

For instructions, see Create users and groups for remote VPN clients and Create a dial-in account for the remote site gateway.

Get latest ISA Server content at ISA Server Guidance.


RADIUS authentication for remote VPN clients

ISA Server 2004 supports Remote Authentication Dial-In User Service (RADIUS) authentication for virtual private network (VPN) clients. With RADIUS authentication enabled, VPN clients authenticate to a RADIUS server, which provides centralized remote access authentication, authorization, accounting, and auditing.

Configuring ISA Server for RADIUS authentication

When you configure ISA Server, select RADIUS authentication as the authentication provider. When you add a RADIUS server, you must configure the following:

  • Server name. The host name or IP address of the Internet Authentication Service (IAS) server.
  • Secret. The server running Routing and Remote Access and the IAS server share a secret that is used to encrypt messages sent between them. You must configure both the remote access server and the IAS server to use the same shared secret.
  • Port. The remote access server must send its authentication requests to the UDP port on which the IAS server is listening. The default value of 1812 does not need to be changed when you are using an IAS server.

For instructions, see Configure RADIUS servers.

RADIUS authentication system policy rule

When you install ISA Server, a default system policy rule allowing RADIUS authentication from the ISA Server computer (Local Host network) to the Internal network is enabled. When this rule is enabled, ISA Server can validate VPN clients using RADIUS authentication. For more information about system policy rules, see System policy overview.

User mapping

If clients are running an operating system other than Windows, and these clients are connecting as remote VPN access clients, you must specify the RADIUS server to use for authentication. Using the ISA Server user mapping feature, you can map users that do not use Windows to Windows accounts. In this way, if you have created any firewall policy rules that apply to user sets, they can also be applied to VPN remote access clients that do not use Windows.

With user mapping enabled, when a RADIUS user presents credentials, the user name and domain are mapped to the same user name and domain, and the user is authenticated as if Windows credentials had been presented.

User mapping can be used only when ISA Server is installed in a domain. Do not enable user mapping in a workgroup environment.

For instructions, see Enable user mapping.

Configuring ISA Server for RADIUS accounting

When you configure the properties of the server running Routing and Remote Access, select RADIUS accounting as the accounting provider.

When you add a RADIUS server, you must configure the following:

  • Server name. The host name or IP address of the IAS server.
  • Secret. The server running Routing and Remote Access and the IAS server share a secret that is used to encrypt messages sent between them. You must configure both the remote access server and the IAS server to use the same shared secret.
  • Port. The remote access server must send its accounting requests to the UDP port on which the IAS server is listening. The default value of 1813 is based on RFC 2866, "RADIUS Accounting" and does not need to be changed when using an IAS server.

For instructions, see Use RADIUS for accounting.

Get latest ISA Server content at ISA Server Guidance.


User mapping of VPN clients

User mapping is used to map virtual private network (VPN) clients connecting to Microsoft Internet Security and Acceleration (ISA) Server 2004 using an authentication method that is not based on Microsoft Windows (RADIUS or EAP) to the Windows namespace. As a result, firewall policy access rules specifying user sets for Windows users and groups are also applied to authenticated users that do not use Windows. If you do not define user mapping for users from namespaces that are not based on Windows, default firewall policy access rules will not be applied to them.

If the RADIUS server and ISA Server are in untrusted domains (or if one is in a workgroup), user mapping is supported only for PAP and SPAP authentication methods. Do not use user mapping if any other authentication method is configured.

You must create mirrored accounts on the ISA Server array members. These accounts are used when the RADIUS accounts are mapped back to the ISA Server accounts.

For instructions, see Enable user mapping.

Note

  • If you do not enable user mapping for users who do not use Windows, you must create a user set for these users so that firewall policy rules can be applied to them. Regardless of the authentication method (RADIUS or EAP), the user set must be defined for the RADIUS namespace.

web link Get latest ISA Server content at ISA Server Guidance.


VPN clients and firewall policy

To allow remote virtual private network (VPN) clients access by using Microsoft Internet Security and Acceleration (ISA) Server 2004, you must enable VPN client access. For instructions, see Enable remote VPN client access. When you enable VPN client access, ISA Server enables the appropriate network and firewall policy rule to allow the initial access.

When remote VPN clients are allowed to connect, ISA Server 2004 makes these clients members of the VPN Clients network. A default system policy rule allows these clients access to the ISA Server computer (Local Host network).

System policy rules

When you enable VPN client access, a system policy rule named Allow VPN client traffic to ISA Server is enabled. Depending on which protocols you configured for remote client access, the system policy rule allows the use of Point-to-Point Tunneling Protocol (PPTP), Layer Two Tunneling Protocol (L2TP), or both, from the External network (where the VPN clients are assumed to be located) to the ISA Server computer (Local Host). This rule is modified when you configure these remote VPN client access properties:

  • VPN access network. Initially set to the External network, you can modify this property. You can specify one or more networks from which VPN clients can connect to ISA Server. When you modify this property, the system policy rule is changed automatically to apply to the additional or changed networks.
  • VPN protocol. The VPN protocol used for remote VPN client access can be PPTP, L2TP, or both. When you modify this setting, the system policy rule is updated to allow the appropriate protocol.

Network rules

A default network rule, created when you install ISA Server, defines a route relationship between the Internal network and the VPN Clients network. Another default rule, allowing access from the VPN Clients network to the External network, is also created when you install ISA Server. You can create new network rules, to allow traffic from the VPN Clients network to other networks. For more information about network rules, see Network rules.

Consider a scenario where a firewall, VPN, or SOCKS client tries to access a remote site network or a VPN client. In this scenario, if the client is located on a network with a network address translation (NAT) relationship to the remote site network, you should configure the following:

  • Configure a rule that allows the intra-array address the same permissions as the client accessing the network.
  • Create a network rule between the intra-array address and the destination network. (The configured relationship is not important.) If you configure a route relationship, the remote site network should include the ISA Server intra-array addresses.

You do not have to separate the subnet for the VPN Clients network from the Internal network.

ISA Server and ARP

ISA Server acts as an Address Resolution Protocol (ARP) proxy for VPN clients. For example, when addresses assigned to the VPN Clients network are part of the Internal network segment, whether addresses are assigned from a static pool or by a DHCP server, computers from the Internal network will send ARP queries to VPN clients. ISA Server will intercept the queries and reply on behalf of the connected VPN client.

Firewall policy rules

To allow remote VPN clients access to resources on the Internal network, you must create an access rule, allowing the appropriate access. If you consider the VPN Clients network to be identical to the Internal network from a firewall policy perspective, you may also want to create an access rule allowing all traffic from the Internal network to the VPN Clients network. For more information about firewall policy, see Firewall Policy Rules.

If you enable and configure quarantine, you must create an access rule for the Quarantined VPN Clients network, allowing appropriate permissions. For more information about quarantine, see VPN and Quarantine.

When ISA Server processes rules to determine if a request from a VPN client is allowed, the VPN credentials are used.

By default, when you define a rule allowing access from the VPN Clients network to the Internal network, access is allowed to all ports. However, if you choose to limit the ports, you must allow access to ports 1745 (for Firewall clients) and 8080 (for Web Proxy clients).

Firewall clients

If ISA Server is configured as a VPN server and acts as a firewall server for Firewall clients, VPN client computers with Firewall Client installed will use port 1745 of the ISA Server Internal network interface. For more information about Firewall clients, see Firewall Client.

VPN client computers configured as Firewall clients will present Firewall client credentials (from the user who is logged on) for authentication, rather than the VPN session credentials. Access rules based on VPN credentials will take effect.

Firewall clients connected to ISA Server cannot connect to another VPN server. This is because the Firewall Client application sends all traffic—including VPN traffic—by way of ISA Server. Therefore, disable the Firewall client while you connect to the VPN server. Alternatively, include all the addresses in the remote network in the network configured for the Firewall client.

When a Firewall client connects to a VPN Clients network or to a remote site network, the client is treated as a SecureNAT client if the destination network has a route relationship with the Firewall client’s address. If there is only one array member, the Firewall Client application functions normally.

Web Proxy clients

If ISA Server is configured as a VPN server and acts as a proxy server for Web Proxy clients, VPN client computers using the ISA Server computer as a proxy will use port 8080 of the ISA Server Internal network interface. For more information about Web Proxy clients, see Web Proxy clients.


Certificates for L2TP connections

If you enable remote virtual private network (VPN) clients to connect to ISA Server 2004 using the Layer Two Tunneling Protocol (L2TP), you will require a certificate.

You need a certification authority (CA) to issue Internet Protocol security (IPSec) certificates. Because the certificates are for internal use only (to be used on your servers and by your remote VPN clients), it is advisable to create a local CA. This procedure takes place on a computer running Windows in the Internal network. For a stand-alone root CA, this can be any computer running Windows in the Internal network. An enterprise root CA must be installed on a domain controller.

Because L2TP over IPSec requires IPSec certificates to be installed from a CA, you will also need to install the services that will enable computers to obtain the certificates through a Web page. If you prefer a different approach for obtaining the certificates for computers, you do not have to perform the Internet Information Services (IIS) and Active Server Pages (ASP) installations.

After you create the certificate, you must install the certificate on the ISA Server computer. Then, the certificate must be installed on the remote VPN client computer.

The directions for creating and installing certificates are detailed in the Digital Certificates for ISA Server and Published Servers scenario documentation, available on the ISA Server Guidance website.

Get latest ISA Server content at ISA Server Guidance.


VPN and Quarantine

This section provides information about the quarantine policy features of Internet Security and Acceleration (ISA) Server 2004.

  • Quarantine Control overview
  • Quarantine Control requirements
  • How Quarantine Control works
  • Quarantine Control configuration steps
  • Firewall policy for quarantined VPN clients

Get latest ISA Server content at ISA Server Guidance.


Quarantine Control overview

Quarantine Control provides phased network access for remote clients, also known as virtual private network (VPN) clients, by restricting them to a quarantine mode before allowing them access to the network. After the client computer configuration is either brought into or determined to be in accordance with your organization's specific quarantine restrictions, standard VPN policy is applied to the connection, in accordance with the type of quarantine you specify. Quarantine restrictions might specify, for example, that specific antivirus software is installed and enabled while connected to your network. Although Quarantine Control does not protect against attackers, computer configurations for authorized users can be verified and, if necessary, corrected before they can access the network. A timer setting is also available, which you can use to specify an interval at which the connection is dropped, if the client fails to meet configuration requirements.

With ISA Server, you can select how to enable quarantine mode:

  • Enable quarantine mode, using RADIUS server policies. This option is available only when ISA Server is installed on a computer running a member of the Microsoft® Windows Server™ 2003 family. When you select the Quarantine according to RADIUS Server policies option, when a VPN client attempts to connect, ISA Server determines whether the client will be subject to quarantine. After the client clears quarantine, the client unconditionally joins the VPN Clients network.
  • Enable quarantine mode, using ISA Server. This option provides use of the Quarantined VPN Clients network, for which you can set firewall policy. This option does not require Routing and Remote Access functionality, and therefore is available when ISA Server is installed on a computer running Windows® 2000 Server.

You can also choose to disable quarantine mode.

For instructions, see Enable Quarantine Control.

Quarantine Control is an option available to you as a means of controlling the compliance of VPN clients with your corporate security requirements. Note that when quarantine mode is disabled, all remote VPN clients with appropriate authentication permissions are placed in the VPN Clients network, and will have the access you have allowed the VPN Clients network in your firewall policy.

Quarantine Control for ISA Server works with Routing and Remote Access to provide a means of restricting VPN client access to corporate networks. With ISA Server, you can require that a newly connected VPN client is assigned to the Quarantined VPN Clients network, with a restrictive firewall policy, until the client's Connection Manager indicates that the client is in compliance with corporate connection policy.

Quarantine Control relies on the Connection Manager (CM) profile you create for your VPN clients. CM profiles are created with the Connection Manager Administration Kit (CMAK) provided in Windows Server 2003 and Windows 2000 Server. The CM profile contains:

  • A post-connect action that runs a network policy requirements script, configured when the CM profile is created with CMAK.
  • A network policy requirements script that performs validation checks on the remote access client computer to verify that it conforms to network policies. This can be a custom executable file or a simple command file (also known as a batch file). When the script has run successfully and the connecting computer has satisfied all of the network policy requirements (as verified by the script), the script runs a notifier component (an executable) with the appropriate parameters. If the script does not run successfully, it should direct the remote access user to a quarantine resource such as an internal Web page, which describes how to install the components that are required for network policy compliance.
  • A notifier component that sends a message indicating a successful execution of the script to the quarantine-compatible ISA Server computer. You can use your own notifier component or you can use Rqc.exe, which is a sample provided with the Windows Server 2003 Resource Kit. With these components installed, the remote access client computer uses the CM profile to perform network policy requirements tests and indicate its success to the ISA Server computer as part of the connection setup.

Note

  • For VPN connections to be established using ISA Server policies, you must disable the quarantine feature in the remote access policies (RAP) that could be stored in a Remote Authentication Dial-In User Service (RADIUS) server or a Windows authentication provider. Do the following:
    1. Open Computer Management and expand the Routing and Remote Access node.
    2. Select Remote Access Policies.
    3. In the details pane, double-click each policy to open its properties, and click Edit Profile.
    4. On the Advanced tab, remove MS-Quarantine-IPFilter and MS-Quarantine-Session-Timeout from the attributes list.

Get latest ISA Server content at ISA Server Guidance.


Quarantine Control requirements

This section describes what you need to run ISA Server Quarantine Control.

ISA Server computer

A quarantine-compatible ISA Server computer has the following components:

  • A computer running a member of the Microsoft® Windows Server™ 2003 or Windows® 2000 Server family (necessary if you want to implement RADIUS quarantine policy rather than ISA Server policy), and ISA Server.
  • A listener component. This component listens for messages from quarantine-compatible remote access clients, which indicate that their scripts have been run successfully. You can create your own custom listener component (matched with your own custom notifier component), or you can install the Remote Access Quarantine Agent service (Rqs.exe) sample from the Windows Server 2003 Resource Kit.

If you create your own listener component, it must be designed to listen for a message from the notifier component and use the MprAdminConnectionRemoveQuarantine() (http://www.microsoft.com/) application programming interface (API) to remove the quarantine restrictions from the remote access connection. Note that the API must call Vpnplgin.dll (in the ISA Server installation directory), rather than Mprapi.dll, as shown in the API documentation. ISA Server will then chain the call to Routing and Remote Access.

With these components installed, the ISA Server computer can use quarantine mode for connecting remote access clients and listen for notifier messages, indicating that the clients have satisfied network policy requirements and can be moved from the Quarantined VPN Clients network to the VPN Clients network.

If you are using Rqc.exe and Rqs.exe, the notification message sent by Rqc.exe contains a text string that indicates the version of the quarantine script being run. This string is configured for Rqc.exe as part of its command-line parameters, as run from the quarantine script. Rqs.exe compares this text string to a set of text strings stored in the registry of the ISA Server computer. If there is a match, the quarantine conditions are removed from the connection. The ConfigureRQSForISA.vbs script, available on the ISA Server website (http://www.microsoft.com/), helps install RQS (the listener component).

Notes

  • The notification sent by Rqc.exe is not encrypted or authenticated and can be spoofed by a malicious client.
  • The RQS.exe agent should be dependent on Routing and Remote Access.

Routing and Remote Access can be configured with either the Windows or RADIUS authentication provider.

Quarantine-compatible RADIUS server (optional)

If Routing and Remote Access on the ISA Server computer is configured with the RADIUS authentication provider, a quarantine-compatible RADIUS server requires a computer running Windows Server 2003 and Internet Authentication Service (IAS), which supports the configuration of the MS-Quarantine-IPFilter and MS-Quarantine-Session-Timeout RADIUS vendor-specific attributes (VSAs). The MS-Quarantine-IPFilter attribute is for the quarantine filters. The MS-Quarantine-Session-Timeout attribute is for the quarantine session timer.

Quarantine resources

Quarantine resources consist of servers that a remote access client in quarantine mode can access to perform name resolution (such as DNS servers), obtain the latest version of the CM profile (file servers with anonymous access allowed), or access instructions and components needed to make the remote access client comply with network policies (Web servers with anonymous access allowed). Anonymous access to file and Web resources is needed, because although remote access users may have the correct credentials to create the remote access connection, they might not be using the correct domain credentials to access protected file and Web resources.

Get latest ISA Server content at ISA Server Guidance.


How Quarantine Control works

The following process describes how ISA Server Quarantine Control works when Rqc.exe, Rqs.exe, and ISA Server policy are used:

  1. The user on the quarantine-compatible remote access client uses the installed quarantine Connection Manager (CM) profile to connect with the quarantine-compatible ISA Server computer.
  2. The remote access client passes its authentication credentials to the ISA Server computer.
  3. The ISA Server computer validates the authentication credentials of the remote access client and, assuming that the credentials are valid, checks its remote access policies. The connection attempt matches the quarantine policy.
  4. The connection is accepted with quarantine restrictions, and the client is assigned an IP address and placed in the Quarantined VPN Clients network. At this point, the remote access client can only successfully send traffic that matches the firewall policy for the Quarantined VPN Clients network and has up to the number of seconds specified in the ISA Server quarantine properties to notify the ISA Server computer that the script has run successfully.
  5. The CM profile runs the quarantine script as the post-connect action.
  6. The quarantine script runs and verifies that the remote access client computer's configuration complies with network policy requirements. If all the tests for network policy compliance pass, the script runs Rqc.exe with its command-line parameters, one of which is a text string for the version of the quarantine script included within the CM profile.
  7. Rqc.exe sends a notification to the ISA Server computer, indicating that the script was successfully run. The notification includes the quarantine script version string.
  8. The notification is received by the listener component (Rqs.exe). The notification traffic was allowed because it matched the permitted traffic specified by the firewall policy (in the ISA Server access rule that allows communication on the RQS port 7250 from the VPN Clients and Quarantined VPN Clients networks to the Local Host network).
  9. The listener component verifies the script version string in the notification message with those configured in the registry and sends back either a message indicating that the script version was valid or a message indicating that the script version was invalid.
  10. If the script version was valid, the listener component calls the MprAdminConnectionRemoveQuarantine() API, which causes ISA Server to move the client from the Quarantined VPN Clients network to the VPN Clients network.
  11. The listener component creates an event detailing the quarantined connection in the system event log.

Get latest ISA Server content at ISA Server Guidance.


Quarantine Control configuration steps

This section provides information about configuring ISA Server Quarantine Control. Before you enable quarantine mode, you must complete the following steps:

  1. Create a client-side script that validates client configuration information.
  2. Create a notification component that provides verification to the ISA Server computer that the script has successfully run. If you do not want to create a notification component, you can use Rqc.exe.
    The notifier component is included in the Connection Manager (CM) profile and installed on the client computer. The notifier component sends notification to the ISA Server computer when the administrator-provided script has run successfully on the client.
  3. Create a listener component to install on ISA Server computers (that can receive information from the notification component), and then remove the client from quarantine mode, applying the full access policy. If you do not want to create a listener component, you can use the Rqs.exe sample. The listener component is installed on the ISA Server computer, and receives notification from the notifier component that the script on the client has successfully performed all configuration checks. After the listener component receives notification, it removes the client from quarantine mode, and the ISA Server computer applies standard firewall policy rules to the client.
  4. If you are using the Rqs.exe sample, run the script ConfigureRQSForISA.vbs, available on the ISA Server website (http://www.microsoft.com/). The script performs the following actions:
    1. Installs RQS as a service and sets it to run in the local system account.
    2. Creates an ISA Server access rule that allows communication on the RQS port (7250) from the VPN Clients and Quarantined VPN Clients networks to the Local Host network. This is necessary so that the ISA Server computer can receive notice that the client has met the connection requirements.
    3. Modifies registry keys on the ISA Server computer so that RQS will work with ISA Server.
    4. Starts the RQS service.
    The script has one switch (install or remove) and requires two parameters: the set of allowed RQS shared keys, and the path to RQS.exe.
    A shared key is required by the RQS service from RQC.exe before the VPN client can leave the Quarantined VPN Clients network. If the client provides a shared key that is not in the allowed set, it will be disconnected. There can be more than one shared key, separated by "\0" when providing arguments to the ConfigureRQSForISA.vbs script, available on the ISA Server website (http://www.microsoft.com/).

    Note

    • The ConfigureRQSForISA.vbs script requires that the files Reg.exe and Sc.exe be in the system path. In Microsoft® Windows Server™ 2003, these files are present by default in %windir%\system32. In Windows® 2000 Server, you must install the files to the system path before running ConfigureRQSForISA.vbs. You can obtain Reg.exe from the Windows 2000 CD under support\tools. Sc.exe is part of the Microsoft Windows 2000 Resource Kit, which you can download from the Free Tool Downloads website. (http://www.microsoft.com/)
  5. Create a CM profile with the Connection Manager Administration Kit (CMAK). For more information about CMAK, see Connection Manager Administration Kit in Windows Server 2003 Help (http://www.microsoft.com/).
  6. Distribute the CM profile for installation on remote access client computers.

Quarantine notifier and listener components

You can create your own notifier and listener components, or you can use Rqs.exe (a listener component) and Rqc.exe (a notifier component). For more information, see Windows Resource Kit Tools Help. The Remote Access Quarantine Agent service is included when Rqs.exe is installed on an ISA Server computer. When you create the CM profile, you can include the administrator-provided script and Rqc.exe, which are distributed to and installed on remote access client computers. This profile can be installed on the following client operating systems: Windows XP Professional, Windows XP Home Edition, Windows 2000 Professional, Windows Millennium Edition, and Windows 98 Second Edition.

Quarantine settings

After you complete the preliminary steps for setting up quarantine, you can configure the quarantine settings on the ISA Server computer. After you enable quarantine mode, you can configure the Quarantined VPN Clients network properties, selecting one of the following:

  • Quarantine according to RADIUS Server policies. If you enabled quarantine, this option uses the RADIUS Server policies for quarantine.
  • Quarantine according to ISA Server policies. If you enabled quarantine, this option uses ISA Server policies for quarantine. You can also specify how long users can remain in quarantine mode, before being disconnected.

Even with quarantine enabled, you can exempt specific users from quarantine control.

Get latest ISA Server content at ISA Server Guidance.


Firewall policy for quarantined VPN clients

Your firewall policy controls the access you will allow from the Quarantined VPN Clients network to network resources. These resources could include the RADIUS server or domain controller against which the user is authenticated, a server that provides antivirus software and signature updates, and the DHCP server that provides IP addresses to VPN clients.

To allow access to a resource, you create an access rule, with the Quarantined VPN Clients network as the source, and the server to which access is required as the destination. This requires creating a computer rule element for each server, so that it can be used in access rules. Alternatively, you can create a computer set containing all of the computers to which the quarantined clients require access, and create an access rule with the Quarantined VPN Clients network as the source and the computer set as the destination. Another possibility is to design your network so that all of the servers to which access is required are on a subnet, and define a subnet rule element for use in the access rule.

For more information about firewall policy, see Firewall policy rules overview.

The following are some examples of the types of access you may want to allow to the Quarantined VPN Clients network. The first three items on this list represent the access needed by the network policy requirements script, without which the client will not be released to the VPN Clients network. Remember that the Connection Manager specific to your clients may require access to specific servers on specific protocols. Consult with the creator of your Connection Manager to ascertain what access rules are needed.

  • Allows queries to LDAP servers on the Internal network.
  • Allows traffic to domain controllers.
  • Allows quarantined VPN clients DNS queries to DNS servers.
  • Allows quarantined VPN clients WINS traffic to WINS servers.

Note

  • The ConfigureRQSForISA.vbs script, available on the ISA Server website, creates an ISA Server access rule that allows communication on the RQS port (7250) from the VPN Clients and Quarantined VPN Clients networks to the Local Host network. This is necessary so that the ISA Server computer can receive notice that the client has met the connection requirements.

Get latest ISA Server content at ISA Server Guidance.


Site-to-Site VPN

This section provides information about the features of Microsoft Internet Security and Acceleration (ISA) Server 2004 for a site-to-site virtual private network (VPN).

  • Site-to-site VPN overview
  • L2TP over IPsec and PPTP networks
  • IPsec tunneling protocol network
  • Dial-in accounts for remote site connections
  • Addresses for NLB-enabled remote sites
  • VPN connection owner
  • Site-to-site VPN connections for PPTP and L2TP
  • Site-to-site VPN and firewall policy


Site-to-site VPN overview

A large corporation often has multiple sites that require communication, for example, a corporate office in New York and a sales office in Washington. The two offices can be connected securely over the Internet using a site-to-site virtual private network (VPN).

ISA Server 2004 provides three VPN protocols for site-to-site connections:

  • Point-to-Point Tunneling Protocol (PPTP)
  • Layer Two Tunneling Protocol (L2TP) over Internet Protocol security (IPSec)
  • Internet Protocol security (IPSec) tunnel mode

For more information about VPN tunneling protocols, see VPN tunneling protocols.

The process of configuring remote VPN networks differs, depending on the tunneling protocol you select. For all remote site networks, you must configure the network, set up a network and firewall policy for the remote network, and configure the remote site gateway (VPN server).

In addition, for IPSec networks, you can further configure the security settings on the ISA Server computer. You must also configure the IPSec policy settings on the remote site gateway.

For more information about configuring L2TP over IPSec and PPTP remote networks, see L2TP over IPSec and PPTP networks. For more information about configuring IPSec remote networks, see IPSec tunneling protocol network.

Get latest ISA Server content at ISA Server Guidance.


L2TP over IPsec and PPTP networks

Microsoft Internet Security and Acceleration (ISA) Server 2004 supports a site-to-site virtual private network (VPN) using Point-to-Point Tunneling Protocol (PPTP) and Layer Two Tunneling Protocol (L2TP) over Internet Protocol security (IPsec). For example, you can use these tunneling protocols if you are using ISA Server 2004 as your VPN server, and the site you are connecting to is using Microsoft® Windows Server™ 2003, Windows® 2000 Server, ISA Server 2004, or ISA Server 2000 as a VPN server. ISA Server 2004 uses Routing and Remote Access to establish the L2TP over IPsec VPN connection.

The figure illustrates a possible network topology for the L2TP over IPsec solution.

VPN site to site with L2TP over IPsec

Setting up remote networks using PPTP or L2TP over IPsec involves these general steps:

  1. Create a remote site network, selecting PPTP or L2TP over IPsec as the tunneling protocol. For instructions, see Add a remote site network.
  2. Select PPTP or L2TP over IPsec as the tunneling protocol. For instructions, see Configure tunneling protocol for a remote site network.
  3. Configure ISA Server network rules and access policy. For more information, see Site-to-site VPN and firewall policy.
  4. Configure the general VPN properties for connections initiated by remote VPN sites, because ISA Server views those sites as VPN clients. For more information, see Site-to-site VPN connections for PPTP and L2TP.
  5. Configure automatic dialing, if your ISA Server computer is connected to the Internet through a dial-up connection. For instructions, see Configure automatic dialing.
  6. Configure the remote VPN server.

web link Get latest ISA Server content at ISA Server Guidance.


IPsec tunneling protocol network

Microsoft Internet Security and Acceleration (ISA) Server 2004 supports a site-to-site virtual private network (VPN) using the Internet Protocol security (IPsec) tunneling protocol. For example, you can use IPsec tunneling protocol if you are using ISA Server 2004 as your VPN server, and the site you are connecting to is using a third-party product or ISA Server 2004 as its VPN server. The figure shows a possible network topology for the IPsec tunnel solution.

VPN site-to-site with IPsec

As shown in the figure, the main office is using ISA Server 2004 as its VPN server. ISA Server 2004 is on a computer running either Microsoft® Windows Server™ 2003 or Windows® 2000 Server.

The branch office may be running one of several third-party VPN servers. Alternatively, the branch may be using ISA Server 2004, Windows Server 2003 or Windows 2000 Server as its VPN server.

Setting up remote networks using IPsec involves these general steps:

  1. Create a remote site network. Select IPsec as the tunneling protocol. For instructions, see Add a remote site network.
  2. Configure ISA Server network rules and access policy. For more information, see Site-to-site VPN and firewall policy.
  3. Configure automatic dialing, if your ISA Server computer is connected to the Internet through a dial-up connection. For instructions, see Configure automatic dialing.
  4. Configure the remote VPN server. The remote VPN server must be configured to connect to the ISA Server computer in IPsec tunnel mode, according to manufacturer instructions. ISA Server provides a summary of the information needed to configure the remote server. For instructions on viewing the summary information, see View IPsec policy.
  5. Configure advanced IPsec settings. For instructions, see Configure advanced IPsec settings for Phase I and Configure advanced IPsec settings for Phase II.

IPsecPol tool

To create a remote site network that uses the IPsec protocol tunneling mode on a computer running Windows 2000, you must install the IPsecPol tool, available on the Microsoft Web site (http://www.microsoft.com/). The tool must be installed to the ISA Server installation folder.

When you create a remote site network that uses the IPsec tunneling protocol, the Microsoft Firewall service modifies the IPsec filters on the computer, when restarting the Firewall service. This process can take up to several minutes, depending on the number of subnets included in the address ranges for the network. To minimize the effect, we recommend that you define IP address ranges that are aligned in subnet boundaries.

PolicyAgent service

If you stop or restart the IPsec PolicyAgent service, all dynamic IPsec configuration information is lost, including ISA Server VPN site-to-site IPsec configuration settings, and the clients are disconnected. Furthermore, when the PolicyAgent service is stopped, and the IPsec policy is erased, all traffic from the clients is forwarded to the Internet, unencrypted.

To restore settings, start the PolicyAgent service and restart the Firewall service. Alternatively, restart the computer.

IPsec policy for domain members

Typically, the ISA Server computer is not a member of a domain. In this case, a local IPsec policy can be used. However, if ISA Server is a member of a domain that has IPsec policy applied to all its members, the local IPsec policies are overwritten by the domain IPsec policies. Work with the domain administrator to ensure that the domain IPsec policy does not conflict with the IPsec policy configured for the remote site network. To view the remote site network's IPsec policy:

  1. In ISA Server Management, click Virtual Private Networks (VPN).
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable remote network.
  4. On the Tasks tab, click View IPsec Policy.

IPsec support for multiple IP addresses

For IPsec remote site networks, when using a non-primary IP address as the local endpoint, the following is not supported:

  • A NAT relationship cannot be configured from any internal network to the remote site network (for traffic initiated from the internal networks to the remote site network).
  • Web Proxy traffic is not supported from any internal network to the remote site network. You can allow HTTP traffic by defining a new protocol (for example, named HTTP1) that is not configured for the Web Proxy application filter. Use that protocol in a rule that allows HTTP traffic to the specific remote site network.

When connecting multiple IPsec remote site networks to the same ISA Server computer running Windows Server 2003, we recommend that you define unique IP addresses for each remote site network's local endpoint.

If multiple IPsec remote site networks require NAT or HTTP functionality (from the Internal network to the remote site network), we recommend that you use a dedicated network adapter for each remote site network (using the primary IP address on the network adapter as the local endpoint). To identify the primary IP address:

  1. Select the relevant network adapter and then right-click Properties.
  2. Click TCP-IP protocol and then click Properties.

web link Get latest ISA Server content at ISA Server Guidance.


Dial-in accounts for remote site connections

When creating a site-to-site network for remote access, you must also create a user account for initiating the remote access dial-up connection. For the connection to succeed:

  • The name of the user account and the name of the site-to-site network must be identical.
  • The remote access user dial-in properties must be set to allow remote access.

This information applies to site-to-site connections using Layer Two Tunneling Protocol (L2TP) or Point-to-Point Tunneling Protocol (PPTP). It does not apply to connections using Internet Protocol security (IPSec).

For instructions, see Create a dial-in account for the remote site gateway.

Get latest ISA Server content at ISA Server Guidance.


Addresses for NLB-enabled remote sites

When the remote site network to which you are connecting is an array with Network Load Balancing (NLB) enabled, the address you specify for the remote tunnel endpoint must be the virtual IP address of the NLB-enabled array. For instructions, see Configure remote tunnel endpoint.

Addresses

When you create the remote site network, specify all the addresses in the remote site.

In addition, for IPsec networks, for Hypertext Transfer Protocol (HTTP) proxy or network address translation (NAT) traffic between sites, you must include all the dedicated IP addresses of the network adapters associated with the remote site network. This is because the source IP addresses for HTTP proxy and NAT traffic from remote sites are subject to address translation (on the remote side). The local site therefore sees the traffic as if it is arriving from the primary IP address of the remote site—that is from its dedicated IP address. For instructions, see Configure addresses for a remote site network.

Remote NLB

When the remote site network is an NLB-enabled array, the initial connection from this array of Microsoft Internet Security and Acceleration (ISA) Server 2004 computers will be to the virtual IP address of the computer. The tunnel will be established from one of the dedicated IP addresses on the remote array. For this reason, you must specify all the dedicated IP addresses as additional remote tunnel endpoints. For instructions, see Configure additional tunnel endpoints for the remote site.

web link Get latest ISA Server content at ISA Server Guidance.


VPN connection owner

When a site-to-site connection is established with an array of Microsoft Internet Security and Acceleration (ISA) Server 2004 computers, only one array member is actually the connection owner. The connection owner is the virtual private network (VPN) tunnel endpoint.

When Network Load Balancing (NLB) is enabled, ISA Server automatically assigns the connection owner; no additional configuration is required. ISA Server uses an algorithm to optimize the connection owner assignment, creating as balanced a network as possible. After a tunnel has been established, the server assigned as the connection owner does not change, even if other servers are added or removed. If the assigned connection owner becomes unavailable, ISA Server automatically passes the connection to another array member. In this way, ISA Server supports failover for VPN site-to-site connections.

When NLB is not enabled, you must assign a connection owner for the remote site network. If the connection owner becomes unavailable, there will be no connectivity to the remote site.

For instructions, see Assign a connection owner.

web link Get latest ISA Server content at ISA Server Guidance.


Site-to-site VPN connections

Site-to-site VPN connections for PPTP and L2TP

In a site-to-site network, virtual private network (VPN) connections can be initiated either by Microsoft Internet Security and Acceleration (ISA) Server 2004 or by the remote site gateway.

Connections initiated by the remote site gateway

ISA Server considers a remote site gateway that uses Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol (L2TP) as any remote access client. For this reason, the remote site gateway must:

  • Configure the VPN access network on which it is located, so that it can initiate connections. For instructions, see Configure VPN access networks.
  • Configure a user with a dial-in account on the ISA Server computer. The user can be a Windows user or a RADIUS user. The same considerations apply to the remote site network as to the remote VPN client. For instructions, see Create a dial-in account for the remote site gateway.
  • Have an IP address, assigned by ISA Server. The address should be located on the Internal network. For instructions, see Configure VPN address assignment.
  • Have authentication protocols configured, which will be used when authenticating its user account information to ISA Server. For instructions, see Configure VPN authentication methods.

You can also configure whether connections initiated by the remote site should be terminated after a specific amount of time. For instructions, see Terminate inactive VPN connections automatically.

Connections initiated by ISA Server

For each remote site network that uses PPTP or L2TP, you can configure whether ISA Server can also initiate VPN connections. If ISA Server can initiate connections, you must configure appropriate credentials, which will be used to authenticate to the remote site gateway.

You can also configure the authentication methods used when ISA Server initiates connections to the remote site gateway. The authentication protocol that you configure should be the protocol required by the remote site gateway. For example, if the remote site gateway uses IPsec, you should configure authentication using either certificates or a preshared key. For instructions, see Configure VPN authentication methods for site-to-site connections initiated by ISA Server.


Site-to-site VPN and firewall policy

When you configure a site-to-site virtual private network (VPN) in ISA Server, you are establishing a new network: the remote site, recognized by the ISA Server computer as a remote VPN. Remote site networks should include all the addresses on the remote site. For instructions on creating remote site networks, see Add a remote site network.

When you create a remote network, the VPN site-to-site connection is enabled. ISA Server enables system policy rules, allowing access from all External networks to the ISA Server computer (Local Host network), using the VPN tunneling protocols. This rule is modified if you modify the VPN access network, which is initially set to the External network. You can specify one or more networks from which VPN clients can connect to ISA Server. When you modify this, the system policy rule is changed automatically to apply to the additional or changed networks. For more information on system policy rules, see System policy overview.

The default system policy rules also allow access from a computer set named IPsec Remote Gateways. IPsec Remote Gateways is a predefined computer set, which cannot be modified. When an IPsec site-to-site network is added, the IP address configured as the remote tunnel endpoint is added to the IPsec Remote Gateways computer set.

To allow remote networks access to resources on the Internal network, you must create an access rule, allowing the appropriate access. If you consider the remote network to be identical to the Internal network from a firewall policy perspective, you may also want to create an access rule allowing all traffic from the Internal network to the remote network.

When you create access rules to control traffic to and from a remote network, do not require user authentication. In other words, do not change the default All Users setting on the Users property page of the access rule.

For more information about firewall policy, see Firewall policy rules overview.


Common VPN Configuration

This section provides information about the features of Internet Security and Acceleration (ISA) Server 2004 for common virtual private network (VPN) configuration.

  • VPN access network
  • VPN tunneling protocols
  • VPN Authentication
  • VPN client address assignment and name resolution


VPN access network

For virtual private network (VPN) client connections, networks from which clients can connect to the ISA Server 2004 computer with VPN enabled are called access networks.

For site-to-site (remote) connections, an access network is a network where the remote VPN server is located.

By default, for both site-to-site connections and for client connections, the VPN access network is set only to the External network. Therefore, when you enable VPN access, VPN connections can be established for computers on the External network.

For instructions, see Configure VPN access networks.

Remote VPN client access

When you first enable VPN client access on ISA Server, a system policy rule called Allow VPN client traffic to ISA Server is enabled. This allows access from the External network to the Local Host, because the External network is configured by default as an access network. You can subsequently configure additional access networks, by specifying additional VPN access networks. The system policy rule is automatically updated to apply to the additional access networks.

Site-to-site access

For site-to-site access, when you create a new remote site network, ISA Server adds the remote network to the list of networks included in the Protected Networks network set. In addition, ISA Server enables these system policy rules:

  • Allow VPN site-to-site traffic from ISA Server. This rule allows the ISA Server computer access to clients on the External network, using the selected VPN protocol.
  • Allow VPN site-to-site traffic to ISA Server. This rule allows clients on the External network access to the ISA Server computer, using the selected VPN protocol.

Get latest ISA Server content at ISA Server Guidance.


