ISA Server 2004 welcome page

header graphic
Microsoft® Internet Security and Acceleration (ISA) Server 2004 introduces multi-networking support, easy-to-use and highly integrated virtual private networking configuration, extended and extensible user and authentication models, and improved management features.
branding bullet About this Help
This documentation is designed to assist you in performing day-to-day ISA Server administration tasks. It contains the following sections:
  • Introducing ISA Server
  • Installation and Migration
  • Security and Administration
  • Clients
  • Multi-Networking
  • Firewall Policy
  • Virtual Private Networking
  • Caching
  • Monitoring
  • Add-ins
  • Additional Resources
branding bullet ISA Server Guides and Articles
Your primary source for in-depth technical information about ISA Server is the set of Web-based ISA Server Guides and Articles. New documents are added to the library periodically, ensuring that you always have the latest ISA Server technical information.

ISA Server Help may have been updated after ISA Server was released.

To download and install any Help updates, and to get additional, up-to-date content, go to ISA Server Guides and Articles.
branding bullet ISA Server Community
Whether you are a novice or an experienced user, Community is your place to share ideas, get answers to your questions, read expert advice, and more. Join peer-to-peer discussions about ISA Server issues and solutions at ISA Server Community.


Introducing ISA Server

Microsoft® Internet Security and Acceleration (ISA) Server 2004 is an extensible enterprise firewall and Web cache server built on the Microsoft Windows Server™ 2003 and Windows® 2000 Server operating system security, management, and directory for policy-based access control, acceleration, and management of internetworking.

The Internet provides organizations with opportunities to connect with customers, partners, and employees. Although this offers opportunities, it also presents risks and concerns about security, performance, and manageability. ISA Server is designed to address the needs of today's Internet-enabled businesses. ISA Server provides a multilayered enterprise firewall that helps protect network resources from viruses, hackers, and unauthorized access. The ISA Server 2004 Web cache enables organizations to save network bandwidth and provide faster Web access for users by serving objects locally rather than over a congested Internet.

Whether deployed as dedicated components or as an integrated firewall and caching server, ISA Server provides a unified management console that simplifies security and access management. Built for both the Windows Server 2003 and Windows 2000 Server platforms, ISA Server provides secure and fast Internet connectivity with powerful, integrated management tools.

This section introduces you to ISA Server.

  • ISA Server overview
  • New Features
  • Deployment scenarios

Get latest ISA Server content at ISA Server Guides and Articles.
Send feedback about this page Send feedback about this page.


ISA Server overview

Microsoft® Internet Security and Acceleration (ISA) Server 2004 offers secure, fast, and manageable Internet connectivity. ISA Server integrates a sophisticated, application layer aware, multiple layer enterprise firewall and a high performance Web cache. It builds on Microsoft Windows Server™ 2003 and Windows® 2000 Server security and directory for policy based security, acceleration, and management of internetworking.

Secure Internet connectivity

Connecting networks and users to the Internet introduces security and productivity concerns. ISA Server 2004 provides your organization with the comprehensive ability to control access and monitor usage on a per-user basis. ISA Server protects networks from unauthorized access, performs stateful filtering and inspection, and alerts administrators to attacks against the firewall or protected network.

ISA Server is a firewall, featuring security with packet level, circuit level, and application level traffic screening, stateful filtering and inspection, broad network application support, a tightly integrated virtual private network (VPN), system hardening, integrated intrusion detection, intelligent layer 7 application filters, firewall transparency for all clients, advanced authentication, secure server publishing, and much more. ISA Server 2004 enables you to do the following:

  • Protect networks from unauthorized access.
  • Defend Web and e-mail servers from external attacks.
  • Inspect incoming and outgoing network traffic to ensure security.
  • Receive alerts of suspicious activity.

Fast Web access

The Internet offers organizations productivity benefits, but only if content is accessible, access is fast, and the cost is reasonable. The ISA Server 2004 cache minimizes performance bottlenecks and saves network bandwidth by serving locally cached Web content. ISA Server enables you to do the following:

  • Provide faster Web access for users, by serving objects from the Web cache rather than over a congested Internet.
  • Reduce Internet bandwidth costs, by reducing network traffic on the link.
  • Distribute Web server content and e-commerce applications, to reach customers worldwide efficiently and cost effectively.
  • Serve popular Web content from the ISA Server Web cache, to free up Internal network bandwidth for other content requests.

Unified management

By combining firewall and high performance Web cache functions, ISA Server 2004 delivers a common management infrastructure that reduces network complexity and costs. ISA Server is tightly integrated with Windows Server 2003 and Windows 2000. This provides a consistent and powerful way to manage user access and configuration of firewall rules.

Extensible platform

Security policies and imperatives vary from organization to organization. Traffic volume and content formats pose unique concerns. No single product fits all security and performance needs, so ISA Server 2004 is built to be highly extensible. Available for ISA Server are a comprehensive software developers kit (SDK), a large selection of third-party add-on solutions, and an extensible administration option. More information about third-party add-on solutions is available on the ISA Server Partners website (http://www.microsoft.com/).

Using the ISA Server administration Component Object Model (COM), you can extend ISA Server functionality. The administration objects also allow for automation of all tasks that are done through ISA Server Management. This means that any task can be automated by an ISA Server administrator by using the administration objects. For more information, see the Microsoft SDK website (http://www.microsoft.com/).


New Features

Microsoft Internet Security and Acceleration Server (ISA) 2004 introduces multi-networking support, easy-to-use and highly integrated virtual private networking configuration, extended and extensible user and authentication models, and improved management features, including configuration export and import.

The following sections briefly describe these new features.

  • New features: multi-networking
  • New features: security and firewall policy
  • New features: virtual private networking
  • New features: monitoring
  • New features: add-ins


New features: multi-networking

The following table lists features of the multi-networking functionality introduced by ISA Server 2004. These features are described in greater detail in Multi-Networking.

Feature | Description
Multiple network configuration | You can configure one or more networks, each with distinct relationships to other networks. Access policies are defined relative to the networks and not necessarily relative to a given Internal network. ISA Server extends the firewall and security features to apply to traffic between any networks or network objects.
Unique per-network policies | The new multi-networking features of ISA Server enable you to protect your network against internal and external security threats by limiting communication between clients, even within your own organization. Multi-networking functionality supports sophisticated perimeter network (also known as demilitarized zone, DMZ, or screened subnet) scenarios, so that you can configure how clients in different networks access the perimeter network. Access policies between networks can then be based on the unique security zone represented by each network.
Routed and NAT network relationships | You can use ISA Server to define routing relationship between networks, depending on the access and communication required. In some cases, you may want more secure, less transparent communication between the networks. For these scenarios, you can define a network address translation (NAT) relationship. In other situations, you may want to simply route traffic through ISA Server. In these cases, you can define a routed relationship. Packets moving between routed networks are fully exposed to ISA Server stateful filtering and inspection mechanisms.


New features: security and firewall policy

The following table lists features of the security and firewall policy functionality introduced by ISA Server 2004. These features are described in greater detail in Firewall Policy.

Feature | Description
Support for complex protocols requiring multiple primary connections | ISA Server supports complex protocols, including those required by many streaming media, voice applications, and video applications. These applications require that the firewall manage complex protocols.
Customized protocol definitions | You can control the source and destination port number for any protocol for which you create a firewall policy rule. You have a high level of control over what packets are allowed inbound and outbound through the firewall.
Authentication | Users can be authenticated using built-in Windows, RADIUS, RSA SecurID authentication, or other namespaces. Rules can be applied to users or user groups in any namespace. Third-party vendors can use the software development kit (SDK) to extend these built-in authentication methods, offering additional authentication mechanisms.
Network objects | You can define network objects, including computers, networks, network sets, address ranges, subnets, computer sets, and domain name sets. These network objects are used to define source and destination settings for firewall policy rules.
Firewall policy rules representing an ordered list | Firewall policy rules represent an ordered list in which connection parameters are first compared to the top listed rule. ISA Server moves down the list of rules until it finds a rule matching the connection parameters and enforces the matching rule's policy. This approach to firewall policy makes it easier to determine why a specific connection is allowed or denied.
Outlook Web Access Publishing Wizard | The ISA Server Outlook Web Access Publishing Wizard provides steps for creating the Secure Sockets Layer (SSL) virtual private network (VPN) for Outlook Web Access for your Exchange server.
FTP support | You can access Internet File Transfer Protocol (FTP) servers listening on alternate port numbers without requiring special configuration on the client or the ISA Server computer.
Port redirection for server publishing rules | You can receive a connection on one port number and redirect the request to a different port number on the published server.
Secure Web publishing | You can place servers behind the firewall, either on the corporate network or on a perimeter network, and securely publish their services. Using the secure Web Publishing Wizard, you can create a rule allowing remote users secure SSL remote access to published Web servers.
HTTP 1.1 support | ISA Server is an HTTP 1.1 client, when it is connected with an upstream server. In both forward (Web Proxy) and reverse (Web publishing) scenarios, ISA Server can receive and inspect chunked (transfer encoding) content. Also, it is possible to configure Web publishing rules to receive compressed content, but in this case, the response body cannot be inspected. Note that ISA Server does not perform compression.


New features: virtual private networking

ISA Server 2004 supports secure virtual private network (VPN) access that can connect branch offices or remote users to corporate networks. ISA Server firewall policy is applied to VPN connections to control what resources and protocols VPN users can access. VPN features are described in greater detail in Virtual Private Networking.

The following table lists VPN features supported by ISA Server.

Feature | Description
VPN administration | ISA Server includes a fully integrated virtual private networking mechanism, which is based on Microsoft® Windows Server™ 2003 and Windows® 2000 Server functionality.
Stateful filtering and inspection for VPN | Because VPN clients are configured as a separate network, you can create distinct policies for VPN clients. The firewall policy engine discriminately checks requests from VPN clients, statefully filtering and inspecting these requests and dynamically opening connections based on the access policy.
SecureNAT client support for VPN clients connected to ISA Server VPN server | ISA Server extends VPN client support by allowing SecureNAT clients to access the Internet, even without Firewall Client software installed on the client system. You can also enhance corporate network security by forcing user or group-based firewall policy on VPN SecureNAT clients.
Stateful filtering and inspection through site-to-site VPN tunnel | ISA Server introduces stateful filtering and inspection for all communications moving through a site-to-site VPN connection. You can control resources so that specific hosts or networks can access on opposite sides. User or group-based access policies can be used to gain granular control over resource utilization through the link.
VPN Quarantine Control | You can quarantine VPN clients on a separate network until they meet a predefined set of security requirements. VPN clients passing security tests are allowed network access based on VPN client firewall policies. VPN clients who fail security tests may be provided limited access to servers that will help them meet network security requirements.
IPSec tunnel mode support for site-to-site VPN links | ISA Server features site-to-site link support by allowing you to use IPSec tunnel mode as the VPN protocol. IPSec tunnel mode support greatly increases ISA Server interoperability with a wide array of third-party VPN solutions.
VPN monitoring and logging | You can monitor VPN client and remote VPN network activity, just as you monitor activity of any other ISA Server client.