VPN tunneling protocols

ISA Server 2004 supports two virtual private network (VPN) protocols for remote client access connections:

  • Point-to-Point Tunneling Protocol (PPTP)
  • Layer Two Tunneling Protocol (L2TP)

In addition, for site-to-site VPN connections, Internet Protocol security (IPSec) tunnel mode is supported.

For instructions on configuring protocols for remote client access, see Configure tunneling protocols for remote client access.

PPTP

Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables the secure transfer of data from a remote client to a private enterprise server by creating a VPN across TCP/IP-based data networks. PPTP supports on-demand, multi-protocol, virtual private networking over public networks such as the Internet. PPTP allows IP traffic to be encrypted, and then encapsulated in an IP header to be sent across a corporate IP network or a public IP network such as the Internet.

L2TP

Layer Two Tunneling Protocol (L2TP) is an industry-standard Internet tunneling protocol that provides encapsulation for sending Point-to-Point Protocol (PPP) frames across packet-oriented media. L2TP allows IP traffic to be encrypted, and then sent over any medium that supports point-to-point datagram delivery, such as IP. The Microsoft implementation of L2TP uses Internet Protocol security (IPSec) encryption to protect the data stream from the VPN client to the VPN server. IPSec tunnel mode allows IP packets to be encrypted, and then encapsulated in an IP header to be sent across a corporate IP network or a public IP network such as the Internet.

PPTP connections require only user-level authentication through a PPP-based authentication protocol. L2TP over IPSec connections require the same user-level authentication and, in addition, computer-level authentication using computer certificates.

IPSec tunnel mode

Tunneling is the entire process of encapsulation, routing, and decapsulation. Tunneling wraps, or encapsulates, the original packet inside a new packet. This new packet might have new addressing and routing information, which enables it to travel through a network. When tunneling is combined with data confidentiality, the original packet data (as well as the original source and destination) is not revealed to those listening to traffic on the network. After the encapsulated packets reach their destination, the encapsulation is removed, and the original packet header is used to route the packet to its final destination.

The tunnel itself is the logical data path through which the encapsulated packets travel. To the original source and destination peer, the tunnel is usually transparent and appears as just another point-to-point connection in the network path. The peers are unaware of any routers, switches, proxy servers, or other security gateways between the tunnel's beginning point and the tunnel's endpoint. When tunneling is combined with data confidentiality, it can be used to provide a VPN.

The encapsulated packets travel through the network inside the tunnel. In this example, the network is the Internet. The gateway might be an edge gateway that stands between the outside Internet and the private network. The edge gateway can be a router, firewall, proxy server, or other security gateway. Also, two gateways can be used inside the private network to protect traffic across untrusted parts of the network.

When IPSec is used in tunnel mode, it provides encapsulation for IP traffic only. The primary reason for using IPSec tunnel mode is interoperability with other routers, gateways, or end systems that do not support L2TP over IPSec or PPTP VPN tunneling.

Note

  • If you stop or restart the IPSec PolicyAgent service, all dynamic IPSec configuration information is lost, including ISA Server VPN site-to-site IPSec configuration settings, and VPN clients are disconnected. To restore settings, either start the PolicyAgent service and restart the Microsoft Firewall service, or restart the computer.

VPN protocol comparison

The following table compares the VPN protocols.

Protocol | When to use | Security level | Comments
IPSec tunnel mode | Connecting to third-party VPN server | High | This is the only option you can use if you are connecting to a non-Microsoft VPN server.
L2TP over IPSec | Connecting to an ISA Server 2004 computer, ISA Server 2000 computer, or Windows VPN server | High | Uses Routing and Remote Access. Less complicated than the IPSec tunnel solution, but requires that the remote VPN server be an ISA Server computer or a Windows VPN server.
PPTP | Connecting to an ISA Server 2004 computer, ISA Server 2000 computer, or Windows VPN server | Moderate | Uses Routing and Remote Access. Same restrictions as L2TP, but slightly easier to configure. L2TP is considered more secure because it uses IPSec encryption.

Get latest ISA Server content at ISA Server Guidance.


VPN Authentication

The authentication of virtual private network (VPN) clients is an important security concern. Authentication methods typically use an authentication protocol that is negotiated during the connection establishment process. This section describes the authentication methods supported by ISA Server 2004:

  • EAP authentication method
  • EAP authentication configuration
  • MS-CHAP authentication method
  • CHAP, SPAP, and PAP authentication methods
  • Preshared keys (custom IPSec policy for L2TP connections)

Authentication methods for remote site gateways

When a remote site gateway initiates a connection with ISA Server, it is initially authenticated as any remote VPN client. The authentication methods that you apply for remote VPN clients also apply for the remote site gateway. For more information about how the remote site gateway connects to ISA Server, see VPN site-to-site connections.

Authentication methods when ISA Server initiates remote site connections

You can configure ISA Server to allow the ISA Server computer to initiate connections to the remote site gateway. In this case, you must also configure the authentication methods to be used. For instructions, see Configure VPN authentication methods for site-to-site connections initiated by ISA Server.

Get latest ISA Server content at ISA Server Guidance.


EAP authentication method

With the Extensible Authentication Protocol (EAP), an arbitrary authentication mechanism authenticates a remote access connection. The exact authentication scheme to be used is negotiated by the remote VPN client and the authenticator (either ISA Server or the RADIUS server). ISA Server includes support for Message Digest 5 Challenge (MD5-Challenge) and EAP-Transport Level Security (EAP-TLS) by default.

EAP allows for an open-ended conversation between the remote VPN client and the authenticator. The conversation consists of authenticator requests for authentication information and the responses by the remote VPN client. For example, when EAP is used with security token cards, the authenticator can separately query the remote access client for a name, PIN, and card token value. As each query is asked and answered, the remote access client passes through another level of authentication. When all questions have been answered satisfactorily, the remote access client is authenticated.

A specific EAP authentication scheme is known as an EAP type. Both the remote access client and the authenticator must support the same EAP type for successful authentication to occur.

For instructions on configuring authentication methods, see Configure VPN authentication methods.

EAP infrastructure

EAP is a set of internal components that provide architectural support for any EAP type in the form of a plug-in module. For successful authentication, both the remote access client and authenticator must have the same EAP authentication module installed. ISA Server supports two EAP types: MD5-Challenge and EAP-TLS.

MD5-Challenge

Message Digest 5 Challenge (MD5-Challenge) is a required EAP type that uses the same challenge/handshake protocol as PPP-based CHAP, but the challenges and responses are sent as EAP messages. A typical use for MD5-Challenge is to authenticate the credentials of remote VPN clients by using user name and password security systems. You can also use MD5-Challenge to test EAP interoperability.

EAP-TLS

EAP-Transport Level Security (EAP-TLS) is an EAP type that is used in certificate-based security environments. If you are using smart cards for remote access authentication, you must use the EAP-TLS authentication method. The EAP-TLS exchange of messages provides mutual authentication, negotiation of the encryption method, and encrypted key determination between the remote VPN client and the authenticator. EAP-TLS provides the strongest authentication and key determination method.

EAP-RADIUS

EAP-RADIUS is not an EAP type, but the passing of EAP messages of any EAP type by an authenticator to a RADIUS server for authentication. For example, when ISA Server is configured for RADIUS authentication, the EAP messages sent between the remote VPN client and ISA Server are encapsulated and formatted as RADIUS messages between the remote access server and the RADIUS server.

EAP-RADIUS is used in environments where RADIUS is used as the authentication provider. An advantage of using EAP-RADIUS is that EAP types do not need to be installed at each remote access server, only at the RADIUS server. In the case of Internet Authentication Service (IAS), you only need to install EAP types on the IAS server.

For more information about RADIUS authentication, see RADIUS authentication for remote VPN clients.

Get latest ISA Server content at ISA Server Guidance.


EAP authentication configuration

If you create a virtual private network (VPN) remote site network that uses a Point-to-Point Tunneling Protocol (PPTP) connection, and select Extensible Authentication Protocol (EAP) as its authentication protocol, you must complete the EAP configuration. EAP configuration is done using Routing and Remote Access.

To complete the EAP configuration, do the following:

  1. In Routing and Remote Access Management console, select the Network Interfaces node.
  2. When you applied the changes to the ISA Server configuration, a demand dial interface with the same name you gave the network was created. Select this demand dial interface, and then click Properties.
  3. On the Security tab, the advanced custom settings option should be selected. Click Settings to open Advanced Security Settings.
  4. Select the EAP you will be using, and then click Properties to configure the EAP according to your EAP provider.

Note

  • To open Routing and Remote Access Management console, click Start, click Administrative Tools, and then click Routing and Remote Access.

Get latest ISA Server content at ISA Server Guidance.


MS-CHAP authentication method

ISA Server 2004 supports the Microsoft Challenge Handshake Authentication Protocol (MS-CHAP), also known as MS-CHAP version 1. MS-CHAP is a nonreversible, encrypted password authentication protocol. The challenge handshake process works as follows:

  1. The authenticator, which is the remote access server or the Internet Authentication Service (IAS) server, sends a challenge to the remote access client that consists of a session identifier and an arbitrary challenge string.
  2. The remote access client sends a response that contains the user name and a nonreversible encryption of the challenge string, the session identifier, and the password.
  3. The authenticator checks the response and, if valid, the user's credentials are authenticated.

If you use MS-CHAP as the authentication protocol, you can use Microsoft Point-to-Point Encryption (MPPE) to encrypt the data sent on the PPP or PPTP connection.

ISA Server also supports MS-CHAP version 2. MS-CHAP version 2 provides stronger security for remote access connections than MS-CHAP. You should consider using MS-CHAP version 2 instead of MS-CHAP.

Notes

  • MS-CHAP (version 1 and version 2) is the only authentication protocol provided with the Microsoft® Windows Server™ 2003 family that supports password change during the authentication process.
  • If MS-CHAP v1 is used as the authentication protocol, a 40-bit encrypted connection cannot be established if the user's password is larger than 14 characters. This affects both dial-up and virtual private network (VPN) remote access, and demand dial connections.

For instructions on setting authentication methods, see Configure VPN authentication methods.

MS-CHAP version 2

ISA Server supports version 2 of the Microsoft Challenge Handshake Authentication Protocol (MS-CHAP v2), which provides stronger security for remote access connections.

MS-CHAP v2 is a one-way encrypted password, mutual authentication process that works as follows:

  1. The authenticator, which is the remote access server or the Internet Authentication Service (IAS) server, sends a challenge to the remote access client that consists of a session identifier and an arbitrary challenge string.
  2. The remote access client sends a response that contains:
    • The user name.
    • An arbitrary peer challenge string.
    • A one-way encryption of the received challenge string, the peer challenge string, the session identifier, and the user's password.
  3. The authenticator checks the response from the client and sends back a response that contains:
    • An indication of the success or failure of the connection attempt.
    • An authenticated response based on the sent challenge string, the peer challenge string, the encrypted response of the client, and the user's password.
  4. The remote access client verifies the authentication response and, if correct, uses the connection. If the authentication response is not correct, the remote access client terminates the connection.

Get latest ISA Server content at ISA Server Guidance.


CHAP, SPAP, and PAP authentication methods

ISA Server 2004 supports the Challenge Handshake Authentication Protocol (CHAP), Shiva Password Authentication Protocol (SPAP), and Password Authentication Protocol (PAP).

CHAP

The Challenge Handshake Authentication Protocol (CHAP) is a challenge/response authentication protocol that uses the industry-standard Message Digest 5 (MD5) hashing scheme to encrypt the response. CHAP is used by various vendors of network access servers and clients. A server running Routing and Remote Access supports CHAP so that remote access clients that require CHAP are authenticated. Because CHAP requires the use of a reversibly encrypted password, you should consider using another authentication protocol such as Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) version 2.

Notes

  • If your password expires, CHAP cannot change passwords during the authentication process.
  • You cannot use Microsoft Point-to-Point Encryption (MPPE) with CHAP.

For instructions on setting authentication methods, see Configure VPN authentication methods.

SPAP

The Shiva Password Authentication Protocol (SPAP) is a reversible encryption mechanism employed by Shiva. When a computer running Windows XP Professional connects to a Shiva LAN Rover, it uses SPAP, as does a Shiva client that connects to a server running Routing and Remote Access. This form of authentication is more secure than plaintext but less secure than CHAP or MS-CHAP.

Important

  • When you enable SPAP as an authentication protocol, the same user password is always sent in the same reversibly encrypted form. This makes SPAP authentication susceptible to replay attacks, where an attacker captures the packets of the authentication process and replays the responses to gain authenticated access to your intranet. The use of SPAP is discouraged, especially for virtual private network connections.

Notes

  • If your password expires, SPAP cannot change passwords during the authentication process.
  • Make sure your network access server (NAS) supports SPAP before you enable it on a remote access policy on an Internet Authentication Service (IAS) server.
  • You cannot use Microsoft Point-to-Point Encryption (MPPE) with SPAP.

PAP

Password Authentication Protocol (PAP) uses plaintext passwords and is the least secure authentication protocol. It is typically negotiated if the remote access client and remote access server cannot negotiate a more secure form of validation.

To enable PAP-based authentication, you must do the following:

  1. Enable PAP as an authentication protocol on the remote access server. PAP is disabled by default.
  2. Enable PAP on the appropriate remote access policy. PAP is disabled by default.
  3. Enable PAP on the remote access client.

Notes

  • By disabling PAP on ISA Server, plaintext passwords are never sent by the dial-up client. Disabling support for PAP increases authentication security, but remote VPN clients who only support PAP cannot connect.
  • If your password expires, PAP cannot change passwords during the authentication process.
  • You cannot use Microsoft Point-to-Point Encryption (MPPE) with PAP.

Get latest ISA Server content at ISA Server Guidance.


Preshared keys (custom IPsec policy for L2TP connections)

A preshared key is a string of Unicode characters used to authenticate Layer Two Tunneling Protocol (L2TP) over Internet Protocol security (IPsec) connections. The use of preshared keys is supported on many operating systems, including Microsoft® Windows Server™ 2003 and Windows® XP. You can also configure Microsoft Internet Security and Acceleration (ISA) Server 2004 to use a preshared key to authenticate connections from other routers.

For instructions, see Configure a preshared key for VPN connections.

Advantages and disadvantages of preshared keys

Preshared key authentication does not require the hardware and configuration investment of a public key infrastructure (PKI), which is necessary for using computer certificates for L2TP over IPsec authentication. Preshared keys are simple to configure on a remote access server, and they are relatively simple to configure on a remote access client. They can be made transparent to the user if they are issued within Connection Manager profiles. If you are in the process of establishing a PKI or if you manage an Active Directory® domain, you can configure Routing and Remote Access to accept an L2TP over IPsec connection using a computer certificate or a preshared key.

However, a single remote access server can utilize only one preshared key for all L2TP over IPsec connections that require a preshared key for authentication. You must issue the same preshared key to all L2TP over IPsec VPN clients that connect to the remote access server using a preshared key. Unless you distribute the preshared key within a Connection Manager profile, each user must manually type the preshared key. This limitation further reduces the security of the deployment and increases the probability of error. If the preshared key on a remote access server is changed, a client with a manually configured preshared key will be unable to connect to that server until the preshared key on the client is changed. If the preshared key was distributed to the client within a Connection Manager profile, that profile must be reissued with the new preshared key and reinstalled on the client computer. Unlike certificates, the origin and the history of a preshared key cannot be determined. For these reasons, the use of preshared keys to authenticate L2TP over IPsec connections is considered a relatively weak authentication method. If you want a long term, strong authentication method, you should consider using a PKI.

Considerations when choosing a preshared key

A preshared key is a sequence of characters that is configured on both the remote access server and the L2TP over IPsec client. The preshared key can be any non-null string of any combination of up to 256 Unicode characters. When you choose a preshared key, consider the fact that users who utilize the New Connection Wizard to create the VPN client connection must type the preshared key manually. A key that is long and complex enough to provide adequate security might be difficult for the majority of your users to type accurately. If the preshared key presented by the VPN client deviates in any way from the preshared key configured on the remote access server, client authentication will fail.

Note

  • On ISA Server, you can use only English characters in the preshared key.

When the preshared key is first stored, the remote access server and the VPN client attempt to convert the Unicode string into ASCII. If the attempt is successful, the ASCII version of the string will be used for authentication. This strategy ensures that the preshared key is not corrupted in transmission by any devices that do not comply with the Unicode standard, such as routers from other companies. If the preshared key cannot be stored as ASCII, the Unicode string will be used. If the Unicode preshared key must be processed by any device that does not comply with the Unicode standard, the connection attempt will probably fail.

web link Get latest ISA Server content at ISA Server Guidance.


VPN client address assignment and name resolution

When you configure Microsoft Internet Security and Acceleration (ISA) Server 2004 to allow a virtual private network (VPN), you must configure how remote clients will be assigned addresses: dynamically or statically. When a VPN client is assigned an address, the address becomes part of the VPN Clients network.

For instructions on setting authentication methods, see Configure VPN address assignment.

Note

  • ISA Server acts as an Address Resolution Protocol (ARP) proxy for VPN clients. For example, when addresses assigned (from a static pool or by a DHCP server) to VPN clients are part of the Internal network segment, computers from the Internal network will send ARP queries to VPN clients. ISA Server will intercept the queries and reply on behalf of the connected VPN client.

Dynamic address assignment

If the remote clients are assigned addresses dynamically, you will require a Dynamic Host Configuration Protocol (DHCP) server. The DHCP server will dynamically assign IP addresses to VPN clients when they connect. This is the recommended approach to assigning IP addresses to VPN clients.

Any computer running Windows Server 2003 in the Internal network can serve as the DHCP server. The existing DHCP server of your Internal network will serve VPN client needs.

If you use a DHCP server for address assignment, when a VPN client establishes a connection, its address is automatically moved from the Internal network to the VPN Clients network (or Quarantined VPN Clients network, if quarantine is enabled and the client is quarantined). The address is restored to the Internal network when the client disconnects. This address assignment is not visible in ISA Server Management.

If you use a DHCP server to assign IP addresses on the Internal network, but will assign a group of IP addresses from the Internal network to be a static pool for VPN Clients, you must configure the DHCP server to not assign those addresses.

When you use dynamic address assignment, the address that the VPN client is assigned is actually an address from the Internal network. When the VPN client establishes a connection, its address is dynamically moved from the Internal network to the VPN Clients network. When the client subsequently disconnects, the address is returned to the Internal network. These shifts in IP address membership are not visible in ISA Server Management.

Only static addresses can be assigned on arrays with more than one member. By using static address pools, the array members can update their routing tables before any client connects. With dynamic address assignment, the client is assigned an address only when it connects to the server. This in turn necessitates intra-array traffic, as each server has to update its routing table.

Note

  • If no DHCP server is configured on the Internal network, you must configure a static pool of IP addresses in the VPN Clients network.

Static address assignment

Alternatively, you can provide the IP addresses from a static pool of addresses. For example, this approach can be used when your Internal network IP addresses are statically assigned.

If you use a static address pool for address assignment, the addresses that you want to assign to the pool must first be removed from other defined networks, because overlapping of IP addresses between networks is not allowed. You must provide one more IP address in the static address pool than the expected number of remote VPN connections. (This includes remote site and roaming client connections.)

Broadcast name resolution for VPN clients

You can enable broadcast name resolution for VPN connections to ISA Server, specifying which DNS server or which Windows Internet Name Service (WINS) server the client will use to resolve computer names. In this case, a remote access client can resolve full computer names, NetBIOS names of computers, and other resources on a remote network that does not have either a DNS or a WINS server configured.

web link Get latest ISA Server content at ISA Server Guidance.


VPN connection monitoring

You can monitor virtual private network (VPN) sessions, filtering the Sessions view to show only the VPN connections. To monitor VPN clients, configure the filter so that Session Type is set to VPN client. To monitor connections from a remote site network, configure the filter on the Sessions view so that the Source Network is set to VPN Site-to-Site.

Logging

ISA Server 2004 supports the following types of logging for VPN connections:

  • Event logging. Event logging is the recording of events in the system event log. Event logging is typically used for troubleshooting or for notifying network administrators of unusual events.
  • ISA Server logging. ISA Server also supports the logging of authentication and access information for remote VPN connections. This logging is separate from the events recorded in the system event log. You can use the information that is logged to track remote access usage and authentication attempts. For more information, see Log storage format.
  • RADIUS-based authentication and accounting logging. A server running Routing and Remote Access supports the logging of accounting information for remote access connections at a Remote Authentication Dial-In User Service (RADIUS) server when RADIUS authentication and accounting are enabled. This logging is separate from the events recorded in the system event log. You can use the information that is logged on your RADIUS server to track remote access usage. For instructions, see Use RADIUS authentication and Use RADIUS for accounting.

Get latest ISA Server content at ISA Server Guidance.


VPN: How To

This section provides instructions for configuring remote VPN clients, site-to-site VPN, and common VPN configuration settings.

  • Configure Remote VPN Client Access
  • Configure Site-to-Site VPN Connections
  • Configure Common VPN Settings


Configure Remote VPN Client Access

This section provides steps for configuring remote virtual private network (VPN) client access.

  • Enable remote VPN client access
  • Configure maximum number of simultaneous remote client connections
  • Allow remote access for domain groups
  • Configure tunneling protocols for remote client access
  • Enable user mapping
  • Create users and groups for remote VPN clients
  • Enable Quarantine Control
  • Exempt users from Quarantine Control
  • Monitor VPN clients


Enable remote VPN client access

To enable remote VPN client access

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the VPN Clients tab.
  3. On the Tasks tab, click Enable VPN Client Access.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you enable VPN client access, a system policy rule named Allow VPN clients to firewall is enabled.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure maximum number of simultaneous remote client connections

To configure maximum number of simultaneous remote client connections

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. On the details pane, click the VPN Clients tab.
  3. On the Tasks tab, click Configure VPN Client Access.
  4. Verify that Enable VPN client access is selected.
  5. In Maximum number of VPN clients allowed, type the maximum number of VPN clients that can connect simultaneously.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you enable VPN client access, a system policy rule named Allow VPN clients to firewall is enabled.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Allow remote access for domain groups

To allow remote access for domain groups

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the VPN Clients tab.
  3. On the Tasks tab, click Configure VPN Client Access.
  4. On the Groups tab, click Add.
  5. Type the names of users or groups that are allowed remote access to the ISA Server computer.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You cannot add the Windows built-in user groups as VPN users. Built-in domain groups may be used (even in a situation where the ISA Server computer is also the domain controller).
  • You must set the dial-in properties for users belonging to these domain groups to Control access through remote access policy.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure tunneling protocols for remote client access

To configure tunneling protocols for remote client access

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the VPN Clients tab.
  3. On the Tasks tab, click Configure VPN Client Access.
  4. On the Protocols tab, select one or more of the following:
    • Enable PPTP
    • Enable L2TP/IPSec

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you enable remote VPN clients to connect to ISA Server 2004 using the L2TP tunneling protocol, you will require a certificate.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Enable user mapping

To enable user mapping

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the VPN Clients tab.
  3. On the Tasks tab, click Configure VPN Client Access.
  4. On the User Mapping tab, click Enable User Mapping.
  5. If the user name to be mapped does not include a domain name, select When username does not contain a domain, use this domain. Then, in Domain Name, type the name of the domain to use.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If the RADIUS server and ISA Server are in different domains (or if one is in a workgroup), user mapping is supported only for PAP and SPAP authentication methods. Do not use user mapping if any other authentication method is configured.
  • User mapping can be used only when ISA Server is installed in a domain. Do not enable user mapping in a workgroup environment.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Create users and groups for remote VPN clients

To create users and groups for remote VPN clients

  1. In Computer Management, click Local Users and Groups, right-click Groups, and then select New Group.
  2. In New Group, type a name for the group, and then click Create.
  3. Click Users. For each user that you want to have remote VPN access, perform the following actions:
    1. Double-click the user to display its properties.
    2. On the Member Of tab, click Add.
    3. In Enter the object names to select, type the name of the group, and then click OK.
    4. On the Dial-in tab, select Control access through Remote Access Policy, and then click OK.

Note

  • Only users with the dial-in properties configured can use ISA Server for remote VPN client access.

Get latest ISA Server content at ISA Server Guidance.


Enable Quarantine Control

To enable Quarantine Control

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, select the Networks tab, and then select the Quarantined VPN Clients network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Quarantine tab, select Enable Quarantine Control.
  5. Select one of the following options:
    • Quarantine according to RADIUS server policies. When a VPN client attempts to connect, Routing and Remote Access policy determines whether the connection request is passed to ISA Server. After Routing and Remote Access policy has been verified, the client unconditionally joins the VPN Clients network.
    • Quarantine VPN clients according to ISA Server policies. When a VPN client attempts to connect to the ISA Server computer, Routing and Remote Access unconditionally passes the request to ISA Server. ISA Server places the connecting client in the Quarantined VPN Clients network, subjecting the client to the firewall policy defined for that network. When the client clears quarantine, it moves into the VPN Clients network. When you select this option, you must disable the Routing and Remote Access quarantine feature so that the VPN connection can be established.
  6. If quarantined clients should be disconnected after a specified time, select Disconnect quarantine users after (seconds) and type the number of seconds that will pass before a client will be removed from the Quarantined VPN Clients network and disconnected from ISA Server.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select this option, you must configure Quarantine Control on the ISA Server computer and on the remote VPN clients attempting to connect. Otherwise, remote VPN clients will remain in quarantine mode until the specified time passes and they are disconnected from ISA Server.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Exempt users from Quarantine Control

To exempt users from Quarantine Control

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, select the Networks tab, and then select the Quarantined VPN Clients network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Quarantine tab, select Enable Quarantine Control.
  5. Click Add.
  6. In Available User Sets, select which users should be exempted from Quarantine Control.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you enable Quarantine Control, you must configure Quarantine Control on the ISA Server computer and on the remote VPN clients attempting to connect. Otherwise, remote VPN clients will remain in quarantine mode until the specified time passes and they are disconnected from ISA Server.
  • Users exempted from Quarantine Control automatically become members of the VPN Clients network.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Monitor VPN clients

To monitor VPN clients

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the VPN Clients tab.
  3. On the Tasks tab, click Monitor VPN Clients.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The Sessions viewer displays data for VPN clients connecting to this array.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Site-to-Site VPN Connections

This section provides steps for configuring site-to-site virtual private network (VPN) connections.

  • Add a remote site network
  • Configure tunneling protocol for a remote site network
  • Configure remote tunnel endpoint
  • Configure local tunnel endpoint
  • Assign a connection owner
  • Configure addresses for a remote site network
  • Configure additional tunnel endpoints for the remote site
  • Allow ISA Server to initiate connections to the remote VPN gateway
  • Configure VPN authentication methods for site-to-site connections initiated by ISA Server
  • Disable a remote site network
  • Monitor remote site network sessions
  • Configure PPTP and L2TP Networks
  • Configure IPsec Networks


Add a remote site network

To add a remote site network

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the Remote Sites tab.
  3. On the Tasks tab, click Add Remote Site Network.
  4. In the wizard, follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you create a remote site network that uses the Internet Protocol security (IPsec) tunneling protocol, the Microsoft Firewall service modifies the IPsec filters on the computer, when restarting the Firewall service. This process can take up to several minutes, depending on the number of subnets included in the address ranges for the network. To minimize the effect, we recommend that you define IP address ranges that are aligned in subnet boundaries.
  • If you stop or restart the IPsec PolicyAgent service, all dynamic IPsec configuration information is lost, including ISA Server VPN site-to-site IPsec configuration settings, and VPN clients are disconnected. To restore settings, start the PolicyAgent service or restart the Firewall service.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure tunneling protocol for a remote site network

To configure tunneling protocol for a remote site network

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the Remote Sites tab, and then select the applicable remote network.
  3. On the Tasks tab, click Configure Remote Site.
  4. On the Protocol tab, select one of the following:
    • L2TP/IPsec. To enable Layer Two Tunneling Protocol (L2TP) over Internet Protocol security (IPsec) authentication and encryption protocol to pass through the ISA Server computer.
      If you select this option, you can optionally select Use preshared key IPsec authentication instead of certificate authentication, and type a preshared key that will be used for secondary authentication. This preshared key must be configured on each client that will connect using this policy.
    • PPTP. To enable Point-to-Point Tunneling Protocol (PPTP) to pass through the ISA Server computer. PPTP is a tunneling protocol used to manage tunnels and encapsulate data.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • This task can be performed only on PPTP and L2TP networks. To specify IPsec tunnel mode tunneling protocol, you must create a new remote network.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure remote tunnel endpoint

To configure remote tunnel endpoint

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable remote network.
  4. On the Tasks tab, select Configure Remote Site.
  5. On the Connection tab:
    • For IPsec networks, in Enter the remote tunnel endpoint, type the IP address.
    • For PPTP and L2TP networks, in Remote gateway name or IP address, type the name or IP address of the remote VPN gateway.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The user name you specify here must be configured on the remote VPN gateway.
  • When the remote site network to which you are connecting is an array with Network Load Balancing (NLB) enabled, the address you specify for the remote tunnel endpoint must be the virtual IP address of the NLB-enabled array.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure local tunnel endpoint

To configure local tunnel endpoint

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable remote IPsec network.
  4. On the Tasks tab, select Configure Remote Site.
  5. On the Connection tab:
    • For IPsec networks, in Enter the local tunnel endpoint, type the IP address of the local VPN gateway.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If Network Load Balancing (NLB) is enabled on the network adapter used to connect to the remote site, use its virtual IP address as the local tunnel endpoint.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Assign a connection owner

To assign a connection owner

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable remote network.
  4. On the Tasks tab, click Configure Remote Site.
  5. On the Server tab, in the Select connection owner drop-down list box, select the connection owner.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If Network Load Balancing (NLB) is enabled for the array, you do not need to specify a connection owner. It will be assigned automatically, regardless of the connection owner specified on this page.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure addresses for a remote site network

To configure addresses for a remote site network

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the Remote Sites tab, and then select the applicable remote site network.
  3. On the Tasks tab, click Configure Remote Site.
  4. On the Addresses tab, click Add Range.
  5. Type the first address of the network address range in Start address.
  6. Type the last address of the network address range in End address.
  7. To add an enterprise network, click Add Network.
  8. Select the applicable enterprise networks.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you create a remote site network that uses the Internet Protocol security (IPsec) tunneling protocol, the Microsoft Firewall service modifies the IPsec filters on the computer, when restarting the Firewall service. This process can take up to several minutes, depending on the number of subnets included in the address ranges for the network. To minimize the effect, we recommend that you define IP address ranges that are aligned in subnet boundaries.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure additional tunnel endpoints for the remote site

To configure additional tunnel endpoints for the remote site

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable remote network.
  4. On the Tasks tab, select Configure Remote Site.
  5. On the Remote NLB tab, click Add Range.
  6. In Start address, type the first address in the range and in End address, type the last address in the range.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If the remote gateway is an array with Network Load Balancing (NLB) enabled, you must specify all the dedicated IP addresses here. Do not specify the virtual IP address.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Allow ISA Server to initiate connections to the remote VPN gateway

To allow ISA Server to initiate connections to the remote VPN gateway

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable remote network.
  4. On the Tasks tab, select Configure Remote Site.
  5. On the Connection tab, in Remote VPN gateway name or IP address, type the name or IP address of the remote VPN gateway.
  6. Click Local site can initiate connections to remote site. Then, in User Name, Domain, Password, and Confirm Password, type a user name that ISA Server can use to initiate connections.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The user name you specify here must be configured on the remote VPN gateway.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure VPN authentication methods for site-to-site connections initiated by ISA Server

To configure VPN authentication methods for site-to-site connections initiated by ISA Server

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, double-click the applicable remote network.
  4. On the Authentication tab, select the appropriate option for the authentication protocols that the remote VPN gateway will use to authenticate connections initiated by ISA Server.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Disable a remote site network

To disable a remote site network

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the Remote Sites tab, and then select the applicable remote site network.
  3. On the Tasks tab, click Disable Remote Site.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Monitor remote site network sessions

To monitor remote site network sessions

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the Remote Sites tab, and then click the applicable remote site network.
  3. On the Tasks tab, click Monitor Site Sessions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The Sessions tab displays data for the specific network you selected to monitor.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure PPTP and L2TP Networks

This section provides steps for configuring PPTP and L2TP networks.

  • Create a dial-in account for the remote site gateway
  • Terminate inactive VPN connections automatically

Get latest ISA Server content at ISA Server Guidance.


Create a dial-in account for the remote site gateway

To create a dial-in account for the remote site gateway

  1. On the ISA Server computer, click Start, point to Administrative Tools, and then click Computer Management.
  2. In Computer Management, click Computer Management, click System Tools, click Local Users and Groups, and then click Users.
  3. In the details pane, right-click the applicable user and then click Properties.
  4. On the Dial-in tab, under Remote Access Permission (Dial-in or VPN), select Allow access.

Note

  • You only have to create a dial-in account for PPTP and L2TP networks. You do not have to create a dial-in account for IPSec networks.

Related Topics

Get latest ISA Server content at ISA Server Guidance.


Terminate inactive VPN connections automatically

To terminate inactive VPN connections automatically

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, double-click the applicable remote network (PPTP and L2TP networks only).
  4. On the Connection tab, click Terminate inactive connections after. Then, select how long a session can remain inactive before it is terminated.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure IPsec networks

This section provides steps for configuring Internet Protocol security (IPsec) with Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • View IPsec policy
  • Configure advanced IPsec settings for Phase I
  • Configure advanced IPsec settings for Phase II


View IPsec policy

To view IPsec policy

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the Remote Sites tab, and then select the applicable Internet Protocol security (IPsec) remote site network.
  3. On the Tasks tab, click View IPsec Policy.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure advanced IPsec settings for Phase I

To configure advanced IPsec settings for Phase I

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable IPsec remote site network.
  4. On the Tasks tab, click Configure Remote Site.
  5. On the Connection tab, click IPsec Settings.
  6. On the Phase I tab, in Encryption algorithm, select one of the following:
    • DES, to use the DES algorithm and a single 56-bit key.
    • 3DES, to use Triple Data Encryption Standard algorithm, and three unique 56-bit keys. This option offers higher security.
  7. In Integrity algorithm, select one of the following:
    • SHA1, to use a 160-bit key (stronger).
    • MD5, to use a 128-bit key (faster).
  8. In Diffie-Hellman group, select one of the following:
    • Group 1 (768 bit), to generate 768 bits of master key keying material.
    • Group 2 (1024 bit), to generate 1024 bits of master key keying material (stronger security).
    • Group 3 (2048 bit), to generate 2048 bits of master key keying material (strongest security).
  9. In Authenticate and generate a new key every, type the time interval at which the master key should be generated, triggering reauthentication.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you use a stronger group for the Diffie-Hellman settings, the secret key derived from Diffie-Hellman exchange has greater strength. Use Group 2 when required for interoperability with Windows Server 2003, Windows 2000, and Windows XP.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure advanced IPsec settings for Phase II

To configure advanced IPsec settings for Phase II

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the Remote Sites tab, and then select the applicable remote IPsec site network.
  3. On the Tasks tab, click Configure Remote Site.
  4. On the Connection tab, click IPsec Settings.
  5. On the Phase II tab, in Encryption algorithm, select one of the following:
    • 3DES, to use Triple Data Encryption Standard algorithm, and three unique 56-bit keys. This option offers higher security.
    • DES, to use the DES algorithm and a single 56-bit key.
  6. In Integrity algorithm, select one of the following:
    • MD5, to use a 128-bit key (faster).
    • SHA1, to use a 160-bit key (stronger).
  7. Select Generate a new key every to limit the amount of time a key is reused before reauthentication is required. Specify the time limit by typing a value in Kbytes, in seconds, or in both fields.
  8. Select Use Perfect Forward Secrecy (PFS) if master key material should not be used to generate more than one session key. Enabling PFS requires reauthentication and, therefore, may affect performance. Then, in Diffie-Hellman group, select one of the following:
    • Group 1 (768 bit), to generate 768 bits of master key keying material.
    • Group 2 (1024 bit), to generate 1024 bits of master key keying material (stronger security).
    • Group 3 (2048 bit), to generate 2048 bits of master key keying material (strongest security).

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you set a Kbytes or seconds limit for session key settings, whichever interval is reached first will start a new key.
  • When you use a stronger group for the Diffie-Hellman settings, the secret key derived from Diffie-Hellman exchange has greater strength. Use Group 2 when required for interoperability with Windows Server 2003, Windows 2000, and Windows XP.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Common VPN Settings

This section provides steps for configuring common VPN settings.

  • Configure VPN access networks
  • Configure VPN address assignments
  • Configure VPN authentication methods
  • Configure a preshared key for VPN connections
  • Use RADIUS authentication
  • Use RADIUS for accounting

Get latest ISA Server content at ISA Server Guidance.


Configure VPN access networks

To configure VPN access networks

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. In the details pane, click the VPN Clients tab.
  3. On the Tasks tab, click Select Access Networks.
  4. On the Access Networks tab,
    • Select the network to which remote VPN clients should connect, if you are configuring remote VPN client access.
    • Select the network to which the remote site gateway should connect, if you are configuring site-to-site VPN access.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The access networks you configure here are used for both remote VPN client access and for site-to-site network access.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure VPN address assignment

To configure VPN address assignment

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. On the Tasks tab, click Define Address Assignments.
  3. On the Address Assignment tab, select one of the following options:
    • Static address pool. To assign static addresses to the remote VPN gateway or the remote VPN clients.
    • Dynamic Host Configuration Protocol (DHCP). To assign addresses to the remote VPN gateway or the remote VPN clients dynamically.
  4. If you select Static address pool, do the following:
    1. Click Add.
    2. In Select the server, select the array member for which you are defining the static address pool.
    3. In Start address, type the first address in the range of addresses to assign to the VPN clients.
    4. In End address, type the last address in the range of addresses to assign to the VPN clients.
  5. In Use the following network to obtain DHCP, DNS and WINS services, select the network on which the name resolution servers are located.
  6. Click Advanced. Then, do the following:
    1. In Name Resolution, select one of the following:
      • Obtain DNS server addresses using DHCP configuration. If VPN clients should obtain the DNS server by using a DHCP configuration.
      • Use the following DNS server addresses. To provide the static IP address of the DNS server that VPN clients should use for name resolution.
    2. If you select Use the following DNS server addresses, in Primary, type the IP address of a DNS server located on the Internal network that the VPN clients can use to resolve names on the Internal network. In Backup, type the IP address of a DNS server located on the Internal network that the VPN clients can use to resolve names on the Internal network, when the primary DNS server is not available.
    3. Select one of the following:
      • Obtain WINS server addresses using DHCP configuration. If VPN clients should obtain the WINS server by using a DHCP configuration.
      • Use the following WINS server addresses. To provide the static IP address of the WINS server that VPN clients should use for name resolution.
    4. If you select Use the following WINS server addresses, in Primary, type the IP address of a WINS server located on the Internal network that the VPN clients can use to resolve names on the Internal network. In Backup, type the IP address of a WINS server located on the Internal network that the VPN clients can use to resolve names on the Internal network, when the primary DNS server is not available.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Routing and Remote Access users are not supported.
  • If you select Static address pool, for remote site networks, you must create a static address pool on each array member.
  • DHCP cannot be used on arrays with more than one member server.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure VPN authentication methods

To configure VPN authentication methods

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. On the Tasks tab, click Select Authentication Methods.
  3. On the Authentication tab, select the appropriate check boxes for the authentication protocols that ISA Server will use to authenticate remote VPN clients and remote VPN gateways (if configured).