New features: monitoring

The following table lists features of the monitoring functionality introduced by ISA Server 2004. These features are described in greater detail in Monitoring.

Feature | Description
Dashboard | The Dashboard view of ISA Server summarizes monitoring information about sessions, alerts, services, reports, connectivity, and general system health. The Dashboard provides you with a quick view on how your network is functioning.
Real-time monitoring in log viewer | You can view firewall and Web Proxy logs in real time. The monitoring console displays the log entries as they are recorded in the firewall log file.
Built-in log query (filtering) | You can query the log files using the built-in log query facility. Microsoft Data Engine (MSDE) logs can be queried for information contained in any field recorded in the logs. You can limit the scope of the query to a specific time frame. The results appear in the ISA Server console and can be copied to the Clipboard and pasted into another application for more detailed analysis.
Real-time monitoring and filtering of sessions | You can view all active connections. From a session view, you can sort or disconnect individual or groups of sessions. In addition, you can filter the entries in the session's interface to focus on the sessions of interest using the built-in sessions filtering facility.
Connectivity verifiers | You can verify connectivity by regularly monitoring connections to a specific computer or Uniform Resource Locator (URL) from the ISA Server computer using connection verifiers. You can configure which method to use to determine connectivity: Ping, Transmission Control Protocol (TCP) connect to a port, or HTTP GET. You can select which connection to monitor by specifying an IP address, computer name, or URL.
Report publishing | You can configure ISA Server report jobs to automatically save a copy of a report to a local folder or network file share. The folder or file share the reports are saved in can be mapped to a website virtual directory so that other users can view the report. You can also manually publish reports that have not been configured to automatically publish after report creation.
Log to an MSDE database | Logs can now be stored in MSDE format. Logging to a local database enhances query speed and flexibility.


New features: add-ins

ISA Server 2004 supports many Internet protocols, including Hypertext Transfer Protocol/Secure Sockets Layer (HTTP/SSL), File Transfer Protocol (FTP), RDP, Telnet, RealAudio, RealVideo, Internet Relay Chat (IRC), H.323, Windows media streaming, e-mail protocols, and news protocols, with built-in add-ins. These add-ins are described in greater detail in Add-ins.

The following table lists add-in features of ISA Server.

Feature | Description
HTTP filtering on a per-rule basis | ISA Server HTTP policy allows the firewall to perform deep HTTP stateful inspection (application layer filtering). The extent of the inspection is configured on a per-rule basis. You can configure custom constraints for HTTP inbound and outbound access.
Block access to all executable content | You can configure ISA Server HTTP policy to block all connection attempts to Windows executable content, regardless of the file extension used on the resource.
Apply HTTP filtering to all ISA Server client connections | ISA Server could block content for Web Proxy client-based HTTP and FTP connections using MIME Enter (for HTTP) or file extension (for FTP). You can control HTTP access for all ISA Server client connections.
Control HTTP access based on HTTP signatures | You can create HTTP signatures that can be compared against the request URL, request headers, request body, response headers, and response body. You have precise control over what content internal and external users can access through ISA Server.
Force secure Exchange RPC connections from full Outlook MAPI clients | ISA Server Exchange Server publishing rules allow remote users to connect to Exchange using the fully functional Outlook® MAPI client over the Internet. However, the Outlook client must be configured to use secure RPC so that the connection is encrypted. Using ISA Server RPC policy, you can block all nonencrypted Outlook MAPI client connections.
FTP policy | ISA Server FTP policy can be configured to allow users to upload and download using FTP, or you can limit user FTP access to download only.
Link translation | Some published websites may include references to internal names of computers. Because only the ISA Server computer and external namespace, and not the internal network namespace, is available to external clients, these references will appear as broken links. ISA Server includes a link translation feature so that you can create a dictionary of definitions for internal computer names that map to publicly known names.
Granular control over IP options | You can configure IP options on a granular basis and allow only the IP options you require, while blocking all others.


Deployment scenarios

Microsoft Internet Security and Acceleration (ISA) Server 2004 provides value to IT managers, network administrators, and information security professionals in organizations of all sizes who are concerned about the security, performance, manageability, or operating costs of their networks. Organizations can deploy ISA Server in numerous networking scenarios, as described in the following sections.

Internet edge firewall

ISA Server can be deployed as a dedicated Internet edge firewall acting as the secure gateway to the Internet for internal clients. The ISA Server computer is transparent to the other parties in the communication path. Internet users should not be able to tell that a firewall server is present, unless the user attempts to access a network service, protocol, or site where the ISA Server computer denies access. By setting the security access policies, administrators can prevent unauthorized access and malicious content from entering the network.

Key features include:

  • Multilayered traffic screening—packet level, circuit level, and application level filtering.
  • Intelligent application layer aware application filters.
  • Built-in intrusion detection.
  • System hardening for locking down the base operating system.

For detailed information about scenarios on how to control Internet access using ISA Server, see Controlling Secure Internet Access using ISA Server (http://www.microsoft.com/).

Departmental or backbone network firewall

ISA Server can be deployed as a departmental or backbone network firewall that provides secure inbound and outbound access control into and out of protected LANs. Organizations with existing firewall infrastructures may wish to keep their current, high-performance firewalls at the Internet edge and offload sophisticated application layer filtering to ISA Server firewalls at the LAN edges. This allows an organization to leverage current high-speed Internet connections while benefiting from the unique level of protection ISA Server application layer filtering firewalls provide.

Key features include:

  • Secure Outlook Web Access publishing. For detailed information about how to publish Outlook Web Access using ISA Server, see Outlook Web Access Server Publishing in ISA Server (http://www.microsoft.com/).
  • Secure Internet Information Services (IIS) website publishing. For detailed information about secure IIS publishing using ISA Server, see Publishing Web Servers Using ISA Server (http://www.microsoft.com/).
  • Secure Exchange RPC publishing. For detailed information about secure Exchange RPC publishing using ISA Server, see Publishing Exchange Servers Using ISA Server (http://www.microsoft.com/).
  • User-based and group-based access control for all Internet protocols and services.
  • Spam filtering SMTP Message Screener.
  • Web Proxy chaining with upstream Web Proxy servers.

Branch office firewall

ISA Server can be used to connect branch office networks to the main office using site-to-site VPN connections. You can place ISA Server at a branch office where it can act as a firewall protecting the branch office network and as a VPN gateway that connects the branch office network to the main office network. The improved VPN interoperability features of ISA Server allow it to create site-to-site links with any VPN solution you currently have in place.

Key features include:

  • Internet Protocol security (IPSec) tunnel mode support for site-to-site links with third-party VPN gateways.
  • Point-to-Point Tunneling Protocol (PPTP) and Layer Two Tunneling Protocol (L2TP) over IPSec for site-to-site links with Microsoft VPN gateways.
  • Stateful inspection over the site-to-site link limits what remote networks can access on the main office network.
  • ISA Server firewall control for inbound and outbound access from and to the Internet at the branch office.
  • Intelligent application layer filtering that statefully inspects traffic between VPN connected LANs.

For detailed information about how to publish Outlook Web Access using ISA Server, see Site-to-site VPN in ISA Server (http://www.microsoft.com/).

Secure server publishing

ISA Server allows organizations to publish services to the Internet without compromising internal network security. Organizations can configure Web publishing rules and server publishing rules that determine which requests are sent downstream to a server located behind the ISA Server firewall, providing an increased layer of security for their internal servers. All forwarded communications are exposed to the ISA Server stateful filtering and inspection engines. For example, a Microsoft Exchange server can be placed behind ISA Server, and server publishing rules can be created that allow SSL-secured remote access to Exchange Simple Mail Transfer Protocol (SMTP), Post Office Protocol 3 (POP3), Internet Mail Access Protocol 4 (IMAP4), and Network-to-Network Transport Protocol (NNTP) services. Incoming e-mail messages to the Exchange server is intercepted by the ISA Server SMTP Message Screener, which appears as an e-mail server to clients. The ISA Server SMTP Message Screener can then filter the SMTP traffic and forward it on to the Exchange server. The Exchange server is never directly exposed to external users and remains in a secure environment, maintaining access to other internal network services.

Key features include:

  • Easy-to-use secure server publishing wizards.
  • SecureNAT for transparent client connections and server publishing.
  • Published services including Hypertext Transfer Protocol/Secure Sockets Layer (HTTP/SSL), FTP, SMTP, POP3, IMAP4, NNTP, DNS, RDP, H.323, streaming media, and more.

Secure Exchange server SSL VPN

SSL VPNs are becoming increasingly popular because of their ability to provide application-specific, clientless secure access to internal network resources. ISA Server has an improved Outlook Web Access Wizard that allows you to give remote users secure access to Outlook Web Access with an end-to-end SSL VPN. The SSL VPN can leverage ISA Server SSL-to-SSL bridging to allow deep HTTP content inspection. Delegation of Basic authentication and forms-based authentication further protect the Outlook Web Access SSL VPN by preventing unauthenticated sessions with the Outlook Web Access website.

Key features include:

  • Easy-to-use Outlook Web Access publishing wizard.
  • Clientless SSL VPN to Exchange Outlook Web Access through SSL VPN.
  • End-to-end security through the unique SSL-to-SSL bridging of ISA Server.
  • Delegation of Basic authentication prevents unauthenticated access to the Outlook Web Access website.
  • Forms-based authentication allows the firewall administrator to set session time-outs and prevent users from accessing attachments.
  • Deep HTTP application layer inspection prevents users from uploading files through an Outlook Web Access connection.
  • Certificates for SSL connections can be generated by Microsoft Certificate Services or obtained from a third-party certificate provider.

Additional scenarios

As the Internet continues to evolve and new applications are introduced, the ability of ISA Server to protect the network will continue to prove effective. Check the ISA Server Guides and Articles (http://www.microsoft.com/) website for new or updated documentation.


Installation and Upgrade

This section explains the installation process and provides step-by-step instructions on how to install Microsoft Internet Security and Acceleration (ISA) Server 2004.

If you have ISA Server 2000 installed, you can upgrade that installation without removing it from the computer. Most configuration information is migrated. This section explains the upgrade and upgrade process.

  • Installation and Upgrade: Concepts
  • Installation and Upgrade: How To
  • Deployment Scenario: Getting Started with ISA Server
  • Troubleshooting installation


Installation and Upgrade: Concepts

This section provides background information about the Microsoft Internet Security and Acceleration (ISA) Server 2004 installation process and information about upgrading from ISA Server 2000.

  • Installation of ISA Server
  • Upgrading from ISA Server 2000


Installation of ISA Server

This section provides background information about new installations of Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Installation requirements
  • Installation process
  • Unattended setup
  • Default settings


Installation requirements

To use ISA Server, you need:

  • A personal computer with a 550 megahertz (MHz) or higher Pentium II-compatible CPU.
  • Microsoft® Windows Server™ 2003 or Windows® 2000 Server operating system.
  • 256 megabytes (MB) of memory.
  • One network adapter that is compatible with the computer's operating system, for communication with the Internal network.
  • An additional network adapter for each network connected to the ISA Server computer.
  • One local hard disk partition that is formatted with the NTFS file system and has at least 150 MB of available hard disk space. This is exclusive of hard disk space you want to use for caching.

For installation instructions, see Run ISA Server setup.

Installation of ISA Server on a computer running Windows 2000

If you install ISA Server on a Windows 2000 operating system, note the following additional requirements:

  • Windows 2000 Service Pack 4 (SP4) or later must be installed.
  • Internet Explorer 6 or later must be installed.
  • If you are using the Windows 2000 SP4 slipstream, you must also install the hotfix specified in article 821887, "Events for Authorization Roles Are Not Logged in the Security Log When You Configure Auditing for Windows 2000 Authorization Manager Runtime," in the Microsoft Knowledge Base.

If you install ISA Server on a Windows 2000 operating system, note the following functional differences:

  • You cannot configure the L2TP IPSec preshared key.
  • Quarantine mode for VPN clients is not supported when using RADIUS policy.
  • All ISA Server services run using the local system account.


Installation process

Before you set up ISA Server, review Installation requirements.

As part of the installation options, you will specify addresses in the Internal network. For information about the Internal network, see Internal network configuration.

Note

  • To perform this procedure, you must be a member of the Administrators group.

When you install ISA Server, you will be requested to supply the following information.

  1. CD key. This is the 10-digit number located on the back of the ISA Server CD-ROM case.
  2. Installation options. You can select one of the following:
    • Full installation. All components are installed
    • Typical installation. All components except SMTP Message Screener and Firewall Client Share are installed.
    • Custom installation. You can select which components to install.
  3. Internal network configuration. You must configure the address ranges to include in the Internal network.

Note that if all the network adapters are disabled or disconnected, no IP addresses are listed in the Construct Internal Network dialog box. When there are no enabled network adapters, you are not required to specify a local IP address in the Internal network range. However, we recommend that you add this range of IP addresses:

0.0.0.1 - 255.255.255.254

As part of the installation process, ISA Server modifies the TCP/IP driver's dynamic port range, setting it to 65,535. This modification will take effect after the computer is rebooted. Note that your computer is not automatically rebooted after ISA Server is installed.

Stopping and Disabling Services

As part of the installation process, the following services are disabled:

  • Internet Connection Firewall or Internet Connection Sharing
  • IP Network Address Translation

In addition, the following services are stopped during installation:

  • SNMP service
  • FTP Publishing service
  • Network News Transfer Protocol (NNTP)
  • IIS Admin service
  • World Wide Web Publishing service

Installing the Firewall Client Share

When you select to install the Firewall Client Share, the files that a computer requires to install the Firewall Client software are copied to a folder on the computer. The folder is shared with Read permissions for the Everyone group.

When you install the share, the system policy rule named Allow access to firewall client share to trusted computers, which allows clients on the Internal network to access the share, is enabled. This rule allows the clients to install the software from the share. For more information, see System policy overview.


Capacity planning

The minimum system requirements for Microsoft Internet Security and Acceleration (ISA) Server 2004 are described in Installation requirements. However, for improved performance, plan the ISA Server 2004 hardware and Internet connectivity to meet the expected load. When determining the hardware required for an ISA Server computer, consider the following questions:

  • How many processors are needed, and what types of processors are required?
  • How much RAM and disk space are needed, and how many network adapters are required?
  • What is the recommended Internet connection bandwidth?

The answers to these questions depend upon your specific security configuration needs and on the deployment scenario. Specifically, all of the following impact the hardware recommendations: the firewall policy configuration, logging requirements, peak total network throughput, and whether you are publishing servers or simply allowing Internet access. Of these, peak total throughput on the Internet connection has proven to be the most significant factor in determining computing needs, because in most cases, it represents the Internet capacity needs.

The following table provides general guidelines, depending on the Internet link bandwidth you use. Note that the recommendations listed here assume Web traffic and a policy configuration with several hundreds of rules. The recommendations also assume no special configurations such as caching, third party filters, and others. If you enable caching, an Internet link with twenty to thirty percent lower bandwidth may suffice. Furthermore, if you configure the clients to be proxy-aware, then you can expect double throughput for the same hardware configurations.

Internet link bandwidth | Up to 5 T1 (7.5 Mbps) | Up to 25 Mbps | Up to T3 (45 Mbps) | Notes
Processors | 1 | 1 | 2 |
Processor type | Pentium III 550 MHz (or higher) | Pentium 4 2.0 - 3.0 GHz | Xeon 2.0 - 3.0 GHz | Alternatively, you can use other processors with comparable power that emulate the IA-32 instruction set. In deployments requiring only stateful inspection filtering (that is, no need for higher application level filtering), the Pentium 4 and Xeon processor recommendations reach LAN wire speeds.
Memory | 256 MB | 512 MB | 1 GB | With Web caching enabled, these requirements may be higher.
Disk space | 150 MB | 2.5 GB | 5 GB | This is exclusive of hard disk space you need to use for caching.
Network adapter | 10/100 Mbps | 10/100 Mbps | 100/1000 Mbps | These are the requirements for the network adapters not connected to the Internet.

For more detailed information, see the Capacity Planning (http://www.microsoft.com/) document, on the ISA Server website.


Unattended setup

You can install ISA Server 2004 by using the unattended server setup command. For instructions, see Run ISA Server unattended setup.

Note

  • To perform this procedure, you must be a member of the Administrators group.

You cannot perform an unattended installation on a computer with ISA Server 2000 installed. Msisaund.ini contains the configuration information that is used by server setup in unattended mode. It has no effect on the standard ISA Server setup. If a value is not specified in this file, a default value is used. The following table describes the entries and values in the Msisaund.ini file of the server.

Entry | Description
PIDKEY | Specifies the product key. This is the 25-digit number located on the back of the ISA Server CD-ROM case.
INTERNALNETRANGES | Specifies the range of addresses in the Internal network. Msisaund.ini must specify at least one Internet Protocol (IP) address. Otherwise, Setup fails.The syntax is: N From1-To1,From2-To2,... FromN-ToN, where N is the number of ranges, and FromI to ToI are the starting and ending addresses in each range.
InstallDir={install_directory} | Specifies the installation directory for ISA Server. If not specified, it defaults to the first disk drive with enough space. The syntax is: Drive:\Folder The default folder is: %Program Files%\Microsoft ISA Server
COMPANYNAME=Company_Name | Specifies the name of the company installing the product.
DONOTDELLOGS = {0|1} | If set to 1, log files on the computer are not deleted. The default is 0.
DONOTDELCACHE = {0|1} | If set to 1, cache files on the computer are not deleted. The default is 0.
ADDLOCAL= {MSFirewall_Management}, {MSFirewall_Services}, {Message_Screener}, {Publish_Share_Directory}, {MSDE} | Specifies a list of components (delimited by commas) that should be installed on the computer. To install all the components, set ADDLOCAL=ALL.
REMOVE={MSFirewall_Management}, {MSFirewall_Services}, {Message_Screener}, {Publish_Share_Directory}, {MSDE} | Specifies a list of components (delimited by commas) that should be removed from the computer. To remove all the components, set REMOVE=ALL.
IMPORT_CONFIG_FILE =Importfile.xml | Specifies a configuration file to import. For more information about importing a configuration file, see Export and import.


Default settings

After installation, ISA Server 2004 uses the default settings that are listed in the following table.

Feature | Default setting | For more information, see
User permissions | Members of the Administrators group on the local computer can configure firewall policy.
Internal network | The Internal network contains entries specified during the installation process. | Internal network
Network settings The following network rules are created:
  • Local Host Access. Defines a routed network relationship between the Local Host network and all networks. This defines a network relationship to other networks, needed by services running on the ISA Server computer.
  • Internet Access. Defines a network address translation (NAT) network relationship from the Internal network, the Quarantined VPN Clients network, and the VPN Clients network, to the External network. Access will be allowed only if you configure the appropriate access policy.
  • VPN Clients to Internal Network. Defines a routed network relationship between the VPN Clients network and the Internal network. Access will be allowed only if you enable virtual private network (VPN) client access.
Network rules
Firewall policy | A default rule (named Default Rule) denies traffic between all networks. | Firewall Policy Rules
System policy | ISA Server is secure by default, while allowing certain critical services to function. Upon installation, some system policy rules are enabled to allow necessary services. We recommend that you review the system policy configuration, and customize it so that only services that are critical to your specific deployment are enabled. | System Policy
Web chaining | A default rule (named Default Rule) specifies that all Web Proxy client requests are retrieved directly from the Internet. | Web chaining rules
Caching | The cache size is set to 0. All caching is therefore disabled. | Cache overview
Alerts | Most alerts are active. We recommend that you review and configure the alerts in accordance with your specific networking needs. | Alerts
Client configuration | When installed or configured, Firewall and Web Proxy clients have automatic discovery enabled. Web browser applications on Firewall clients are configured when the Firewall client is installed. | Automatic discovery overview


Upgrading from ISA Server 2000

Microsoft Internet Security and Acceleration (ISA) Server 2004 supports a full upgrade path for ISA Server 2000 users. Most ISA Server 2000 rules, network settings, monitoring configuration, and cache configuration will be upgraded to ISA Server 2004.

ISA Server 2004 introduces many new features and changes. These changes affect the server configuration and upgrade scenarios. This section provides information about the key items to consider as part of the upgrade process.