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • For remote networks, the authentication method that you select is the method that will be used when the remote VPN gateway initiates a connection to the ISA Server computer.
  • EAP authenticated users are authenticated by RADIUS servers. Firewall policy rules that apply to users will only be applied to these users if you also configure the user mapping feature.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure a preshared key for VPN connections

To configure a preshared key for VPN connections

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. On the Tasks tab, click Select Authentication Methods.
  3. On the Authentication tab, select Allow custom IPSec policy for L2TP connection if a customer Internet Protocol security (IPSec) policy can be used in a Layer Two Tunneling Protocol (L2TP) VPN connection.
  4. In Pre-shared key, type the preshared key to be used by all connections that use this custom IPSec policy.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • For remote networks, the authentication method that you select is the method that will be used when the remote VPN gateway initiates a connection to the ISA Server computer.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Use RADIUS authentication

To use RADIUS authentication

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. On the Tasks tab, click Specify RADIUS Configuration.
  3. On the RADIUS tab, select Use RADIUS for authentication.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Use RADIUS for accounting

To use RADIUS for accounting

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Virtual Private Networks (VPN)
  2. On the Tasks tab, click Specify RADIUS Configuration.
  3. On the RADIUS tab, select Use RADIUS for accounting (logging).

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Troubleshooting VPN

What problem are you having?

VPN client connections fail sporadically.

Cause: This happens when ISA Server is a domain member and the domain controller has two or more IP addresses in the Internal network.

Solution: Assign only one address to the domain controller.

A remote VPN client cannot connect to ISA Server.

Cause: There are many reasons that a user may not be able to access ISA Server, including:

  • The user account was not configured correctly.
  • The user does not have appropriate access to the ISA Server computer.

Solution: If the cause seems to be incorrect account configuration, try the following:

  • Check that the dial-in privilege is enabled per user, or that the user account belongs to a group that is set in the Remote Access Policy configuration. For more information, see Users for remote VPN client access.
  • Check that the remote VPN client is properly configured with appropriate authentication methods and tunneling protocols. These must match the configuration settings on ISA Server.

See also: Users for remote VPN client access and VPN tunneling protocols.

Traffic originating from the IP address of the remote site gateway is denied (considered IP spoofing).

Cause: In a remote site network scenario that uses Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol (L2TP), the ISA Server computer may not have a default gateway configured. When no default gateway is defined, a static route is not added between ISA Server and the remote site gateway. Because there is no route, traffic from the remote site gateway is perceived as spoofing, and the traffic is denied.

Solution: Add a default gateway. You can specify a dummy default gateway.

ISA Server stops responding after you disconnect an L2TP site-to-site connection.

Cause: When you disconnect a Layer Two Tunneling Protocol (L2TP) VPN site-to-site connection through Routing and Remote Access or ISA Server Management, ISA Server may stop responding.

Solution: Restart the ISA Server computer.

IPsec remote site-to-site connections cannot be established.

Cause: There are many reasons that a remote site-to-site connection cannot be established, including:

  • The Internet Protocol security (IPsec) connection failed.
  • The remote site gateway cannot be reached.
  • The address of the local ISA Server computer is not configured properly on the remote site gateway.
  • The address range for the remote site network is not configured properly—either on the remote site gateway or on ISA Server.
  • The shared key is not configured correctly (if you are using a preshared key).
  • If certificate authentication is being used, the proper certificates are not available.

Solution: Try the following:

  • If the cause seems to be related to improper configuration of the network address changes, check the configuration. For instructions, see Configure addresses for a remote site network.
  • Verify that the certificates are configured properly.
  • If the cause seems to be related to the security audit, check the event viewer for the latest security failures.
  • If the cause seems to be related to authentication negotiation, check if any of the following Internet Key Exchange (IKE) events occurred:
    • Event 541 (success). Recorded when IKE successfully negotiates either a main mode security association (SA) or an IPsec SA. The SA parameters are noted in the text of the event.
    • Event 542 (success). Recorded when IKE successfully deletes an IPsec SA. An IPsec SA might be deleted because the SA lifetime expired, a new SA was generated during quick mode rekey, the IPsec peer sent a delete message, the IPsec policy changed, or the IPsec service was stopped.
    • Event 543 (success). Recorded when IKE successfully deletes a main mode SA. An IKE main mode SA might be deleted because the SA lifetime expired, the IPsec peer sent a delete message, the IPsec policy changed, or the IPsec service was stopped.
    • Event 544 (failure). Recorded when the IKE negotiation is terminated due to a certificate trust failure and subsequent authentication failure. This failure might occur because a valid certificate chain could not be found on the IPsec peer, or the certificate chain that was found could not be sent to a trusted root certification authority (CA).
    • Event 545 (failure). Recorded when the IKE negotiation is terminated due to the validation failure of a computer certificate signature. This event is rare because it indicates that the computer certificate on the IPsec peer has a mismatched RSA type public/private key pair.
    • Event 546 (failure). Recorded when an SA cannot be established due to an invalid IKE proposal from the IPsec peer. This error typically occurs when an IPsec policy is incorrectly configured.
    • Event 547 (failure). Recorded when the IKE negotiation fails. The causes of the failure are noted in the text of the event.

PPTP or L2TP remote site-to-site connections cannot be established.

Cause: There are many reasons that a remote site-to-site connection cannot be established, including:

  • The remote site gateway cannot be reached.
  • The address of the local ISA Server computer is not configured properly on the remote site gateway.
  • The site-to-site connection does not have an appropriately configured user account.
  • For L2TP connections, the preshared key may not match (if you are using a preshared key).
  • If certificate authentication is being used, the proper certificates are not available.


Caching

Microsoft Internet Security and Acceleration (ISA) Server 2004 implements a cache of frequently requested objects to improve network performance. You can configure the cache to ensure that it contains the most frequently used data.

  • Caching: Concepts
  • Caching: How To
  • Troubleshooting caching

Get latest ISA Server content at ISA Server Guidance.


Caching: Concepts

This section provides information about the cache feature of Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Cache overview
  • How caching works
  • Cache configuration
  • Cache rules
  • Content download jobs
  • CARP


Cache overview

ISA Server implements a cache of frequently requested objects to improve network performance. You can configure the cache to ensure that it contains the most frequently used data.

By default, when you install ISA Server, caching is effectively disabled. This is because no space on any disk drive on the ISA Server computer has been specified to be used for caching. When you configure a drive for caching, by specifying how much space to use on the drive, you effectively enable caching. You can further configure the cache, specifying which content can be cached.

With caching enabled, you can configure cache rules, which determine whether content from specified sites should be stored or retrieved from the ISA Server cache. A cache rule applies to requested sites, regardless of the source network.

Also, when caching is enabled, you can configure content download jobs. With content download jobs, ISA Server can be configured to download content automatically, at a specified time. In this way, network performance can be improved, as ISA Server can be configured to access frequently requested content during off-peak hours.

Using caching

ISA Server can be deployed as a forward caching server that provides clients with faster access to requested content. ISA Server maintains a centralized cache of frequently requested objects that can be accessed by any Web browser client. Objects served from the disk cache require significantly less processing than objects served from another network. This improves client browser performance, decreases user response time, and reduces bandwidth consumption on your Internet connection.

In the following figure, clients on the Internal network request objects from servers on the External network. The figure illustrates how ISA Server responds when a user requests an object.

How caching works

The figure also illustrates how users benefit when ISA Server caches objects. Although the figure focuses on a forward caching scenario, the process is identical for reverse caching, when Internet users access a corporate Web server. The figure illustrates these steps:

  1. The first user (Client 1) requests a Web object.
  2. ISA Server checks whether the object is in the cache. Because the object is not in the ISA Server cache, ISA Server requests the object from the server on the Internet.
  3. The server on the Internet returns the object to the ISA Server computer.
  4. ISA Server retains a copy of the object in its cache, and returns the object to Client 1.
  5. Client 2 requests the same object.
  6. ISA Server returns the object from its cache, rather than obtaining it from the Internet.

ISA Server can be deployed in front of an organization's Web server that is hosting a commercial Web business or providing access to business partners. With incoming Web requests, ISA Server can impersonate a Web server to the outside world, fulfilling client requests for Web content from its cache. ISA Server forwards requests to the Web server only when the requests cannot be served from its cache.

Get latest ISA Server content at ISA Server Guidance.


How caching works

ISA Server maintains a cache of Web objects and attempts to fulfill Web requests from the cache. If the request cannot be fulfilled from the cache, the ISA Server computer initiates a new request on behalf of the client. Once the remote Web server responds to the ISA Server computer, the ISA Server computer caches the response to the original client request and sends a response to the client.

ISA Server supports forward caching, used for outgoing requests, and reverse_caching, used for incoming requests. Clients in both forward caching and reverse caching benefit from the full gamut of ISA Server caching features. For more information, see Cache overview.

ISA Server includes a Web Proxy filter, which handles the caching functionality. For any specific network, if Firewall Client support is enabled, or if ISA Server is configured as the default gateway for SecureNAT clients, the Web Proxy filter caches objects requested by Firewall and SecureNAT clients.

ISA Server determines whether to retrieve the object from its cache or from another server by examining cache properties and cache rules that you have configured. ISA Server analyzes cache configuration, cache rules, and existing cache content to determine whether an object should be retrieved from the cache.

If the user request is allowed, ISA Server tries to return a response from the cache:

  1. ISA Server checks whether HTTP caching is enabled for the requested destination. If it is not enabled, ISA Server checks the Web chaining rules, to determine how to route the request.
  2. If HTTP caching is enabled, ISA Server looks for the requested object in the cache. If a valid object exists in the cache, ISA Server retrieves it from the cache and returns it to the user.
    The object is considered invalid, if the expiration time specified for the object or in the client request directives has passed.
  3. If the Web chaining rule is configured to route the request, ISA Server determines whether to route the request to the upstream server or to the requested Web server.
  4. If a Web chaining rule is configured to route the request to the Web server, ISA Server sends the request to the Web server.
  5. If the Web server is not accessible, ISA Server checks whether you configured the server to return expired objects from the cache. If you instructed the server to return the expired object as long as the specific expiration time did not pass, the object is returned from the cache to the user.
  6. If the Web server is available, ISA Server determines whether the object can be cached, and whether you configured the applicable cache rule's properties to cache the response. If so, ISA Server caches the object and returns it to the user.

For more information on cache rules, see Cache rules. For more information on Web chaining rules, see Web chaining rules.

Get latest ISA Server content at ISA Server Guidance.


Cache configuration

By default, when you install Microsoft Internet Security and Acceleration (ISA) Server 2004, caching is disabled. To enable caching, you must configure space on any cache drive on the ISA Server computer. For instructions, see Enable caching.

You must use a formatted NTFS partition for caching, and the drive must be a local drive. Typically, the best performance is obtained if you use a drive different from the one on which the main ISA Server system and the Microsoft Windows® operating system are installed. We recommend that you format the drive before using it for caching.

If you want to use the ISA Server caching feature, you must install ISA Server on a computer that has at least one partition formatted as an NTFS volume. If your current server disk volume uses FAT partitions, you can convert these partitions to NTFS by using Convert, which is included with Windows. Convert does not overwrite the data on the disk. For more information about using Convert, type convert /? at a command prompt.

For each server, you can configure the size and location of the cache used by ISA Server. We recommend that you allocate a large cache, because objects are dropped from the cache when it reaches its capacity. For instructions, see Configure cache size.

Cache content files

When you configure a drive for caching, ISA Server creates a cache content file on that drive with the .cdat extension. The file, named Dir1.cdat, is created in the drive:\urlcache folder.

When objects are cached, ISA Server appends them to the cache content file. If the cache content file is too full to hold a new object, ISA Server removes older objects from the cache, by using a formula that evaluates age, how often the object is accessed, and size.

Configuring which content to cache

You can configure whether ISA Server should cache the following types of Hypertext Transfer Protocol (HTTP) objects:

  • Objects whose last modification date is not specified.
  • Objects that do not have a 200 response.

You can also configure the maximum size of objects in the memory cache.

For instructions, see Configure which content to cache, Configure maximum size of objects in the cache, and Configure negative caching.

When the Time to Live (TTL) for an object passes, that object is considered expired. You can configure whether expired content should be returned from the cache, if the requested Web site is not available. For instructions, see Configure whether to return expired objects from the cache.

Important

  • If a Web site does not have appropriately configured cache control directives for content that should not be cached, ISA Server may return user content to a malicious user.

RAM caching

ISA Server caches objects to random access memory (RAM) and to the disk. Objects cached to memory can be retrieved faster than objects cached to the disk. By default, 10 percent of the RAM is used for caching objects. All additional objects are cached only to the disk. For instructions, see Configure the percentage of available memory to use for caching.

Headers

ISA Server does not cache responses to requests that contain the following HTTP response headers:

  • cache-control: no-cache
  • cache-control: private
  • pragma: no-cache
  • www-authenticate
  • set-cookie

In addition, the ISA Server computer does not cache responses to requests that contain the following HTTP request headers:

  • authorization, unless the origin server explicitly allowed this by including 'cache-control: public' header in the response
  • cache-control: no-store


Cache rules

Cache rules let you specify the types of content stored in the cache and how objects are served from the cache. Depending on your organization's needs, cache rules can be applied to content from all sites or to specified sites (destination sets), and to all content groups or limited to specified content types. In addition, you can limit the amount of time that objects are considered valid, and the way cache rules handle expired objects.

For instructions, see Create a cache rule.

Configuring cache storage

On a per-rule basis, you can configure which objects are stored in the cache. For any destination, you can specify whether content will be cached, and which types of content will be cached:

  • Dynamic content. Specifies that Microsoft Internet Security and Acceleration (ISA) Server 2004 will cache retrieved objects even if they are marked as not cacheable.
  • Content for offline browsing. Specifies that ISA Server will serve all the requests from the content in the cache, therefore requiring that even not cacheable content (with 302 and 307 response codes) are stored in the cache.
  • Content requiring user authentication for retrieval. Specifies that ISA Server will cache content that may require authentication to be accessed.
  • Maximum object size. Specifies maximum size of objects that ISA Server will cache. For instructions, see Limit size of objects cached for a cache rule.

Retrieving objects from the cache

As part of the cache rules configuration, you can define how objects in the cache are retrieved and served from the cache.

Before ISA Server serves an object from the cache, it checks whether a valid copy of the object exists in the cache. An object is considered valid if its Time to Live (TTL) did not expire, as specified in the Hypertext Transfer Protocol (HTTP) or File Transfer Protocol (FTP) caching properties, or in the object itself. Depending on how you configure the rule's cache properties, ISA Server will retrieve the object from the cache. You can configure ISA Server to do one of the following:

  • Retrieve an object from the cache only if the object is still valid. If an object is not valid, the request is routed to the server and retrieved.
  • Retrieve an object from the cache regardless of whether the object is still valid. If the object is not found in the cache, the request is routed to the server. This option can work together with requests generated by scheduled content download jobs.
  • Never route the request. If no version of the object is found in the cache, an error page is returned.

You can also configure the cache rule so that the requested object is never saved to the cache.

Caching HTTP and FTP content

For a specified destination, you can configure whether to cache HTTP content and FTP content. If HTTP content is cached, you can also configure expiration policy for the HTTP objects. Similarly, you can configure expiration policy for FTP objects.

With cache rules configuration, you can define whether caching will be enabled for HTTP, FTP, and Secure Sockets Layer (SSL) responses. You can also configure the cache rule to limit cached content according to file size.

HTTP object caching

Cached HTTP objects expire according to TTL settings. For HTTP objects, expiration is configured based on the TTL defined in the response header, and the TTL boundaries defined in the cache rule. TTL boundaries are calculated as a percentage of content age, which is the amount of time since an object was created or modified. HTTP objects expire according to the TTL defined for HTTP objects in the cache rule. For instructions, see Configure HTTP caching for a cache rule.

FTP object caching

You can configure how FTP objects are maintained in the ISA Server cache. For FTP objects, you can configure the TTL period for all objects.

By default, the TTL for all FTP objects is set to one day.

For configuration instructions, see Configure FTP caching for a cache rule.

SSL object caching

You can configure whether SSL objects are maintained in the ISA Server cache. For configuration instructions, see Configure SSL caching for a cache rule.

Rule order

Cache rules are ordered, with the default cache rule processed last. For each new connection, the ISA Server computer processes the cache rules in order (that is, the first rule is processed first). If the request matches the conditions specified by the rule, the request is cached accordingly. Otherwise, the next rule is processed. This continues until the last rule, the default rule, is processed, and applied to the request.

Default cache rule

When you install ISA Server, it configures a default cache rule. The default rule is initially configured so that only valid requested objects will be retrieved from the ISA Server cache. If the object in the cache is not valid, it will be retrieved directly from the Internet.

You cannot modify how the default cache rule retrieves objects.

web link Get latest ISA Server content at ISA Server Guidance.


Content download jobs

Using the cache content download job feature of Microsoft Internet Security and Acceleration (ISA) Server 2004, you can schedule content download from the Internet directly to the ISA Server cache. A background process downloads the content according to a predefined schedule.

Cache content download jobs allow you to update the ISA Server cache with Hypertext Transfer Protocol (HTTP) contents that may soon be requested by Web Proxy clients. Scheduled cache content download can save valuable network bandwidth and improve the overall cache performance without affecting throughput.

For ISA Server to download content as specified in the content download job, the Scheduled Download Jobs system policy configuration group must be enabled. For instructions, see Enable system policy configuration group. Note that when you enable this system policy configuration group, ISA Server blocks unauthenticated HTTP traffic from the ISA Server computer. This is true even if some other policy rule allows the traffic.

If you want to allow such traffic, instead of enabling the system policy configuration group, you could create an access rule that allows the HTTP access to All Networks, which is required to effectively run content download jobs. Additionally, add a higher-ordered access rule that allows unauthenticated HTTP access from the Local Host network.

The routing configuration specified in Web chaining rules always takes precedence over the routing configuration specified in content download jobs. Even if the content download job specifies not to route the request, and even if the object exists in the cache, the request will be routed if a Web chaining rule specifies to route the request. For more information about Web chaining rules, see Web chaining rules.

For instructions, see Create a scheduled cache content download job.

Note

  • If the cache content download job fails, an event is logged to the Windows event viewer.

Automating cache content download

ISA Server extends caching performance with customized cache download. By monitoring and analyzing Internet access, you can determine which HTTP content will be needed and when. You can then use the scheduled cache content download feature to download the HTTP content directly to the ISA Server cache, upon request or as scheduled. This enables you to update the ISA Server cache with HTTP content that you anticipate will be requested by clients in your organization. This content will be available for access directly from the ISA Server cache, rather than from the Internet.

You can download a single Uniform Resource Locator (URL), multiple URLs, or an entire Web site. When you create a scheduled cache content download job, you can limit which content will be downloaded. For example, you can limit the download to a single domain. Similarly, you can limit how many links to follow.

When you schedule cache content download, you can configure dynamic content to be cached by configuring the ISA Server cache to store the objects, even if the HTTP cache control headers indicate that they are not necessarily cacheable. For instructions, see Configure a location from which to download cache content.

Warning

  • If the Web server from which the object is being downloaded requires client authentication, the scheduled content download job will fail.

The download occurs according to a preconfigured schedule. You can also specify if the schedule will recur periodically. For instructions, see Configure a cache content download job schedule.


CARP

This section describes the Cache Array Routing Protocol (CARP).

  • CARP Overview
  • How CARP works
  • CARP deployment
  • Configuring CARP
  • CARP and scheduled content download jobs

web link Get latest ISA Server content at ISA Server Guidance.


CARP Overview

Microsoft Internet Security and Acceleration (ISA) Server 2004 uses the Cache Array Routing Protocol (CARP) to provide seamless scaling and efficiency when using multiple ISA Server computers that are arrayed as a single logical cache. CARP allows arrays of ISA Server computers to efficiently balance Web-based client load and split cached content between them. CARP provides client computers with the information and algorithms required to identify the best server in the array to serve their request, thus eliminating the need for array members to forward requests between them. CARP also supports array server selection by the servers themselves and chained proxies.

CARP uses hash-based routing to determine the best path through an array to resolve a request. The request resolution path is based upon a hash of array member identities and Uniform Resource Locators (URLs). For any given URL request, the browser or downstream proxy server will know exactly where in the array the information will be stored, whether it is already cached from a previous request, or find it on the Internet for delivery and cache it for the first time.

CARP provides powerful benefits:

  • Because CARP determines the best request resolution path, there is no query messaging between proxy servers, as is found with conventional Internet Cache Protocol (ICP) networks. By doing this, CARP avoids the heavier query congestion that normally occurs with a greater number of servers.
  • CARP eliminates the duplication of content that otherwise occurs on an array of proxy servers. With an ICP network, an array of five proxy servers can rapidly evolve into duplicate caches of the most frequently requested URLs. The hash-based routing of CARP keeps this from happening by allowing all five ISA Server computers to exist as a single logical cache. The result is a faster response to queries and a far more efficient use of server resources.
  • CARP has positive scalability. Due to its hash-based routing and—as a result—its independence from peer-to-peer pinging, CARP becomes faster and more efficient as more proxy servers are added. ICP arrays, which must conduct queries to determine the location of cached information, is an inefficient process that generates extraneous network traffic. ICP arrays have negative scalability: the more servers added to the array, the more querying required between servers to determine location.
  • CARP automatically adjusts to additions or deletions of servers in the array. The hash-based routing means that, when a server is either taken offline or added, only minimal reassignment of URL caches is required.
  • CARP ensures that the cache objects are either distributed evenly among all servers in the array or by the load factor that you configure for each server.


How CARP works

The Cache Array Routing Protocol (CARP) process provides efficient routing for requests, on the client side and on the server side.

Client-side CARP

Client-side CARP works by having the client select an array member to serve each individual Uniform Resource Locator (URL). On the client side, Microsoft Internet Security and Acceleration (ISA) Server 2004 processes the CARP algorithm as follows:

  1. Client browsers select an array to use by means of a script, generated by ISA Server in response to automatic discovery and specific queries (for Wpad.dat and Array.dll?Get.Routing.Script), and retrieved from the array.
  2. When a user types a URL into a Web browser, the URL is handed off to the script, which computes a prioritized list of array servers that will serve that page.
  3. The browser connects to the first server in the list and requests that it retrieve the page. If the first server does not respond, the next server in the list is contacted, and so on until the object can be retrieved.
  4. The script always returns the same server list for a given URL, ensuring each URL is cached on one array server only.

The script generated by ISA Server implements the CARP algorithm. The script includes information about the configuration and current status of the array. The script ensures that the URL space is divided evenly and in accordance with configurable load factors between the array members.

Server-side CARP

Client browsers select array members to use in a predetermined, circular, or random fashion. When a request reaches an array member, the server runs the CARP algorithm with the requested URL as its argument, and determines the array member that can best serve the request. The request is forwarded to that server.

Server-side CARP is used mostly as a fallback for clients that have not been configured or have been configured incorrectly.

CARP exceptions

Some Web sites require that the same IP address is used for the duration of a session. CARP should not be enabled for these Web sites. You can use the CARP exception feature to specify that these sites should be exempted from CARP, although all other requests on this network are balanced using CARP. For instructions, see Disable CARP for specific Web sites.

Load factor

Because ISA Server computers in an array may have different hardware and may be more powerful than others, you may want to divide the cache load differently. For this reason, you can configure the CARP functions, specifying the load factor for any given server in the array. For instructions, see Configure load factor.

CARP requests

CARP-based requests are forwarded on the intra-array address. For more information about a server's intra-array IP address, see Array communication.

web link Get latest ISA Server content at ISA Server Guidance.


CARP deployment

The following sections describe how CARP works in various deployment scenarios.

CARP and multi-networking

The Microsoft Internet Security and Acceleration (ISA) Server 2004 array provides network-specific scripts to clients on different networks. Each script returns addresses for the array member on the network on which the client is located. For example, the script provided to clients on a network named Net_A will always return addresses of the array member on Net_A.

Web chaining

In a chained scenario, one ISA Server array chains Web requests to another array.

When a user types a URL into a browser located in the chained network, the browser sends the request to the chained server. The chained server consults the list to generate an ordered list of array servers that will serve that page. The chained server connects to the first server in the list and requests it to retrieve the page.

If that server does not respond, the next server in the list is contacted, and so on. The generated ordered server list is always the same for a given URL, ensuring each URL is cached on one array server only. The array provides network-specific lists to clients on different networks. Each list contains array server addresses on the network the client is on. For example, the list provided to chained servers on a network named Net_A always returns server addresses on Net_A.

Publishing

CARP cannot be used in publishing scenarios.

CARP and NLB

Network Load Balancing (NLB) allows for load balancing of all types of network traffic going into the array. Unlike CARP, it is not limited to Web requests.

NLB uses virtual IP addresses that are shared among all array servers. Each array member can pick packets sent to a virtual IP address, according to the NLB algorithm. To send anything to a specific array member, a dedicated, non-virtual IP address must be used as the destination.

CARP does not include the virtual IP address in the script sent to clients or when server-side requests are forwarded to other array members. Instead, the next available dedicated IP address on the network is used.

For more information on NLB, see Network Load Balancing overview.


Configuring CARP

When you enable CARP, the cache drives on all the servers in the array are treated as a single logical cache drive. In this way, cached objects can be efficiently distributed among the member servers.

To enable CARP, you must do the following:

  1. Enable caching on at least one member server. For instructions, see Enable caching.
  2. Enable CARP for the array-level network. CARP will be applied to objects cached for requests on this network. For instructions, see Enable CARP.
  3. (Optional). Configure the load factor for the array members. By default, the load factor on each server is set to 100. You can configure a higher load factor, if you want more objects to be cached to a specific server. Alternatively, configure a lower load factor if fewer objects should be cached to the server.
    For instructions, see Configure load factor.
  4. CARP functionality requires that the network with the intra-array address for this array listens for Web Proxy client requests. For instructions on how to configure this network to listen for Web Proxy client requests, see Listen for Web Proxy client requests.


CARP and scheduled content download jobs

Scheduled content download jobs are affected by the Cache Array Routing Protocol (CARP) settings on the Local Host network. If CARP is enabled on the Local Host network, the scheduled content download job is processed only on one array member. The downloaded content is distributed among the array members, according to the CARP algorithm.

If CARP is disabled on the Local Host network, the scheduled content download job is processed on each array member. The downloaded content is duplicated on every array member.

When CARP is enabled on the Local Host network, we recommend that you also enable CARP on the default Internal network. Otherwise, Microsoft Internet Security and Acceleration (ISA) Server 2004 will not be able to retrieve objects from the cache that were requested by clients on the Internal network, which were cached when scheduled content download jobs were processed.

For instructions, see Enable CARP.


Caching: How To

This section provides instructions for configuring the cache feature of Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Configure General Cache Properties
  • Configure Cache Rules
  • Configure Content Download Jobs
  • Configure CARP

web link Get latest ISA Server content at ISA Server Guidance.


Configure General Cache Properties

This section provides step-by-step instructions on how to configure general caching properties.

  • Enable caching
  • Configure cache size
  • Configure which content to cache
  • Configure maximum size of objects in the cache
  • Configure negative caching
  • Configure whether to return expired objects from the cache
  • Configure the percentage of available memory to use for caching


Enable caching

To enable caching

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Drives tab and select the applicable drive.
  3. On the Tasks tab, click Define Cache Drives (enable caching).
  4. Select one of the drives listed.
  5. In Maximum cache size (MB), type the amount of space on the selected drive to allocate for caching.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Caching is enabled only when the size of at least one cache drive is greater than zero.
  • When the Microsoft Firewall service is stopped, the cache drives are not displayed in ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure cache size

To configure cache size

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Drives tab and select the applicable drive.
  3. On the Tasks tab, click Define Cache Drives (enable caching).
  4. Select one of the drives listed.
  5. In Maximum cache size (MB), type the amount of space on the selected drive to allocate for caching.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Caching is enabled only when the size of at least one cache drive is greater than zero.
  • When the Microsoft Firewall service is stopped, cache drive information is not displayed in ISA Server Management.
  • Although unformatted drives are listed, they cannot be used for caching.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure which content to cache

To configure which content to cache

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules or Content Download Jobs tab.
  3. On the Tasks tab, click Configure Cache Settings.
  4. On the Advanced tab, to cache objects for which a last modification time is not specified, select the Cache objects that have an unspecified last modification time check box.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure maximum size of objects in the cache

To configure maximum size of objects in the cache

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. On the details pane, click the Cache Rules or Content Download Jobs tab.
  3. On the Tasks tab, click Configure Cache Settings.
  4. On the Advanced tab, to limit maximum size of URLs cached in memory, in Maximum size of URL cached in memory (bytes), type the maximum number of bytes in the text box.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure negative caching

To configure negative caching

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules or Content Download Jobs tab.
  3. On the Tasks tab, click Configure Cache Settings.
  4. On the Advanced tab, select the Cache objects even if they do not have an HTTP status code of 200 check box.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure whether to return expired objects from the cache

To configure whether to return expired objects from the cache

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules or Content Download Jobs tab.
  3. On the Tasks tab, click Configure Cache Settings.
  4. On the Advanced tab, select one of the following:
    • Do not return the expired object. If you select this option, an error page will be returned.
    • Return the expired object only if expiration was. Select this option to return an expired version of the object from the ISA Server cache.
  5. If you selected to return the expired object, specify the Time to Live (TTL) limits for the object.
    • In At less than this percentage of original Time to Live, specify the maximum percentage of the TTL. If the expiration time exceeds this limit, the object is not returned.
    • In But no more than, specify the maximum number of minutes since the object expired. If the expiration time exceeds this limit, the object is not returned.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure the percentage of available memory to use for caching

To configure the percentage of available memory to use for caching

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules or Content Download Jobs tab.
  3. On the Tasks tab, click Configure Cache Settings.
  4. On the Advanced tab, in Percentage of free memory to use for caching, type a number between 1 and 100 that specifies the maximum percentage of memory that should be allocated for caching.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Cache Rules

This section provides steps for configuring cache rules.

  • Create a cache rule
  • Configure network entities for a cache rule
  • Configure how Web objects are cached
  • Configure HTTP caching for a cache rule
  • Configure FTP caching for a cache rule
  • Configure SSL caching for a cache rule
  • Limit size of objects cached for a cache rule
  • Disable a cache rule
  • Delete a cache rule

Get latest ISA Server content at ISA Server Guidance.


Create a cache rule

To create a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab.
  3. On the Tasks tab, click Create a Cache Rule.
  4. Follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure network entities for a cache rule

To configure network entities for a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab, and then select the applicable cache rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the To tab, do the following:
    • To apply the rule to specific network entities, click the upper Add button, and then select the network entities to which the rule should be applied.
    • To specify network entities to which the rule should not be applied, click the lower Add button, and then select the network entities to which the rule should not be applied.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The rule will never be applied to network objects in the Exceptions list, even if the network object is also included in the This rule applies to content requested from these destinations list.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure how Web objects are cached

To configure how Web objects are cached

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab, and then select the applicable cache rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Cache Store and Retrieval tab, select one of the following options:
    • If the objects should only be retrieved from the cache if it has not expired, click Only if a valid version of the object exists in cache. If no valid version exists, route the request.
    • If the object should be retrieved from the cache when available and otherwise using the specified route, click If any version of the object exists in cache. If none exists, route the request.
    • If the object should only be retrieved if it is in the cache, click Any version of the requested object. If none exists, drop the request.
  5. In Cache content, select one of the following options:
    • If retrieved objects should not be cached, click Never, no content will ever be cached.
    • If content should be cached only if the source and request headers indicate that the object should be cached, click If source and request headers indicate to cache. Then, select one or more of the following:
      • Dynamic content (if ISA Server will cache retrieved objects even if they are marked as not cacheable)
      • Content for offline browsing (302, 307 responses)
      • Content requiring user authentication for retrieval

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select the If any version of the object exists in cache. If none exists, route the request option, requests generated by scheduled content download jobs can still be retrieved.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure HTTP caching for a cache rule

To configure HTTP caching for a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab, and then select the applicable cache rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the HTTP tab, select the Enable HTTP caching check box.
  5. To specify how long HTTP objects will remain in the cache, expressed as a percentage of the time of the content's existence, type a number in Set TTL of objects.
  6. To specify how long HTTP objects will remain in the cache, expressed as a time, type the minimum and maximum time in No less than and No more than.
  7. To retain objects beyond their expiration time in the cache, but in accordance with the settings you configured, select Also apply these TTL boundaries to sources that specify expiration.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The higher the percentage you specify in Set TTL of objects, the less frequently the cache is updated.
  • When you shorten the Time to Live (TTL) by specifying the Also apply these TTL boundaries to sources that specify expiration option, objects in the cache will be more recent. However, there may be some degradation in network performance, because objects are retrieved frequently from the Internet.
  • To restore the TTL defaults, click Restore Defaults.
  • Even when you disable HTTP caching for all cache rules, ISA Server allocates cache memory. To stop ISA Server from allocating memory, set the cache size to 0.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure FTP caching for a cache rule

To configure FTP caching for a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab and select the applicable cache rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the FTP tab, select the Enable FTP caching check box.
  5. To specify how long the FTP objects should remain in the cache, in Time-to-Live for FTP objects, type a number. Select a time unit from the drop-down list box: Seconds, Minutes, Hours, Days, or Weeks.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To reset FTP expiration policy to equal importance, click Restore Defaults.
  • When you disable FTP caching for all cache rules, ISA Server allocates cache memory. To stop ISA Server from allocating memory, set the cache size to 0.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure SSL caching for a cache rule

To configure SSL caching for a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab, and then select the applicable cache rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Advanced tab, select the Cache SSL responses check box.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Limit size of objects cached for a cache rule

To limit size of objects cached for a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab and select the applicable cache rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Advanced tab, select the Do not cache objects larger than check box.
  5. Type the size and select a unit of measurement from the drop-down list box.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • ISA Server includes the size of the object's headers when calculating the object size.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Disable a cache rule

To disable a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab and select the applicable rule.
  3. On the Tasks tab, click Disable Selected Rules.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To enable a cache rule, on the Tasks tab, click Enable Selected Rules.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Delete a cache rule

To delete a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab and select the applicable rule.
  3. On the Tasks tab, click Delete Selected Rules.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Content Download Jobs

This section provides steps for configuring content download jobs.

  • Create a scheduled cache content download job
  • Configure a cache content download job schedule
  • Configure a location from which to download cache content
  • Limit the number of connections created for a content download job
  • Configure Time to Live for downloaded cache content
  • Configure which content to include in a content download job
  • Run a content download job now
  • Disable a content download job
  • Delete a content download job

Get latest ISA Server content at ISA Server Guidance.


Create a scheduled cache content download job

To create a scheduled cache content download job

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab.
  3. On the Tasks tab, click Schedule a Content Download Job.
  4. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Content download jobs can only run if:
    1. The Local Host network is configured to listen for Web Proxy client requests.
    2. The system policy rules allowing content download are enabled.
    3. The Microsoft ISA Server Job Scheduler service is running.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure a cache content download job schedule

To configure a cache content download job schedule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab, and select a content download job.
  3. On the Tasks tab, click Edit the Selected Job.
  4. On the Schedule tab, in Date and Time, select the date and time when the content should be downloaded from the Internet.
  5. In Download Frequency, do one of the following:
    • To download the content only once at the specified time, click Once.
    • To download the content every day at the specified time, click Daily.
    • To download the content on a specified day at a specified time, click Weekly on and select the check boxes for the days on which to download content.
  6. If you selected Daily or Weekly on, in Daily Frequency, do one of the following:
    • To download the content only once a day, click Run the job one time every day.
    • To download the content several times during the day, click Repeat every, and then type how often to run the job.
    • In Do not start a new run of the job after, type the latest time at which a content download job should begin.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure a location from which to download cache content

To configure a location from which to download cache content

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab, and then select a content download job.
  3. On the Tasks tab, click Edit the Selected Job.
  4. On the Content tab, in Download content from this URL, type the Uniform Resource Locator (URL) from which to download the content.
  5. To download only content from the domain specified in Begin downloading from URL, select the Do not follow link outside the specified URL domain name check box.
  6. To limit the number of links to follow from a single page when downloading content, select the Maximum depth of links per page check box and type the number of links.
  7. To limit the total number of objects to cache, in Maximum number of concurrent TCP connections to create for this job, type the number of connections.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Type the URL using this format: http://widgets.microsoft.com/path.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Limit the number of connections created for a content download job

To limit the number of connections created for a content download job

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab, and then select the applicable content download job.
  3. On the Tasks tab, click Edit the Selected Job.
  4. On the Content tab, in Maximum number of concurrent TCP connections to create for this job, type the maximum number of connections that can be created for this job.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Time to Live for downloaded cache content

To configure Time to Live for downloaded cache content

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab, and select a content download job.
  3. On the Tasks tab, click Edit the Selected Job.
  4. To override the Time to Live (TTL) for an object, click the Cache tab, and then select Override object's TTL.
  5. If the TTL is not defined, to override the TTL for an object, select Set TTL if not defined in response.
  6. To configure a specific TTL for the downloaded objects, type a TTL in Mark downloaded objects with a new TTL (minutes).

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you select Override object's TTL, the TTL will be determined either by the TTL specified or by the TTL specified in the cache configuration properties.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure which content to include in a content download job

To configure which content to include in a content download job

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab, and then select the applicable content download job.
  3. On the Tasks tab, click Edit the Selected Job.
  4. On the Cache tab, in Cache content, select one of the following options:
    • If all content should always be cached, even if the headers in the request or response indicate that the object should not be cached, click All content will be cached.
    • If content should be cached only if the headers in the request or response indicate that the object should be cached, or if the content is dynamic, click If source and request headers indicate to cache, or if content is dynamic, then the content will be cached.
    • If content should be cached only if the headers in the request or response indicate that the object should be cached, click If source and request headers indicate to cache, then the content will be cached.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select All content will be cached, all content is cached, including the redirection responses (301, 302, and 307).
  • When you select If source and request headers indicate to cache, or if content is dynamic, then the content will be cached, even when the headers do not indicate to cache the content—because it is dynamic—the content is cached.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Run a content download job now

To run a content download job now

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab, and then select the applicable content download job.
  3. On the Tasks tab, click Start Selected Jobs Now.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Content download jobs can run only if:
    • The Local Host network is configured to listen for Web Proxy client requests.
    • The system policy rules allowing content download are enabled.
    • The Microsoft ISA Server Job Scheduler service is running.
  • To stop a content download job, on the Tasks tab, click Stop Running Jobs.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Disable a content download job

To disable a content download job

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab and select the applicable job.
  3. On the Tasks tab, click Disable the Selected Jobs.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To enable a content download job, on the Tasks tab, click Enable the Selected Jobs.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Delete a content download job

To delete a content download job

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab and select the applicable job.
  3. On the Tasks tab, click Delete the Selected Jobs.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure CARP

This section provides steps for configuring Cache Array Routing Protocol (CARP).

  • Enable CARP
  • Disable CARP for specific Web sites
  • Configure load factor

web link Get latest ISA Server content at ISA Server Guidance.


Enable CARP

To enable CARP

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the CARP tab, select Enable CARP on this network.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Cache Array Routing Protocol (CARP) is only effective when caching is enabled for the array. Caching is enabled when at least one cache size of at least one cache drive on the array is not set to zero.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Disable CARP for specific Web sites

To disable CARP for specific Web sites

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the CARP tab, select Enable CARP on this network.
  5. Click Add.
  6. From the list, select the domain name set for which Cache Array Routing Protocol (CARP) should be disabled, click Add, and then click Close.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Disable CARP for Web sites that require client IP addresses to remain the same throughout a session.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure load factor

To configure load factor

  1. In the console tree of ISA Server Management, click Servers.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Array_Name
    • Configuration
    • Servers
  2. In the details pane, click the applicable array member.
  3. On the Tasks tab, click Configure Selected Server.
  4. On the CARP tab, in Load factor, type a load factor.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Cache Array Routing Protocol (CARP) is only effective when caching is enabled for the array. Caching is enabled when at least one cache size of at least one cache drive on the array is not set to zero.
  • The load factor is the relative availability of this server for caching.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Troubleshooting caching

What problem are you having?

Not all traffic is saved to the ISA Server cache.

Cause: ISA Server caches only items that meet the caching criteria.

Solution: When clients access objects that can be cached, network performance seems to improve, as the objects are retrieved from the ISA Server cache rather than from the network. However, if your clients are commonly accessing objects that are not cached, you may not perceive improved performance.


Monitoring

This section provides information about the monitoring feature of Internet Security and Acceleration (ISA) Server 2004.

  • Monitoring: Concepts
  • Monitoring: How To
  • Troubleshooting monitoring

Get latest ISA Server content at ISA Server Guidance.


Monitoring: Concepts

This section provides background information about the monitoring feature of Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Dashboard
  • Alerts
  • Sessions
  • Services
  • Configuration status
  • Logs
  • Reports
  • Connectivity
  • Performance monitor


Dashboard

The Dashboard view of ISA Server summarizes monitoring information about sessions, alerts, services, reports, connectivity, and general system health. The default Dashboard view displays the following information:

  • Connectivity. Checks connectivity from ISA Server to other computers or URLs.
  • Alerts. Lists the events that have occurred on the ISA Server computer.
  • Services. Lists the services on the ISA Server computer and the current status.
  • Sessions. Lists the total number of client sessions.
  • Reports. Lists newly created reports.
  • System health. Displays performance information about the ISA Server computer.

In each Dashboard area, there is visual status indication. An X in a red circle indicates a potential problem, a yellow icon indicates a warning, and a check mark in a green circle indicates that everything is okay.

You can customize the Dashboard view to hide information.

For instructions on viewing the Dashboard, see View the Dashboard.

Using the Dashboard to monitor ISA Server status

The Dashboard is useful to quickly identify critical issues related to ISA Server. It can be part of a daily routine, to verify the status of critical servers and services.

For example, you might verify that the ISA Server services are up and that key servers have connectivity. A glance at the Dashboard will show you if everything is running smoothly. After you check the operating status, you can review any alerts, to check if any attacks have been thwarted—or if any specific problem requires your immediate attention.

When you encounter an issue on the Dashboard, you can easily search for more information. Click on the relevant pane header to jump to a tab with more detailed information.

You can acknowledge and reset alert instances in the Dashboard view. For more information about acknowledging and resetting alerts, see Alerts.

Get latest ISA Server content at ISA Server Guidance.


Alerts

The alert service of Microsoft Internet Security and Acceleration (ISA) Server 2004 notifies you when specified events occur. You can configure alert definitions to trigger a series of actions when an event occurs. The ISA Server alert service acts as a dispatcher and as an event filter. It is responsible for catching events, checking whether certain conditions are met, and taking corresponding actions.

ISA Server Management displays the full list of events that have occurred, categorized by alert type: information, warning, and error.

All alerts are displayed in the Alerts view.

Acknowledging and resetting alerts

When an event occurs, ISA Server triggers the action configured in the alert definition. The alert is displayed in the Alerts view, and a summary of all the events are listed in the Dashboard view.

You can reset an entire group of alert instances, by selecting the alert header. In the Alerts view, alert instances are grouped together by category (for example, Service shutdown). You can expand or collapse the group headings to display or hide the items they contain.

You can use ISA Server Management to indicate that you are handling a specific event, or a group of events, by acknowledging the events. When you mark an event (or groups of events) as acknowledged, the status for those events is changed in the Alerts view—and those events are no longer displayed on the Dashboard. For instructions, see Acknowledge an alert.

Similarly, you can reset an alert, thereby effectively removing it from the Alerts view. For instructions, see Reset an alert.

Note

  • All alerts are reset when the ISA Server computer restarts.

Triggering numerous alerts

The following alerts may occur numerous times. However, ISA Server triggers events for these alerts only once a second.

Event | Condition
Connection limit exceeded | Any
Intrusion detected | Windows out-of-band attack
Intrusion detected | IP half scan attack
Intrusion detected | Land attack
Intrusion detected | UDP bomb attack
Intrusion detected | Ping of death attack
Intrusion detected | All port scan attack
Intrusion detected | Well-known port scan attack
Invalid DHCP offer | Any
IP spoofing | Any
Oversized UDP packet | Any

Creating alert definitions

When you install ISA Server, an alert is preconfigured for every event type. You can define more specific events. For example, consider the preconfigured alert definition for the Network configuration changed event. As the network administrator, you might want to refine this general alert, creating two unique alert definitions:

  • An alert definition for when a network is disabled.
  • An alert definition for when a network is enabled.

The alert definition for the former would trigger an action to run a batch file to disconnect the computer from a load balancing cluster each time a network becomes disabled. The alert definition for the latter might be to send you an e-mail message.

Note

  • Alerts with specific events take precedence over less-specific events. For example, suppose you have two alerts configured, one for Any network configuration change and the other for Network connected. When a network is connected, the alert actions for the latter will be performed.

For instructions, see Add an alert definition.

Configuring alert definitions

You can select which event and additional condition trigger an alert action.

You can also configure the following thresholds, which determine when the alert action will be performed:

  • How many times per second the event will occur before issuing an alert (also called the event frequency threshold).
  • How many events will occur before the alert is issued.
  • How long to wait before issuing the alert again.

For instructions, see Edit an alert condition.

Alert action

You can set one or more of the following actions to be performed when an alert condition is met:

  • Send an e-mail message.
  • Run a specific action.
  • Log the event in the Windows event log.
  • Stop or start the Microsoft Firewall service or Scheduled Content Download service.

You can configure which credentials will be used when an application is executed. Use the Local Security Policy to configure user privileges.

Note

  • Be sure that the specified user has Logon as batch job privileges.

When the alert action is to execute a command, the path specified for the command action must exist on the ISA Server computer. We recommend that you use environment variables (such as %SystemDrive%) within the path name.

For instructions, see Edit an alert action.

If you configure an e-mail action to use an SMTP server located on the Internal network, you must enable the system policy rule that allows the Local Host network to access the Internal network using SMTP. In the System Policy Editor, in the Remote Monitoring configuration group, select SMTP, and then click Enable. The Allow SMTP protocol from firewall to trusted servers rule is enabled.

If you configure an e-mail action to use an external SMTP server, you must create an access rule that allows the Local Host network to access the External network (or the network on which the SMTP server is located), using SMTP.

Events

The following table lists the events and, where relevant, additional keys that are defined by ISA Server. When you create an alert, you specify one of the following events that triggers the alert.

Event | Description
Access to Configuration Storage server is blocked | As a result of changes made to the configuration, access to the Configuration Storage server is blocked.
Account name resolution failed | The Configuration Agent was unable to resolve the account specified for administration.
Alert action failure | The action associated with this alert failed.
Application filter not registered | The application filter was not registered on this server.
Array-level policy rule was deleted | The enterprise policy does not permit some types of array-level policy rules.
Cache container initialization error | The cache container initialization failed, and the container was ignored.
Cache container recovery complete | The recovery of a single container was completed.
Cache file resize failure | The operation to reduce the size of the cache file failed.
Cache initialization failure | The Web cache proxy was disabled because of global failure.
Cache restoration completed | The cache content restoration was completed.
Cache write error | There was a failure in writing content to the cache.
Cached object discarded | During cache recovery, an object with conflicting information was detected. The object was ignored.
Component load failure | There was a failure to load an extension component.
Configuration Agent removed overlapping ranges | The ISA Server Configuration Agent has removed ranges from the included enterprise network, because they overlap with another array network.
Configuration changes cannot be loaded by ISA Server services | ISA Server failed to load the new configuration. When a new configuration is saved, ISA Server will renew its attempt to apply the changes.
Configuration changes overload | Continuous or excessive changes to the configuration were detected. This may indicate an attack on the Configuration Storage server.
Configuration error | An error occurred while reading configuration information.
Connection limit exceeded | A user or an IP address exceeded its connection limit.
Connection limit for a rule was exceeded | The number of connections per second allowed for a rule was exceeded.
DHCP anti-poisoning intrusion detection disabled | The DHCP anti-poisoning intrusion detection mechanism was disabled.
Dial on demand failure | There was a failure to create a dial-on-demand connection, because there is no answer or the line is busy.
DNS intrusion | A host name overflow, length overflow, or zone transfer attack occurred.
DNS zone transfer intrusion | A zone transfer attack occurred.
Event log failure | There was a failure to log the event information to the system event log. This alert is disabled by default.
Free disk space limit exceeded | Log storage free disk space limit exceeded.
Firewall communication failure | There is a failure in communication between the Firewall client and the ISA Server service.
FTP filter initialization warning | The FTP filter failed to parse the allowed FTP commands. Verify that the commands are stored in the correct format. Each command should be no more than four characters, and each command should be separated from the previous one with a space character.
Intra-array configuration error | The ISA Server intra-array configuration is invalid.
Intrusion detected | An intrusion was attempted by an external user.
Invalid configuration settings | Configuration settings cannot be applied.
Invalid CRL found | Client certificate was revoked due to invalid or missing certificate revocation list (CRL). The CRL may have expired, and ISA Server was unable to download a valid CRL. Verify that the CRL download system policy configuration group is enabled, and that there is connectivity to the CRL distribution points.
Invalid DHCP offer | The DHCP offer IP address is not valid.
Invalid dial-on-demand credentials | Invalid dial-on-demand credentials were detected.
Invalid network adapter configuration | The network adapter is configured with several IP addresses that belong to several networks. This is an illegal configuration.
IP spoofing | The IP packet source address is not valid.
ISA Server cannot connect to the Configuration Storage server | ISA Server cannot connect to the Configuration Storage server. The configuration, currently stored on the local computer, will remain in effect.
ISA Server computer restart is required | Changes made to the configuration will only take effect after restarting the computer.
ISA Server computer switched Configuration Storage servers | ISA Server switched from one Configuration Storage server to the other due to a change in the configuration, connectivity issues, or Configuration Storage server availability.
ISA Server VPN tunnel redistribution is recommended | The virtual private network (VPN) tunnels are not distributed evenly among the ISA Server computers in the array.
Local NLB configuration change | The Microsoft Firewall service identified changes to the local Network Load Balancing (NLB) configuration or state. Changes to the NLB configuration or state are supported only through the ISA Server administrator. Any local changes will be overridden.
Log deletion failure | Log deletion according to configuration failed.
Log failure | One of the service logs failed.
Log storage limits | One or more of the log storage limits was reached.
Logging resumed | One of the services resumed logging following a previous failure.
Misconfigured alert | An alert definition contains an invalid property.
Network configuration changed | A network configuration change that affects ISA Server was detected.
NLB configuration failure | Failed to configure Network Load Balancing to work with ISA Server.
NLB inconsistent configuration detected | Network Load Balancing inconsistency was found on some networks. Traffic might not be routed properly.
NLB is draining and stopping | Network Load Balancing is draining and stopping due to a request by the administrator.
NLB possible reduced load balancing performance | Network Load Balancing performance may be impaired due to a failure to resolve a Web server name.
NLB shutdown - Firewall service not responding | Network Load Balancing on the local computer was stopped because Firewall service has stopped responding.
NLB shutdown - Firewall service stopped | Network Load Balancing on the local computer was stopped because Firewall service was stopped.
NLB started | Network Load Balancing on the local computer was started.
NLB stopped - configuration failure | The Firewall service failed to apply Network Load Balancing configuration. NLB on the local computer will be disabled.
NLB stopped - network adapter problem | There is no suitable network adapter for Network Load Balancing on some networks. NLB on the local computer will be stopped.
NLB stopped - NLB integration is unavailable | Network Load Balancing integration cannot be configured on this server.
NLB stopped - RRAS service not responding | Network Load Balancing on the local computer was stopped because Routing and Remote Access has stopped responding.
NLB stopped - VPN static address pool is empty | Network Load Balancing on the local computer was stopped because the VPN static address pool on this computer is empty.
NLB stopped manually | Network Load Balancing on the local computer was stopped manually by the administrator.
No available ports | Failed to create a network socket because there are no available ports.
No connectivity | ISA Server failed to establish a connection to the requested server.
OS component conflict | There is a conflict with one of the operating system components: IP network address translation (NAT) editor, Internet Connection Sharing (ICS), or Routing and Remote Access.
Oversized UDP packet | ISA Server dropped a User Datagram Protocol (UDP) packet because it exceeded maximum size, as specified in the registry key.
POP intrusion | Detected a Post Office Protocol (POP) buffer overflow.
Propagate configuration change failed | A change to the configuration in the central storage could not be propagated to the ISA Server computer.
Quarantined VPN Clients network changes | A user was removed from Quarantined VPN Clients network. This alert is disabled by default.
Report summary generation failure | Received an error while generating a report summary from log files.
Resource allocation failure | There was a resource allocation failure. For example, the system ran out of memory.
Revert to last known configuration failed | The ISA Server configuration agent was unable to revert to the last known configuration.
Revert to last known configuration succeeded | The ISA Server configuration agent successfully reverted the configuration.
Routing (chaining) failure | ISA Server failed to route the request to an upstream server.
Routing (chaining) recovery | ISA Server resumed routing to an upstream server.
RPC filter - bind failure | RPC filter cannot use the defined port because it is already in use.
RPC filter - connectivity changed | The connectivity to the publishing RPC service <server name> changed. <additional key>.
Server publishing failure | The server publishing rule is configured incorrectly.
Server publishing is not applicable | The server publishing rule cannot be applied.
Server publishing recovery | The server publishing rule can now be applied.
Service initialization failure | There was a service initialization failure.
Service not responding | An ISA Server service terminated or stopped functioning unexpectedly.
Service shutdown | A service stopped properly. <%service name%>
Service started | A service started properly. <%service name%>
Slow connectivity | ISA Server encountered a slow connection to the requested server.
SMTP filter event | A Simple Mail Transfer Protocol (SMTP) command rule was violated.
SOCKS configuration failure | The port specified in SOCKS properties is in use by another protocol.
SYN attack | ISA Server detected a SYN attack.
The Configuration agent has restored its connection with the Configuration Storage server | The Configuration agent has restored its connection with the Configuration Storage server. Changes made during the disconnection time will now be applied to the service.
The configuration was reloaded | The configuration was reloaded. The Configuration agent recovered from the error and successfully reloaded the configuration information.
Total log size limit exceeded | Log storage total size limit was exceeded.
Undefined account for intra-array authentication | For intra-array authentication when array members are in a workgroup, the intra-array account must be defined and enabled. Some features such as VPN, Cache Array Routing Protocol (CARP), and reporting will not work unless the intra-array account is properly configured.
Unregistered event | An unregistered event was raised.
Unresolvable remote gateway address on a VPN network | A remote gateway address specified for a VPN site-to-site network cannot be resolved. As a result, a VPN connection cannot be established to the remote network. In addition, if the network used for the VPN connection from the remote server is enabled for NLB, VPN traffic may be picked up by the wrong array member, and not by the intended server.
Upload new configuration to services failed | The ISA Server configuration agent was unable to upload the configuration to the ISA Server services.
Upstream chaining credentials | The upstream chaining credentials are incorrect.
VPN connection failure | VPN client connection attempt failed.
Web filter not registered | The Web filter was not registered on this server.
Windows NLB is not installed | Network Load Balancing is not installed on this computer. NLB configuration cannot be applied or monitored.
Windows user-based policy in workgroup | The applied policy contains one or more policy rules specifying Windows-based user authentication. The ISA Server array is in a workgroup. Windows-based user authentication cannot be applied to an ISA Server array in a workgroup.


Sessions

Using the Microsoft Internet Security and Acceleration (ISA) Server 2004 real-time monitoring feature, you can centrally monitor ISA Server computer activity. The Sessions view is refreshed automatically, each time a new session is identified by ISA Server. For instructions, see View sessions.

A session is the unique combination of a client's IP address and user name. When ISA Server does not require authentication, all traffic from the same IP address is considered a single session. If a Web browser opens more than one TCP connection to the same IP address, ISA Server considers the connections to be a single session.

ISA Server lists sessions of the following types: Firewall client, SecureNAT, virtual private network (VPN) client, VPN site-to-site, and Web Proxy.

Web Proxy sessions indicate the last minute of Web browser activity, even if the client is not currently browsing.

If a publishing server is currently being published, ISA Server will show it as a Firewall client session. Therefore, some Firewall client sessions may be listed, even if no client is actually connected.

All session details are listed in the Sessions view. A summary of total Firewall client, SecureNAT, and Web Proxy sessions is displayed on the Dashboard. For more information, see Dashboard.

Note

  • When IP routing is disabled, traffic from users and IP addresses is listed in the Sessions view. When IP routing is enabled, only sessions from traffic that passes using an application filter is listed.

Filtering Sessions view

You can filter the Sessions view to focus on specific issues. For example, if a client reports problems connecting, you can filter the Sessions view to display only sessions initiated by that client. The Sessions view displays only data for sessions that match all the expressions included in the filter. The filter expressions are combined using the logical AND operator. For instructions, see Monitor specific sessions.

After you create a query, effectively filtering the Sessions view, you can save it for future use. It is often useful to have a set of queries, with each query used to focus on a different session type. For instructions, see Save a filter definition and Load a filter definition.

Disconnecting sessions

The Sessions view provides a visual indication of any potentially malicious or unwanted session activity. In the Sessions view, you can stop the unwanted session immediately. For instructions, see Disconnect a session.

When you stop a session, all associated connections are also closed.

Note that stopping sessions will not prevent a client from reactivating the session. Instead, you must change the firewall policy configuration, creating a rule that specifically denies access to the unwanted clients. For more information, see How firewall policy works.

Pausing and stopping session monitoring

You can stop session monitoring, essentially clearing the Sessions view on ISA Server. When you stop session monitoring, ISA Server loses all information about any sessions that had been monitored. When you restart session monitoring, ISA Server must collect all information about active sessions.

Alternatively, you can pause monitoring. In this case, sessions displayed in the Sessions view are not removed. However, new sessions are not added to the view. When you resume session monitoring, ISA Server updates the Sessions view with the relevant, new session information.

For instructions, see Pause monitoring sessions and Stop monitoring sessions.


Services

When you install Microsoft® Internet Security and Acceleration (ISA) Server 2004, the following Microsoft Windows® operating system services are also installed:

  • Microsoft Firewall service
  • Microsoft ISA Server Control service
  • Microsoft ISA Server Job Scheduler service
  • ISA Server Storage service
  • Microsoft SQL Server™ 2000 Desktop Engine

You can use the Services view to stop or start the Microsoft Firewall service, Microsoft ISA Server Job Scheduler service, and the Microsoft SQL Server 2000 Desktop Engine service. For instructions, see Start or stop a service.

In addition, the packet filter driver (fweng) is a kernel mode driver that gets all traffic on the firewall and makes the packet filtering and address translation decisions on the network traffic.

Microsoft Firewall service

Microsoft Firewall service (fwsrv) is a Windows service that supports requests from Firewall clients and SecureNAT clients.

You can use ISA Server Management to monitor Microsoft Firewall service status. Similarly, you can use ISA Server Management to stop or start the Firewall service.

The Firewall service supports requests from any Web browser. This allows Web access to nearly every desktop operating system, including Microsoft Windows Server™ 2003, Windows 2000 Server, Windows NT® Server, Windows XP, Windows Millennium Edition, Windows 98, Windows 95, Macintosh, and UNIX. The Firewall service works at the application level on behalf of a client requesting an Internet object that can be retrieved using one of the protocols supported by the Web Proxy protocols: File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), and HTTPS.

Clients—typically browsers—must be specifically configured to use the ISA Server computer. When a user requests a Web site, the browser parses the URL. If a dot-com address is used, as in a fully qualified domain name (FQDN) or IP address, the browser considers the destination to be remote and sends the HTTP request to the ISA Server computer for processing.

When you stop the Firewall service, the information in the cache is not deleted. However, when you restart the service, several seconds may pass before the cache is fully enabled and functional. If the service failed, ISA Server will restore the information in the cache. This will take some time, and performance may not be optimal until the cache is eventually restored.

Microsoft ISA Server Control service

The ISA Server Control service (mspadmin) is a Microsoft Windows service that is responsible for:

  • Restarting other ISA Server services, as necessary.
  • Generating alerts and running actions.
  • Updating the configuration to all array members. The Configuration Agent component of this service is responsible for the update. The ISA Server Control service works together with the ISA Server Storage service to update the configuration.

You cannot use ISA Server Management to stop or start the ISA Server Control service. To stop the service, type the following at a command prompt:

net stop isactrl

If you stop the ISA Server Control service, all other ISA Server services will also be stopped.

Microsoft ISA Server Job Scheduler service

The Microsoft ISA Server Job Scheduler service (w3prefch) is a Microsoft Windows service that downloads cache content from Web servers, according to the jobs you configure using ISA Server Management.

You can use ISA Server Management to monitor the Microsoft ISA Server Job Scheduler service status. Similarly, you can use ISA Server Management to stop or start the Microsoft ISA Server Job Scheduler service.

If this service is stopped, you cannot run scheduled content download jobs.

ISA Server Storage service

The ISA Server Storage service is a Windows service used to manage read and write access to the local ISA Server configuration store, which is registry based, with some file storage. The local configuration is used by the array member. It is periodically updated by the Configuration Agent, from the specified Configuration Storage server.

To stop this service, type the following at a command prompt:

Net stop isastg

When the ISA Server Storage service is stopped, all other ISA Server services are also stopped. If the process is not stopped correctly, the array member will use the last well-known configuration.

ISASTGCTRL service (for ADAM)

The ISASTGCTRL service is a Windows service used to manage read and write access to the Configuration Storage server information. The configuration information is stored in Active Directory Application Mode (ADAM) store.

This service is available only on the Configuration Storage server.

To stop this service, type the following at a command prompt:

Net stop isastgctrl

Network Load Balancing

When you enable Network Load Balancing (NLB) integration, information about how ISA Server configures NLB on each server is displayed in ISA Server Management. You can stop, start, suspend, resume, or drain-and-stop the NLB service for each server in the array. For more information, see NLB configuration.

Remote Access Service

When you enable VPN client access or when you create a PPTP or L2TP remote site network, the Remote Access Service is displayed in ISA Server Management. Like any other ISA Server service, you can use ISA Server Management to start or stop the Remote Access Service. For more information, see Virtual Private Networking.

web link Get latest ISA Server content at ISA Server Guidance.


Configuration status

The configuration status view facilitates the administrator validating that all the arrays have been updated with the configuration information from the Configuration Storage server to which ISA Server Management is connected. The configuration status presents a listing of which Configuration Storage server is being used by each array member and an indication as to the last time the array member was updated.

As an initial troubleshooting tool, the configuration status can be useful in helping you identify problems in your organization. At a glance, you can determine which array members are not fully synced with the configuration information from the Configuration Storage server to which ISA Server Management is connected.

You can configure how often the configuration status is updated by setting the refresh rate to Low, Medium, or High.

Status

Every array member is listed in the configuration status, with an indication of its status. The array member status is one of the following:

  • Synced. This status indicates that the array member's configuration information and the configuration information on the Configuration Storage server are synchronized.
  • Updating. This status indicates that the array member is in the process of updating its configuration from its Configuration Storage server.
  • Not Synced. This status indicates that the array member's configuration information is not updated with the configuration information on the Configuration Storage server to which ISA Server Management is connected.
  • Error. This status indicates that there is a problem.

An error may occur for one of the following reasons:

  • Connectivity problem between the array member and the Configuration Storage server.
  • Connectivity problem between ISA Server Management and the array member.
  • Connectivity problem between ISA Server Management and the Configuration Storage server.
  • Problem loading the configuration.
  • Problem replicating the configuration information.

web link Get latest ISA Server content at ISA Server Guidance.


Logs

By default, when you install Microsoft Internet Security and Acceleration (ISA) Server 2004, logging is enabled for all components. You can disable logging for any component, including Web Proxy, Microsoft Firewall service, or SMTP Message Screener. By default, the log information for Web Proxy and Firewall service logs is saved to a Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) database, which can be displayed in the log viewer. You can configure the log storage, saving the information to a file, an SQL database, or an MSDE 2000 database.

This section provides information about the logging feature of ISA Server 2004.

  • Log storage format
  • Log viewer
  • Microsoft Firewall service log fields
  • Web Proxy log fields
  • SMTP Message Screener log fields
  • SQL database logging

Get latest ISA Server content at ISA Server Guidance.


Log storage format

Microsoft Internet Security and Acceleration (ISA) Server 2004 log information can be viewed in a log viewer, directly from ISA Server Management. In addition, the log information can be stored in one of the following formats:

  • Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) database
  • SQL database
  • File

MSDE 2000 database

When you save log information in MSDE 2000 format, it can be viewed in the log viewer. This provides easy access to online information about network activity. Because you can export the data displayed in the log viewer, you can also save, in a text file, the data displayed in MSDE 2000 format. For instructions, see Configure logging to an MSDE database.

MSDE 2000 logs are limited to 2 gigabytes (GB). When a log exceeds this limit, ISA Server automatically creates a new database. Similarly, a new log is created at the beginning of every day. The log viewer, however, displays all the data as if it were in a single database.

Note

  • If you delete an MSDE 2000 database file without first detaching it from MSDE 2000, the offline log viewer might not run queries as expected. ISA Server supports an automatic clean up of database files, but to delete a file manually, detach it from MSDE 2000 before deletion.

SQL database

You can save log information to an SQL database. This is useful for remote logging. For more information about logging to an SQL database, see SQL database logging.

For instructions, see Configure logging to an SQL database.

The system policy rule named Allow remote logging using NetBIOS to trusted servers must be enabled to log to an SQL database.

File

You can save ISA Server logs to a file, in one of the following formats:

  • World Wide Web Consortium (W3C) format
  • ISA Server format

The SMTP Message Screener log information is saved by default in file format. It cannot be saved to a database.

For instructions, see Configure logging to a file.

Log files are limited to 2 GB. When a file exceeds this limit, ISA Server automatically creates a new file. Similarly, a new log file is created at the beginning of every day.

W3C logs contain both data and directives, describing the version, date, and logged fields. Because the fields are described in the file, unselected fields are not logged. The tab character is used as a delimiter. Date and time are in Coordinated Universal Time (UTC).

ISA Server format contains only data with no directives. All fields are always logged. Unselected fields are logged with a dash, to indicate that they are empty. The comma character is used as a delimiter. The date and time fields are in local time.

Options

By default, the log information for MSDE 2000 logs and log files is stored in the ISALogs folder, under the ISA Server installation folder. You can change the location.

If you specify a relative directory, the log is saved in the ISALogs folder, under the ISA Server installation folder. If you specify an absolute path, the actual log folder may be different on every server.

Important

  • We recommend that you log to NTFS volumes.

You can compress log files to reduce the disk space required. Files are compressed only if stored on NTFS partitions. You may notice a decrease in performance when working with NTFS-compressed files. When you read from (access) a compressed file, Windows automatically decompresses it for you, and when you write to the file, Windows compresses it. This process may decrease your computer's performance.

Log maintenance

ISA Server has a log maintenance feature, which you can configure so that log files do not exceed specific space requirements. When you log to an MSDE 2000 database or to a file, you can configure how long log information should be stored on the local disk, and how much disk space should be allocated for logging. For instructions, see Configure log storage limits and Configure logging to an MSDE database.

ISA Server checks that logs do not exceed the specified limits every ten minutes. This means that for up to a period of ten minutes, logs might exceed the limits.

The log maintenance feature does not apply to the SMTP filter log.

Log failure

Because ISA Server is deployed to secure your network, it is critical that logging information is always available and accurate. You should carefully monitor alerts and verify that their activity is always being logged. Check for alerts that indicate failure to log for a variety of reasons, including disk space, SQL Server connectivity issues, and others.

By default, if ISA Server cannot log activity, the Microsoft Firewall service is stopped. You can change the default behavior by configuring the log failure alert to not stop ISA Server services.

If the ISA Server computer fails, the last log records may be lost.


Log viewer

You can use the Microsoft Internet Security and Acceleration (ISA) Server 2004 log viewer to monitor and analyze traffic and troubleshoot network activity. The log viewer can display log entries as they occur (live). In this case, each time an event is logged, it is displayed in the log viewer.

Filtering the log viewer data

You can filter the data displayed in the log viewer, displaying data that meets specific criteria. The log viewer displays only log data if it matches all the expressions included in the filter. The filter expressions are combined using the logical AND operator.

For example, you may want all log entries currently being logged for a specific IP address. In this case, you would edit the logging filter as follows:

  • Set Client IP to the relevant IP address.
  • Set Log Time to Live.

When you filter the log, you must always select exactly one log record type (Firewall or Web Proxy) and one Log Time. For instructions, see Filter the log viewer data.

Log information can be displayed in the log viewer, regardless of log format. However, the Log Time must be set to Live for all log formats, other than Microsoft SQL Server 2000 Desktop Engine (MSDE 2000). For MSDE 2000 logs, you can filter the Log Time, thereby displaying historic log information. For more information about log formats, see Log storage format.

Notes

  • When you filter the log view, only up to ten thousand results are displayed in the log viewer.
  • Some log information, including IP data, Raw IP header, and Interface, is displayed for traffic that is not allowed for reasons other than a policy rule or application filter. For example, if traffic is dropped because it is considered spoofed, the log information will not be displayed.

Offline log viewer

You can filter the data displayed in the log viewer, to display offline data. To do so, edit the logging filter, setting Log Time to any time. As long as the Log Time is not set to Live, the log viewer displays offline data.

When you display offline data, the log viewer actually queries the database. Offline log viewing can be used only when the log storage format is MSDE 2000.

Log viewer fields

The following table lists how fields for each of the ISA Server log files are displayed in the log viewer. Note that the SMTP Message Screener log information is not displayed in the log viewer.

Firewall | Web Proxy | Description
Action | Not applicable | For a table of possible values, see Action log values.
Not applicable | Authenticated Client | Indicates whether the client has been authenticated with ISA Server. Possible values are Y and N.
Bidirectional | Not applicable | Indicates whether the traffic is send/receive.
Bytes Received | Bytes Received | The number of bytes sent from the destination computer and received by the client during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the destination computer or that no bytes were received from the destination computer.
Bytes Sent | Bytes Sent | The number of bytes sent from the source client to the destination server during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the destination computer or that no bytes were sent to the destination computer.
Not applicable | Cache Info | This number reflects the cache status of the object, which indicates why the object was or was not cached. This field applies only to the Web Proxy log. For a table of possible values, see Cache info log values.
Client Agent Client Agent The client application type sent by the client in the Hypertext Transfer Protocol (HTTP) header.
For Microsoft Firewall service, this field includes information about the client's operating system. For a table of possible values, see Operating system log values.
Client Host Name | Client Host Name | The domain name for the local computer for the current connection. For Web Proxy, a hyphen (-) in this field may indicate that an object was retrieved from the Web Proxy server cache and not from the destination. In the Firewall log, this field is reserved for future use.
Client IP | Client IP | The IP address of the requesting client.
Client Username | Client Username | The account of the user making the request. If ISA Server access control is not being used, ISA Server uses anonymous.
Destination Host IP | Destination Host IP | The network IP address for the remote computer that provides service to the current connection. For Web Proxy, a hyphen (-) in this field may indicate that an object was sourced from the Web Proxy server cache and not from the destination. One exception is negative caching. In that case, this field indicates a destination IP address for which a negative-cached object was returned.
Destination Host Name | Destination Host Name | The domain name for the remote computer that provides service to the current connection. For Web Proxy, a hyphen (-) in this field may indicate that an object was retrieved from the Web Proxy server cache and not from the destination.
Destination Network | Destination Network | The network that provides service to the current connection.
Destination Port | Destination Port | The reserved port number on the remote computer that provides service to the current connection. This is used by the client application initiating the request.
Destination Proxy | Not applicable | The remote computer that provides service to the current connection.
Not applicable | Error Info | Error information
Filter Information | Filter Information | This field includes information that a Web filter can log. For example, when the HTTP filter denies a request, the reason for the denial is stored here.
Not applicable HTTP Method Specifies the application method used. For Web Proxy, common values are GET, PUT, POST, and HEAD.
For Firewall service, common values are CONNECT, BIND, SEND, RECEIVE, GHBN (GetHostByName), and GHBA (GetHostByAddress).
Log Time | Log Time | The time that the logged event occurred.
Not applicable | Object Source | Indicates the source that was used to retrieve the current object. This field applies only to the Web Proxy log. For a table of possible values, see Object source log values.
Not applicable | MIME type | The Multipurpose Internet Mail Extensions (MIME) type for the current object. This field may also contain a hyphen (-) to indicate that this field is not used or that a valid MIME type was not defined or supported by the remote computer. This field applies only to the Web Proxy log.
Network Interface | Not applicable | Primary IP address of the interface that received the traffic.
Original Client IP | Original Client IP | The IP address of the client making the request.
Not applicable Processing Time This indicates the total time, in milliseconds, that is needed by ISA Server to process the current connection. It measures elapsed server time from the time that the server first received the request to the time when final processing occurred on the server—when results were returned to the client and the connection was closed.

For cache requests that were processed through Web Proxy, processing time measures the elapsed server time needed to fully process a client request and return an object from the server cache to the client.
Protocol Protocol Specifies the application protocol used for the connection. Common values are HTTP, File Transfer Protocol (FTP), and Secure Hypertext Transfer Protocol (HTTPS).
For Firewall service, the port number is also logged.
Raw Payload | Not applicable
Not applicable | Referring Server | If ISA Server is used upstream in a chained configuration, this indicates the server name of the downstream server that sent the request.
Result Code | Result Code | This field indicates the status of the request. For a table of possible values, see Result code log values.
Rule | Rule | This reflects the rule that either allowed or denied access to the request.
Not applicable | Server Name | The name of the computer running ISA Server. This is the computer name that is assigned in Microsoft Windows.
Not applicable Service The name of the service that is logged.
  • w3proxy indicates outgoing Web requests.
  • fwsrv indicates Firewall service.
  • w3reverseproxy indicates incoming Web requests.
Source Network | Source Network | The network from which the request originated.
Source Port | Not applicable | The port on which the requesting client makes the request.
Source Proxy | Not applicable | IP address representing the client computer.
Transport | Transport | Specifies the transport protocol used for the connection. Common values are TCP and User Datagram Protocol (UDP).
Not applicable | URL | This field shows the contents of the URL request. This field applies only to the Web Proxy log.


Microsoft Firewall service log fields

You can use the Microsoft Internet Security and Acceleration (ISA) Server 2004 log to monitor and analyze the status of the Microsoft Firewall service.

The following table lists the fields that you can include in each of the ISA Server log files. Note that, in ISA Server log format, if a field is disabled, it will appear in the log with a hyphen (-). In World Wide Web Consortium (W3C) log file format, the field will not appear.

The Field column refers to the position in the ISA Server file format.

You can limit the fields that are saved to the log. For instructions, see Specify fields to log.