  • Upgrade process
  • ISA Server 2000 administration and monitoring configuration upgrade
  • ISA Server 2000 access policy configuration upgrade
  • ISA Server 2000 publishing policy configuration upgrade
  • ISA Server 2000 policy elements upgrade
  • ISA Server 2000 network and client configuration upgrade
  • ISA Server 2000 dial-up, chaining, and routing configuration upgrade
  • ISA Server 2000 add-in configuration upgrade
  • ISA Server 2000 cache configuration upgrade
  • ISA Server 2000 Routing and Remote Access upgrade
  • ISA Server 2000 Feature Pack 1 and hotfix configuration upgrade
  • New ways to do familiar tasks


Upgrade process

The ISA Server 2004 Migration Tool enables a full upgrade path for ISA Server 2000 users to ISA Server 2004. Most ISA Server 2000 configuration information will be upgraded to ISA Server 2004. ISA Server 2004 introduces many new features and changes over ISA Server 2000. These changes affect the server configuration and upgrade scenarios.

Note:

  • ISA Server 2000 Service Pack 1 (SP1) must be installed on the computer.
  • You can only upgrade from ISA Server 2000 Standard Edition.

There are three options for upgrading from ISA Server 2000:

  • In-place upgrade. In this scenario, you install ISA Server 2004 on the same computer running ISA Server 2000. The configuration is migrated directly to ISA Server 2004, as described in the following topics. You do not have to run any tool.
  • Migrate ISA Server 2000 configuration. In this scenario, you either install ISA Server 2004 on a different computer, or completely remove ISA Server 2000 before installing ISA Server 2004. In either case, you must use the Migration Tool to migrate the configuration information to ISA Server 2004, as described in the following topics.
  • Migrate Routing and Remote Access configuration. In this scenario, you may have previously configured virtual private networking using Routing and Remote Access. You can use the Migration Tool to copy some of that configuration to ISA Server 2004, as described in ISA Server 2000 Routing and Remote Access configuration upgrade.

In-place upgrade

You can also perform an in-place upgrade by running the Migration Tool on a computer with ISA Server 2000 installed. When you perform an in-place upgrade, ISA Server 2000 is removed and ISA Server 2004 is installed with the migrated configuration.

Migrating the configuration

The migration from ISA Server 2000 to ISA Server 2004 includes the following steps:

  1. Run the ISA Server Migration Wizard on the ISA Server 2000 computer. The wizard creates an .xml file with the configuration information.
  2. Install Microsoft ISA Server 2004.
  3. Import the .xml file to the ISA Server 2004 computer. Before you import the .xml file, we recommend that you perform a full backup of the current settings on the ISA Server 2004 computer.

The actual IP address of the external network adapter on the original ISA Server 2000 computer is saved in the .xml file with the configuration information. If ISA Server 2004 is installed on a different computer, you must correct the IP address after you import the .xml file.

Upgrading Add-ins

Application filters and Web filters supplied by third party vendors for ISA Server 2000 are not compatible with ISA Server 2004. Some third party vendors have created new versions for ISA Server 2004. To upgrade to the new versions, perform the following steps:

  1. Uninstall the application filters and Web filters from the ISA Server 2000 computer.
  2. Perform the upgrade to ISA Server 2004, as described here.
  3. Install the new version of the application filter or Web filter.

For more information on how add-ins are upgraded, see ISA Server 2000 add-in configuration upgrade.

What is not upgraded

The following ISA Server 2000 objects and configuration settings are not migrated to ISA Server 2004:

  • Bandwidth rules are no longer supported in ISA Server 2004.
  • Permission settings, such as system access control lists (SACLs), are not upgraded. For more information, see ISA Server 2000 administration and monitoring configuration upgrade.
  • Logging and reporting configuration and information are not migrated. For more information, see ISA Server 2000 administration and monitoring configuration upgrade.

Note

  • When you upgrade, the H.323 Gatekeeper installed with ISA Server 2000 is removed.

When you use the Migration Tool to install ISA Server 2004, the Firewall Client Share (with the Firewall Client for ISA Server 2004 software) is installed. It is recommended that you install the Firewall Client Share. For instructions, see Create a shared folder for Firewall Client Installation.


ISA Server 2000 administration and monitoring configuration upgrade

Some administration and monitoring configuration settings are migrated to ISA Server 2004, as detailed in the following sections.

System access control lists

In ISA Server 2000, you can use ISA Server Management to reconfigure a system access control list (SACL) on certain objects. In addition, the SACL for any element could be changed, using the Admin COM object model.

SACLs are not migrated to ISA Server 2004. Instead, the default SACLs are applied.

Monitoring

All ISA Server 2000 alert definitions are migrated directly to ISA Server 2004, with the following exceptions:

  • Alert definitions that reference Web Proxy are created for the Microsoft Firewall service instead, because there is no Web Proxy service in ISA Server 2004.
  • The following ISA Server 2004 alert definitions are not modified: DNS intrusion, POP intrusion, RPC filter connectivity changed, and SOCKS configuration failure.

No log configuration settings are migrated from ISA Server 2000. ISA Server 2004 log settings are set to the post-installation default settings. After migration, ISA Server 2004 logs are stored as Microsoft Data Engine (MSDE) logs or in text format.

Report jobs, reports, and report configuration are not migrated.


ISA Server 2000 access policy configuration upgrade

Most ISA Server 2000 access policy rules are upgraded to ISA Server 2004, as detailed in the following sections.

Bandwidth rules

Bandwidth rules (and associated policy elements) are not supported in ISA Server 2004. They are not upgraded.

IP packet filters

ISA Server 2000 packet filters are not explicitly configurable in ISA Server 2004. Packet filters in ISA Server 2000 were used to:

  • Publish servers on a perimeter network.
  • Run applications or other services on the ISA Server computer.
  • Allow outgoing traffic from the ISA Server computer.
  • Allow access to protocols that are not based on User Datagram Protocol (UDP) or Transmission Control Protocol (TCP).

If packet filtering is disabled on ISA Server 2000, then all traffic to the Local Host and Perimeter networks is allowed and the packet filters are ignored. When migrating the ISA Server 2000 configuration, the ISA Server 200 packet filters are migrated as is to ISA Server 2004.

The following table lists how custom ISA Server 2000 packet filters are upgraded to ISA Server 2004 access rules.

Property | ISA Server 2000 packet filter | ISA Server 2004 access rule
Name, description, servers, enabled |  | Same as ISA Server 2000 values
ISA Server 2000 IP Protocol upgraded to ISA Server 2004: Protocol definition | TCP, UDP, ICMP, or custom IP protocol | Same protocol
 | Any | No new protocol, and migration tool sets protocol to All outbound IP traffic
 | Protocol number | Same protocol number
 | Local port | Source port defined in the access rule, and destination port (or source port, depending on the protocol direction) defined in the protocol connection
 | Local port number | Source port range (on the Protocol tab of the access rule)
Direction | Outbound | Outbound
 | Inbound | Outbound (To and From fields changed accordingly)
 | Send Receive | Send Receive
 | Receive Send | Send Receive (To and From fields changed accordingly)
ISA Server 2000: Local computer (Applies To) upgraded to ISA Server 2004: Access Rule "To" property | Default IP address | Local Host network
 | Local computer set to the IP address of the ISA Server 2000 computer | Computer element with the IP address of the ISA Server 2004 computer
 | Local computer set to a specific IP address | Computer element with the specific IP address
 | Local computer set to a perimeter network | Address range object with the IP addresses of the perimeter network
ISA Server 2000: Remote computer (Applies To) upgraded to ISA Server 2004: Access Rule "From" property | All remote computers | All External networks
 | This remote computer | Computer object set to the IP address of the remote computer
 | This range of computers | Subnet with the specified address range

Note

  • If the direction of the ISA Server 2000 packet filter is Both, two rules are created on ISA Server 2004, with the To and From properties switched for the second rule.

Example

The access rules (created to replace the ISA Server 2000 packet filters) that deny access are ordered first. The rules that allow access are ordered subsequently, as shown in the following table.

ISA Server 2000 ISA Server 2004
Packet filter with these properties
  • Protocol: UDP
  • Direction: Send Receive
  • Local port: 53
  • Remote port: 78
  • Local computer applies to: default IP addresses on the external interface
  • Remote computer: All remote computers
 Access rule with these properties:
  • Source network is set to Local Host
  • Port: 53
  • Destination network is set to All External networks
Protocol definition with these properties:
  • Protocol: UDP
  • Port: 78
  • Direction: Send Receive

IP packet filters: predefined

ISA Server 2000 includes several predefined IP packet filters. The migration tool creates system policy rules, based on these IP packet filters, as detailed in the following table.

ISA Server 2000 IP packet filter | ISA Server 2004 system policy rule
DHCP Client | Allow DHCP request from firewall
DNS filter | DNS from local host to Anywhere
ICMP outbound | ICMP from firewall to Anywhere
ICMP Ping response (in), ICMP Timeout in, ICMP source quench, ICMP unreachable in | Allow all ICMP from firewall to networks
IP Reply (out) | Allow all ICMP(PING) from trusted server to firewall

When running the ISA Server Migration Tool, you can choose whether to allow traffic from the Internal network to the ISA Server computer. If you select this option, a rule is created that allows traffic from the Internal network to the Local Host network, and the reverse.

Protocol rules

ISA Server 2000 access policy consisted of protocol rules, and site and content rules. ISA Server 2004 includes only access rules, which are based on a combination of the original protocol rules, and site and content rules.

ISA Server 2000 protocol rules are upgraded to ISA Server 2004 access rules. Most properties are directly upgraded to ISA Server 2004. The Applies To property is upgraded, as detailed in the following table.

ISA Server 2000 protocol rule | ISA Server 2004 access rule
Any Request | Source network set to Internal and Local Host.
Client address sets | From is set to a computer set with specific IP addresses in original client address set. Source network is set to Internal.
Users and groups | From is set to a user set with the specific users originally specified. Source network is set to Internal.

Note that third-party application filters are not upgraded. Similarly, any protocol definitions that are installed with the application filter are not upgraded. Any rules that apply to these protocol definitions are not upgraded.

You can configure an ISA Server 2000 registry key, IgnoreContentTypeIfNotApplicable, which determines whether a content group is ignored for protocol rules that do not apply to HTTP. If this registry key is enabled, the migration tool creates two access rules for any protocol rule that applied to both HTTP and additional protocols. For example, if ISA Server 2000 includes a protocol rule that applies to POP3 and HTTP protocols, the migration tool creates two access rules on ISA Server 2004: one for POP3 and another for HTTP.