Field | Firewall (W3C) | Firewall (MSDE 2000) | Description
1 | computer | servername | The name of the computer running ISA Server. This is the computer name that is assigned in Microsoft Windows.
2 | date | TimeStamp | The date that the logged event occurred, according to the time and date set on the ISA Server computer. In Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) format, this is the time stamp, which includes both the date and the time.
3 | time | Not applicable | The time that the logged event occurred, according to the time and date set on the ISA Server computer. In W3C format, this is in Coordinated Universal Time (UTC).
4 | IP Protocol | Protocol | Specifies the transport protocol used for the connection. Common values are Transmission Control Protocol (TCP) and User Datagram Protocol (UDP).
5 | source | SourceIP | The IP address of the requesting client. The source fields contains IP address and port in all formats except MSDE 2000. In MSDE 2000, the SourceIP and SourcePort fields are split into address and port, to allow you to query each by number.
5 |  | SourcePort | (MSDE 2000 only) For ICMP packet, this field indicates the ICMP type. In MSDE 2000, the SourceIP and SourcePort fields are split into address and port, to allow you to query each by number.
6 | destination | DestinationIP | The network IP address for the remote computer that provides service to the current connection. The Destination field contains IP address and port in all formats except MSDE 2000. In MSDE 2000, the DestinationIP and DestinationPort fields are split into address and port, to allow you to query each by number.
6 |  | DestinationPort | (MSDE 2000 only) For ICMP packets, this field indicates the ICMP code. In MSDE 2000, the DestinationIP and DestinationPort fields are split into address and port, to allow you to query each by number.
7 | original client IP | OriginalClientIP | The IP address of the client making the request.
8 | source network | SourceNetwork | The name of the network from which the request originated.
9 | destination network | DestinationNetwork | The name of the network that provides service for the current request.
10 | action | Action | Specifies the application method used. Common values are CONNECT, BIND, SEND, RECEIVE, GHBN (GetHostByName), and GHBA (GetHostByAddress).
11 | status | resultcode | This field indicates the status of the request. For a table of some possible values, see Result code log values.
12 | rule | rule | This reflects the rule that either allowed or denied access to the request.
13 | application protocol | ApplicationProtocol | Specifies the name of the application protocol, based on the protocol definitions, or Unidentified IP Traffic if the application protocol cannot be determined.
14 | Bidirectional | Bidirectional | Specifies whether the ApplicationProtocol is bidirectional (Send and Receive).
15 | bytes sent | bytessent | The number of bytes sent from the source client to the destination server during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the destination computer or that no bytes were sent to the destination computer.
16 | bytes sent intermediate | bytessentDelta | The number of bytes that have already been sent to the destination computer by the source client during the current connection.
17 | bytes received | bytesrecvd | The number of bytes sent from the destination computer and received by the client during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the destination computer or that no bytes were received from the destination computer.
18 | bytes received intermediate | bytesrecvdDelta | The number of bytes that have already been received by the destination computer from the source client during the current connection.
19 | connection time | connectiontime | The length of the connection, in milliseconds.
20 | connection time intermediate | connectiontimeDelta | The length of the connection so far, in milliseconds.
21 | source proxy | SourceProxy | Reserved for future use.
22 | destination proxy | DestinationProxy | Reserved for future use.
 | Source Name | SourceName | Reserved for future use.
24 | destination name | DestinationName | Reserved for future use.
25 | Username | ClientUserName | The account of the user making the request. If ISA Server access control is not being used, ISA Server uses anonymous.
26 | agent | ClientAgent | For Firewall clients, specifies operating system in this format: <Application_Name>:<OS_Signature>. For SecureNAT clients, this fields is empty.
27 | Session ID | sessionid | This identifies a session's connections. For Firewall clients, each process that connects through the Firewall service initiates a session. For SecureNAT clients, a single session is opened for all the connections that originate from the same IP address.
28 | Connection ID | connectionid | This identifies entries that belong to the same socket. Outbound TCP usually has two entries for each connection: when the connection is established and when the connection is terminated. UDP usually has two entries for each remote address.
29 | Interface | Interface | The primary IP address of the network adapter on which the request was received.
30 | IP header | IPHeader | The IP header of the packet.
31 | protocol payload | Payload | The IP payload of the packet.


Web Proxy log fields

You can use the Microsoft Internet Security and Acceleration (ISA) Server 2004 log to monitor and analyze the status of the Web proxy requests.

The following table lists the fields that you can include in each of the ISA Server log files. Note that, in ISA Server log format, if a field is disabled, it will appear in the log with a hyphen (-). In World Wide Web Consortium (W3C) log file format, the field will not appear.

The Field column refers to the position in the ISA Server file format.

You can limit the fields that are saved to the log. For instructions, see Specify fields to log.

Notes

  • The authentication process for a Web Proxy client may consist of several requests, each of which is logged.
  • In the Web Proxy log, the destination IP address and port number are not logged for denied requests.
Field | Web Proxy (W3C) | Web Proxy (MSDE 2000) | Description
1 | c-ip | ClientIP | The IP address of the requesting client.
2 | cs-username | ClientUserName | The account of the user making the request. If ISA Server access control is not being used, ISA Server uses anonymous.
3 | c-agent | ClientAgent | Indicates the "User-Agent" header specified in client request.
4 | sc-authenticated | ClientAuthenticate | Indicates whether the client has been authenticated with ISA Server. Possible values are Y and N.
5 | date | TimeStamp | The date that the logged event occurred, according to the time and date set on the ISA Server computer. In Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) format, this is the time stamp, which includes both the date and the time.
6 | time | Not applicable | The time that the logged event occurred, according to the time and date set on the ISA Server computer. In W3C format, this is in Coordinated Universal Time (UTC).
7 s-svcname service The name of the service that is logged.
  • w3proxy indicates outgoing Web requests.
  • w3reverseproxy indicates incoming Web requests.
8 | s-computername | servername | The name of the computer running ISA Server. This is the computer name that is assigned in Windows.
9 | cs-referred | referredserver | Reserved for future use.
10 | r-host | DestHost | The domain name for the remote computer that provides service to the current connection. A hyphen (-) in this field may indicate that an object was retrieved from the Web Proxy server cache and not from the destination.
11 | r-ip | DestHostIP | The network IP address for the remote computer that provides service to the current connection. A hyphen (-) in this field may indicate that an object was sourced from the Web Proxy server cache and not from the destination. One exception is negative caching. In that case, this field indicates a destination IP address for which a negative-cached object was returned.
12 | r-port | DestHostPort | The reserved port number on the remote computer that provides service to the current connection. This is used by the client application initiating the request.
13 time-taken processingtime This indicates the total time, in milliseconds, that is needed by ISA Server to process the current connection. It measures elapsed server time from the time that the server first received the request to the time when final processing occurred on the server—when results were returned to the client and the connection was closed.

For cache requests that were processed through Web Proxy, processing time measures the elapsed server time needed to fully process a client request and return an object from the server cache to the client.
14 | cs-bytes | bytesrecvd | The number of bytes sent from the destination computer and received by the client during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the destination computer or that no bytes were received from the destination computer.
15 | sc-bytes | bytessent | The number of bytes sent from the source client to the destination server during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the destination computer or that no bytes were sent to the destination computer.
16 | cs-protocol | protocol | Specifies the application protocol used for the connection. Common values are HTTP, File Transfer Protocol (FTP), and Secure Hypertext Transfer Protocol (HTTPS).
17 | cs-transport | transport | Specifies the transport protocol used for the connection. The value is always TCP.
18 | s-operation | operation | Specifies the application method used. For Web Proxy, common values are GET, PUT, POST, and HEAD.
19 | cs-uri | uri | This field shows the contents of the URL request. This field applies only to the Web Proxy log.
20 | cs-mime-type | mimetype | The Multipurpose Internet Mail Extensions (MIME) type for the current object. This field may also contain a hyphen (-) to indicate that this field is not used or that a valid MIME type was not defined or supported by the remote computer. This field applies only to the Web Proxy log.
21 | s-object-source | objectsource | Indicates the source that was used to retrieve the current object. This field applies only to the Web Proxy log. For a table of the possible values, see Object source log values.
22 | sc-status | resultcode | This field indicates the status of the request. For a table of some possible values, see Result code log values.
23 | s-cache-info | CacheInfo | This number reflects the cache status of the object, which indicates why the object was or was not cached. This field applies only to the Web Proxy log. For a table of the possible values, see Cache info log values.
24 | rule | rule | This reflects the rule that either allowed or denied access to the request.
25 | FilterInfo | FilterInfo | This field includes information that a Web filter can log. For example, when the HTTP filter denies a request, the reason for the denial is stored here.
26 | cs-Network | SrcNetwork | The network from which the request is issued.
27 | sc-Network | DstNetwork | The network to which the request is forwarded.
28 | error-info | ErrorInfo | This field includes additional information about how the request was processed.


SMTP Message Screener log fields

You can use the ISA Server log to monitor and analyze the status of the SMTP Message Screener.

The following table lists the fields that you can include in each of the ISA Server log files. Note that, in ISA Server log format, if a field is disabled, it will appear in the log with a hyphen (-). In World Wide Web Consortium (W3C) log file format, the field will not appear.

The Field column refers to the position in the ISA Server file format.

You can limit the fields that are saved to the log. For instructions, see Specify fields to log.

Field | W3C | Description
1 | date | The date that the logged event occurred.
2 | time | The time that the logged event occurred. In W3C format, this is in Coordinated Universal Time (UTC).
3 | cs-sender | The sender name, as specified in the "MAIL FROM:" SMTP header. Limited to 72 characters.
4 | cs-recipient | The list of recipients, as specified in the "RCPT TO:" SMTP header. Limited to 72 characters.
5 | cs-subject | The message subject. Limited to 72 characters.
6 | cs-messageid | The ID of the message. The ID is either the unique message ID generated by the sender, or the ID automatically assigned by the Windows SMTP service, when it is received. Limited to 72 characters.
7 x-action The action that ISA Server took. One of the following:
  • Delete. The message is deleted.
  • Hold. The message is stored in the BadMail queue.
  • Forward. The message is forwarded to a different recipient (not the recipient specified in the original message).
  • Pass. The message is sent to the specified recipients (in cs-recipient).
8 x-reason The reason ISA Server executed the action (x-action). One of the following:
  • Some message properties could not be read. Taking default action.
    (The default action is Hold).
  • Policy rule stamp could not be found in the message. Taking default action.
    (The default action is Hold). The policy rule stamp is an indication that ISA Server puts in the message to let the Message Screener know which rule should be applied to the message. This is generated if the message did not pass through the SMTP application filter before being passed to the SMTP Message Screener.
  • Logger is not initialized yet. Taking default action.
    (The default action is Hold).
  • Policy rule could not be read. Taking default action.
    (The default action is Hold).
  • Failed while trying to forward the message.
    The specific error code is also listed here.
  • The SMTP Message Screener policy rule does not allow messages from sender.
  • The SMTP Message Screener policy rule does not allow attachment.
  • The SMTP Message Screener policy rule does not allow attachment extension.
  • The SMTP Message Screener policy rule does not allow attachments of specified size.
  • The SMTP Message Screener policy rule does not allow messages with specified subject.
  • The SMTP Message Screener policy rule does not allow messages with specified message body.

Get latest ISA Server content at ISA Server Guidance.


SQL database logging

Saving the log information to an SQL database is useful for remote logging. For instructions on configuring logging for Microsoft® SQL Server™, see Set up SQL Server for ISA Server logging. For maximum security and functionality, we strongly recommend consulting with a SQL Server database administrator to perform this task.

If you select this method, note the following:

  • Microsoft SQL Server with Service Pack 3 (SP3) must be installed. SQL Server SP3 is available on the SQL Server Download Center (http://www.microsoft.com/).
  • We recommend that you configure appropriate security when logging to an SQL database.
  • We recommend that you deploy the computer running SQL Server in a separate network and configure a special firewall policy allowing traffic only between the SQL Server network and Microsoft Internet Security and Acceleration (ISA) Server 2004.
  • We recommend that you use Windows authentication (and not SQL authentication).
  • If you are logging the information to a remote database, we recommend that you configure encryption and data signature for the log information being copied to the remote database.
  • For maximal security, we recommend that you configure Internet Protocol security (IPsec) for the communication between the ISA Server computer and the computer running SQL Server.
  • We recommend that you do not configure the autogrow and autoshrink parameters for the SQL database. Follow the guidelines stipulated at INF: Considerations for Autogrow and Autoshrink Configuration (http://www.microsoft.com/).

By default, ISA Server uses a Secure Sockets Layer (SSL)-encrypted connection to the computer running SQL Server, to help secure the sensitive data in the log files. You can configure whether the connection should be SSL-encrypted. For instructions, see Use data encryption when connecting to an SQL database.

Capacity planning guidelines for SQL logging

The following minimal network connectivity is required between ISA Server and the computer running SQL Server:

  • 100 megabits for up to 3 array members
  • 1 gigabit for 4 and more array members

Attack mitigation

When an attack occurs, many events will be logged to the computer running SQL Server. To continue logging despite the large number of events, follow these guidelines:

  • By default, the log failure alert is configured to stop the Microsoft Firewall service when it is generated. Consider reconfiguring this alert to send an e-mail message to an administrator's e-mail address. Also, use the ISA Server software development kit (SDK) to create a script that does not drop connections for which traffic is not logged. For example, you can use the script located on the Coding Corner (http://www.microsoft.com/). For more information about using these properties, see ISA Server SDK Help, available in the SDK folder of the ISA Server CD.
  • Do not log traffic that is denied by the Default rule. For instructions, see Log requests matching a rule.

web link Get latest ISA Server content at ISA Server Guidance.


Reports

This section provides information about the reporting feature of Internet Security and Acceleration (ISA) Server 2004.

  • Reports overview
  • How the report mechanism works
  • Report viewing and publishing

Get latest ISA Server content at ISA Server Guidance.


Reports overview

You can use the reporting feature of Microsoft Internet Security and Acceleration (ISA) Server 2004 to summarize and analyze communication patterns. Specifically, you can create reports to show you common usage patterns. For example:

  • Who is accessing sites, and which sites are being accessed
  • Which protocols and applications are being used most often
  • General traffic patterns
  • Cache ratio

You can also use reports to monitor the security of your network. For example, you can generate reports that track malicious attempts to access internal resources. Similarly, by tracking the number of connections to a published server, or the traffic to the server, you might identify an attempt at denial of service.

Recurring reports

The ISA Server reporting mechanism enables you to schedule recurring reports, based on the data collected from the log files. You can schedule reports to be generated on a recurring, periodic basis of daily, weekly, monthly, or yearly. The report can include daily, weekly, monthly, or yearly data.

When you schedule a report job, specify the following:

  • Period of activity that the report will cover
  • When and how often the report will be generated

For instructions, see Create a recurring report job.

Creating reports

You can create a suite of reports, as described in Report viewing and publishing. The reports are created by collating information from the log files on each array member, as described in How the report mechanism works.

In a workgroup deployment, you must enable Authenticate using this account on the Intra-array Credentials tab of the array properties page, and specify a user account that is defined on all array members. For instructions, see Specify intra-array credentials.

web link Get latest ISA Server content at ISA Server Guidance.


How the report mechanism works

The Microsoft Internet Security and Acceleration (ISA) Server 2004 reporting mechanism combines the summary logs from ISA Server computers into a database on each ISA Server computer. The database resides in a folder on the ISA Server computer; by default, in the ISASummaries folder. When a report is created, all relevant summary databases are combined into a single report database. The report is created, based on the combined summaries.

ISA Server reports are based on the Web Proxy and Microsoft Firewall service logs. The following table lists the Firewall service log fields and Web Proxy log fields used to generate reports.

Web Proxy log fields | Firewall service log fields
Bytes Received | Action
Bytes Sent | Bytes Received
Client Agent | Bytes Sent
Client IP | Bytes Sent Delta
Client Username | Client Agent
Destination Host Name | Client Username
Destination IP | Client IP
Destination Port | Client Port
HTTP Status code | Destination IP
Log Time | Destination Port
Log Date | Log Date
Object source | Log Time
Processing Time | Original Client IP
Protocol | Processing Time
Transport | Processing Time Delta
URL | Protocol
 | Result Code
 | Transport

At a specific time, the DailySum.exe application, which is installed with ISA Server, summarizes the log information listed previously. DailySum.exe always runs by default on the ISA Server computer, whether you create or schedule reports or not. For instructions on disabling the application, see Disable report summary database generation.

Two log summaries are saved: one with a daily summary and one with a monthly summary. At the beginning of each month, DailySum.exe creates a monthly summary that summarizes all the past month's daily summaries. At least 35 daily summaries are saved, and at least 13 monthly summaries are saved. You can configure how and where ISA Server saves log summaries. For instructions, see Configure the report summary database.

To generate a report, ISA Server runs the ISARepGen.exe application, also installed with ISA Server.

Traffic that is not included in the report

The following traffic is not included in reports generated by ISA Server:

  • Traffic for which the Action field in the log equals Established or Allowed.
  • Proxy authentication queries. This type of traffic is identified in the log as having the LogType field equal to Web Proxy and the destination either ms_proxy_intra_array_auth_query or ms_proxy_auth_query.
  • Establishment and termination of VPN sessions. This type of traffic is identified in the log as having the ClientAgent field equal VPN remote access or VPN remote site.
  • Traffic for which the Object source field in the log equals Member. When Cache Array Routing Protocol (CARP) is configured, each client Web request appears twice in the log. The first request is from the client to the first ISA Server computer. The second request is from the second ISA Server computer to the real Web server.


Report viewing and publishing

You can view a report by double-clicking the report name in ISA Server Management. The report is displayed in Internet Explorer. For instructions, see View a report.

The report can be viewed only on the computer running ISA Server Management. On any other computer, the report shows either empty data, or a page with empty frames and a message that the "Page cannot be displayed."

Note the following about data displayed in the report:

  • Requests are calculated only when the connection is terminated.
  • Bytes are counted for every line in the log.

Publishing reports

To make reports more available, you can publish them to a shared folder. Everyone who needs access to the reports should have Read permissions to this folder. In this way, others can view the reports without accessing the ISA Server computer and not through ISA Server Management. For instructions, see Publish a report.

When a report is published, several report files and the associated graphics are saved to the specified published folder.

Credentials for report publishing

When you publish any report, the IsaRepGen.exe process must have write permissions to the publishing folder. You can configure the credentials that IsaRepGen.exe uses to create reports.

By default, the Local System account is used. Note, however, that if you publish reports to a different computer, the Local System account credentials are actually passed as the (ISA Server) computer account. The computer account must have permissions to write to the network shared folder.

If ISA Server is installed in a Windows NT 4.0 domain or in workgroup mode, IsaRepGen.exe uses the Unauthenticated account. In this case, we recommend that you specify user credentials when publishing reports to another computer.

Report content

You can configure the content to include in any report. The following type of content can be included in a report:

  • Summary. When you include summary content, the report includes summarized information about network traffic usage, sorted by application. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity.
  • Web usage. When you include Web usage content, the report displays information about top Web users, common responses, and browsers. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity. It shows how the Web is being used in a company.
  • Application usage. When you include application usage content, the report illustrates Internet application usage information about top users, client applications, and destinations.
  • Traffic and utilization. When you include traffic and utilization content, the report illustrates total Internet usage by application, protocol, and direction. These reports also show average traffic and peak simultaneous connections, cache hit ratio, errors, and other statistics.
  • Security. When you include security content, the report lists attempts to breach network security.

Get latest ISA Server content at ISA Server Guidance.


Connectivity

Using the Internet Security and Acceleration (ISA) Server connectivity feature, you can verify connectivity by regularly monitoring connections from the ISA Server computer to any specific computer or URL on any network. You can configure which method to use to determine connectivity:

  • Ping. When you configure this method, ISA Server sends an ICMP ECHO_REQUEST to the specified server and waits for an ICMP ECHO_REPLY. Use this method to verify that a server is running and can be reached by ISA Server.
  • TCP connect. When you configure this method, ISA Server tries to establish a TCP connection to a specific port on the specified server. Use this method to verify that a specific service is running on the server and can be reached by ISA Server.
  • HTTP request. When you configure this method, ISA Server sends an HTTP Get request and waits for the reply. Use this method to verify that a Web server is running and can be reached by ISA Server.

You can select which server to monitor, by specifying an IP address, computer name, or URL. For instructions, see Create a connectivity verifier.

When you configure a connectivity verifier for a server, you categorize it into one of the following groups: Active Directory, DHCP, DNS, Published Servers, Web (Internet), and others. Server group status is displayed on the Dashboard view, enabling you to quickly determine if there is a problem with a particular service.

Connectivity is verified by default every thirty seconds. You can change this interval, by using the Refresh rate script, available on the ISA Server Coding Corner (http://www.microsoft.com/). Note that the refresh rate applies to all connectivity verifiers, on all array members.

For example, suppose you publish FTP, SQL, and Exchange servers, and you depend on their regular availability to clients. You can create a connectivity verifier for each server, grouping them all in the Published Servers group. On the Dashboard, you can see a first indication that one of the servers is not functioning properly. On the Connectivity tab, you can determine which specific server is not functioning properly. For instructions, see Configure a connectivity verifier group.

In another scenario, you might want to validate that ISA Server has connectivity to Web sites on the External network. To do this, you might define HTTP connectivity verifiers to three common Web sites, generally known for being available. Group the connectivity verifiers in the Web (Internet) group.

When you create a connectivity verifier that issues an HTTP request to check connectivity, ISA Server enables a system policy rule that allows HTTP and HTTPS traffic from the Local Host to All Networks, named Allow HTTP/HTTPS from firewall to all networks, for HTTP connectivity verifiers. After you disable (or delete) all connectivity verifiers that use HTTP, the system policy rule is disabled. For more information, see System policy overview.

Analyzing HTTP responses

When you configure a connectivity verifier method to send an HTTP request, the monitored server is expected to return an HTTP response. Depending on the response, ISA Server will mark the connectivity verifier status, as detailed in the following table.

HTTP response from monitored server | Connectivity verifier status
1xx, 2xx, or 3xx | OK. This is the response time in milliseconds.
401 (Web server authentication required) | OK. This is not considered an error, because the Web server returned the message.
407 (proxy authentication required) | Error (Windows Server 2003). This is considered an error because connectivity to the actual Web server cannot be determined.
407 (proxy authentication required) | Authentication required (Windows 2000 Server).
4xx (except 401 and 407) or 5xx | Error.
Request timed out | Time-out.
The server name could not be resolved | Unresolved name.
ISA Server is down | Unable to verify. The Microsoft Firewall service is unavailable.


Performance monitor

Performance data can be viewed in a report or in various graph and log formats. A performance log can be useful in monitoring counters over an extended period of time. Performance alerts can be configured to create an event as a result of counters reaching certain values. These events could include a log entry, sending a network message, or running a program. You can view performance data for ISA Server either on the Dashboard or using the ISA Server Performance Monitor, which displays the default counters for ISA Server in the Windows System Monitor. For instructions on viewing the Dashboard, see View the Dashboard. For instructions on using System Monitor, see the Windows Help.

When remotely administering ISA Server, you can view the performance counters by opening the Performance Logs and Alerts snap-in. On computers running Windows 2000, only Administrators of the ISA Server computer can view the performance counters. On computers running Windows Server 2003, all members of the Performance Monitoring Users groups can view the performance counters.

Get latest ISA Server content at ISA Server Guidance.


Monitoring: How To

This section provides specific steps for monitoring Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Refresh the monitoring view
  • Set the refresh rate
  • View the Dashboard
  • View the configuration status
  • Enable auditing of Configuration Storage server permission settings
  • Configure Alerting
  • Configure Session Monitoring
  • Start or stop a service
  • Configure Logging
  • Configure Reports
  • Configure Connectivity Verifiers


Refresh the monitoring view

To refresh the monitoring view

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the tab with the view you want to refresh. The available tabs include Dashboard, Alerts, Services, Configuration Status, Reports, and Connectivity.
  3. On the Tasks tab, click Refresh Now.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you click Refresh Now, only the data on the selected tab is refreshed.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Set the refresh rate

To set the refresh rate

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the tab with the view you want to refresh. The available tabs include Dashboard, Alerts, Services, Configuration Status, Reports, and Connectivity.
  3. On the Tasks tab, in Automatic Refresh Rate, select one of the following: None, Low, Medium, or High.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When the refresh rate is set to Low, the data is refreshed every 120 seconds.
    When the refresh rate is set to Medium, the data is refreshed every 60 seconds.
    When the refresh rate is set to High, the data is refreshed every 30 seconds.
  • The refresh rate does not impact connectivity verifiers. To set the refresh rate for connectivity verifiers, use the Refresh rate script, available on the ISA Server Coding Corner (http://www.microsoft.com/). Note that the refresh rate applies to all connectivity verifiers, on all array members. For more information, see Connectivity.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


View the dashboard

To view the Dashboard

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Dashboard tab.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


View the configuration status

To view the configuration status

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Configuration Status tab.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Enable auditing of Configuration Storage server permission settings

To enable auditing of Configuration Storage server permission settings

  1. On the Configuration Storage server, click Start, point to Administrative Tools, and then click Local Security Policy.
  2. Click Security Settings, click Local Policies, and then click Audit Policy.
  3. In the details pane, right-click Audit directory service access, and then click Properties.
  4. Select Success and Failure.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure alerting

This section provides specific steps for configuring alerts in Internet Security and Acceleration (ISA) Server 2004.

  • Enable an alert definition
  • Add an alert definition
  • Edit an alert definition
  • Edit an alert condition
  • Edit an alert threshold
  • Edit an alert action
  • Acknowledge an alert
  • Reset an alert

Get latest ISA Server content at ISA Server Guidance.


Enable an alert definition

To enable an alert definition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. On the Tasks tab, click Configure Alert Definitions.
  4. On the Alert Definitions tab, select the check box to enable the selected alert.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Add an alert definition

To add an alert definition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. On the Tasks tab, click Configure Alert Definitions, and then click Add.
  4. Follow the on-screen instructions in the New Alert Configuration Wizard.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can create new alert definitions only for events that do not already have an associated alert definition.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Edit an alert definition

To edit an alert definition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. On the Tasks tab, click Configure Alert Definitions.
  4. On the Alert Definitions tab, select an alert definition, and then click Edit.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To disable an alert definition, clear the check box next to the name of the alert.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Edit an alert condition

To edit an alert condition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. On the Tasks tab, click Configure Alert Definitions.
  4. Select the alert definition you want to edit, and then click Edit.
  5. On the Events tab, do the following:
    • In Event, click the event that triggers the alert. If the event needs an additional condition, in Additional condition, click the condition.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can modify the event associated with an alert definition only if that event is not already associated with a different alert definition.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Edit an alert threshold

To edit an alert threshold

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. On the Tasks tab, click Configure Alert Definitions.
  4. Select the alert definition you want to edit, and then click Edit.
  5. On the Events tab, select the Number of occurrences check box, and type how many events must occur before the alert is issued.
  6. Select the Number of events per second check box, and type how many events must occur per second before the alert is issued.
  7. Select one of the following options:
    • If the alert should be reissued immediately if the event recurs, click Immediately.
    • If the alert should be reissued only after the alert is reset, click Only if the alert was manually reset.
    • If the alert should be reissued after a specified amount of time, click If time since last execution is more than Number minutes, and then type the number of minutes that should elapse before the action should be performed.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can modify the event associated with an alert definition only if that event is not already associated with a different alert definition.
  • An alert will be triggered after the number of occurrences you specify occurs. For example, if you specify 5, the alert will be triggered on the sixth occurrence of the event. Similarly, an alert will be triggered after the number of seconds you specify occurs. For example, if you specify 5 seconds, the alert will be triggered after six seconds pass.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Edit an alert action

To edit an alert action

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. On the Tasks tab, click Configure Alert Definitions.
  4. Select the alert definition you want to edit, and then click Edit.
  5. On the Actions tab, modify one or more of the following actions:
    • To send an e-mail message when the alert condition occurs, select the Send e-mail check box, and then type the Simple Mail Transport Protocol (SMTP) server, recipient, and sender.
    • To run an application when the alert condition occurs, select the Run a program check box, and then type the command to run at a command prompt. To select the account from which to run the program, click Set Account, and then select the account.
    • To log the event, select the Report to Windows event log check box.
    • To stop ISA Server services, select the Stop selected services check box, and then click Select to select which ISA Server services to stop when the alert condition occurs.
    • To start ISA Server services, select the Start selected services check box, and then click Select to select which ISA Server services to start when the alert condition occurs.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can specify multiple recipients of e-mail messages by typing addresses in the To and Cc fields, separated by semicolons (;).
  • If you configure an e-mail action to use an SMTP server located on the Internal network, you must enable the system policy rule that allows the Local Host network to access the Internal network using the SMTP protocol. In the System Policy Editor, in the Remote Monitoring configuration group, select SMTP, and then click Enable. The Allow SMTP protocol from firewall to trusted servers rule is enabled.
  • If you configure an e-mail action to use an external SMTP server, you must create an access rule that allows the Local Host network to access the External network (or the network on which the SMTP server is located), using the SMTP protocol.
  • If ISA Server runs a program, you can specify which user account should be used. The specified user must have Logon as batch job permissions.
  • In Use this account, you can click Set Account to specify a user account to run the program.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Acknowledge an alert

To acknowledge an alert

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. In the details pane, select an alert, or group of alerts you want to acknowledge.
  4. On the Tasks tab, click Acknowledge Selected Alerts.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can acknowledge an entire group of alerts, by selecting the group heading.
  • In the Alerts view, alert instances are grouped together by category (for example, Service shutdown). You can expand or collapse the group headings to display or hide the items they contain.
  • To select adjacent alerts, click the first alert, and then hold down SHIFT and click the last item.
  • To select nonadjacent alerts, click the first alert, and then hold down CTRL and click additional items.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure invalid DHCP offer alert

To configure invalid DHCP offer alert

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. In the details pane, click the Invalid DHCP offer group, and then click the Invalid DHCP offer alert.
  4. On the Tasks tab, click Renew DHCP Addresses.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Reset an alert

To reset an alert

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. In the details pane, select an alerts, or group of alerts you want to acknowledge.
  4. On the Tasks tab, click Reset Selected Alerts.
  5. Click Yes if you are sure that you want to reset the selected alerts.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can reset an entire group of alerts, by selecting the group heading.
  • In the Alerts view, alert instances are grouped together by category (for example, Service shutdown). You can expand or collapse the group headings to display or hide the items they contain.
  • To select adjacent alerts, click the first alert, and then hold down SHIFT and click the last item.
  • To select nonadjacent alerts, click the first alert, and then hold down CTRL and click additional items.
  • When the Microsoft ISA Server Control service (isactrl) is restarted, all alerts are automatically reset.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure session monitoring

This section provides specific steps for configuring session monitoring in Internet Security and Acceleration (ISA) Server 2004.

  • View sessions
  • Disconnect a session
  • Monitor specific sessions
  • Save a filter definition
  • Load a filter definition
  • Pause monitoring sessions
  • Stop monitoring sessions

Get latest ISA Server content at ISA Server Guidance.


View sessions

To view sessions

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Sessions tab.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The sessions are listed in the details pane.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Disconnect a session

To disconnect a session

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Sessions tab.
  3. Select the applicable session.
  4. On the Tasks tab, click Disconnect session.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Monitor specific sessions

To monitor specific sessions

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Sessions tab.
  3. On the Tasks tab, click Edit Filter.
  4. In Filter by, select one of the following options:
    • Activation. Used to filter only for sessions activated since the specified time.
    • Application Name. Used to filter based on an application name.
    • Client Host Name, Client IP, or Client Username. Used to filter for sessions from specific clients.
    • Session Type. Used to filter for sessions from specific types of clients: Firewall client, SecureNAT, VPN client, VPN site-to-site, or Web proxy.
    • Server Name. Used to filter based on a server name.
    • Source Network. Used to filter for sessions from specific source networks.
  5. In Condition and Value, specify the appropriate condition, and then click Add to List.
  6. Repeat steps 4 and 5 to add more conditions to the filter. Then, click Start Query.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • By default, all sessions are listed in the Sessions details pane.
  • The Sessions viewer displays only data for sessions that match all the expressions included in the filter. The filter expressions are combined using the logical AND operator.
  • By default, the Application Name and Server Name columns are not displayed in the Sessions details pane. To display these columns, right-click the column headings in the details pane and then select the appropriate column.
  • To remove an expression from the filter list, click Edit Filter. Then, select the expression and click Remove.
  • To edit an expression in the filter list, click Edit Filter. Then, select the expression, perform the desired edits, and then click Update.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Save a filter definition

To save a filter definition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Sessions tab.
  3. On the Tasks tab, click Export Filter Definitions.
  4. In File name, specify the file name of the .xml file with the filter definition. Then, click Save.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Load a monitoring definition

To load a filter definition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Sessions tab.
  3. On the Tasks tab, click Import Filter Definitions.
  4. In File name, specify the file name of the .xml file with the filter definition. Then, click Load.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Pause monitoring sessions

To pause monitoring sessions

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Sessions tab.
  3. On the Tasks tab, click Pause Monitoring Sessions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To resume monitoring sessions, on the Tasks tab, click Resume Monitoring Sessions.
  • When you pause session monitoring, sessions displayed in the Sessions view are not removed. However, new sessions are not added to the view. When you resume session monitoring, ISA Server updates the Sessions view with the relevant, new session information.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Stop monitoring sessions

To stop monitoring sessions

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Sessions tab.
  3. On the Tasks tab, click Stop Monitoring Sessions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you stop monitoring sessions, ISA Server loses information about any sessions that had been monitored.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Start or stop a service

To start or stop a service

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Services tab.
  3. Select the applicable service: Microsoft Data Engine, Microsoft Firewall service, or Microsoft ISA Server Job Scheduler service.
  4. On the Tasks tab, click Start Selected Service to start the selected service, or click Stop Selected Service to stop the selected service.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If the service is already stopped, Stop Selected Service will not be available on the Tasks tab.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure Logging

This section provides instructions on how to configure the logging feature of Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Enable logging for a specific service
  • Log requests matching a rule
  • Specify fields to log
  • Configure logging to an SQL database
  • Use data encryption when connecting to an SQL database
  • Configure logging to an MSDE database
  • Set up SQL Server for ISA Server logging
  • Configure log storage limits
  • Configure logging to a file
  • Filter the log viewer data
  • Save a log filter definition
  • Load a log filter definition
  • Save log viewer data


Enable logging for a specific service

To enable logging for a specific service

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, select the appropriate task:
    • Configure Firewall Logging. To configure the location of the Firewall log.
    • Configure Web Proxy Logging. To configure the location of the Web Proxy log.
    • Configure SMTP Message Screener Logging. To configure the location of the SMTP Message Screener log.
  4. On the Log tab, select the Enable logging for this service check box.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To disable logging for a specific service, on the Log tab, verify that the Enable logging for this service check box is not selected.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Log requests matching a rule

To log requests matching a rule

  1. In the console tree of ISA Server Management, click Firewall Policy (for array-level requests) or Enterprise Policies (for enterprise-level requests).

    For enterprise-level rules, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Policies
    • Enterprise policy

    For array-level rules, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Firewall Policy
  2. In the details pane, click the rule for which logging should be enabled.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Action tab, select the Log requests matching this rule check box.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If a large amount of data is being logged from a specific protocol or source, you can create a new rule, which applies to that type of traffic, for which requests are not logged. For example, suppose your policy does not allow DHCP requests, and as a result, there are many DHCP requests that are being denied. You can create a new access rule that denies DHCP requests, but does not log the requests.
  • By disabling logging for a specific rule, you effectively reduce the load on the ISA Server computer if it is under attack. However, note that if you disable logging on the default deny rule, ISA Server cannot detect port scan attacks.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Specify fields to log

To specify fields to log

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, select the appropriate task:
    • Configure Firewall Logging. To configure the location of the Firewall log.
    • Configure Web Proxy Logging. To configure the location of the Web Proxy log.
    • Configure SMTP Message Screener Logging. To configure the location of the SMTP Message Screener log.
  4. On the Fields tab, do one of the following:
    • To select specific fields, select the appropriate check box.
    • To clear all the check boxes in the field list, click Clear All.
    • To select all the check boxes in the field list, click Select All.
    • To select a default set of fields in the ISA Server log file, click Restore Defaults.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure logging to an SQL database

To configure logging to an SQL database

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, select the appropriate task:
    • Configure Firewall Logging. To configure the Firewall log.
    • Configure Web Proxy Logging. To configure the Web Proxy log.
  4. On the Log tab, select SQL Database.
  5. Click Options, and then do the following:
    • In Server, type the name of the computer running SQL Server to which the information will be logged.
    • In Port, type the port number to use. The default port of the computer running SQL Server is 1433.
    • In Database, type the name of the database on the computer running SQL Server.
    • Select Use Windows authentication (recommended) or Use SQL server authentication.
    • In User and Password, type the credentials of the account to use to authenticate this connection.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The Remote Logging (SQL) system policy configuration group must be enabled to log on to an SQL database.
  • When applicable, we recommend that you use Windows authentication. In a workgroup deployment, if you configure SQL logging for Windows authentication, you should specify a local user account. This account must exist on all array members and on the computer running SQL Server. The account should also have appropriate logon permissions specified in SQL Server Security.
  • If you use the default SQL port, the Allow remote SQL logging from ISA Server to selected servers system policy rule is enabled, allowing SQL access from the Local Host network to all computers on the Internal network.
    We recommend that you modify the system policy so that this rule applies only to the specific computer running SQL Server. For instructions, see Edit destinations for a system policy rule.
  • If you specify a non-default port in step 5, do the following:
    1. Create a UDP and a TCP protocol for the specified port. For instructions, see Create a protocol.
    2. Create an access rule from Local Host network to the network on which the computer running SQL Server is located, allowing use of the two protocols you created. For instructions, see Create an access rule.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Use data encryption when connecting to an SQL database

To use data encryption when connecting to an SQL database

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, select the appropriate task:
    • Configure Firewall Logging. To configure the Firewall log.
    • Configure Web Proxy Logging. To configure the Web Proxy log.
  4. On the Log tab, select SQL Database.
  5. Click Options.
  6. Select Force data encryption.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The Remote Logging (SQL) system policy configuration group must be enabled to log to an SQL database.
  • If you configure encryption when logging to an SQL database, you must install a certificate on the computer running SQL Server. Then, update the trusted root authority on each array member to trust the server certificate.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure logging to an MSDE database

To configure logging to an MSDE database

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, select the appropriate task:
    • Configure Firewall Logging. To configure the location of the Firewall log.
    • Configure Web Proxy Logging. To configure the location of the Web Proxy log.
  4. On the Log tab, click MSDE Database.
  5. (Optional) Click Options to confirm or modify the following parameters:
    • ISALogs folder or This folder. To select the location of the log file.
    • Delete files older than. Specify the number of days to keep log files before they are automatically deleted.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you delete a Microsoft SQL Server 2000 Desktop Engine (MSDE 2000) database file without first detaching it from MSDE 2000, the offline log viewer might not run queries as expected. ISA Server supports an automatic clean up of database files, but to delete a file manually, detach it from MSDE 2000 before deletion.
  • When you specify the log file folder location, you can specify an environment variable. For example, you can specify %logDirectory%. ISA Server will warn you that the specified location is not valid. You can ignore this message. The service will be started.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Set up SQL Server for ISA Server logging

To set up SQL Server for ISA Server logging

  1. Set up SQL Server with a database file:
    1. On the computer running SQL Server, start Enterprise Manager.
    2. Connect to the computer running SQL Server that you want to host the database files.
    3. On the Tools menu, click SQL Query Analyzer.
    4. On the File menu, click Open and open "ISA CD":\FPC\Program Files\Microsoft ISA Server.
    5. Open one of the following .sql files, based on how you want to log to an SQL database:
      • For the Microsoft Firewall service, open the Fwsrv.sql file.
      • For Web Proxy, open the W3proxy.sql file.
    6. Create a database.
    7. Add the following lines to the top of each script:
      Use <database name>
Go
    8. On the Query menu, click Execute.
  2. Set up SQL Server to accept the data connection from the ISA Server computer. If ISA Server is not located in the same Windows Server 2003 domain or Windows 2000 domain, you must set up a SQL Server account:
    1. Start the SQL Enterprise Manager and connect to the computer running SQL Server that you set up to host your databases.
    2. Click Microsoft SQL Servers, click SQL Server Group, click server_name, click Security, and then right-click Logins.
    3. Click New Login.
    4. If you are located in the same domain as ISA Server, you can click Windows Authentication.
      1. In Name, type: domainname\isaservername$
      2. On the Database Access tab, click the databases that this logon method can access (the databases that you created earlier).
      In an array configuration, a separate logon should be created for each array member.
    5. If you are located on a different domain than ISA Server, you must use SQL Server authentication:
      1. In Name, type a specific name.
      2. Use a name to describe the logon method.
      3. Enter a password for this logon method.
      4. On the Database Access tab, select the databases that this logon method can access (the databases that you created earlier).
    6. Select Change the default database, and then select the database to which ISA Server will log data.
    7. Configure SELECT and INSERT permissions for the table. Configure EXECUTE permissions for the sp_batch_insert procedure for ISA Server services for logging to this database.

Notes

  • By default, ISA Server uses a Secure Sockets Layer (SSL)-encrypted connection to the computer running SQL Server, to help secure the sensitive data in the log files. To enable this connection, you must install a root certification authority (CA) certificate on the array members. For more information, see HOW TO: Enable SSL Encryption for SQL Server 2000 with Certificate Server (http://www.microsoft.com/).
  • For instructions on configuring data encryption for ISA Server, see Use data encryption when connecting to an SQL database.
  • We recommend that you use Ethernet cards for the Peripheral Component Interconnect (PCI) bus with transfer rates of 100 megabits per second for communication between the array members and the computer running SQL Server.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure log storage limits

To configure log storage limits

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, select the appropriate task:
    • Configure Firewall Logging. Used to configure the firewall log limits.
    • Configure Web Proxy Logging. Used to configure the Web proxy log limits.
  4. On the Log tab, select File or MSDE Database.
  5. Click the Options button.
  6. To limit the size of the logs, select Limit total size of log files (GB). Then, type the maximum log size.
  7. To maintain a specified amount of free disk space on the disk that the logs are stored, select Maintain free disk space (MB). Then, type how much free disk space to maintain.
  8. If you selected either Limit total size of log files (GB) or Maintain free disk space (MB), select one of the following:
    • Deleting older log files as necessary. Used to delete the oldest log files when you exceed the limits specified previously.
    • Discarding new log entries. Used to stop ISA Server from adding any new log entries (while keeping all the old log information).
  9. To delete old log information, select Delete files older than (days). Then, type how long to keep log information.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You cannot set log limits for SQL database logs.
  • ISA Server checks that logs do not exceed the specified limits every ten minutes. For up to a period of ten minutes, logs might exceed the limits.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure logging to a file

To configure logging to a file

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, select the appropriate task:
    • Configure Firewall Logging. To configure the location of the Firewall log.
    • Configure Web Proxy Logging. To configure the location of the Web Proxy log.
    • Configure SMTP Message Screener Logging. To configure the location of the SMTP Message Screener log.
  4. On the Log tab, click File.
  5. (Optional) Click Options to confirm or modify the following parameters:
    • ISALogs folder or This folder. To select the location of the log file.
    • Compress log files. To compress the log file.
    • Delete log files older than. Specify the number of days to keep log files before they are automatically deleted.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you specify the log file folder location, you can specify an environment variable. For example, you can specify %logDirectory%. ISA Server will warn you that the specified location is not valid. You can ignore this message. The service will be started.
  • Compressing the log file decreases its size and reduces the amount of space it uses.
  • You may notice a decrease in performance when working with NTFS-compressed files. When you read from (access) a compressed file, Windows automatically decompresses it for you, and when you write to the file, Windows compresses it. This process may decrease your computer's performance.

If you are not running the Simple Mail Transfer Protocol (SMTP) Message Screener component on the ISA Server computer, and in ISA Server Management (on the ISA Server computer) you specify a folder location for the Message Screener log that does not exist on the computer running the Message Screener component, the folder will only be created on that computer after it is restarted.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Filter the log viewer data

To filter the log viewer data

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, click Edit Filter.
  4. In Filter by, select one of the log fields.
  5. In Condition and Value, specify the appropriate condition, and then click Add To List.
  6. Repeat steps 4 and 5 to add more conditions to the filter. Then, click Start Query.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The log viewer displays log data only if it matches all the expressions included in the filter. The filter expressions are combined using the logical AND operator.
  • To edit an expression in the filter list, click Edit Filter. Then, select the condition and click Update.
  • To delete an expression from the filter list, select the applicable expression in Query according to this list of expressions, and then click Remove.
  • When you create the filter, you must specify exactly one Log Time and one Log Record Type.
  • The log viewer updates data only when the Microsoft Firewall service is running. When the Firewall service is not running, ISA Server enforces lockdown mode. For more information, see Lockdown mode.
  • The log viewer can display information only about the Firewall and Web Proxy logs. SMTP Message Screener log information cannot be displayed in the log viewer.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Save a log filter definition

To save a log filter definition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, click Export Filter Definitions.
  4. In File name, specify the file name of the .xml file with the filter definition. Then, click Save.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Load a log filter definition

To load a log filter definition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, click Import Filter Definitions.
  4. In File name, specify the file name of the .xml file with the filter definition. Then, click Load.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Save log viewer data

To save log viewer data

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, select one of the following:
    • Copy All Results to Clipboard. To copy all the data displayed in the log viewer.
    • Copy Selected Results to Clipboard. To copy selected data from the log viewer.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To select adjacent log entries, click the first log entry, and then hold down SHIFT and click the last item.
  • To select nonadjacent log entries, click the first log entry, and then hold down CTRL and click additional items.
  • After you copy the data to the Clipboard, you can paste the text into an appropriate application for analysis.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure reports

This section provides specific instructions for configuring reports in Internet Security and Acceleration (ISA) Server 2004.

  • Create a report
  • Create a recurring report job
  • Configure the report summary database
  • Disable report summary database generation
  • Configure Recurring Reports
  • View and Publish Reports

Get latest ISA Server content at ISA Server Guidance.


Create a report

To create a report

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Generate a New Report.
  4. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The Microsoft ISA Server Job Scheduler service must be running to create a report.
  • If you publish the report to a shared folder, be sure to supply credentials that will be used by the reporting engine for publishing. These credentials should have write permissions in the specified folder. To allow others to view the published report, give them read permissions to that folder.
  • To create a recurring report job, click Configure Recurring Reports on the Tasks tab.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Create a recurring report job

To create a recurring report job

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Click Add to create a new recurring report job, and follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The Microsoft ISA Server Job Scheduler service must be running to create a report.
  • If you publish the report to a shared folder, be sure to supply credentials that will be used by the reporting engine for publishing. These credentials should have write permissions in the specified folder. To allow others to view the published report, give them read permissions to that folder.
  • In a workgroup deployment, you must enable Authenticate using this account on the Intra-array Credentials tab of the array properties page, and specify a user account that is defined on all array members. For instructions, see Specify intra-array credentials.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure the report summary database

To configure the report summary database

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Configure Log Summary and Report Preferences.
  4. On the Log Summary tab, select the Enable daily and monthly summaries check box.
  5. In Specify the generation time, type the time of day that the report data should be generated.
  6. Do one of the following:
    • To save the reports in the ISASummaries subfolder on this computer, select ISASummaries folder.
    • To save the reports in another folder, select This folder, and then click Browse and click the folder in which to save the reports.
  7. To configure the number of saved summaries:
    • In Number of saved summaries, in Daily summaries, type the number of daily summaries to save.
    • In Monthly summaries, type the number of monthly summaries to save.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • At least 35 daily summaries must be saved. At least 13 monthly summaries must be saved.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Disable report summary database generation

To disable report summary database generation

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Configure Log Summary and Report Preferences.
  4. On the Log Summary tab, clear the Enable daily and monthly summaries check box.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you create a report when the report summary database generation is disabled, ISA Server will create the missing log summaries to generate the report. If the summaries had previously been created, but subsequently deleted, they will not be re-created.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure recurring reports

This section provides specific instructions for configuring recurring reports in Internet Security and Acceleration (ISA) Server 2004.

  • Configure report contents for a report job
  • Configure a report job schedule
  • Configure period on which to base the report
  • Specify when to run a report job
  • Run a scheduled report job now
  • Notify upon report generation
  • Delete a report job

Get latest ISA Server content at ISA Server Guidance.


Configure report contents for a report job

To configure report contents for a report job

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Select the applicable report job, and then click Edit.
  5. On the Content tab, select which of the following reports should be generated:
    • Summary
    • Web usage
    • Application usage
    • Traffic and utilization
    • Security

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you use the New Report Wizard to create a report, you can specify the types of reports to generate on the Report Types page of the wizard.
  • Summary reports include a set of reports with common information about protocol usage, Web sites accessed, cache information, and general traffic activity. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity.
  • Web usage reports include a set of reports that display top Web users, common responses, and browsers. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity. It shows how the Web is being used in a company.
  • Application usage reports illustrate Internet application usage in a company, including incoming and outgoing traffic, top users, client applications, and destinations. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity, because they can help you plan network capacity and determine bandwidth policies.
  • Traffic and utilization reports illustrate total Internet usage by application, protocol, and direction. These reports also show average traffic and peak simultaneous connections, cache hit ratio, errors, and other statistics. These reports can help plan and monitor network capacity and determine bandwidth policies.
  • Security reports list attempts to breach network security. Security reports can help identify attacks or security violations after they have occurred.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure a report job schedule

To configure a report job schedule

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Select the applicable report job, and then click Edit.
  5. On the Schedule tab:
    • To generate reports every day, click Every day.
    • To generate reports on a specific day every week, click On the following days, and then select the appropriate days.
    • To generate reports every month, click Every month, on this date. Specify the day of the month to generate the report.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The content displayed in the report will reflect the period specified when you configure the report period.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure period on which to base the report

To configure period on which to base the report

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Select the applicable report job, and then click Edit.
  5. On the Content tab, in Select a period to base the report on:
    • To generate reports that show activity in the past day, select Daily.
    • To generate reports that show activity over the past week, select Weekly.
    • To generate reports that show activity over the past month, select Monthly.
    • To generate reports that show activity over the past year, select Yearly.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you create a recurring report job, the period is assumed to be the same as the report job schedule. For example, if you create a recurring report job to run weekly, the report will show activity for the previous week.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Specify when to run a report job

To specify when to run a report job

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Select the applicable report job, and then click Edit.
  5. On the Schedule tab, in Generation Hour, specify the time of day at which to run the report job.
  6. In Start Date, specify the date on which to start running the report.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you specify a date that does not exist in some months (for example, 31), the report will not run in those months.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Run a scheduled report job now

To run a scheduled report job now

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Select the applicable report job, and then click Run Now.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Notify upon report generation

To notify upon report generation

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Select the applicable report job, and then click Edit.
  5. On the Notification tab, select Send e-mail.
  6. In SMTP server, type the name of the mail server to use when sending the e-mail notification.
  7. In From, To, and Cc, type the e-mail address of the sender and the recipients.
  8. In Message, type a message to send to the e-mail recipients.
  9. To verify that a message will be sent successfully, click Test.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Delete a report job

To delete a report job

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Select the applicable report job, and then click Remove.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


View and publish reports

This section provides specific instructions for viewing and publishing reports in Internet Security and Acceleration (ISA) Server 2004.

  • View a report
  • Customize report data
  • Sort report data
  • Publish a report
  • Delete a report

Get latest ISA Server content at ISA Server Guidance.


View a report

To view a report

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab, and then select the applicable report.
  3. On the Tasks tab, click View Selected Report.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The graph displays only the top ten items included in a report.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Customize report data

To customize report data

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, to configure the applicable report type, click one of the following:
    • Customize Summary Content
    • Customize Web Usage Content
    • Customize Application Usage Content
    • Customize Traffic and Utilization Content
    • Customize Security Content
  4. Click a tab, and then in Include this number of, type the maximum amount of data that should be included in the report.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Sort report data

To sort report data

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click to configure the applicable report type:
    • Customize Summary Content
    • Customize Web Usage Content
    • Customize Application Usage Content
    • Customize Traffic and Utilization Content
    • Customize Security Content
  4. In Sort Order, click the option that should be used to sort the data in the report.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The report will be sorted the next time you view the report.
  • The data in the tables are sorted. However, the graphs in the reports are not regenerated.
  • You cannot configure the sort order for the Security Content report.
    You cannot configure the sort order for Top Protocols in the Traffic and Utilization Content and in the Summary Content reports.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Publish a report

To publish a report

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab, and then select the applicable report.
  3. On the Tasks tab, click Publish Selected Report.
  4. In Browse for Folder, select the folder in which the published reports folder should be created.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The published reports are stored in a folder named Report_Job_Name_(Start date—End date).
    For example, if you publish the report job named DailyReports, scheduled to run from December 1, 2004 through December 15, 2004, the published reports folder will be named DailyReports_(12.1.2004—12.15.2004).
  • To view the report, double-click the file named report.htm located in the published folder. This has links to all the report types generated.
  • You can configure report publishing when you generate a report or configure a recurring report job. In the Report Publishing page of the wizard, type the name of the folder in which the published reports folder should be created.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Delete a report

To delete a report

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Reports tab, and then select the applicable report.
  3. On the Tasks tab, click Delete Selected Report. Then, click Yes.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure connectivity verifiers

This section contains information about creating and configuring connectivity verifiers in Internet Security and Acceleration (ISA) Server 2004.

  • Create a connectivity verifier
  • Configure connection verification method
  • Configure connection verification time-out
  • Configure a connectivity verifier group
  • Disable a connectivity verifier

Get latest ISA Server content at ISA Server Guidance.


Create a connectivity verifier

To create a connectivity verifier

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Connectivity tab.
  3. On the Tasks tab, click Create New Connectivity Verifier.
  4. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The Dashboard view lists the connectivity status by group. If all servers in a group are responsive (and within the specified response time threshold), the group status reflects that the servers in the group are responsive. If any server in the group is not responsive, the group status displayed reflects the worst-case status for that group, for example, Slow connectivity or No connection.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure connection verification method

To configure connection verification method

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Connectivity tab and select the applicable verifier.
  3. On the Tasks tab, click Edit Selected Verifier.
  4. On the Properties tab, select one of the following methods:
    • Send an HTTP "GET" request
    • Send a Ping request
    • Establish a TCP connection
  5. If you select Establish a TCP connection, in Connect to port, specify a protocol to select its default port, or select Custom, and then specify the port number.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure connection verification time-out

To configure connection verification time-out

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Connectivity tab and select the applicable verifier.
  3. On the Tasks tab, click Edit Selected Verifier.
  4. On the Properties tab, in Specify the timeout response threshold (msec), type the number of milliseconds to wait to determine that the server is not responding.
  5. Select Trigger an alert if the server response is not within the specified timeout, if ISA Server should trigger an alert indicating that the server is not responding.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure a connectivity verifier group

To configure a connectivity verifier group

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Connectivity tab and select the applicable verifier.
  3. On the Tasks tab, click Edit Selected Verifier.
  4. On the Properties tab, in Group type, select one of the following:
    • Active Directory
    • DHCP
    • DNS
    • Others
    • Published Servers
    • Web (Internet)

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The Dashboard view lists the connectivity status by group. If all servers in a group are responsive (and within the specified response time threshold), the group status reflects that the servers in the group are responsive. If any server in the group is not responsive, the group status displayed reflects the worst-case status for that group, for example, Slow connectivity or No connection.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Disable a connectivity verifier

To disable a connectivity verifier

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Monitoring
  2. In the details pane, click the Connectivity tab and select the applicable verifier.
  3. On the Tasks tab, click Disable Selected Verifiers.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Troubleshooting monitoring

What problem are you having?

An error message indicates that At least one data sample is missing.

Cause: The System Performance monitor may generate this message when you remotely administer ISA Server from a computer running Windows XP.

Solution: Ignore this message.

In a workgroup scenario, cannot monitor the array.

Cause: Appropriate administrative roles must be configured for a user on the Configuration Storage server. Also, mirrored accounts must be created on each array member.

Solution: Specify users and roles on each array member. For instructions, see Assign administrative roles for array administrators or Assign administrative roles for enterprise administrators.

Troubleshooting logging

What problem are you having?

Anonymous access is blocked, but the logs show requests from anonymous users.

Cause: When a user is required to authenticate, the communication works as follows:

  1. A user sends an anonymous request. ISA Server responds with a 407 error and terminates the connection. An anonymous request is logged.
  2. The user sends the same request with Keep-Alive and NTLM authentication information. ISA Server responds again with a 407 error, and with an authentication challenge. The connection is not terminated. Another anonymous request is logged.
  3. The user sends the same request with the authentication response. Now the request is authenticated and served.

Solution: Validate that the anonymous requests are followed by a request from an actual, authenticated user. Otherwise, there may be a configuration problem.

Cannot find client authentication (user names) information in the log file.

Cause: ISA Server does not always require that clients authenticate themselves. If clients are not authenticated, they are granted anonymous access and their authentication information is not logged.

Solution: You can configure ISA Server to always require that Web Proxy clients authenticate themselves by configuring the incoming and outgoing Web request properties. For more information, see Configure authentication methods for Web Proxy clients and Firewall policy and authentication.

Too much information is filling the log.

Cause: When you create a rule, by default, any requests that match the rule are logged. Because the Default Rule denies all traffic, any requests that are not specifically allowed by rules that you create will be logged. This could potentially fill your log quickly.

Solution: If you notice a large amount of log data from a specific protocol or source, you can create a new rule, which applies to that type of traffic, for which requests are not logged. For example, suppose your policy does not allow DHCP requests, and many DHCP requests are being denied. You can create a new access rule that denies DHCP requests, but does not log the requests.

Logging fails with a SQL Server time-out error.

Cause: Access to the computer running SQL Server may not have been configured properly.

Solution: Check whether access to the computer running SQL Server was configured properly. On the SQL Server Logging Options tab, click Test. For instructions, see Configure logging to an SQL database. If the test fails:

  • Check that the computer running SQL Server is available.
  • Check that the SQL database, table, and user permissions are set appropriately.
  • Check that the remote SQL logging system policy rule is enabled.
  • Create an access rule allowing access on that port to the computer running SQL Server, if a non-default SQL port (other than 1433) was specified,
  • Check that the SQL Server memory quota was not exceeded.
  • Check that DNS lookup to the computer running SQL Server is successful. When using data encryption, reverse DNS lookup queries on the computer running SQL Server should be resolvable to all array members.

An error message indicates that The query stopped because an error occurred while it was running.

Cause: Permissions were not configured appropriately on the SQL Server database table.

Solution: On the computer running SQL Server, verify that SELECT permissions on the relevant tables were given to the user authenticating with the computer running SQL Server.

The Log deletion failure event was generated.

Cause: Log deletion failed, because of the configuration. This may be the result of a lock on a database.

Solution: Run the osql utility, which is located on the computer running SQL Server in the \Program Files\Microsoft SQL Server\80\Tools\Binn\ folder. At a command prompt, type the following:

OSQL.EXE” –E –S <server name>\msfw
Then, at the command prompt, type:
sp_who2
Go
A list of sessions to the SQL objects will be displayed.

Troubleshooting sessions

What problem are you having?

There seems to be more current users (in the Microsoft Firewall service performance counters) than sessions (in the Sessions view).

Cause: ISA Server considers a session a unique combination of IP address and user name. A connection is considered a new session from a specific IP address only if a unique user logs on. System Monitor, in contrast to ISA Server, counts all connections.

Troubleshooting reports

What problem are you having?

Report contains empty data.

Cause: Reports can be saved from Internet Explorer only on the computer running ISA Server Management. On any other computer, the report shows either empty data or empty frames with a message that the "Page cannot be displayed."

Solution: To view reports on another computer, publish the report. For instructions, see Publish a report.

The report does not list any requests from a user, but traffic is passing through ISA Server for that user.

Cause: ISA Server counts requests from users only when the request completes. If a request takes more than a day, it will be counted only on the day it completes.

Solution: Check the next day's report to see details about the request.

Troubleshooting alerts

What problem are you having?

ISA Server does not perform the action configured for the alert definition.

Cause: When you configure an action for an alert definition, you can specify which account runs the action. If the specified account does not have Log on as batch job permission, the action will not be performed.

Solution: Give the user running the action permission to perform the action. For information about assigning Logon as batch job permission, see Windows Help.

Alert definition that is configured to send e-mail message notification when the event occurs is not functioning properly.

Cause: Check which SMTP server is configured to send the e-mail message notification. If it is an external SMTP server, you must create an access rule that allows the Local Host access to the external SMTP server.

Solution: Create an access rule, allowing the Local Host to access the External network, using SMTP. For instructions, see Create an access rule.


Add-ins

Add-ins are application filters and Web filters developed by Microsoft or by third-party vendors. These add-ins provide additional filtering functionality to Internet Security and Acceleration (ISA) Server 2004. This section describes the add-ins and provides step-by-step instructions on how to configure them.

  • Add-ins: Concepts
  • Add-ins: How To
  • Deployment scenario: SMTP filter

Get latest ISA Server content at ISA Server Guidance.


Add-ins: Concepts

This section describes add-ins: application filters and Web filters, developed by Microsoft or by third-party vendors. These add-ins provide additional filtering functionality to Internet Security and Acceleration (ISA) Server 2004.

  • Extensibility overview
  • Application Filters
  • Web Filters

Get latest ISA Server content at ISA Server Guidance.


Extensibility overview

Security policies and implementation vary from organization to organization. Traffic volume and content formats also pose unique concerns. Because one product or vendor cannot meet all of the security and performance needs of a large organization, Microsoft Internet Security and Acceleration (ISA) Server 2004 is highly extensible. ISA Server includes a comprehensive software development kit for custom development. Also, a large number of independent vendors offer compatible and complementary solutions that extend ISA Server and integrate with ISA Server. These third-party offerings include content security tools, such as virus scanning and lexical analysis, and management tools, such as real-time monitoring, remote administration, site blocking, Uniform Resource Locator (URL) categorization, reporting, and more. The ISA Server Software Development Kit includes full API documentation, step-by-step directions, and examples of source code for developing extensions and add-in components.

ISA Server uses these extensibility mechanisms:

  • Extensible administration. You can write scripts or management tools using the administrative Component Object Model (COM) object, with programmatic read/write access to all management options.
  • Application filters. You can develop application filters that intercept, analyze, or modify any data stream.
  • Web filters. You can create Web filters, based on Internet Server API (ISAPI), for viewing, analyzing, blocking, redirecting, or modifying Hypertext Transfer Protocol (HTTP) and File Transfer Protocol (FTP) traffic.
  • Extensible user interface. You can extend the ISA Server interface with Microsoft Management Console (MMC) snap-ins.
  • Extensible alerts. You can define new events and scripts that are automatically launched in response to events.
  • Extensible storage. You can register additional information for storage with ISA Server configuration, which centralizes management of add-in filters and tools.

Installing add-ins

Application filters and Web filters developed by third-party vendors can be installed on the ISA Server computer. When you install add-ins in an enterprise environment, be sure to install the add-ins on each member of the array. To avoid installation issues, do not install the add-ins on the array members simultaneously.

Array and enterprise administrators can install and register add-ins on the ISA Server computer. The ISA Server administrator need not belong to the Administrators group of the local computer. When the array or enterprise administrator registers the add-in, the add-in is loaded to the Microsoft Firewall service process, which runs under the Network service account.

Enterprise-level add-ins

Add-ins can be configured at the enterprise level and at the array level. When an add-in is enabled at the enterprise level, it is also applied to each array. When an add-in is disabled at the enterprise level, the add-in can be enabled by the array administrator for each array. Add-ins enabled at the enterprise level cannot be disabled at the array level.

web link Get latest ISA Server content at ISA Server Guidance.


Application Filters

Internet Security and Acceleration (ISA) Server 2004 application filters provide an extra layer of security at the Microsoft Firewall service. Application filters can access the data stream or datagrams associated with a session within the Firewall service. Application filters are registered with the Firewall service and work with some or all of the application level protocol streams or datagrams. An application filter can perform protocol-specific or system-specific tasks, such as authentication and virus checking. This section describes the application filters provided with ISA Server.

  • FTP access filter
  • H.323 filter
  • Intrusion detection filters
  • RPC filter
  • SMTP Filtering
  • SOCKS filter
  • Streaming media application filters
  • Web Proxy filter

Get latest ISA Server content at ISA Server Guidance.


FTP access filter

The FTP access filter that is provided with ISA Server forwards File Transfer Protocol (FTP) requests from SecureNAT clients to the Microsoft Firewall service. The filter dynamically opens secondary ports, which are required by FTP, and performs necessary address translation for SecureNAT clients.

Although you could create a protocol for FTP, the protocol would not offer the full range of capabilities afforded by the FTP access filter. The following list describes the differences between a user-defined FTP protocol and the FTP access filter:

  • The FTP access filter dynamically opens specific ports for the secondary connection, but the protocol definition opens a range of secondary ports.
  • The FTP access filter can protect clients by performing the address translation required for the secondary connection.
  • Because the FTP access filter includes a read-only FTP protocol definition, it can distinguish between read and write permissions, enabling you to fine-tune access permissions.

The FTP access filter uses the following protocol definitions, which are installed with the filter during the ISA Server installation:

  • FTP client read-only
  • FTP client
  • FTP server

For instructions about applying FTP access filtering to a specific rule, see Configure FTP filtering.

By default, the FTP access filter is applied to FTP and FTP server protocols. For more information on protocols, see Protocols.

Get latest ISA Server content at ISA Server Guidance.


H.323 filter

ISA Server includes an H.323 filter that allows H.323 compliant applications, such as NetMeeting 3.0 or later, to pass through ISA Server. This enables rich multimedia and real-time collaboration capabilities between enterprises using the Internet. Organizations that deploy interdepartmental firewalls can also use this technology to enhance communications between their employees over their intranets.

Additionally, the H.323 filter protects communication between internal clients and the Internet, hiding client IP addresses and restricting access, as needed.

For instructions on configuring the H.323 filter, see Configure H.323 filter.

H.323 protocol

The H.323 protocol is a set of standards enabling real-time multimedia conferencing and communications over packet-based networks that do not guarantee Quality of Service (QoS). The standard was developed to accommodate varying usages. Due to the inadequate quality of voice over the Internet, it was proposed that improvements could be made if communications were carried partly on the Internet and partly on the public switched telephone network (PSTN). The H.323 standards would also provide for communications between a standard PSTN phone and a computer-based client.

H.323 defines how compliant components (terminals, gateways, gatekeepers, and Multipoint Control Units (MCUs)) engage in audio, video, and multipoint conference communications. The H.323 standards define the mandatory and optional services supplied by a gatekeeper. The H.323 protocol standard contends with call control and management for both point-to-point and multipoint conferences. The standard also defines the gateway operability that allows calls to be connected between H.32x terminals as well as between LAN and PSTN devices.

By default, the H.323 filter is applied to the H.323 protocol. For more information on protocols, see Protocols.

Limiting access to H.323

You can create access rules that limit access to the H.323 protocol. For example, you might want to deny a client's H.323 access to video, T120 data-sharing, and outbound calls. You can create an access rule that allows the H.323 client access only to the inbound calls protocol. Because ISA Server allows access only when explicitly specified, only this protocol will be allowed.

Get latest ISA Server content at ISA Server Guidance.


Intrusion detection filters

ISA Server 2004 includes intrusion detection filters:

  • The DNS intrusion detection filter works with DNS server publishing rules. The filter intercepts and analyzes all inbound DNS traffic destined for the Internal network.
  • The POP3 application filter checks for Post Office Protocol version 3 (POP3) buffer overflow attacks.

DNS filter

The DNS application filter, installed with ISA Server, intercepts and analyzes DNS traffic destined for the Internal network. The DNS filter is the backbone of the ISA Server intrusion detection mechanism. Intrusion detection identifies when an attack is attempted against your network and performs a set of configured actions, or alerts, in case of an attack. To detect unwanted intruders, ISA Server compares network traffic and log entries to well-known attack methods. Suspicious activities trigger alerts. Actions include connection termination, service termination, e-mail alerts, logging, and others.

For instructions, see Enable intrusion detection of common attacks and Enable intrusion detection of DNS attacks.

If intrusion detection is enabled, you can configure which of the following intrusions triggers alerts:

  • All ports scan attack
  • Enumerated port scan attack
  • IP half scan attack
  • Land attack
  • Ping of Death attack
  • UDP bomb attack
  • Windows out-of-band attack

In addition, you can configure which of the following DNS attacks triggers alerts:

  • DNS host name overflow. A DNS host name overflow occurs when a DNS response for a host name exceeds a certain fixed length (255 bytes). Applications that do not check the length of the host names may return overflow internal buffers when copying this host name, allowing a remote attacker to execute arbitrary commands on a targeted computer.
  • DNS length overflow. DNS responses for Internet Protocol (IP) addresses contain a length field, which should be 4 bytes. By formatting a DNS response with a larger value, some applications executing DNS lookups will overflow internal buffers, allowing a remote attacker to execute arbitrary commands on a targeted computer.
    ISA Server also checks that the value of RDLength does not exceed the size of the rest of the DNS response.
  • DNS zone transfer. A DNS zone transfer occurs when a client system uses a DNS client application to transfer zones from an internal DNS server, from any source port.

All ports scan attack

This alert notifies you that an attempt was made to access more than the preconfigured number of ports. You can specify a threshold, indicating the number of ports that can be accessed.

Enumerated port scan attack

This alert notifies you that an attempt was made to count the services running on a computer by probing each port for a response.

If this alert occurs, you should identify the source of the port scan. Compare this with the services that are running on the target computer. Also, identify the source and intent of the scan. Check the access logs for indications of unauthorized access. If you do detect indications of unauthorized access, you should consider the system compromised and take appropriate action.

IP half scan attack

This alert notifies that repeated attempts to send TCP packets with invalid flags were made.

During a normal TCP connection, the source initiates the connection by sending a SYN packet to a port on the destination system. If a service is listening on that port, the service responds with a SYN/ACK packet. The client initiating the connection then responds with an ACK packet, and the connection is established. If the destination host is not waiting for a connection on the specified port, it responds with an RST packet. Most system logs do not log completed connections until the final ACK packet is received from the source. Sending other types of packets that do not follow this sequence can elicit useful responses from the target host, without causing a connection to be logged. This is known as a TCP half scan, or a stealth scan, because it does not generate a log entry on the scanned host.

If this alert occurs, log the address from which the scan occurs. If appropriate, configure the ISA Server rules to block traffic from the source of the scans.

Land attack

This alert notifies you that a TCP SYN packet was sent with a spoofed source IP address and port number that matches that of the destination IP address and port. If the attack is successfully mounted, it can cause some TCP implementations to go into a loop that causes the computer to fail.

Ping of Death attack

This alert notifies you that an IP fragment was received with more data than the maximum IP packet size. If the attack is successfully mounted, a kernel buffer overflows, which causes the computer to fail.

UDP bomb attack

This alert notifies you that there is an attempt to send an illegal User Datagram Protocol (UDP) packet. A UDP packet that is constructed with illegal values in certain fields will cause some older operating systems to fail, when the packet is received. If the target machine does fail, it is often difficult to determine the cause.

Windows out-of-band attack

This alert notifies you that there was an out-of-band denial of service attack attempted against a computer protected by ISA Server. If mounted successfully, this attack causes the computer to fail or causes a loss of network connectivity on vulnerable computers.

POP filter

The Post Office Protocol (POP) filter intercepts and analyzes POP traffic destined for the Internal network. Specifically, the application filter checks for POP buffer overflow attacks.

A POP buffer overflow attack occurs when a remote attacker attempts to gain root access of a POP server by overflowing an internal buffer on the server.

Get latest ISA Server content at ISA Server Guidance.


RPC filter

Microsoft Internet Securiy and Acceleration (ISA) Server handles traffic for all remote procedure calls (RPCs) between clients outside your network and RPC servers located inside your network. Using the ISA Server RPC filter, you can define one or more universally unique identifier (UUID) interfaces as an RPC protocol definition. This protocol definition is used in ISA Server publishing rules for the server, so that external clients can access UUID interfaces on the internal RPC server.

The RPC filter applies to RPC traffic only (including user-defined RPC protocols). It does not apply to any RPC traffic that is tunneled through another protocol. For example, this filter does not affect RPC over HTTP or RPC over XML. For more information about protocols, see Protocols.

Exchange server publishing and the RPC filter

A popular method of accessing Exchange servers from remote sites is by using the full Microsoft Outlook® MAPI client. Users prefer using the same full Outlook MAPI client for e-mail that they use when directly connected to the corporate network. The challenge for the firewall and security administrator is how to make the full Outlook MAPI client remote access connections secure. Remote access to Microsoft Exchange RPC services (which is required for Outlook MAPI client access) can require a large number of statically open ports on the Internet edge firewall. The number of statically opened ports required to allow remote access to Exchange RPC services has been a barrier to enabling an improved Outlook mail experience from remote locations.

On a conventional firewall, to enable this type of access, a large number of statically opened ports on the traditional firewall made security and firewall administrators hesitant about allowing remote access for the full Outlook MAPI client. An important concern is the potential for viruses and worms designed to attack RPC and DCOM services. If you use a conventional firewall that is not RPC application layer aware, RPC worms can attack the network through this port number. Such an attack could infect the Exchange server and subsequently infect other machines on the corporate network.

The ISA Server RPC filter enables you to force secure Outlook MAPI connections with the corporate Exchange server. The RPC filter blocks outbound RPC worm connections from the corporate network. The filter can help you prevent RPC worm connections from leaving the corporate network and prevent hosts on your network from infecting computers on the Internet.

The RPC filter can also be used to enforce secure RPC connections from Outlook MAPI clients. When this feature is enabled, connection requests from remote Outlook MAPI clients must be done through a secure encrypted channel. If the connection is not secured, ISA Server drops the client request. This allows ISA Server, instead of users, to control the level of security.

For instructions, see Configure RPC filtering.

RPC filtering for Outlook clients

The following describes when the initial RPC endpoint mapper connection is established between the Outlook MAPI client and ISA Server:

  1. The Outlook MAPI client establishes a connection to TCP port 135 on the external interface of ISA Server.
  2. The RPC filter statefully inspects packets in the connection. If invalid RPC communications are detected, the connection is dropped.
  3. Valid RPC connections from Outlook MAPI clients are forwarded to the Exchange server. The Exchange server responds to the request with a port number that the client uses for subsequent data connections.
  4. ISA Server intercepts the response and changes the port number to a valid port that the Outlook MAPI client can use on the external interface of ISA Server.
  5. ISA Server forwards to the Outlook MAPI client the port number it will use for subsequent communications with the Exchange server.

The following is the communications sequence between the Outlook MAPI client and the Exchange server after the endpoint mapper connection is established:

  1. The Outlook MAPI client establishes a connection to the MAPI port that ISA Server instructed it to use. ISA Server screens the RPC commands to ensure that no exploits are contained within the channel.
  2. Information sent by the Outlook MAPI client is forwarded by ISA Server to the Exchange server RPC services.
  3. The Exchange server responds to the Outlook MAPI client, and ISA Server intercepts the responses. The RPC filter screens these responses and changes the source port number.
  4. ISA Server forwards the responses to the Outlook MAPI client.

Strict RPC compliance

Outbound RPC protocols can be configured on a per-rule basis, to enforce strict RPC compliance. By default, strict compliance is enforced for RPC protocols. By enforcing strict compliance, RPC-type protocols, such as DCOM, will not be allowed through ISA Server.

For instructions, see Configure RPC filtering.


SMTP Filtering

ISA Server 2004 is a sophisticated, application layer aware firewall that can be configured to stop unwanted e-mail messages, including dangerous viruses and worms. ISA Server performs inspection of SMTP messages, and blocks dangerous code and unwanted e-mail messages from entering the corporate network.

ISA Server use two components to protect the corporate network:

  • SMTP filter. For more information, see SMTP filter.
  • SMTP Message Screener. For more information, see Message Screener.

Get latest ISA Server content at ISA Server Guidance.


SMTP filter

Microsoft Internet Security and Acceleration (ISA) Server 2004 intercepts all Simple Mail Transfer Protocol (SMTP) traffic that arrives on port 25 of the ISA Server computer. The SMTP filter accepts the traffic, inspects it, and passes it on, only if the rules allow.

The SMTP filter can work in conjunction with Message Screener to provide deeper content inspection. For more information about Message Screener, see Message Screener.

By default, the SMTP filter is applied to the SMTP and SMTP server protocols, for incoming traffic. For more information about protocols, see Protocols.

ISA Server supports inter-forest communication between Exchange Server computers only when the communication is over a secure channel (using TLS).

Logging blocked e-mail messages

If an SMTP command is blocked because it violates one of the SMTP filter's conditions, the blocked message will only be logged when you enable the SMTP filter event alert. This alert is disabled by default. For instructions, see Enable an alert definition.

Handling commands

The SMTP filter examines SMTP commands sent by Internet SMTP servers and clients. The filter can intercept SMTP commands and check whether they are larger than they should be. SMTP commands that are larger than configured limits are assumed to be attacks against the SMTP server and can be stopped by the SMTP filter. For instructions on configuring which commands to filter, see Configure SMTP filter buffer overflow thresholds.

Each SMTP command has a maximum length associated with it. This length represents the number of bytes allowed for each command. If an attacker sends a command that exceeds the number of bytes allowed for the command, ISA Server drops the connection and prevents the attacker from communicating with the corporate mail server.

When a client uses a command that is defined but disabled, the filter closes that connection. When a client uses a command that is unrecognized by the SMTP filter, no filtering is performed on that message. If a client uses the TURN command, all e-mail messages will be dropped by the filter.