Site and content rules

ISA Server 2000 access policy consisted of protocol rules, and site and content rules. ISA Server 2004 includes only access rules, which are based on a combination of the original protocol rules, and site and content rules.

ISA Server 2000 site and content rules are upgraded to ISA Server 2004 access rules. Most properties are directly upgraded to ISA Server 2004. The Applies To property is upgraded, as detailed in the following table.

ISA Server 2000 site and content rule | ISA Server 2004 access rule
Any Request | Source network set to Internal and Local Host.
Client address sets | From is set to a computer set with specific IP addresses in original client address set. Source network is set to Internal and Local Host.
Users and groups | From is set to a user set with the specific users originally specified. Source network is set to Internal.

You can configure an ISA Server 2000 registry key, IgnoreContentTypeIfNotApplicable, which determines whether a content group is ignored for protocol rules that do not apply to HTTP. If this registry key is enabled, the migration tool creates two access rules for any protocol rule that applied to both HTTP and additional protocols. For example, if ISA Server 2000 includes a protocol rule that applies to POP3 and HTTP protocols, the migration tool creates two access rules on ISA Server 2004: one for POP3 and another for HTTP.

Merging protocol rules, and site and content rules

Some protocol rules, and site and content rules, are merged into a single access rule when upgrading to ISA Server 2004.

Naming conventions

The following table details the naming conventions for the new access rules.

ISA Server 2000 rule | ISA Server 2004 rule name | Example
Protocol deny rule | ISANumber-ISA_Rule_Name | ISA12-DenyNimda
Site and content deny rule | ISANumber-ISA_Rule_Name | ISA13-BlockBadStuff
Packet filter | ISANumber-ISA_Rule_Name | ISA14-ICMP
Bidirectional packet filter | ISANumber-ISA_Rule_Name(Inbound) ISANumber-ISA_Rule_Name(Outbound) | ISA18-NNMP(Inbound) ISA19-NNMP(Outbound)
Merged protocol and site and content rule | ISANumber-ISA_Rule_Name+ISA_Rule_Name | ISA15_InternetAccess+BlockBadStuff


ISA Server 2000 publishing policy configuration upgrade

ISA Server 2000 publishing rules are upgraded to ISA Server 2004, as detailed in the following sections.

Server publishing rules

For each server publishing rule on ISA Server 2000, a corresponding server publishing rule is created on ISA Server 2004. Some properties are modified during the upgrade process, as detailed in the following table.

Property | ISA Server 2000 value | ISA Server 2004 value
Action | IP address of server on Internal network | To is set to computer object with the specific IP address.
 | External IP address | IP address of External listener is set to the specific IP address.
 | Protocol | Same as ISA Server 2000.
Applies To | Any request | Source network is set to External and From is set to All Users.
 | Client address sets | From is set to a computer set with the specific IP addresses in the client address set.
 | User and group | Source network is set to External and From is set to All Users.

You can configure an ISA Server 2000 registry key, UseISAAddressInPublishing, which determines whether proxying is enabled. If the registry key is configured on the ISA Server 2000 computer, the Enable proxy check box is selected on ISA Server 2004.

Note that the actual IP address of the external network adapter on the original ISA Server 2000 computer is saved in the .xml file with the configuration information. If ISA Server 2004 is installed on a different computer, you must correct the IP address after you import the .xml file.

Web publishing rules

For each Web publishing rule on ISA Server 2000, a corresponding Web publishing rule is created on ISA Server 2004. Some properties are modified during the upgrade process, as detailed in the following table.

Property | ISA Server 2000 value | ISA Server 2004 value
Action | Discard the request | Denied. Rule is ordered first after the denied access rules.
 | Redirect the request | Allowed. To is set to the computer specified on ISA Server 2000.
 | Send the original request | Same as ISA Server 2000. To is set to the computer specified on ISA Server 2000.
 | Port selection | Same as ISA Server 2000, specified on the Bridging tab.
Destination | All destinations | Not supported. The rule is not exported. A log message is generated.
 | All internal | Not supported. The rule is not exported. A log message is generated.
 | All external | All requests.
 | Selected destination set to single IP address or domain | On ISA Server 2004, more than one Web publishing rule may be created if the specified ISA Server 2000 Web publishing rule was applied to multiple public destinations.
 | Selected destination set to range of IP addresses | Set to first IP address in the range.
 | All destinations except selected | Not supported. The rule is not exported. A log message is generated.
Bridging | HTTP to HTTP and SSL to HTTP | Same.
 | HTTP to HTTP and SSL to SSL | Same
 | HTTP to SSL and SSL to SSL | Same.
 | HTTP to FTP and SSL to FTP | Same.
 | HTTP to HTTP and SSL to FTP | HTTP to HTTP and SSL to SSL.
 | HTTP to SSL and SSL to HTTP | HTTP to HTTP and SSL to SSL.
 | HTTP to SSL and SSL to FTP | HTTP to HTTP and SSL to SSL.
 | HTTP to FTP and SSL to HTTP | HTTP to HTTP and SSL to SSL.
 | HTTP to FTP and SSL to SSL | HTTP to HTTP and SSL to SSL.

On ISA Server 2000, Web listeners are implicitly assigned for each Web publishing rule. For ISA Server 2004, the Web listener is explicitly assigned to each Web publishing rule.

If an ISA Server 2000 Web publishing rule applies to more than one listener, corresponding ISA Server 2004 Web publishing rules are created for each ISA Server 2000 Web listener. For example, if an ISA Server 2000 Web publishing rule applies to three Web listeners, three ISA Server 2004 Web publishing rules are created, one for each Web listener specified in the original ISA Server 2000 Web publishing rule.

If an ISA Server 2000 Web publishing rule applies to a destination set that includes two or more different IP addresses (or domain names) and two or more different paths, ISA Server 2004 Web publishing rules are created for each pair of IP addresses and paths.

Note that the actual IP address of the external network adapter on the original ISA Server 2000 computer is saved in the .xml file with the configuration information. If ISA Server 2004 is installed on a different computer, you must correct the IP address after you import the .xml file.

In ISA Server 2000, a Web publishing rule can apply to a destination set with an empty path.

When migrating Web publishing rules, link translation is not enabled for Web publishing rules that apply to All Destinations. That is, a Web publishing rule with link translation configured will be created, but disabled.

Naming conventions

The following table details the naming conventions for the new publishing rules.

ISA Server 2000 rule | ISA Server 2004 rule name | Example
Server publishing rule | ISANumber-ISA_Rule_Name | ISA12-PublishSMTP
Web publishing rule | ISANumber-ISA_Rule_Name for Listener_Name for domain/path | ISA13-Publishing for External IP: 122.11.223.123 for microsoft.com/foo


ISA Server 2000 policy elements upgrade

Most ISA Server 2000 policy elements are upgraded to ISA Server 2004, as detailed in the following sections.

Client address sets

In ISA Server 2000, client address sets included IP addresses and IP address ranges. Client address sets were used in site and content rules, and in protocol rules (and not in publishing rules).

In ISA Server 2004, client address sets are replaced by computer sets. For each ISA Server 2000 rule that applies to a client address set that is upgraded, a new computer set is created on ISA Server 2004. The upgraded rule applies to the new computer set, which includes the same IP addresses as the original client address set on ISA Server 2000.

Content groups

ISA Server 2000 content groups are upgraded directly to ISA Server 2004. If a content group with the same name exists on ISA Server 2004, the content group from ISA Server 2000 is not imported.

Destination sets

ISA Server 2000 destination sets could include computer names, IP addresses, IP address ranges, domain names, and paths on computers. The destination sets are used in site and content rules, and in publishing rules.

ISA Server 2004 does not use destination sets. Instead, other network elements were introduced, which can be used flexibly with access rules and publishing rules.

The following table describes how ISA Server 2000 destination sets are mapped to various ISA Server 2004 network objects.

ISA Server 2000 policy element | ISA Server 2004 network object
Destination set with wildcards | Domain name set
Destination set with path | URL set
Destination set with single IP address | URL set
Destination set with single IP address and with path | URL set
Destination set with IP address range | Computer set
Destination set with IP address range and path URL set

Note

  • If the ISA Server destination set includes more than five IP addresses, no URL set is created. In this case, a warning is included in the log file. Furthermore, if a rule applies to this destination set, the rule is not upgraded, and a message is included in the log file.

The following table shows examples of how ISA Server 2000 destination sets are upgraded.

Destination set on ISA Server 2000 | Network object on ISA Server 2004
Destination set with mayah.microsoft.com | Domain name set with mayah.microsoft.com
Destination set with eitanh.microsoft.com and with path foo | Domain name set with eitanh.microsoft.com and URL set with http://eitanh.microsoft.com/foo/
Destination set with IP address range 192.168.123.134 (single IP) and path foo | Computer set with range 192.168.123.134 to 192.168.123.134 URL set with http://192.168.123.134/foo/
Destination set with yairh.microsoft.com and path /foo, with IP address 1.2.3.4 and path boo, and with IP address range 1.2.3.4 to 1.2.3.5 and path /home | Computer set with IP address ranges 1.2.3.4 to 1.2.3.4 and IP address ranges 1.2.3.4 to 1.2.3.5. Domain name set with yairh.microsoft.com URL set with http://yairh.microsoft.com/foo, http://1.2.3.4/boo, http://1.2.3.4/home, and http://1.2.3.5/home

Destination sets and rules

The following table describes the ISA Server 2004 rule settings for the destination sets originally used in rules upgraded from ISA Server 2000.

ISA Server 2000 | ISA Server 2004
All destinations | To property is set to Anywhere.
All Internal destinations | To property is set to Internal Network. Destination network is set to Internal.
All External destinations | To property is set to External Network. Destination network is set to External.
Selected destination | To property is set to computer sets, domain names, and URL sets, corresponding to the original destination set.

Protocol definitions

ISA Server 2000 included two types of protocol definitions:

  • Explicitly defined protocol definitions. Protocol elements created upon installation, by ISA Server, or created subsequently by a user.
  • Implicitly defined protocol definitions. Used by specific application filters or by an IP packet filter.

The migration tool creates corresponding protocol definitions in ISA Server 2004 for all explicitly defined protocol elements. If ISA Server 2004 already has a protocol definition with the same name, the ISA Server 2000 protocol definition is not imported.

Implicitly defined protocol definitions, created by third-party application filters, are not upgraded. A warning message indicates this in the migration log file. Implicitly defined protocol definitions, used with IP packet filters, are upgraded.