The RFC considers the AUTH command as part of the MAIL FROM command. For this reason, the SMTP filter blocks MAIL FROM commands only when they exceed the length of the MAIL FROM and AUTH commands issued (when AUTH is enabled). For example, if you specify maximum length of MAIL FROM as 266 bytes and AUTH as 1,024 bytes, the message will be blocked only if the MAIL FROM command exceeds 1,290 bytes.

The SMTP filter does not inspect SSL-encrypted SMTP traffic, including the STARTTLS and TLS commands.


Message Screener

Microsoft Internet Security and Acceleration (ISA) Server 2004 includes two components to help prevent mail relaying, the entry of viruses, and unwanted attachments on the network: the Simple Mail Transfer Protocol (SMTP) filter and Message Screener. Message Screener is an ISA Server optional component, which you can install separately from ISA Server and ISA Server Management.

SMTP Message Screener works together with the SMTP filter, to intercept all incoming SMTP traffic arriving on TCP port 25 of the ISA Server computer. Message Screener is designed for filtering spam. Its primary purpose is to filter keywords, attachments, and e-mail messages sent from unwanted senders and domains, according to your specifications. It must be installed on an SMTP server running Internet Information Services (IIS) 6.0 or IIS 5.0. This server does not have to be the ISA Server computer. For example, Message Screener could be installed on the ISA Server computer, on the Exchange Server computer, or on any other internal SMTP server running IIS 6.0 or IIS 5.0.

Note

  • If you do not install Message Screener on the ISA Server computer, add the Message Screener computer to the Remote Management Computers computer set. For instructions, see Modify a computer set.

SMTP Message Screener can filter incoming mail based on:

  • Value sent in the MAIL FROM SMTP command. This is used for sender and domain name filtering.
  • Content-Disposition header field for each attachment. This field commonly contains the attachment file name and extension. Message Screener can filter attachments by extension, by name, or by size.
  • Keyword filtering. This is used for filtering the message subject and the body, either text/plain or text/html content type.

SMTP Message Screener can be configured to delete e-mail messages, hold e-mail messages for later inspection, or forward e-mail messages to a security administrator's account for further examination and analysis.

Consider, for example, a common virus that sends unwanted e-mail messages containing a specific keyword. You can configure Message Screener to take one of three actions when e-mail messages with this keyword are received:

  • Delete message
  • Hold message
  • Forward message to

Configuring message screening

Follow these steps to install and enable message screening with ISA Server.

  1. Install Message Screener. Typically, this will not be on the ISA Server computer. For instructions, see Install Message Screener.
  2. Configure the SMTPCredTool. For instructions, see Configure SMTPCred Tool.

Logging blocked messages

Messages that are allowed or blocked by SMTP Message Screener are logged locally to a file on the computer running Message Screener. The file is located by default in %ProgramFiles%\Microsoft ISA Server\ISALogs. For more information about the SMTP log, see SMTP Message Screener log fields.

Note

  • If you are not running Message Screener on the ISA Server computer, and you specify a folder location for the Message Screener log that does not exist on the Message Screener computer, the folder will only be created on that computer after it is restarted.


SOCKS filter

The SOCKS filter provided with ISA Server forwards requests from SOCKS applications to the Microsoft Firewall service. ISA Server checks the access policy rules to determine if the SOCKS client application can communicate with the Internet.

When you install ISA Server, the SOCKS filter is disabled for all networks. You can configure ISA Server to listen for SOCKS requests on any port. (SOCKS applications typically send requests to port 1080.) You can modify the default port.

For instructions, see Configure SOCKS filtering.


Streaming media application filters

Streaming media application filters allow Firewall clients and SecureNAT clients to use the following streaming media protocols to access media streaming servers such as Microsoft Windows Media® Technologies (WMT) Server.

Microsoft Internet Security and Acceleration (ISA) Server 2004 includes three application filters, which enable client access to common streaming media protocols:

  • RTSP filter. Applies to Real Time Streaming Protocol (RTSP), which is used for access rules, and RTSP Server, which is used for server publishing rules. When enabled, this application filter can be used to allow Windows Media Player 9 or later, RealPlayer G2 or later, QuickTime 4, and other client access and server publishing.
  • MMS filter. Applies to the Microsoft Windows Media (MMS), which is used for access rules, and to the MMS Server protocol, which is used for server publishing rules. When enabled, this application filter can be used to allow Windows Media Player 8 (default client in Windows XP) client access and server publishing.
  • PNM filter. Applies to Progressive Networks protocol (PNM), which is used for access rules, and PNM Server, which is used for server publishing rules. When enabled, this application filter can be used to allow RealPlayer client access and server publishing.

You can create access rules that limit access to the protocol definitions. For example, you might want to limit a client's access to Windows Media only. You can create a protocol rule that allows the Client MMS: Windows Media protocol and another protocol rule that denies use of the Client PNM: RealNetworks protocol.

If you disable the streaming media filter, all its protocol definitions are also disabled. Traffic that uses Windows Media Technologies, RealNetworks, and RTSP protocol definitions is blocked.

By default, the streaming media filters apply to the following protocols: RTSP, RTSP Server, MMS, MMS Server, PNM, and PNM Server. For more information about protocols, see Protocols.

Get latest ISA Server content at ISA Server Guidance.


Web Proxy filter

The Web Proxy filter works at the application level on behalf of a client requesting Web-based traffic. Although you cannot disable this filter, you can configure whether the filter applies to specific protocols. By default, it is applied to the Hypertext Transfer Protocol (HTTP), which is configured as follows:

  • Direction is Outbound.
  • Protocol Type is TCP.
  • Port is 80.

For more information about protocols, see Protocols.

When Web Proxy filter is enabled for a protocol, that protocol can use the following features, if applicable:

  • Authentication. For more information, see Authentication.
  • HTTP filtering. For more information, see HTTP filter.

When the Web Proxy filter is disabled for a protocol, ISA Server does not intercept requests from clients connecting to Web servers. This disables all caching and other proxying services for the client request. For instructions on disabling (or applying) a filter for a protocol, see Apply an application filter to a protocol.

You can create a custom protocol, which listens on a port other than 80, and apply the Web Proxy application filter to that protocol. In this way, you extend the Web Proxy filter functionality to the custom protocol.


Web Filters

ISA Server features can be extended by installing Web filters developed by other vendors. Web filters can monitor, evaluate, and intercept Hypertext Transfer Protocol (HTTP) communication between an Internal network and the Internet.

Web filters are loaded when the Microsoft Firewall service is started. Web filters can be configured to receive a number of special filter event notifications that occur with each HTTP request and response.

ISA Server includes the following Web filters:

  • Authentication filters
  • HTTP filter
  • Link Translation

Installing and upgrading additional application filters

Additional application filters developed by other vendors can work with ISA Server to extend its security model.

When you install a new application filter, you must restart the Firewall service.

When you upgrade a Web filter, we recommend that you create an access rule that denies use of the HTTP protocol. In this way, you block all HTTP traffic, until the filter again becomes functional. After the upgrade process completes, you can delete or disable the rule. For instructions, see Create an access rule.

Get latest ISA Server content at ISA Server Guidance.


Authentication filters

ISA Server includes a variety of authentication schemes. Support for the new authentication mechanisms is enabled by the following Web filters:

  • OWA forms-based authentication Web filter. This enables forms-based (cookie) authentication for publishing Outlook Web Access servers.
  • RSA SecurID Web filter. This enables authentication of Web requests using RSA SecurID authentication.
  • RADIUS authentication Web filter. This enables authentication of Web requests using RADIUS authentication.

ISA Server allows you to authenticate users in Active Directory and other authentication databases by using RADIUS to query Active Directory. Web publishing rules can also use RADIUS to authenticate remote access connections.

ISA Server can authenticate remote connections using SecurID two-factor authentication. This provides a high level of authentication security because a user must know something and have something to gain access to the published Web server.

ISA Server can generate the forms used by Outlook Web Access sites for forms-based authentication. This enhances security for remote access to Outlook Web Access sites by preventing unauthenticated users from contacting the Outlook Web Access server.

For more information about authentication, see Authentication Methods for Web Requests.

Get latest ISA Server content at ISA Server Guidance.


HTTP filter

Microsoft Internet Security and Acceleration (ISA) Server 2004 can perform stateful inspection, in addition to stateful filtering. Stateful inspection enables ISA Server to examine application layer commands and data. ISA Server can block the attack code passing through the stateful filtering mechanism because the packets are subsequently passed to the stateful inspection mechanism. The ISA Server stateful application layer filter examines Hypertext Transfer Protocol (HTTP) commands and data, and blocks packets from being passed to the Web server on the corporate network. This stops the attacks at the perimeter.

The HTTP filter is a Web filter that allows you to block HTTP requests based on the Content-Type HTTP header and on the following:

  • Length of request payload. For instructions, see Limit request payload length.
  • Length of URL. For instructions, see Limit URLs that can be specified in a request.
  • HTTP request method. For example, the request method POST, GET, or HEAD may be used. For instructions, see Block specified HTTP methods.
  • HTTP request file name extension. For example, the file name extension may be .exe, .asp, or .dll. For instructions, see Block specified HTTP extensions.
  • HTTP request or response header. For example, the request or response header may be Location, Server, or Via. For instructions, see Block specified HTTP headers.
  • Signature or pattern in the request or response headers or body. For instructions, see Block specified HTTP signatures.

The HTTP filter is initially configured with defaults that help ensure secure HTTP access. However, depending on your specific deployment scenario, you should customize these defaults. For example, for Web publishing scenarios, allow these methods: OPTIONS, TRACE, GET, HEAD, and POST.

Notes

  • When you block specific signatures, you are blocking applications that tunnel traffic over HTTP and can be characterized by specific patterns in request headers, response headers, and body (for example, Windows Messenger). HTTP signature blocking will not block applications that use different types of content encoding or range requests.
  • It is assumed that all HTTP requests and responses are UTF-8 encoded. If a different encoding scheme is used, signature blocking cannot be performed.

Configuring extensions

When the HTTP filter is configured to allow or deny specific file name extensions, it first determines the extension. ISA Server considers an extension any character starting with a last period (.) and ending with a slash (/) or question mark (?), or to the end of the URL, if there is no / or ?. In addition, if ISA Server identifies characters after a . that seem like an extension (for example, .exe, .dll, or .com), the HTTP filter uses those as the extension.

The following table lists some examples of client requests and the file name extension that ISA Server uses for HTTP filtering.

Client request | Extension
http://server/path/file.ext | .ext
http://server/path/file.htm/additional/path/info.asp | .asp
http://MyServer/Path.exe/file.ext | .exe

In the last example listed in the table, if the HTTP filter allows .exe extensions, the request will be allowed (even if the filter does not allow .ext extensions). To work around this issue, deny the .ext signature in the URL. For instructions, see Block specified HTTP signatures.

Per-rule filtering

The HTTP filter can be configured on a per-rule basis, for Web publishing and access rules. For a given rule, you can configure which methods, extensions, and signatures are blocked.

The maximum length of headers is the only HTTP filter property that is configured for all rules that apply to HTTP. By default, it is set to 32,768 bytes. For instructions, see Limit the maximum size of a header in HTTP requests.

When the HTTP filter denies a request, the reason for denial is stored in the Filter Information field of the Web Proxy log.

Important

  • When you configure the HTTP filter, you can select to block high bit characters. When this option is selected, URLs that contains DBCS or Latin 1 characters will be blocked. This can impact scenarios such as Outlook® Web Access publishing, SharePoint™ Portal Server publishing, and any scenario in which a GET request passes a parameter that includes a character from a double-byte character set. For instructions, see Limit URLs that can be specified in a request.

For more information about common configurations, see HTTP Filtering in ISA Server 2004 (http://www.microsoft.com/).


Link Translation

Some published websites may include references to internal names of computers. Because only ISA Server—and not the whole network—is made available to external clients, these references will appear as broken links. ISA Server includes a link translation Web filter, which you can use to create a dictionary of definitions for internal computer names that map to publicly known names.

For more information, see:

  • How link translation works
  • Link translation dictionaries

Get latest ISA Server content at ISA Server Guidance.


How link translation works

Due to the ISA Server link translation Web filter's built-in functionality and its default dictionary, enabling link translation for a Web publishing rule will solve problems in simple publishing scenarios. For example, when pages on the internal Web server contain absolute Uniform Record Locators (URLs) that point to its own server name (NetBIOS name), the link translation filter returns the appropriate links that are accessible for External network users. In addition, even when those URLs contain http:// and the external user connects to the website using https://, ISA Server link translation changes the link to use https:// instead of http://. For instructions, see Replace absolute links in Web pages.

The default link translation dictionary also translates requests made to nonstandard ports. For example, if users connect to a website published on a nonstandard port on the ISA Server firewall, such as http://www.external.net:8181, link translation includes the port number in the URLs sent back to the external client.

For more complex publishing scenarios or when complex Active Server Pages (ASP) code is involved, it is necessary to configure dictionary definitions that map to the names returned by the internal website. The dictionary name mappings are configured on a per-Web publishing rule basis on ISA Server.

When link translation is enabled, ISA Server also checks the Content-type header of the response to determine whether link translation should be applied to the body of the message. (By default, link translation operates only on the HTML documents content group, although other content groups can be specified.)

Notes:

  • The link translation filter works by first looking for a Content-type header to determine whether it needs to perform translation. If no Content-type header is present, the filter will look for a Content-location header to perform translation. If neither header is present, the filter will look at the file name extension of the requested URL.
  • ISA Server only performs link translation on HTML document strings, such as internal computer names, that are specified in UTF-8 format.
  • If the website contains many links that must be translated, this may adversely impact ISA Server performance.

    When link translation dictionaries are used in Web publishing rules, the link translation filter maps text strings according to the following rules:

    1. The filter searches for the strings in the order they were added to the dictionary.
    2. If the filter finds a match to a text string, it will look at the next character to the right to determine if it is a terminating character. The following are considered terminating characters.
    Terminating characters
    \t \r \n ; ~ < ! " & '
    ( $ ) * + , / > =
    ? [ \ ] ^ ` { | }
  • If the filter finds a terminating character immediately to the right of the string, it will perform translation.

For example, consider the search string http://IntSalesA. Although the string is in both http://IntSalesA/Sales/ and http://IntSalesAfrica/, the link translation Web filter only replaces http://IntSalesA/Sales/ because f is not a terminating character.

Note that FTP:// links are not automatically added to the default link translation dictionary. You can add them to the dictionary explicitly.

Caution

  • Internal links that are not mapped in the link translation dictionary are passed as is to the user. In this way, names of internal computers are exposed and are put at risk, allowing a potential hacker to become aware of these internal names. This can be particularly dangerous for computers with meaningful names (for example, a computer named \\Firewall).

Get latest ISA Server content at ISA Server Guidance.


Link translation dictionaries

When you enable link translation for a Web publishing rule, a link translation dictionary is automatically created. In most cases, you will not need to add more entries to the default dictionary. If necessary, you can add more entries to this dictionary.

The default dictionary includes the following entries:

  • Any occurrence on the website of the computer name that is specified on the To tab of the Web publishing rule properties is replaced with the website name (or IP address).
    For example, if a rule redirects all requests for http://www.microsoft.com to an internal computer called msinternal, all occurrences of http://msinternal in the response page returned to the client are replaced with http://www.microsoft.com.
  • If a port that is not the default is specified on the incoming Web request listener, it is used when replacing links on the response page. If a default port is specified, the port is removed when replacing links on the response page.
  • If the client specifies HTTPS in the request to the ISA Server computer, ISA Server, in the response from the IIS Server computer, replaces all occurrences of HTTP with HTTPS.

Example

For example, consider a scenario where ISA Server publishes a site located on a computer with the internal name IIS_A.Org, which is available on the default HTTP port 80 and SSL port 443. ISA Server publishes the site, using its public name www.fabrikam.com, on the same default ports. A client might make the following request:

GET /dirA HTTP/1.1
Host: www.fabrikam.com

Note that the directory name in the request is not terminated by a slash (/). When the server running Internet Information Services (IIS) receives this request, it automatically returns a 302 response with the location header set to http://IIS_A.Org/dirA/, which is the internal name of the server followed by the directory name and terminated by a slash.

ISA Server translates the response header value to http://www.fabrikam.com/dirA/.

In this example, the following entries are automatically added to the link translation dictionary:

  • http://IIS_A.Org is mapped to http://www.fabrikam.com
  • http://IIS_A.Org:80 is mapped to http://www.fabrikam.com
  • https://IIS_A.Org is mapped to https://www.fabrikam.com
  • https://IIS_A.Org:443 is mapped to https://www.fabrikam.com

If an initial client request was sent on a secure connection (using SSL), all the links to the same computer will be translated to use SSL for security reasons. The following entries are automatically included in the link translation dictionary:

  • http://IIS_A.Org is mapped to https://www.fabrikam.com
  • http://IIS_A.Org:80 is mapped to https://www.fabrikam.com
  • https://IIS_A.Org is mapped to https://www.fabrikam.com
  • https://IIS_A.Org:443 is mapped to https://www.fabrikam.com

If the site uses ports other than the default ports (for example, 81 for HTTP and 444 for SSL), links will contain that port number. The port number will also be translated, as follows:

  • http://IIS_A.Org:81 is mapped to http://www.fabrikam.com
  • https://IIS_A.Org:444 is mapped to https://www.fabrikam.com

Similarly, if ISA Server publishes the site on ports that are not the default ports (for example, 82 for HTTP and 445 for SSL), links will be translated to the published ports:

  • http://IIS_A.Org is mapped to http://www.fabrikam.com:82
  • http://IIS_A.Org:80 is mapped to http://www.fabrikam.com:82
  • https://IIS_A.Org is mapped to https://www.fabrikam.com:445
  • https://IIS_A.Org:443 is mapped to https://www.fabrikam.com:445

Tips and hints on adding entries

Follow these guidelines when creating entries for the link translation dictionary:

  • Do not end the search string with a terminating character. For example, use http://IIS_A.Org and not http://IIS_A.Org/.
  • When adding an entry for a site name, also add an entry with the site name and port. For example, when adding the search string http://IIS_A.Org, also add the search string http://IIS_A.Org:80.
  • Use both http:// and https://.
  • Use caution when changing directory structures.
  • Dictionaries with a large number of entries, which are applied to websites that include many links that require translation, could detrimentally impact ISA Server performance.

Get latest ISA Server content at ISA Server Guidance.


Add-ins: How To

This section describes how to use the filtering add-ins, developed by Microsoft or by third-party vendors. These add-ins provide additional filtering functionality to Internet Security and Acceleration (ISA) Server 2004.

  • Enable or disable a filter
  • Configure H.323 filter
  • Configure Intrusion Detection Filters
  • Configure Web Filter for RSA SecurID
  • Configure SOCKS filter
  • Configure SMTP Filter

Get latest ISA Server content at ISA Server Guidance.


Enable or disable a filter

To enable or disable a filter

  1. In the console tree of ISA Server Management, click Add-ins.

    For enterprise add-ins, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Add-ins

    For array-level add-ins, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Add-ins
  2. In the details pane, click either the Application Filters tab or the Web Filters tab, and then click the applicable application filter or Web filter.
  3. On the Tasks tab, do one of the following:
    • To enable the filter, click Enable Selected Filters.
    • To disable the filter, click Disable Selected Filters.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • By disabling a filter, you disable application filtering for the applicable protocols. The recommended method of disabling application filtering is by not applying the filter to a specific protocol.
  • Add-ins can be enabled at the array level and at the enterprise level. When an add-in is enabled at the enterprise level, it is also applied to each array. Add-ins enabled at the enterprise level cannot be disabled at the array level. When an add-in is disabled at the enterprise level, the add-in can be enabled by the array administrator for each array.
  • You cannot disable the PPTP Filter and Web Proxy Filter add-ins.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure H.323 filter

To configure H.323 filter

  1. In the console tree of ISA Server Management, click Add-ins.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Add-ins
  2. In the details pane, select the H.323 Filter.
  3. On the Tasks tab, click Configure Selected Filter.
  4. On the Call Control tab, do one or more of the following:
    • To specify an H.323 gatekeeper, select the Use this Gatekeeper check box and enter the fully qualified domain name (FQDN) of the H.323 gatekeeper server.
    • To permit people in other organizations to call people within your organization, select the Allow incoming calls check box.
    • To enable DNS gatekeeper lookup, select the Use DNS gatekeeper lookup and LRQs for alias resolution check box.
    • To permit audio calls, select the Allow audio check box.
    • To permit video calls, select the Allow video check box.
    • To permit T.120 data and application sharing, select the Allow T120 and application sharing check box.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

Get latest ISA Server content at ISA Server Guidance.


Configure Intrusion Detection Filters

This section describes how to configure the intrusion detection filters included with Internet Security and Acceleration (ISA) Server 2004.

  • Enable intrusion detection of common attacks
  • Enable intrusion detection of DNS attacks
  • Log dropped packets

Get latest ISA Server content at ISA Server Guidance.


Enable intrusion detection of common attacks

To enable intrusion detection of common attacks

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • General
  2. In the details pane, click Enable Intrusion Detection and DNS Attack Detection.
  3. On the Common Attacks tab, click Enable intrusion detection.
  4. Select one or more of the following:
    • Windows out-of-band (WinNuke). Select this option when ISA Server will generate an event if an out-of-band denial of service attack is attempted against a computer protected by ISA Server.
    • Land. Select this option when ISA Server will generate an event if a TCP SYN packet is sent with a spoofed source IP address and port number that matches that of the destination IP address and port number.
    • Ping of death. Select this option when ISA Server will generate an event if an IP fragment is received with more data than the maximum IP packet size.
    • IP half scan. Select this option when ISA Server will generate an event if repeated attempts to connect to a destination computer are made and no corresponding ACK packets are communicated.
    • UDP bomb. Select this option when ISA Server will generate an event if there is an attempt to send an illegal User Datagram Protocol (UDP) packet. Although an event will be generated when the attack occurs, you must specifically enable and configure an alert to trigger an action.
    • Port scan. Select this option when ISA Server will generate an event if an attempt is made to count the services running on a computer by probing each port for a response. If you select this option, also specify the following:
      • Detect after attacks on well-known ports. Type the maximum number of well-known ports that can be scanned before generating an event when a port scan attack is detected. A well-known port is any port in the range from 1 through 2048.
      • Detect after attacks on ports. Type the maximum number of ports that can be scanned before generating an event when a port scan attack is detected.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Enable intrusion detection of DNS attacks

To enable intrusion detection of DNS attacks

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • General
  2. In the details pane, click Enable Intrusion Detection and DNS Attack Detection.
  3. On the DNS Attacks tab, click Enable detection and filtering of DNS attacks.
  4. Select one or more of the following:
    • DNS host name overflow. If ISA Server should check for DNS host name overflow intrusion attempts. The DNS intrusion detection filter intercepts and analyzes DNS traffic destined for the Internal network. A DNS host name overflow intrusion occurs when a DNS response for a host name exceeds a certain fixed length.
    • DNS length overflow. If ISA Server should check for DNS length overflow intrusion attempts. A DNS length overflow intrusion occurs when a DNS response for IP addresses exceeds a specified length of 4 bytes.
    • DNS zone transfer. If ISA Server should check for DNS zone transfer intrusion attempts. A DNS zone transfer intrusion occurs when a client system uses a DNS client application to transfer zones from an internal DNS server.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Log dropped packets

To log dropped packets

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • General
  2. In the details pane, click Enable Intrusion Detection and DNS Attack Detection.
  3. On the Common Attacks tab, click Log dropped packets.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • By default, when you install ISA Server, all dropped packets are logged.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure Web Filter for RSA SecurID

This section describes how to configure Internet Security and Acceleration (ISA) Server 2004 for RSA ACE/Agent and RSA ACE/Server.

  • Set up the ISA Server computer as an RSA ACE/Agent
  • Verify that ISA Server can authenticate against the RSA ACE/Server

Get latest ISA Server content at ISA Server Guidance.


Set up the ISA Server computer as an RSA ACE/Agent

To set up the ISA Server computer as an RSA ACE/Agent

  • Copy the Sdconf.rec file, located in the ACE\Data folder on the RSA ACE/Server computer, to the %windir%\system32 folder on the ISA Server computer.

Note

  • If you are using a version of RSA Ace/Server earlier than 5.0, perform the following steps:
    1. On the RSA ACE/Server computer, click Start, click Programs, click RSA ACE Server, and then click Database Administration - Host Mode.
    2. On the Agent Host menu, click Add Agent Host.
    3. In Name, type the name of the ISA Server computer.
    4. In Network address, type the IP address of the ISA Server computer, if it did not appear.
    5. In Agent Host, click Generate Configuration File, click One Agent Host, click OK, double-click the name of the ISA Server computer, and save the Sdconf.rec file in a folder on the computer.
    6. Copy the Sdconf.rec file to the %windir%\system32 folder on the ISA Server computer.

Related Topics

Get latest ISA Server content at ISA Server Guidance.


Verify that ISA Server can authenticate against the RSA ACE/Server

To verify that ISA Server can authenticate against the RSA ACE/Server

  1. Copy Sdtest.exe from the \Tools folder CD or from the shared folder on your network that contains the ISA Server files to the ISA Server installation folder.
  2. Run Sdtest.exe.
  3. In RSA SecurID Authentication Information, click RSA ACE/Server Test Directly.
  4. In RSA SecurID Authentication, type the user name in Enter User Name and the passcode in Enter PASSCODE.
  5. Click OK when the Authentication successful message appears.

Important

  • Because the Web filter for RSA SecurID authentication communicates and authenticates with the RSA ACE/Server, the ISA Server computer must be able to communicate and authenticate against the RSA ACE/Server.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Configure SOCKS filter

To configure SOCKS filter

  1. In the console tree of ISA Server Management, click Add-ins.

    For enterprise add-ins, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Enterprise
    • Enterprise Add-ins

    For array-level add-ins, where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Add-ins
  2. In the details pane, select the SOCKS V4 Filter.
  3. On the Tasks tab, click Configure Selected Filter.
  4. On the General tab, for enterprise-level SOCKS filter, select Enable this filter for all arrays. For array-level SOCKS filter, select Enable this filter.
  5. For array-level SOCKS filter, on the Networks tab, in Port, type the port number on which ISA Server will listen for SOCKS requests.
  6. For array-level SOCKS filter, select one or more networks on which ISA Server will listen for SOCKS requests.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you disable the enterprise-level SOCKS filter, the array-level filter can be enabled, on a per-array basis.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure SMTP Filter

This section describes how to configure the SMTP filter included with Internet Security and Acceleration (ISA) Server 2004.

  • Install Message Screener
  • Configure SMTPCred tool
  • Configure SMTP filter buffer overflow thresholds
  • Stop users from gaining access to the SMTP server
  • Stop domains from gaining access to the SMTP server
  • Filter e-mail attachments
  • Filter e-mail messages by keyword

Get latest ISA Server content at ISA Server Guidance.


Install Message Screener

To install Message Screener

  1. At a command prompt, type:
    Path\ISAAutorun.exe
    where Path is the path to the ISA Server 2004 installation files. The path may be the root folder of the ISA Server CD or a shared folder on your network that contains the ISA Server files.
  2. On the Welcome screen, click Next. Follow the on-screen instructions.
  3. On the License Agreement screen, click I accept the terms of the license agreement, and then click Next.
  4. On the Customer Information screen, fill in the information, and then click Next.
  5. On the Setup Scenarios screen, select Install ISA Server Management, and then click Next.
  6. On the Component Selection screen, do the following:
    • Click ISA Server Management, and then click This feature will not be available.
    • Click Message Screener, and then click This feature will be installed on the local hard drive.
    Then, click Next.
  7. Click Install.

Notes

  • To perform this procedure, you must be a member of the Administrators group.
  • Message Screener must be installed on a Simple Mail Transfer Protocol (SMTP) server, which is typically not your ISA Server computer.
  • The user account specified for configuring SMTP Message Screener must have read access to the ISA Server computer.
  • The SMTP server that runs Message Screener can pass these credentials by using the SMTPCred tool. For instructions, see Configure SMTPCred tool.
  • If you do not install Message Screener on the ISA Server computer, you must create an access rule allowing Message Screener access to the Local Host network, using the MS Firewall Control protocol.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure SMTPCred tool

To configure SMTPCred tool

  1. Run the SMTPCred tool by typing SMTPCred.exe at a command prompt.
  2. In the message box, type the name or IP address of the ISA Server computer.
  3. Type the domain name, administrator name, and password in the applicable text boxes.
  4. Click Test.

Notes

  • By default, the SMTPCred.exe tool is located in the ISA Server installation folder.
  • The user account specified for configuring SMTP Message Screener must be a user with ISA Server Array Auditor permissions on the ISA Server computer.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance.


Configure SMTP filter buffer overflow thresholds

To configure SMTP filter buffer overflow thresholds

  1. In the console tree of ISA Server Management, click Add-ins.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Add-ins
  2. In the details pane, on the Application Filters tab, click SMTP Filter.
  3. On the Tasks tab, click Configure Selected Filter.
  4. On the SMTP Commands tab, click the applicable command, and then click Edit.
  5. In SMTP Command Rule, select Enable SMTP command.
  6. In Maximum Length, type the maximum length of the command line for the commands.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To add a new command, click Add and type the command name in SMTP Command Rule.
  • When a client uses a command that is defined but disabled, the filter closes that connection.
  • When a client uses a command that is unrecognized by the SMTP filter, no filtering is performed on that message.
  • Only commands on incoming traffic are filtered by the SMTP filter.
  • Only simple SMTP commands can be added.
  • If a client uses the TURN command, all e-mail messages will be dropped by the filter.
  • The RFC considers the AUTH command as part of the MAIL FROM command. For this reason, the SMTP filter blocks MAIL FROM commands only when they exceed the length of the MAIL FROM and AUTH commands issued (when AUTH is enabled). For example, if you specify a maximum length of MAIL FROM as 266 bytes and AUTH as 1,024 bytes, the message will be blocked only if the MAIL FROM command exceeds 1,290 bytes.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Stop users from gaining access to the SMTP server

To stop users from gaining access to the SMTP server

  1. In the console tree of ISA Server Management, click Add-ins.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Add-ins
  2. In the details pane, on the Application Filters tab, click SMTP Filter.
  3. On the Tasks tab, click Configure Selected Filter.
  4. On the Users/Domains tab, in Sender's email address, type the e-mail address of a sender who will be denied access to the SMTP server, and then click Add.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Message Screener must be installed and enabled to use this functionality.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Stop domains from gaining access to the SMTP server

To stop domains from gaining access to the SMTP server

  1. In the console tree of ISA Server Management, click Add-ins.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Add-ins
  2. In the details pane, on the Application Filters tab, click SMTP Filter.
  3. On the Tasks tab, click Configure Selected Filter.
  4. On the Users/Domains tab, in Domain name, type the name of a domain whose users are denied access to the SMTP server, and then click Add.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Message Screener must be installed and enabled to use this functionality.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Filter e-mail attachments

To filter e-mail attachments

  1. In the console tree of ISA Server Management, click Add-ins.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Add-ins
  2. In the details pane, on the Application Filters tab, click SMTP Filter.
  3. On the Tasks tab, click Configure Selected Filter.
  4. On the Attachments tab, click Add.
  5. In Mail Attachment Rule, select the Enable this rule check box.
  6. Select one of the following and type the appropriate information:
    • Attachment name. Type the name of the attachment.
    • Attachment extension. Type the extension of the attachment.
    • Attachment size limit. Type the maximum size of the attachment.
  7. In Action, select one of the following:
    • Delete message
    • Hold message
    • Forward message to
  8. If you selected Forward message to, type one or more addresses, separated by semicolons (;), to which the message should be forwarded.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Message Screener must be installed and enabled to use this functionality.
  • To change the order in which actions will be applied to the condition, click the up or down arrows.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Filter e-mail messages by keyword

To filter e-mail messages by keyword

  1. In the console tree of ISA Server Management, click Add-ins.

    Where?

    • Microsoft Internet Security and Acceleration Server 2004
    • Arrays
    • Array_Name
    • Configuration
    • Add-ins
  2. In the details pane, on the Application Filters tab, click SMTP Filter.
  3. On the Tasks tab, click Configure Selected Filter.
  4. On the Keywords tab, click Add.
  5. Click Enable this rule.
  6. In Keyword, type a string to which the rule applies.
  7. In Apply action if keyword is found in, select one of the following:
    • Message subject or body
    • Message subject
    • Message body
  8. In Action, select one of the following:
    • Delete message
    • Hold message
    • Forward message to. Then, type one or more addresses, separated by semicolons (;), to which the message should be forwarded.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Message Screener must be installed and enabled to use this functionality.
  • To change the order in which actions will be applied to the condition, click the up or down arrows.

Related Topics

web link Get latest ISA Server content at ISA Server Guidance (http://www.microsoft.com/).


Deployment scenario: SMTP filter

The SMTP filter always runs on the ISA Server computer. However, you can place the SMTP Message Screener on another computer located on the protected network behind the ISA Server computer. The SMTP Message Screener can be installed in the following locations:

  • On the ISA Server computer
  • On an independent SMTP relay located behind the ISA Server computer
  • On the Exchange server

Message filtering requires a significant amount of processing power. For this reason, most organizations prefer to put the SMTP Message Screener on the ISA Server computer or on an SMTP relay located somewhere on the corporate network, so as not to overload the Exchange server.

The SMTP Message Screener can be installed on an SMTP relay computer on the corporate network running the Internet Information Services (IIS) 6.0 or IIS 5.0 SMTP service. The ISA Server computer publishes the SMTP relay on the Internal network, and the Message Screener blocks dangerous e-mail messages at the SMTP relay computer. The SMTP Message Screener communicates with the SMTP filter to obtain information about which e-mail messages should be blocked.

For more background information, see SMTP filtering. For a detailed deployment scenario, see SMTP Message Screening (http://www.microsoft.com/) on the ISA Server website.

Get latest ISA Server content at ISA Server Guidance.


Deployment Scenarios

Microsoft Internet Security and Acceleration (ISA) Server 2004 provides value to information technology (IT) managers, network administrators, and information security professionals in organizations of all sizes who are concerned about the security, performance, manageability, or operating costs of their networks. Organizations can deploy ISA Server in numerous networking scenarios.

  • Deployment scenario: getting Started with ISA Server
  • ISA Server in a workgroup
  • Internet edge firewall
  • Branch office firewall
  • Publishing scenarios: ISA Server and Exchange server

Additional scenarios

As the Internet continues to evolve and new applications are introduced, the ability of ISA Server to protect the network will continue to prove effective. For new or updated documentation, check the ISA Server Guidance (http://www.microsoft.com/) Web site.


Getting started managing an array

As an array administrator, you can perform the following steps to manage the array:

  1. Install additional array members. You can add additional array members to this array. For more instructions, see Install a computer running ISA Server services.
  2. Specify a Configuration Storage server. Specify the Configuration Storage server used by this array. For fault tolerance, also specify an alternate Configuration Storage server. For instructions, see Specify a Configuration Storage server for this array.
  3. Deploy Firewall Client software. Although this specific scenario focuses on allowing access to Web sites, there are many security advantages to deploying Firewall Client software. For more information, see Client requirements assessment.
  4. Apply your Microsoft Internet Security and Acceleration (ISA) Server 2004 network configuration. ISA Server includes several predefined network templates. You should choose the network template that most closely approximates your actual network. For this scenario, select the Edge Firewall network template, and then select the Unrestricted Internet access firewall policy, because all users on the corporate network are allowed access to the Internet. For instructions on configuring network templates, see Network Templates.
  5. Define how ISA Server caches Web content. Because clients on the corporate network will likely access similar Web sites, you improve network performance by implementing a caching policy. For more information, see Cache overview.
  6. If clients will require remote access, configure VPN access. For more information, see Remote VPN client access.

For more information about common deployment scenarios, see the Getting Started Guide (http://www.microsoft.com/), available on the ISA Server Web site.


ISA Server in a workgroup

A workgroup is a simple grouping of computers, which exists primarily to help users locate printers and folders shared by the group. Workgroups do not offer the centralized user accounts and authentication offered by domains. You may want to install the array members running Microsoft Internet Security and Acceleration (ISA) Server 2004 services in a workgroup specifically because the workgroup is separated from your domain. That is, you may have specific reasons for wanting to isolate a small portion of your corporate network from the domain.

For example, you may want to install an ISA Server array in a workgroup for:

  • Web publishing
  • Outlook Web Access publishing
  • Handling of virtual private network (VPN) connections

For instructions on installing ISA Server in a workgroup, see Installation considerations for workgroup and untrusted domain deployment.

When you set up ISA Server array members in a workgroup, you must create mirrored user accounts on all of the computers in the array. Mirrored accounts are identical local users (user name and password) that you create on each computer in the array. You will use the credentials of this user when you open ISA Server Management and want to connect to the workgroup array. These users should be created on all other arrays in the enterprise that are in workgroups. In this way, you can manage all the arrays in the enterprise from a single ISA Server Management console. For more information, see Roles for domain and workgroup.

For detailed information about how to deploy ISA Server in a workgroup environment, see ISA Server 2004 Enterprise Edition in a Workgroup (http://www.microsoft.com/).

Workgroup clients

Because the workgroup cannot access domain user accounts, workgroup clients cannot be authenticated using Windows authentication. You can use RADIUS authentication or RSA SecurID® authentication to authenticate clients.

User mapping of VPN clients relies on access to domain user accounts, and should not be used in a workgroup scenario. Make sure that the Enable User Mapping check box is cleared (its default condition), on the User Mapping tab of the VPN Clients properties page.

Firewall Client software also depends on access to domain user accounts. Therefore, the Firewall Client will not work in a workgroup setting.


Internet edge firewall

Microsoft Internet Security and Acceleration (ISA) Server 2004 can be deployed as a dedicated Internet edge firewall acting as the secure gateway to the Internet for internal clients. The ISA Server computer is transparent to the others in the communication path. Internet users should not be able to know that a firewall server is present, unless the user attempts to access a network service, protocol, or site where the ISA Server computer denies access. By setting the security access policies, administrators can prevent unauthorized access and malicious content from entering the network.

Key features include:

  • Multilayered traffic screening—packet level, circuit level, and application level filtering.
  • Intelligent application layer aware application filters.
  • Built-in intrusion detection.
  • System hardening for locking down the base operating system.

For detailed information about scenarios on how to control Internet access using ISA Server, see Controlling Secure Internet Access Using ISA Server (http://www.microsoft.com/).