Protocol definitions that cannot be identified by the migration tool are not upgraded. Any rules that apply to unidentified protocol definitions are deleted.

Schedule

ISA Server 2000 schedules upgrade directly to ISA Server 2004. Any ISA Server 2000 rule that does not have a specifically named schedule will reference the schedules created (with the same name) in ISA Server 2004.

A new schedule may be created on ISA Server 2004 when two schedules are used by a site and content rule, and by a protocol rule on ISA Server 2000.

Web listeners

ISA Server 2000 included incoming listeners and outgoing listeners on a specific IP address. In ISA Server 2004, Web listeners can be assigned an entire network, or to a specific IP address.

The incoming listeners on ISA Server 2000 are upgraded to ISA Server 2004 as Web listeners on the External network.

The default outgoing listeners on ISA Server 2000 are upgraded to ISA Server 2004 as Web listeners on the Internal network. If the the default listener is not being used, no listener is upgraded. This is noted in the log file.

Note that the actual IP address of the external network adapter on the original ISA Server 2000 computer is saved in the .xml file with the configuration information. If ISA Server 2004 is installed on a different computer, you must correct the IP address after you import the .xml file.

Naming conventions

The following table details the naming conventions for the new rule elements.

ISA Server 2000 policy element | ISA Server 2004 rule element
Destination set (creates computer set) | Computer set with Destination_Set_Name
Destination set (creates URL set) | URL set with Destination_Set_Name
Default Web listener | External default Web listener
Merged schedule | ScheduleName1_ScheduleName2


ISA Server 2000 network and client configuration upgrade

ISA Server 2000 network and client configuration settings are upgraded to ISA Server 2004, as detailed in the following sections.

Networks

ISA Server 2000 supports only two networks: Internal and External. A perimeter network (also known as DMZ, demilitarized zone, and screened subnet) could be implied by creating packet filters to route traffic from the External network to the perimeter network.

ISA Server 2004 supports multiple networks. The following networks are created by default on ISA Server 2004:

  • Internal, derived from the ISA Server 2000 local address table (LAT). The Internal network on ISA Server 2004 does not include IP addresses in the VPN static address pool configured on ISA Server 2000. It also does not include the broadcast address.
  • External
  • Local Host
  • VPN Clients

The migration tool creates the following network rules on ISA Server 2004:

  • A network rule that defines a route relationship between the Local Host and the Internal network.
  • A network rule that defines a route relationship between the perimeter network and the External network.
  • A network rule that defines a NAT relationship from the Internal network to the perimeter network.

Local Domain Table

The local domain table (LDT) is migrated as is to ISA Server 2004. If the ISA Server 2000 LDT includes IP addresses, these are not migrated to ISA Server 2004.

Client settings

In ISA Server 2004, client settings are per network. ISA Server 2000 client settings are upgraded directly to the client settings on the ISA Server 2004 Internal network.

As in ISA Server 2000, ISA Server 2004 Firewall Client application settings apply to all client requests. Firewall Client application settings are upgraded directly to ISA Server 2004.


ISA Server 2000 dial-up, chaining, and routing configuration upgrade

Most ISA Server 2000 dial-up, chaining, and routing configuration settings are upgraded to ISA Server 2004, as detailed in the following sections.

Dial-up connections

In ISA Server 2000, multiple dial-up connections could be created, but only one dial-up connection could be active at a time. In ISA Server 2004, only a single dial-up can be created.

In ISA Server 2000, the dial-up connection was defined per Firewall client and per Web Proxy client. In ISA Server 2004, the dial-up connection is defined per network.

As part of the upgrade process, only the active dial-up connection is upgraded. It is assigned to the External network.

All other dial-up connections are not upgraded. This is noted in the upgrade log file.

Firewall chaining

ISA Server 2000 chaining configuration is upgraded directly to ISA Server 2004. The only exception is the dial-up connection specified on ISA Server 2000. On ISA Server 2004, the dial-up connection is created on the External network.

Routing rules

Each ISA Server 2000 routing rule is duplicated on ISA Server 2004, as a cache rule and as a routing rule.

The ISA Server 2004 routing rule is created with identical properties to those of the original ISA Server 2000 routing rule. The destinations specified for the ISA Server 2000 routing rule are mapped to specific networks on the To property page of the ISA Server 2004 routing rule properties.

If the ISA Server 2000 routing rule used a dial-up entry, a dial-up entry with the same properties is created on the External network of ISA Server 2004.

A new caching rule is created based on the original ISA Server 2000 routing rule. The destinations specified for the ISA Server 2000 routing rule are mapped to specific networks on the To property page of the ISA Server 2004 routing rule properties.

The following properties are not supported on ISA Server 2004 caching rules and are therefore not upgraded from the original ISA Server 2000 routing rule: bridging and action.


ISA Server 2000 add-in configuration upgrade

Most ISA Server 2000 access policy rules, publishing rules, and IP packet filters are upgraded to ISA Server 2004, as detailed in the following sections.

In ISA Server 2000, application filters were applied unconditionally to specific traffic. In ISA Server 2004, some filtering can be applied on a per-rule basis. The following table describes how ISA Server 2000 application filter functionality is upgraded to ISA Server 2004.

Note:

  • Be sure to remove any application filters or Web filters supplied by third party vendors before upgrading. If these application or Web filters are also available for ISA Server 2004, you can reinstall them after you upgrade.
Application filter or rule | ISA Server 2000 | ISA Server 2004
FTP access | Protocol rules applying to FTP | Access rule with the Read only option of FTP filtering disabled
 | Protocol rules applying to FTP download | Access rule with the Read only option of FTP filtering enabled
 | Protocol rules applying to FTP server | Server publishing rule with the Read only option of FTP filtering disabled
H.323 filter | Allow incoming call | Filter listens on the External network
 | Allow outgoing calls | Filter listens on the Internal network
 | All other configurations | Same as in ISA Server 2000
HTTP redirection | All configurations | Not supported
RPC filter | All configurations | Replaced with per-rule filtering
SMTP filter | SMTP commands | Same as in ISA Server 2000
 | Attachments, users and domains, and keywords | Upgraded to an SMTP server publishing rule, on a per-rule basis
SOCKS v4 filter | Enabled | Listen for SOCKS requests initiated from the Internal network
Streaming media | MMS filter, PNM filter, and RTSP filter: any configuration | Configuration same as ISA Server 2000 MMS stream splitting not supported

Configuration settings for the following application filters are upgraded directly to ISA Server 2004:

  • DNS intrusion detection filter
  • POP intrusion detection filter

If the message screener is not installed on the computer being upgraded to ISA Server 2004, then any traffic from the message screener computer is blocked unless you specifically configure ISA Server 2004, allowing all traffic to and from the Internal network to and from the Local Host network. Similarly, you can add a rule that allows MS Firewall Control traffic from the message screener computer to the Local Host computer.

Some application filter properties are configured differently in ISA Server 2004 than in ISA Server 2000. For more information about how to use ISA Server 2004, see New ways to do familiar tasks.

Note that third-party application filters are not upgraded. Similarly, any protocol definitions that are installed with the application filter are not upgraded. Any rules that apply to these protocol definitions are not upgraded.


ISA Server 2000 cache configuration upgrade

Most ISA Server 2000 cache configuration settings are upgraded to ISA Server 2004, as detailed in the following sections.

Caching

Most ISA Server 2000 cache properties are upgraded directly, with no change, from ISA Server 2000 to ISA Server 2004. Note the following exceptions:

  • General cache properties specifying whether cache objects should be updated are set to the ISA Server 2004 default.
  • General cache properties specifying whether objects exceeding a certain size should be cached are not upgraded.
  • General cache properties specifying whether dynamic content is cached are set in the ISA Server 2004 default cache rule.

The cache drive configuration is retained in ISA Server 2004. If the migration is done to a different computer, the ISA Server 2004 computer should have similar hardware and drive configuration to the original ISA Server 2000 computer.

If ISA Server 2000 was installed in cache mode, the migration tool does the following:

  • Configures the Internal network on ISA Server 2004 to include all addresses associated with the single network adapter specified on the ISA Server 2000 computer.
  • Creates an access rule allowing HTTP, HTTPS, and FTP access from the Internal network to the Internal network.

Schedule content download jobs

ISA Server 2000 scheduled content download jobs are upgraded directly to ISA Server 2004.


ISA Server 2000 Routing and Remote Access upgrade

When you install ISA Server 2004, you can upgrade the Routing and Remote Access configuration. You can upgrade the configuration to ISA Server 2004, regardless of whether ISA Server 2000 is installed on the computer.

Note the following limitations to the Routing and Remote Access configuration upgrade:

  • The maximum number of remote virtual private network (VPN) clients allowed to connect to ISA Server 2004 is set to whichever is larger on Routing and Remote Access: the number of PPTP ports or the number of L2TP ports. For more information, see Configure maximum number of simultaneous remote client connections.
  • If the number of IP addresses statically assigned is smaller than the number of VPN clients, the number of VPN clients is reduced to fit the size of the static address pool. A warning is issued to the user during the Routing and Remote Access upgrade process.
  • Preshared keys configured for Routing and Remote Access are not exported. A warning message is issued.
  • If an invalid IP address is configured for the primary DNS server, it is not exported. The DHCP settings are used instead, and a warning message is issued. If an invalid IP address is configured for the backup DNS server, it is not exported. A warning message is issued.
  • If an invalid IP address is configured for the primary WINS server, it is not exported. The DHCP settings are used instead, and a warning message is issued. If an invalid IP address is configured for the backup WINS server, it is not exported. A warning message is issued.
  • If a site-to-site connection on Routing and Remote Access is configured as PPTP first (and then L2TP), it is upgraded to a remote site network on ISA Server 2004 that uses PPTP only. A warning message is issued.
  • If a site-to-site connection on Routing and Remote Access is configured as L2TP first (and then PPTP), it is upgraded to a remote site network on ISA Server 2004 that uses L2TP only. A warning message is issued.
  • Preshared keys configured for site-to-site connections in Routing and Remote Access are not exported. A warning message is issued.
  • Credentials configured for site-to-site connections in Routing and Remote Access are not exported. On ISA Server 2004, outgoing VPN connections are disabled until you reconfigure them. A warning message is issued.


ISA Server 2000 Feature Pack 1 and hotfix configuration upgrade

ISA Server 2000 Feature Pack 1 introduced several new features, which are included in ISA Server 2004. Most ISA Server 2000 Feature Pack 1 configuration information is migrated directly to ISA Server 2004. Note the following exceptions:

  • Link translation. Directly migrated to ISA Server 2004. Note the following:
    • A new content group is created for content groups to which the ISA Server 2000 link translation filter applied.
    • With ISA Server 2000 Feature Pack 1 link translation, you could configure whether caching of translated responses on external proxy should be prevented. This feature is not supported on ISA Server 2004.
  • SecurID authentication support. Note the following:
    • Web publishing rules that have SecurID enabled are migrated to ISA Server 2004; however, the new rule is disabled.
    • In ISA Server 2000 Feature Pack 1, SecurID authentication was configured per Web publishing rule. In ISA Server 2004, it is configured per Web listener. If ISA Server 2000 has two Web publishing rules with different configurations, the rules are migrated but SecurID authentication configuration is disabled.
    • To complete the migration of SecurID authentication configuration, do the following:
      1. Copy the Sdconf.rec file generated by the access control entry (ACE) server to %SystemRoot%\System32.
      2. Create an access rule allowing communication from the Local Host to the ACE server.
  • URLScan. This filter is renamed HTTP filter in ISA Server 2004. The following functionality, which was supported in ISA Server 2000 Feature Pack 1, is not available in ISA Server 2004:
    • EnableLogging
    • PerProcessLogging
    • AllowLateScanning
    • PerDayLogging
    • RejectResponseUrL
    • UseFastPathReject
    • DenyUrlSequences

ISA Server 2000 hotfixes

All registry keys installed as part of ISA Server 2000 hotfixes are migrated directly to ISA Server 2004.


New ways to do familiar tasks

The following table lists common tasks you can perform using ISA Server 2004, and compares these tasks to how they were performed using ISA Server 2000.

If you want to | In ISA Server 2000 | In ISA Server 2004
Publish co-located servers | Create a static packet filter allowing access to the specific server located on the ISA Server computer. | Create a server publishing rule. For more information, see Server publishing rules.
Enable an application on the ISA Server computer to access the Internet | Create a static packet filter allowing access to the specific port on the ISA Server computer. | Verify that the default network rule, which is created upon installation, accurately defines a relationship between the Local Host network and the External network. Then, create an access rule that allows access to the specific protocol. For more information, see Access rules.
Configure the local address table (LAT) | Click Local Address Table on any service's properties. | The Internal network replaces the local address table, and is configured as part of the setup process. You can subsequently reconfigure the Internal network. For more information, see Internal network.
Configure IP-based protocol support | IP-based protocols were supported in a limited fashion. | Create a protocol, specifying any of the following protocol types: TCP, UDP, ICMP, or IP-level. If you select IP-level, you can specify any low-level protocol. For more information, see Protocols.
Configure virtual private networking | Use the VPN wizards to configure client-to-router or router-to-router VPN. | Configure and enable VPN properties and monitor VPN connections. For more information, see Virtual Private Networking.
Configure outgoing Web request properties | On the array properties, click the Outgoing Web requests tab and configure listener properties. | Each network has its own listener, the network adapter that is responsible for listening for requests bound for that network. For information about configuring listeners for outgoing requests, see Configure authentication method for Web Proxy clients (outgoing requests).
Configure incoming Web request properties | On the array properties, click the Incoming Web requests tab and configure listener properties. | Web listeners are used as part of each Web publishing rule. When you configure a Web publishing rule, you specify which Web listener to use for that rule. For information about Web listeners, see Web listener overview.


Installation and Migration: How To

This section explains how to install Microsoft Internet Security and Acceleration (ISA) Server 2004 and Microsoft Firewall Client for ISA Server 2004 software.

  • Installing ISA Server
  • Migrate ISA Server 2000 configuration


Install ISA Server

This section provides step-by-step instructions about how to install Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Run ISA Server setup
  • Run ISA Server unattended setup
  • Change ISA Server installation options
  • Install ISA Server Management
  • Create a shared folder for Firewall Client installation
  • Uninstall server software


Run ISA Server setup

To run ISA Server setup

  1. Open ISAautorun.exe from the root folder of the ISA Server CD or a shared folder on your network that contains the ISA Server files.
  2. After the setup program shows that it has completed determining the system configuration, on the Welcome page, click Next.
  3. If you accept the terms and conditions stated in the end-user license agreement, click I accept the terms in the license agreement, and then click Next.
  4. Type your customer details, and then click Next.
  5. Click Typical Installation, Full Installation, or Custom Installation.

    Note:

    • There are four components that can be installed.
    • ISA Server Services. The services that comprise ISA Server.
    • ISA Server Management. The ISA Server Management user interface.
    • Firewall Client Installation Share. A location from which client computers can install the Firewall Client software. This is typically installed on a computer other than the ISA Server computer, so it is not part of the Typical Installation option. The Firewall Client Share can be installed on computers running Windows Server 2003, Windows 2000 Server or Windows XP.
    • Message Screener. A component that you configure to screen e-mail messages for keywords and attachments. This component must be installed on an SMTP server, which is typically not your ISA Server computer.

    Typical Installation installs ISA Server Services and ISA Server Management. Full Installation installs all four components. Custom Installation enables you to select which components you will install.

  6. Click Next.
  7. Configure the Internal network. Follow these steps:
    1. Click Add.
    2. Click Configure Internal Network.
    3. Select Add address ranges based on the Windows Routing Table.
    4. Select one or more of the adapters that are connected to the Internal network. These addresses will be included in the Internal network that is defined by default for ISA Server.
    5. Clear the selection of Add the following private IP ranges, unless you want to add those ranges to your Internal network.
    6. Click OK. Read the Setup Message and click OK. Then click OK again to finish the Internal network configuration, and then click Next.
  8. Click Install.
  9. After the installation is complete, if you want to invoke ISA Server Management immediately, select the Invoke ISA Server Management check box, and then click Finish.

Notes

  • To perform this procedure, you must be a member of the Administrators group.
  • If you downloaded the ISA Server installation files from the Web, or if you copied the contents of the ISA Server CD, run the ISAautorun.exe file at a command prompt to begin the ISA Server installation. Then, click Install ISA Server.
  • You cannot install the management consoles for ISA Server 2000 and ISA Server 2004 on the same computer.
  • The MSDE component, required for many monitoring features, is not properly installed when you remotely install ISA Server, using Terminal Services in application server mode. Use Terminal Services in administration mode to properly install MSDE.
  • If Internet Authentication Service (IAS) is running while ISA Server is being installed, you must restart IAS when installation completes. Otherwise, ISA Server will not accept VPN connections.

Related Topics


Run ISA Server unattended setup

To run ISA Server unattended setup

  1. Modify the file called Msisaund.ini.
  2. At a command prompt, type

    PathToISASetup\Setup.exe [/[X|R]] /V" /q[b|n] FULLPATHANSWERFILE=\"PathToINIFile\MSISAUND.INI\""

Parameters

PathToISASetup
The path to the ISA Server 2004 installation files. The path may be the root folder of the ISA Server CD-ROM or a shared folder on your network that contains the ISA Server files.
/Q [b|n]
Performs quiet unattended setup. If you specify b, a progress bar indicates the setup process. If you specify n, no dialog boxes are displayed.
/R
Performs unattended reinstallation.
/X
Performs unattended uninstallation.
PathToINIFile
The path to the folder containing the unattended installation information.

Notes

  • To perform this procedure, you must be a member of the Administrators group.
  • You cannot perform an unattended installation on a computer with ISA Server 2000 installed. The INTERNALNETRANGES property in Msisaund.ini must specify at least one Internet Protocol (IP) address range that includes one of the IP addresses of your ISA Server computer. Otherwise, Setup fails.
  • A sample answer file (Msisaund.ini) is provided on the CD, in the FPC folder.
  • For example, CD\FPC\setup.exe /v" /qn FULLPATHANSWERFILE=\"C:\MSISAUND.INI\"" performs an unattended installation of ISA Server, using the Msisaund.ini file located in c:\.
  • The MSDE component, required for many monitoring features, is not properly installed when you remotely install ISA Server, using Terminal Services in application server mode. Use Terminal Services in administration mode to properly install MSDE.

Related Topics


Change ISA Server installation options

To change ISA Server installation options

  1. On Windows Server 2003 computers, click Start, click Control Panel, and then double-click Add/Remove Programs.
  2. In Microsoft Internet Security and Acceleration Server Setup, click Change/Remove.
  3. On the Welcome page, click Next.
  4. On the Program Maintenance page, select Modify.
  5. In Click on an icon in the list below, choose one or more of the following:
    • Firewall Services. If you select this option, all the ISA Server services will be installed.
    • ISA Server Management. If you select this option, the management console used to centrally manage ISA Server will be installed.
    • Firewall Client Installation Share. If you select this option, a folder with all the files necessary to install the Firewall Client software will be created on the ISA Server computer. The folder will be shared to the Everyone group, thereby allowing anyone access to install the software.
    • Message Screener. If you select this option, the Message Screener will be installed. This component must be installed on an SMTP server, which is typically not your ISA Server computer.
  6. Click Next. Then, click Install to begin the installation.

Notes

  • On Windows 2000, in Add/Remove Programs, click Microsoft Internet Security and Acceleration Server, and then click Change or Remove.
  • Before removing ISA Server, be sure to close ISA Server Management and ISA Server Performance Monitor.
  • To perform this procedure, you must be a member of the Administrators group.
  • If you install only ISA Server Management, you can remotely administer another ISA Server computer. ISA Server will not run on the local computer.
  • When you install the Firewall Client share, the system policy rule named Allow access to firewall client share to trusted computers, which allows clients on the Internal network to access the share, is enabled. This rule must be enabled to allow the clients to install the software from the share.

Related Topics


Install ISA Server Management

To install ISA Server Management

  1. At a command prompt, type:
    Path\ISA\Setup
    where Path is the path to the ISA Server 2004 installation files. The path may be the root folder of the ISA Server CD or a shared folder on your network that contains the ISA Server files.
  2. On the Welcome screen, click Next. Follow the on-screen instructions.
  3. On the License Agreement screen, click I accept the terms of the license agreement and then click Next.
  4. On the Customer Information screen, fill in the information and then click Next.
  5. On the Setup Type screen, select Custom and then click Next.
  6. On the Custom Setup screen, select only to install Firewall Client Share. Perform the following:
    • Click Firewall Services and then click This feature will not be available.
    • Click ISA Server Management and then click This feature will be installed on local hard drive.
    • Click Firewall Client Installation Share and then click This feature will not be available.
    • Click Message Screener and then click This feature will not be available.
    Then, click Next.
  7. Click Install.