Branch office firewall

Microsoft Internet Security and Acceleration (ISA) Server 2004 can be used to connect branch office networks to the main office using site-to-site virtual private network (VPN) connections. You can place ISA Server at a branch office where it can act as a firewall protecting the branch office network and as a VPN gateway that connects the branch office network to the main office network. The improved VPN interoperability features of ISA Server allow it to create site-to-site links with any VPN solution you currently have in place.

Key features include:

  • Internet Protocol security (IPsec) tunnel mode support for site-to-site links with third-party VPN gateways.
  • Point-to-Point Tunneling Protocol (PPTP) and Layer Two Tunneling Protocol (L2TP) over IPsec for site-to-site links with Microsoft VPN gateways.
  • Stateful inspection over the site-to-site link that limits what remote networks can access on the main office network.
  • ISA Server firewall control for inbound and outbound access from and to the Internet at the branch office.
  • Intelligent application layer filtering that statefully inspects traffic between VPN connected local area networks (LANs).

For detailed information about setting up a branch office scenario, see Branch Configuration Scenarios in ISA Server 2004 Enterprise Edition (http://www.microsoft.com/). Also, for detailed information about how to use VPN in a branch office scenario, see Site-to-Site VPN in ISA Server 2004 Enterprise Edition (http://www.microsoft.com/).


Access to back-end Configuration Storage server

When you apply the Front Firewall network template, Microsoft Internet Security and Acceleration (ISA) Server 2004 configures network rules and firewall policy rules, in accordance with the specific policy you specify. For information, see Front Firewall network template.

The Configuration Storage server used by the computer running ISA Server services (at the front end) might be located behind another ISA Server computer (at the back end), as illustrated in the network template diagram on the Networks tab.

To allow the front-end ISA Server computer access to the Configuration Storage server, you must create a server publishing rule on the back-end ISA Server computer with the following parameters:

  1. Set the IP address of the published server to the IP address of the Configuration Storage server.
  2. Set the protocol to MS Firewall Storage Server.
  3. Set the source to the IP address of the front-end ISA Server computer. To do this, you should create a computer element with that IP address and specify the computer on the From tab.
  4. Set the network listener to External.

When you specify an alternate Configuration Storage server (for failover), be sure to also publish that server.

Configuration Storage server name

When you install a computer running ISA Server services, you specify the Configuration Storage server it should use. The Configuration Storage server can also be specified after installation, using the Configuration Storage Server Connection Wizard.

If the front-end ISA Server computer belongs to a domain, the name that you specify for the Configuration Storage server should resolve to the Configuration Storage server or to the back-end ISA Server computer, depending on the network relationship.

If the front-end ISA Server computer belongs a workgroup, a certificate must be installed to allow communication with the Configuration Storage server. The name specified for the Configuration Storage server should match the certificate located on the Configuration Storage server. This name must resolve to the Configuration Storage server (when a route relationship is configured between the networks) and to the back-end ISA Server computer (when a network address translation (NAT) relationship is configured between the networks).

If the front-end ISA Server computer belongs to a domain, the name that you specify for the Configuration Storage server should resolve to the Configuration Storage server (when a route relationship is configured between the networks) and to the back-end ISA Server computer (when a NAT relationship is configured between the networks).

For more information about network rules, see Network rules.

web link Get latest ISA Server content at ISA Server Guidance.


Publishing scenarios: ISA Server and Exchange Server

Microsoft Internet Security and Acceleration (ISA) Server 2004 allows organizations to publish services to the Internet without compromising internal network security. Organizations can configure Web publishing rules and server publishing rules that determine which requests are sent downstream to a server located behind the computer running ISA Server services, providing an increased layer of security for their internal servers. All forwarded communications are exposed to the ISA Server stateful filtering and inspection engines. For example, a Microsoft Exchange Server computer can be placed behind ISA Server, and server publishing rules can be created that allow Secure Sockets Layer (SSL) remote access to Exchange Simple Mail Transfer Protocol (SMTP), Post Office Protocol 3 (POP3), Internet Mail Access Protocol 4 (IMAP4), and Network-to-Network Transport Protocol (NNTP) services. Incoming e-mail messages to the Exchange server are intercepted by the ISA Server SMTP Message Screener, which appears as an e-mail server to clients. The ISA Server SMTP Message Screener can then filter the SMTP traffic and forward it to the Exchange server. The Exchange server is never directly exposed to external users and remains in a secure environment, maintaining access to other internal network services.

Key features include:

  • Easy-to-use secure server publishing wizards.
  • SecureNAT for transparent client connections and server publishing.
  • Published services including Hypertext Transfer Protocol/Secure Sockets Layer (HTTP/SSL), FTP, SMTP, POP3, IMAP4, NNTP, DNS, RDP, H.323, streaming media, and more.
  • Secure Outlook® Web Access publishing. For detailed information about how to publish Outlook Web Access using ISA Server, see Outlook Web Access Server Publishing in ISA Server (http://www.microsoft.com/).
  • Secure Internet Information Services (IIS) Web site publishing. For detailed information about secure IIS publishing using ISA Server, see Publishing Web Servers Using ISA Server (http://www.microsoft.com/).
  • Secure Exchange remote procedure call (RPC) publishing. For detailed information about secure Exchange RPC publishing using ISA Server, see Publishing Exchange Servers Using ISA Server (http://www.microsoft.com/).
  • User-based and group-based access control for all Internet protocols and services.
  • Spam filtering SMTP Message Screener.
  • Web Proxy chaining with upstream Web Proxy servers.

Secure Exchange Server SSL VPN

SSL virtual private networks (VPNs) are becoming increasingly popular because of their ability to provide application-specific, clientless secure access to internal network resources. ISA Server has an improved Outlook Web Access Wizard that allows you to give remote users secure access to Outlook Web Access with an end-to-end SSL VPN. The SSL VPN can leverage ISA Server SSL-to-SSL bridging to allow deep HTTP content inspection. Delegation of Basic authentication and forms-based authentication further protect the Outlook Web Access SSL VPN by preventing unauthenticated sessions with the Outlook Web Access Web site.

Key features include:

  • Easy-to-use Outlook Web Access Publishing Wizard.
  • Clientless SSL VPN to Exchange Outlook Web Access through SSL VPN.
  • End-to-end security through the unique SSL-to-SSL bridging of ISA Server.
  • Delegation of Basic authentication to prevent unauthenticated access to the Outlook Web Access Web site.
  • Forms-based authentication to allow the firewall administrator to set session time-outs and prevent users from accessing attachments.
  • Deep HTTP application layer inspection to prevent users from uploading files through an Outlook Web Access connection.
  • Certificates for SSL connections, generated by Microsoft Certificate Services or obtained from a third-party certificate provider.


Additional Resources

  • Accessibility for ISA Server Management
  • Log Code Values
  • Performance Counters

Get latest ISA Server content at ISA Server Guidance.


Accessibility for ISA Server Management

In addition to Microsoft® Windows Server™ 2003 (or Windows® 2000 Server) and Microsoft Management Console (MMC) accessibility products and services, Microsoft Internet Security and Acceleration (ISA) Server 2004 provides keyboard shortcuts for selecting commands and for navigating in and between console panes.

Navigation

As with any MMC snap-in, you can browse ISA Server Management console tree by expanding and collapsing branches by clicking the plus sign and minus sign, or by double-clicking with the mouse. The following table lists the keystrokes you can use to move in and between console panes.

Keystroke action | Result
TAB | Moves forward between panes in the active window.
SHIFT+TAB | Moves backward between panes in the active window.
UP ARROW | Moves the selection up one item in a pane.
DOWN ARROW | Moves the selection down one item in a pane.
PAGE UP | Moves the selection to the top item visible in a pane.
PAGE DOWN | Moves the selection to the bottom item visible in a pane.
HOME | Moves the selection to the first item in a pane.
END | Moves the selection to the last displayed item in a pane.
RIGHT ARROW | Expands the selected item.
LEFT ARROW | Collapses the selected item. If the selected item does not contain hidden items, functions like the UP ARROW.

The following table lists the mouse actions you can use to move through the ISA Server Management console tree.

Mouse action | Result
Click | Selects an item.
Double-click | Displays or hides items contained by the selected item. Displays properties for or opens an item.
Right-click | Displays the shortcut menu for the selected item.

Navigation between tabs

You can move between tabs by using the Switch to command on the View menu. Press ALT+V to access the View menu, and then press W to access the Switch to command. Then, click the applicable keyboard shortcut to access the tab.

If the tab contains a list, to select an item in the list, use the DOWN ARROW key.

Keyboard shortcuts

The following table lists the keyboard shortcuts for the menu commands in ISA Server Management.

Action | Result
F1 | Opens the Help topic, if any, for the selected item.
Space bar | Opens help link.
F5 | Refreshes the content of all console panes.
ENTER | Displays the properties dialog box, if any, for the selected item.
ALT+SPACEBAR | Displays the ISA Server Management window menu.
ALT+F4 | Closes the snap-in.
ALT+A | Displays the Action menu.
ALT+V | Displays the View menu.
ALT+F | Displays the File menu.
ALT+H | Displays the Help menu.

web link Get latest ISA Server content at ISA Server Guidance.


Log Code Values

  • Action log values
  • Cache info log values
  • Error information log values
  • Operating system log values
  • Object source log values
  • Result code log values

Get latest ISA Server content at ISA Server Guidance.


Action log values

The Firewall log can include an action field. For more information, see Log viewer and Microsoft Firewall service log fields. The following table lists the possible action values.

MSDE value | String in text log
0 | -
1 | Bind
2 | Listen
3 | GHBN
4 | GHBA
5 | Redirect-bind
6 | Establish
7 | Terminate
8 | Denied
9 | Allowed
10 | Failed
11 | Intermediate
12 | Successful Connection
13 | Unsuccessful Connection
14 | Disconnection
15 | User cleared Quarantine
16 | Quarantine timeout

Get latest ISA Server content at ISA Server Guidance.


Cache info log values

The Web Proxy log can include a cache info field that specifies the cache status of the object, which indicates why the object was or was not cached. The following table lists the possible cache info values.

Value | Description
0x00000001 | Request should not be served from the cache.
0x00000002 | Request includes the IF-MODIFIED-SINCE header.
0x00000004 | Request includes one of these headers: CACHE-CONTROL:NO-CACHE or PRAGMA:NO-CACHE.
0x00000008 | Request includes the AUTHORIZATION header.
0x00000010 | Request includes the VIA header.
0x00000020 | Request includes the IF-MATCH header.
0x00000040 | Request includes the RANGE header.
0x00000080 | Request includes the CACHE-CONTROL: NO-STORE header.
0x00000100 | Request includes the CACHE-CONTROL: MAX-AGE, CACHE-CONTROL: MAX-STALE, or CACHE-CONTROL: MIN-FRESH header.
0x00000200 | Cache could not be updated.
0x00000400 | IF-MODIFIED-SINCE time specified in the request is newer than cached LASTMODIFIED time.
0x00000800 | Request includes the CACHE-CONTROL: ONLY-IF-CACHED header.
0x00001000 | Request includes the IF-NONE-MATCH header.
0x00002000 | Request includes the IF-UNMODIFIED-SINCE header.
0x00004000 | Request includes the IF-RANGE header.
0x00008000 | More than one VARY header.
0x00010000 | Response includes the CACHE-CONTROL: PUBLIC header.
0x00020000 | Response includes the CACHE-CONTROL: PRIVATE header.
0x00040000 | Response includes the CACHE-CONTROL: NO-CACHE or PRAGMA: NO-CACHE header.
0x00080000 | Response includes the CACHE-CONTROL: NO-STORE header.
0x00100000 | Response includes either the CACHE-CONTROL: MUST-REVALIDATE or CACHE-CONTROL: PROXY-REVALIDATE header.
0x00200000 | Response includes the CACHE-CONTROL: MAX-AGE or S-MAXAGE header.
0x00400000 | Response includes the VARY header.
0x00800000 | Response includes the LAST-MODIFIED header.
0x01000000 | Response includes the EXPIRES header.
0x02000000 | Response includes the SET-COOKIE header.
0x04000000 | Response includes the WWW-AUTHENTICATE header.
0x08000000 | Response includes the VIA header.
0x10000000 | Response includes the AGE header.
0x20000000 | Response includes the TRANSFER-ENCODING header.
0x40000000 | Response should not be cached.

Get latest ISA Server content at ISA Server Guidance.


Error information log values

The Web Proxy log can include an error information field. For more information, see Log viewer and Web Proxy log fields. The following table lists the possible values.

MSDE value | Description
0x00000001 | Error receiving packets from client
0x00000002 | Error sending packets to client
0x00000004 | Error sending packets to server
0x00000008 | Error receiving packets from server
0x00000040 | Error while connecting
0x00000080 | Connection with client is "Keep-Alive"
0x00000100 | Connection with upstream server is "Keep-Alive"
0x00000200 | Client's request includes a body (of non-zero content length)
0x00000400 | Server's response includes a body (of non-zero content length)
0x00000800 | Name resolution made using DNS cache

Get latest ISA Server content at ISA Server Guidance.


Operating system log values

The Web Proxy and Firewall logs can include a Client Agent field that specifies the operating system initiating the request. The following table lists the possible operating system values.

Value | Description
0:3.1 | Windows® 3.1
0:3.11 | Windows for Workgroups
0:3.95 | Windows 95 (16-bit)
1:3.11 | Win32s
2:4.0 | Windows 95 (32-bit)
2:4.10 | Windows 98
2:4.90 | Windows Millennium Edition
3:3.1 | Windows NT® 3.1
3:3.5 | Windows NT 3.5
3:3.51 | Windows NT 3.51
3:4.0 | Windows NT 4.0
3:5.0 | Windows 2000
3:5.1 | Windows XP
3:5.2 | Windows Server™ 2003

If ISA Server does not recognize the operating system, the log field value is set to Unknown.

Get latest ISA Server content at ISA Server Guidance.


Object source log values

The Web Proxy log can include an object source field that specifies the source that was used to retrieve the current object. For more information, see Log viewer and Web Proxy log fields. The following table lists the possible object source values.

Source values | String in text log | Description
0 | (None) | No source information is available.
1 | Cache | Source is the cache. Object returned from cache.
2 | Verified Cache | Source is the cache. Object was verified to source and had not been modified.
3 | Not Verified Cache | Source is the cache. Object could not be verified to source.
4 | Verify Failed Internet | Source is the Internet. The object in the cache was not valid, and was retrieved from the Internet.
5 | Internet | Source is the Internet. Object added to cache.
7 | Upstream | Object returned from an upstream proxy cache.
8 | Not Modified | Source is the cache. Client performed an If-Modified-Since request and object had not been modified.

Get latest ISA Server content at ISA Server Guidance.


Result code log values

The Web Proxy and Firewall logs can include a result code field that specifies the status of the request. In the Web proxy log, this field indicates the HTTP status code. In the Firewall log, this field indicates the result code.

In the Firewall log, the result code field represents an error. It can be one of the following:

  • A Windows-based HRESULT error code
  • An ISA Server service error code. These errors typically begin with 0xC00. Error text typically includes FWX_E_.

The HTTP Status Code column represents an http error (from the web proxy). It can get one of the following values:

  • An HTTP response code, as defined in the HTTP RFC. For a list of HTTP response codes, see the Platform SDK (http://www.microsoft.com/).
  • A Winsock error code. For a list of Winsock error codes, see MSDN (http://www.microsoft.com/).
  • An ISA Server Web Proxy error code. These errors also include a description.

Get latest ISA Server content at ISA Server Guidance.


Performance Counters

This section describes Internet Security and Acceleration (ISA) Server 2004 performance counters. For information about specific counters, see:

  • Firewall Engine performance counters
  • H.323 filter performance counters
  • Cache performance counters
  • Microsoft Firewall service performance counters
  • SOCKS filter performance counters
  • Web Proxy performance counters

Load monitoring

To monitor general performance, closely monitor the following counters.

Category | Counter name
ISA Server Firewall Engine | Active Connections
ISA Server Firewall Service | Active Sessions
ISA Server Web Proxy | Requests per second
ISA Server Firewall Engine | Bytes/sec

Security monitoring

To monitor general security threats, closely monitor the following counters.

Category | Counter name
ISA Server Firewall Engine | Dropped packets/sec
ISA Server Firewall Engine | Packets/sec
ISA Server Firewall Engine | Connections/sec
ISA Server Web Proxy | Current Average Milliseconds/request

Get latest ISA Server content at ISA Server Guidance.


Firewall Engine performance counters

The following table lists the performance counters for the Firewall Engine.

Performance counter | Description
Active Connections | The total number of active connections currently passing data.
Connections/sec | The number of new connections created per second.
TCP Established Connections/sec | The number of TCP connections newly established per second. A TCP connection is counted as established after the 3-way SYN handshake was completed successfully.
Bytes | The total number of bytes that passed through ISA Server.
Bytes/sec | The number of bytes passed through ISA Server per second.
Packets | The total number of packets inspected by ISA Server.
Packets/sec | The number of packets inspected by ISA Server per second.
Allowed Packets | The total number of packets that ISA Server allows to pass.
Allowed Packets/sec | The number of packets per second that ISA Server allows to pass.
Dropped Packets | The number of packets dropped by ISA Server.
Dropped Packets/sec | The number of packets dropped by ISA Server per second.
Backlogged Packets | The number of backlogged packets.

Get latest ISA Server content at ISA Server Guidance.


H.323 filter performance counters

The following table lists the H.323 filter performance counters.

Performance counter | Description
Total H.323 Calls | The total number of H.323 calls handled by the H.323 filter since the Firewall Service was started.
Active H.323 Calls | The number of H.323 calls that are currently active

Get latest ISA Server content at ISA Server Guidance.


Cache performance counters

The following table lists the performance counters for the Microsoft Internet Security and Acceleration (ISA) Server 2004 cache.

Counter | Description
Disk Bytes Retrieve Rate (KB/sec) | Measures the rate at which bytes of data are retrieved from the disk cache. This counter is similar to the Disk URL Retrieve Rate counter, but monitors bytes, rather than URLs.
Disk Cache Allocated Space (KB) | Measures how much space is being used by the disk cache. It will be equal to or less than the amount configured for the disk cache.
Disk Content Write Rate (Writes/sec) | Measures the number of writes per second to the disk cache for the purpose of writing URL content to the cache disk.
Disk Failure Rate (Failures/sec) | Measures the number of input/output (I/O) failures per second. An I/O failure occurs when ISA Server fails to read from or write to the disk cache. This counter, with the Total Disk Failures counter, will clearly indicate disk cache problems.
Disk URL Retrieve Rate (URL/sec) | Measures how many URLs are sent to clients from the disk cache in one second. This is a useful counter to measure at peak and off-peak times to check how the disk cache is performing. It can be compared with the Memory URL Retrieve Rate counter to determine how cache disk and memory are being utilized.
Max URLs Cached | Measures the maximum number of URLs that have been stored in the cache.
Memory Bytes Retrieved Rate (KB/sec) | Measures the rate at which bytes of data are retrieved from the memory cache. This counter is similar to the Memory URL Retrieve Rate counter, but monitors bytes, rather than URLs.
Memory Cache Allocated Space (KB) | Measures how much space is being used by the memory cache. It should be equal to or less than the amount configured for the memory cache.
Memory URL Retrieve Rate (URL/sec) | Measures how many URLs are sent to clients from the memory cache in one second. This is a useful counter to measure at peak and off-peak times, to check how the memory cache is performing and whether available memory allocated for caching purposes is being used efficiently.
Memory Usage Ratio Percent (%) | Shows the percentage of the total amount of cache fetches that are from the memory cache. A high percentage may indicate that it is worthwhile allocating more available memory resources to the cache. A low percentage may indicate that memory resources may be better used elsewhere.
Total Disk Bytes Retrieved (KB) | Measures the cumulative number of disk bytes that have been retrieved from the disk cache. This counter, added to the Total Memory Bytes Retrieved counter, will indicate the total number of bytes retrieved from the cache.
Total Disk Failures | Measures the number of times that Web Proxy failed to read from or write to the disk cache due to an input/output (I/O) failure. A low counter will indicate that a disk is performing properly. A high counter will indicate that a cache disk is too small, too slow, or corrupted.
Total Disk URLs Retrieved | Measures the cumulative number of URLs that have been retrieved from the disk cache. This counter, added to the Total Memory URLs Retrieved counter, will indicate the total number of URLs retrieved from the cache.
Total Memory Bytes Retrieved (KB) | Measures the cumulative number of memory bytes that have been retrieved from the memory cache in response to client requests to the cache. A low number might indicate that memory resources dedicated to the cache are not being used efficiently. A high number might indicate that more memory resources should be allocated to the cache.
Total Memory URLs Retrieved | Measures the cumulative number of URLs that have been retrieved from the memory cache in response to client requests to the cache. A low number might indicate that memory resources dedicated to the cache are not being used efficiently. A high number might indicate that more memory resources should be allocated to the cache.
Total URLs Cached | Measures the cumulative number of URLs that have been stored in the cache. If this counter and the URLs in Cache counter are low, it may indicate a problem with the cache. The cache may not be configured for optimal use or the cache size may be too small.
URL Commit Rate (URL/sec) | Indicates the speed at which URLs are being written to the cache. If the rate of this counter is comparable to the rate of the Disk Failure Rate counter, it indicates that a high proportion of attempts to write to the cache are failing. This could indicate a problem with cache configuration, a cache disk that is too slow, or a cache size that is too small.
URLs in Cache | Measures the current number of URLs in the cache.

web link Get latest ISA Server content at ISA Server Guidance.


Microsoft Firewall service performance counters

The following table lists the performance counters for the Microsoft Firewall service.

Performance Counter | Description
Accepting TCP Connections | The number of connection objects that wait for a Transmission Control Protocol (TCP) connection from Firewall clients.
Active Sessions | The number of active sessions for the Firewall service.
Active TCP Connections | The number of active TCP connections currently passing data. Connections pending or not yet established are counted elsewhere.
Active UDP Connections | The number of active User Datagram Protocol (UDP) connections.
Available Worker Threads | The number of Firewall service worker threads that are available or waiting in the completion port queue.
Back-connecting TCP Connections | The number of TCP connections awaiting an inbound connect call to complete. These are connections placed by the Firewall service to a client after the Firewall service accepts a connection from the Internet on a listening socket.
Bytes Read/sec | The number of bytes read by the data pump per second.
Bytes Written/sec | The number of bytes written by the data pump per second.
Connecting TCP Connections | The number of TCP connections pending. These are connections awaiting completion between the Firewall service and remote computers.
DNS Cache Entries | The current number of DNS domain name entries cached as a result of Firewall service activity.
DNS Cache Flushes | The number of times that the DNS domain name cache has been flushed or cleared by the Firewall service.
DNS Cache Hits | The number of times a DNS domain name was found within the DNS cache by the Firewall service.
DNS Cache Hits % | The percentage of DNS domain names serviced by the DNS cache, from the total of all DNS entries that have been retrieved by the Firewall service.
DNS Retrievals | The number of DNS domain names that have been retrieved by the Firewall service.
Failed DNS Resolutions The number of
gethostbyname
and
gethostbyaddr
application programming interface (API) calls that have failed. These are calls used to resolve host DNS domain names and IP addresses for Firewall service connections.
Kernel Mode Data Pumps | The number of kernel mode data pumps created by the Firewall service.
Listening TCP Connections | The number of connection objects that wait for TCP connections from remote Internet computers.
Non-connected UDP mappings | The number of mappings available for UDP connections.
Pending DNS Resolutions The number of
gethostbyname
and
gethostbyaddr
application programming interface (API) calls pending resolution. These are calls used to resolve host DNS domain names and Internet Protocol (IP) addresses for Firewall service connections.
SecureNAT Mappings | The number of mappings created by SecureNAT.
Successful DNS Resolutions The number of
gethostbyname
and
gethostbyaddr
application programming interface (API) calls successfully returned. These are calls used to resolve host DNS domain names and IP addresses for Firewall service connections.
Worker Threads | The number of Firewall service worker threads that are currently active.

Get latest ISA Server content at ISA Server Guidance.


SOCKS filter performance counters

The following table lists the SOCKS filter performance counters.

Performance counter | Description
Active Sessions | A single SOCKS session includes the CONNECT and BIND commands for a single client.
Active Connections | The total number of active connections currently passing data. Connections pending or not yet established are not included. This counter is incremented when a SOCKS connection is established. A SOCKS connection is counted after a successful CONNECT command, when the SOCKS filter begins the data pump stage of the protocol. This counter is decremented when the connection is terminated (for any reason).
Connecting Connections | The number of SOCKS connections waiting for a remote computer to connect to. When a client sends a CONNECT command to the SOCKS filter, the SOCKS filter connects to the specified server on behalf of the client. This counter is incremented immediately before the SOCKS filter starts the connection process to the specified server, and is decremented when the connection (to the specified server) process is completed (successfully or unsuccessfully).
Listening Connections | The number of connection objects waiting for remote computers to connect. When a client sends a BIND command to the SOCKS filter, the SOCKS filter listens for an incoming connection on the specified port. This counter is incremented when the SOCKS filter starts waiting for the incoming connection, and is decremented when the incoming connection is received (or if the connection was terminated).
Bytes Read/sec | The number of bytes read on all SOCKS connections per second. The term "bytes read" refers to the amount of data from the client to the server during the data pump stage of the protocol.
Bytes Written/sec | The amount of data sent from the server to the client during the data pump stage of the protocol.
Pending DNS Resolutions | The number of pending name resolution requests. These requests resolve host DNS names and IP addresses for SOCKS connections.
Successful DNS Resolutions | The number of name resolution requests resolved each second. These requests resolve host DNS names and IP addresses for SOCKS connections.

Get latest ISA Server content at ISA Server Guidance.


Web Proxy performance counters

The following table lists the Web Proxy performance counters.

Performance counter | Description
Array Bytes Received/sec (Enterprise) | The rate at which data bytes are received from other ISA Server computers within the same array.
Array Bytes Sent/sec (Enterprise) | The rate at which data bytes are sent to other ISA Server computers within the same array.
Array Bytes Total/sec (Enterprise) | The sum of the Array Bytes Sent/sec and the Array Bytes Received/sec counters. This is the total rate for all data bytes transferred between the ISA Server computer and other members of the same array.
Cache Hit Ratio (%) | Determines how many Web Proxy client requests have been served using cached data (Total Cache Fetches), as a percentage of the total number of successful Web Proxy client requests to the ISA Server computer (Total Successful Requests). Its value gives a good indication of the effectiveness of the cache. A high counter value indicates that a high level of requests are being serviced from the cache, meaning faster response times. A zero counter value indicates that caching is not enabled. A low counter value may indicate a configuration problem. The cache size may be too small, or requests may not be cacheable.
Cache Running Hit Ratio (%) | The amount of requests served from the cache as a percentage of total successful requests serviced. This ratio is the same as that measured by the Cache Hit Ratio counter. The difference between these two counters is that the Cache Running Hit Ratio counter measures this ratio for the last 10,000 requests serviced, and the Cache Hit Ratio counter measures this ratio since the last time that Web Proxy was started. This means that the Cache Running Hit Ratio counter gives a more dynamic evaluation of cache effectiveness.
Client Bytes Received/sec | The rate at which data bytes are received from Web Proxy clients. The value will change according to the volume of Web Proxy client requests, but a consistently slow rate may indicate a delay in servicing requests.
Client Bytes Sent/sec | The rate at which data bytes are sent to Web Proxy clients. The value will change according to the volume of Web Proxy client requests, but a consistently slow rate may indicate a delay in servicing requests.
Client Bytes Total/sec | The sum of the Client Bytes Sent/sec and the Client Bytes Received/sec counters. This is the total rate for all bytes transferred between the ISA Server computer and Web Proxy clients.
Current Array Fetches Average (Milliseconds/request) | The mean number of milliseconds required to service a Web Proxy client request that is fetched through another array member. This does not include requests for services by the Secure Sockets Layer (SSL) tunnel.
Current Average (Milliseconds/request) | The mean number of milliseconds required to service a Web Proxy client request, not including requests serviced by the SSL tunnel. This counter can be monitored at peak and off-peak times to get a comprehensive picture of how fast client requests are being serviced. A counter with a value that is too high might indicate that the ISA Server computer is having difficulty in handling all requests and that requests are being delayed.
Current Cache Fetches Average(Milliseconds/request) | The mean number of milliseconds required to service a Web Proxy client request from the cache. This does not include requests for services by the SSL tunnel.
Current Direct Fetches Average (Milliseconds/request) | The mean number of milliseconds required to service a Web Proxy client request directly to the Web server or upstream proxy. This does not include requests for services by the SSL tunnel.
Current Users | Indicates how many clients are currently running Web Proxy. Monitoring this counter at both peak and off-peak times will give a good indication of server usage. The configuration setting for maximum Web request connections influences this value. This counter may also be useful if you need to temporarily stop ISA Server services.
DNS Cache Entries | The current number of DNS domain name entries cached by Web Proxy. A high counter value suggests a beneficial impact on performance, because a DNS cache entry eliminates the need for a DNS lookup, saving system resources.
DNS Cache Flushes | The total number of times that the DNS domain name cache has been flushed or cleared by Web Proxy. When there is no room left for more data in the DNS cache, the DNS cache is flushed to allow new entries to be made.
DNS Cache Hits | The total number of times a DNS domain name was found within the DNS cache by Web Proxy. This counter can be compared with the DNS Cache Entries and the DNS Cache Flushes counters to find out if DNS caching is working efficiently. A low number of DNS cache hits will impact performance, as every DNS lookup will slow performance, particularly if a problem arises in the lookup process.
DNS Cache Hits % | Determines how many DNS entries have been resolved using cached data (DNS Cache Hits), as a percentage of the total number of DNS domain names retrieved by Web Proxy (DNS Retrievals). A high counter value means better performance as the DNS data is served from the cache, rather than incurring the overhead of resolving DNS lookups.
DNS Retrievals | The total number of DNS domain names that have been retrieved by Web Proxy.
Failing Requests/sec | The rate of Web Proxy client requests that have been completed with some type of error. This counter can be compared with the Requests/sec counter to give an indication of how well ISA Server is servicing incoming Web requests. A high failure rate, as compared with the rate of incoming requests, will suggest that ISA Server is having difficulty in coping with all incoming requests. Connection settings for incoming Web requests may be incorrectly configured, or connection bandwidth may be insufficient.
FTP Requests | The number of File Transfer Protocol (FTP) requests that have been made to Web Proxy. A consistently low counter value may influence the caching policy for FTP objects.
HTTP Requests | The number of Hypertext Transfer Protocol (HTTP) requests that have been made to Web Proxy.
HTTPS Sessions | The total number of Secure Hypertext Transfer Protocol (HTTPS) secured sessions serviced by the SSL tunnel.
Maximum Users | The maximum number of users that have connected to Web Proxy simultaneously. This counter can be useful for determining load usage and license requirements.
Requests/sec | The rate of incoming requests that have been made to Web Proxy. A higher value means that more ISA Server resources will be required to service incoming requests.
Reverse Bytes Received/sec | The rate at which data bytes are received by Web Proxy from Web publishing servers in response to incoming requests. This rate can be monitored at peak and off-peak times as an indication of how ISA Server is performing in servicing incoming Web requests.
Reverse Bytes Sent/sec | The rate at which data bytes are sent by Web Proxy to Web publishing servers in response to incoming requests. This rate can be monitored at peak and off-peak times as an indication of how ISA Server is performing in servicing incoming Web requests.
Reverse Bytes Total/sec | The total sum of the Reverse Bytes Sent/sec and the Reverse Bytes Received/sec counters. This is the total rate for all bytes transferred between Web Proxy and Web publishing servers in response to incoming requests.
Site Access Denied | The total number of Internet sites to which Web Proxy has denied access. An excessively high number might indicate an access policy that is too restrictive.
Site Access Granted | The total number of Internet sites to which Web Proxy has granted access. This can be compared with the Site Access Denied counter to give a numeric summary of the results of access policy configuration.
SNEWS Sessions | The total number of SNEWS sessions serviced by the SSL tunnel.
SSL Client Bytes Received/sec | The rate at which SSL data bytes are received by Web Proxy from SSL clients. Similar to the Client Bytes Received/sec counter, but counts only SSL requests.
SSL Client Bytes Sent/sec | The rate at which SSL data bytes are sent by Web Proxy to SSL clients. Similar to the Client Bytes Sent/sec counter, but counts only SSL requests.
SSL Client Bytes Total/sec | The sum of the SSL Client Bytes Sent/sec and the SSL Client Bytes Received/sec counters. This is the total rate for all bytes transferred between Web Proxy and SSL clients.
Thread Pool Active Sessions | The number of sessions being actively serviced by thread pools.
Thread Pool Failures | The number of requests rejected because the thread pool was full.
Thread Pool Size | The number of threads in the thread pool. This thread pool represents the resources available to service client requests.
Total Array Fetches (Enterprise) | The total number of Web Proxy client requests that have been served by requesting the data from another ISA Server within this array. These requests are the result of the Cache Array Routing Protocol (CARP) algorithm, which randomly stores objects in any one of the member servers cache. This counter is influenced by the cache size for each ISA Server in the array, because a server with a larger cache will hold more cache items. The load factor for each server can also be configured, to determine how workload is divided among array members.
Total Cache Fetches | The total number of Web Proxy client requests that have been served by using cached data. A high number will indicate a cache being fully exploited.
Total Failed Requests | The total number of requests that have failed to be processed by Web Proxy due to errors. Errors can be the result of Web Proxy failing to locate a requested server URL on the Internet or because the client did not have authorized access to the requested URL. This counter should be lower than the Total Successful Requests counter. If not, it is an indication that ISA Server is failing to service requests effectively. This could be a configuration problem, or a connection that is too slow. It could also indicate an access policy that is too restrictive.
Total Pending Connects | The total number of pending connections to Web Proxy.
Total Requests | The total number of requests that have been made to Web Proxy. It is the sum of the Total Successful Requests and the Total Failed Requests counters.
Total Reverse Fetches | The total number of incoming requests that have been served by requesting the data from Web publishing servers.
Total SSL Sessions | The total number of SSL sessions serviced by the SSL tunnel.
Total Successful Requests | The total number of requests that have been successfully processed by Web Proxy. This counter can be compared with the Total Requests and the Total Failed Requests counters to indicate the effectiveness of ISA Server in servicing requests.
Total Upstream Fetches | The total number of requests that have been served by using data from the Internet or from a chained proxy computer. This counter can be compared to the Total Cache Fetches counter to determine what proportion of requests are being serviced from remote servers on the Internet or upstream proxies, compared with those being serviced from the cache.
Total Users | The total number of users that have connected to Web Proxy. It represents a history of past server usage.
Unknown SSL Sessions | The total number of unknown SSL sessions serviced by the SSL tunnel.
Upstream Bytes Received/sec | The rate at which data bytes are received by Web Proxy from remote servers on the Internet or from a chained proxy computer in response to requests from Web Proxy. The value of this counter will depend partially on the connection bandwidth. If the counter value is consistently low, it may indicate a bottleneck caused by a slow connection. Changing the bandwidth priority configuration may help in this situation, or a faster connection may be required.
Upstream Bytes Sent/sec | The rate at which data bytes are sent by Web Proxy to remote servers on the Internet or to a chained proxy computer. The value of this counter will depend partially on the connection bandwidth. If the counter value is consistently low, it may indicate a bottleneck caused by a slow connection. Changing the bandwidth priority configuration may help in this situation, or a faster connection may be required.
Upstream Bytes Total/sec | The sum of the Upstream Bytes Sent/sec and the Upstream Bytes Received/sec counters. It represents the total rate for all bytes transferred between Web Proxy and remote servers on the Internet or a chained proxy server.


Copyright

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

The links in this area will let you leave Microsoft's product and/or Web site. The linked sites are not under the control of Microsoft and Microsoft is not responsible for the contents of any linked site or any link contained in a linked site, or any changes or updates to such sites. Microsoft is not responsible for webcasting or any other form of transmission received from any linked site. Microsoft is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Microsoft of the site.

© 2004 Microsoft Corporation. All rights reserved.

Active Directory, Microsoft, Microsoft Press, MSDN, Visual Basic, Visual C++, Windows, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or other regions and/or countries.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.


Configuration

To configure Microsoft Internet Security and Acceleration (ISA) Server 2004, you first define the ISA Server network topology and create network rules to specify how traffic moves between networks. Next, you can enable caching and configure cache properties, enable application and Web filters, and define general administrative and security settings.

Use the links in the Configuration node of the console tree to help you configure the following:

  • Servers. View array member status. Configure server-specific properties. For more information, see Arrays and array members.
  • Networks. Configure your ISA Server networks and define how traffic is sent between them. For more information, see Networking.
  • Cache. Enable caching, define how Web objects are cached, and create content download jobs. For more information, see Caching.
  • Add-ins. Apply additional security to ISA Server by enabling application filters and Web filters. For more information, see Add-ins.
  • General. Define global administrative and configuration settings for this ISA Server computer.

web link Get latest ISA Server content at ISA Server Guidance.


Server-specific and confidential information

When you export a configuration, you can select to export server-specific and confidential information. For information about exporting, see Exporting and backing up the configuration.

Import server-specific information

Select the Import server-specific information option when importing information to the array from which it was exported, or when importing to a new array that has a member server with the same name.

When you select this option, the server configuration for each array member is restored, including cache configuration, Secure Sockets Layer (SSL) certificate, and Virtual Private Networks (VPN) static address pool.

If you select this option when importing to an array with different members, erroneous and invalid server settings will be imported.

For information about importing, see Importing and restoring the configuration.

Import/Export user permission settings

Select this option when restoring the permission settings of the exported array or enterprise. When you select this option, the environment of the imported array or enterprise, including domain users and role definitions, must be the same as those originally exported. This option is useful when restoring to the same enterprise. It is also useful when you want to duplicate an array configuration within the same domain.

Export confidential information

Select this option when you are exporting the configuration as a backup file. Confidential information that is exported includes:

  • Credentials used for alerts, logging, reports, report jobs, primary and backup routes, dial-up connections, Web publishing, and intra-array communications.
  • The shared secret specified for RADIUS configuration.
  • The preshared key specified for Internet Protocol security (IPsec) configuration.

When you select this option, you must specify a password with eight or more characters.

web link Get latest ISA Server content at ISA Server Guidance.


Import actions

When you import configuration information to an array or to the enterprise, you can select to import or to overwrite (restore).

When you choose to import the configuration, all the information in the specified .xml file will be added to the existing configuration information. This means that if you already have rules configured for the array or the enterprise, those rules will not be erased.

When you choose to overwrite, the existing configuration is erased. Only the configuration information in the imported .xml file will be defined for the array or enterprise.