Note

  • To perform this procedure, you must be a member of the Administrators group.

Related Topics


Create a shared folder for Firewall Client installation

To create a shared folder for Firewall Client installation

  1. At a command prompt, type:
    Path\ISA\Setup
    where Path is the path to the ISA Server 2004 installation files. The path may be the root folder of the ISA Server CD or a shared folder on your network that contains the ISA Server files.
  2. On the Welcome screen, click Next. Follow the on-screen instructions.
  3. On the License Agreement screen, click I accept the terms of the license agreement and then click Next.
  4. On the Customer Information screen, fill in the information and then click Next.
  5. On the Setup Type screen, select Custom and then click Next.
  6. On the Custom Settings screen, select only to install Firewall Client Share. Perform the following:
    • Click Firewall Services and then click This feature will not be available.
    • Click ISA Server Management and then click This feature will not be available.
    • Click Firewall Client Installation Share and then click This feature will be installed on local hard drive.
    • Click Message Screener and then click This feature will not be available.
    Then, click Next.
  7. Click Install.

Notes

  • To perform this procedure, you must be a member of the Administrators group.
  • You can install Firewall Client software on client computers that run Microsoft® Windows Server™ 2003, Windows 2000 Server, Windows XP, Windows Millennium Edition, or Windows NT® 4.0. You can also install Firewall Client software on computers running Windows 98 Second Edition with Microsoft Internet Explorer 5 or later installed.
  • When you install the Firewall Client share, the system policy rule named Allow access to firewall client share to trusted computers, which allows clients on the Internal network to access the share, is enabled. This rule must be enabled to allow the clients to install the software from the share.

Related Topics


Uninstall server software

To uninstall server software

  1. Click Start, click Control Panel, and then double-click Change/Remove Programs.
  2. In Microsoft Internet Security and Acceleration Server Setup, click Remove.
  3. When prompted Are you sure you want to uninstall this product?, click Yes.

Notes

  • If you downloaded the ISA Server installation files from the Web, or if you copied the contents of the ISA Server CD, run the ISAautorun.exe file at a command prompt to begin the ISA Server installation. Then, click Install ISA Server.
  • Before removing ISA Server, be sure to close ISA Server Management and ISA Server Performance Monitor.
  • When you configure ISA Server, some RRAS settings may be modified. When you uninstall ISA Server, the RRAS configuration is reconfigured as follows:
    1. The RRAS service is disabled.
    2. The Remote Access Policy configured by ISA Server is deleted.
    3. RRAS is reset to its default settings and disabled. To configure RRAS, use the Configure and Enable Routing and Remote Access wizard, accessible from the RRAS snap-in.
  • Note that when you uninstall ISA Server, some files are not completely removed from the computer. The table below lists the files that remain and their location.
Folder | File Name
%windir% | IsUninst.exe
%windir%\MUI | muisetup.exe
%windir%\System32 | DBmsLPCn.dll, PJLMON.DLL, SET14.tmp, cliconfg.rll, dbmsgnet.dll, dbmsqlgc.dll, dbmsvinn.dll, dbnetlib.dll, ds16gt.dll, mscpxl32.dll, msdart.dll, msorc32r.dll, odbc32.dll, odbc32gt.dll, odbcad32.exe, odbctrac.dll, simpdata.tlb, sqlsrv32.rll, sqlunirl.dll


Upgrade ISA Server 2000 configuration

To upgrade ISA Server 2000 configuration

  1. At a command prompt, type

    Path\ISA2KExport.exe

    where Path is the path to the ISA Server 2004 installation files. The path may be the root folder of the ISA Server CD or a shared folder on your network that contains the ISA Server files.
  2. On the Welcome page of the ISA Server Migration Tool, click Next.
  3. On the Exported File Location page, type a file name and location for the .xml file that will be created to contain the ISA Server 2000 configuration information. Then, click Next.
  4. If the ISA Server 2000 configuration contains secret data, on the Set Password page, type a password to use when decrypting the .xml file on the ISA Server 2004 computer. The .xml file is encrypted, to protect sensitive configuration information. Then, click Next.
  5. On the Firewall Policy Setting page, select whether to allow traffic from the Internal network to the ISA Server computer. Select one of the following:
    • Block all traffic from the Internal network to the ISA Server computer. Select this option if the clients on the Internal network do not require any services running on the ISA Server computer.
    • Allow traffic from the Internal network to the ISA Server computer. Select this option if clients on the Internal network require services running on the ISA Server computer.
    Then, click Next.
  6. On the Start Migration Process page, click Migrate. When the status bar indicates that the migration process completed, click Next.
  7. Click Finish to close the wizard.

Notes

  • To perform this procedure, you must be a member of the Administrators group.
  • You can use ISA Server 2004 import functionality to import the generated .xml file. For instructions, see Import a configuration.

Related Topics


Deployment scenario: getting started with ISA Server

After you install Microsoft Internet Security and Acceleration (ISA) Server 2004, you must apply configuration settings, in accordance with your business security policies. ISA Server can be deployed in many varied scenarios. This topic focuses on a simple scenario, in which you want to allow clients on your corporate network unlimited access to the Internet.

Perform these steps:

  1. Install ISA Server. As part of the installation, configure the Internal network to include all IP addresses in the corporate network. For more information, see Installation process.
  2. Deploy Firewall Client software. Although this specific scenario focuses on allowing access to websites, there are many security advantages to deploying Firewall Client software. For more information, see Client requirements assessment.
  3. Apply your ISA Server network configuration. ISA Server includes several predefined network templates. You should choose the network template that most closely approximates your actual network. For this scenario, select the Edge Firewall network template, and then select the Unrestricted Internet access firewall policy, because all users on the corporate network are allowed access to the Internet. For instructions on configuring network templates, see Network Templates.
  4. Define how ISA Server caches Web content. Because clients on the corporate network will likely access similar websites, you improve network performance by implementing a caching policy. For more information, see Cache overview.
  5. If clients will require remote access, configure VPN access. For more information, see Remote VPN client access.

For more information on common deployment scenarios, see the Getting Started Guide (http://www.microsoft.com/), available on the ISA Server website.


Troubleshooting installation

After installation, the Microsoft Firewall service cannot start

Cause: This error happens when ISA Server cannot resolve the name of the ISA Server computer. The following error message may appear:

Cannot load an application filter Web Proxy Filter ({4CB7513E-220E-4C20-815A-B67BAA295FF4}).
FilterInit failed with code 0x80072afc.
To attempt to activate this application filter again, stop and restart the Firewall service.

Solution: Configure the DNS server so that the name of the ISA Server computer can be resolved.

During installation, "The Internal Network must contain at least one of the ISA Server computer's IP" error message appears.

Cause: ISA Server installation uses name resolution to determine the local IP addresses, required for constructing the Internal network. However, a line in the HOSTS file also contains that information.

Solution: Check the HOSTS file, located in the %windir%\system32\drivers\etc\hosts folder. Remove the following line: IP ISA_Server_Name.

Installation did not complete successfully.

Cause: Installation may not complete successfully for any number of reasons. Check the setup logs for possible clues.

Solution: Three setup logs are created each time you try to install ISA Server. These files are created in the %windir%\%temp% folder and are named isa*.log.


Security and Administration

Because Microsoft Internet Security and Acceleration (ISA) Server 2004 can be deployed at the edge of the network, it is critical that the computer on which you run ISA Server is fully secured.

Because of its sensitive role, ISA Server should be carefully administered, with permissions delegated carefully. Regular backups of the configuration should be performed. If you deploy more than one ISA Server computer, consider exporting configurations so that the configuration process is more automated.

This section describes security and administration considerations and provides step-by-step instructions on how to secure and administer ISA Server.

  • Security and Administration: Concepts
  • Security and Administration: How To


Security and Administration: Concepts

This section provides background information about administering and securing Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Security best practices
  • Lockdown mode
  • ISA Server console
  • Export and import
  • Back up and restore
  • Administrative roles
  • Remote administration
  • Error reporting and feedback


Security best practices

Because the computer on which ISA Server 2004 is running is often the primary interface to the External network, we recommend that you secure the computer. In addition to this information, the Security Best Practices (http://www.microsoft.com/) document, available on the ISA Server website, is updated periodically with new information.

Follow these best practices:

  • Install critical updates for the following:
    • Operating system
    • ISA Server (latest updates available on the ISA Server website (http://www.microsoft.com/))
    • Additional components installed by ISA Server (MSDE and OWC)
  • Ensure that the ISA Server computer is stored in a physically secure location. Physical access to a server is a high security risk. Physical access to a server by an intruder could result in unauthorized access or modification, as well as installation of hardware or software designed to circumvent security. To maintain a secure environment, you must restrict physical access to the ISA Server computer.
  • Apply the principle of least privilege, where a user has the minimum privileges necessary to perform a specific task. This helps ensure that, if a user account is compromised, the impact is minimized by the limited privileges held by that user. Administrators should use an account with restrictive permissions to perform routine, nonadministrative tasks, and use an account with broader permissions only when performing specific administrative tasks. Consider this when you assign ISA Server administrative roles. For more information, see Administrative roles.
  • Carefully determine who should have permission to log on to the ISA Server computer. Then, configure the logon rights accordingly. See Windows Help for more information.
  • Apply the principle of reduced attack surface, disabling services and functions not critical to the current task. Disable ISA Server features that you do not use. Configure a system policy suited specifically to your network needs, disabling unnecessary functionality. For more information about system policy, see System policy overview.
  • Do not run unnecessary applications and services on the ISA Server computer.
  • We recommend that you do not install DHCP on the ISA Server computer.
  • When requested to present credentials, use strong passwords. A password is considered strong if it provides an effective defense against unauthorized access. A strong password does not contain all or part of the user account name, and contains at least three of the four following categories of characters: uppercase characters, lowercase characters, base 10 digits, and symbols found on the keyboard (such as !, @, or #).
  • Protect against Layer 2 attacks by deploying security solutions such as Layer 2 IDS and static MAC or port associations on switches.
  • After applying configuration changes, test them. For example, use a port scanning to verify that only the applicable ports are actually open.
  • Where possible, configure Internet Protocol security (IPSec) in the network.
  • Configure static Address Resolution Protocol (ARP) entries on the ISA Server computer.

RADIUS server configuration recommendations

  • If you are using a RADIUS server for authentication, create a connectivity verifier that monitors the server status. Configure the alerts so that an appropriate action is taken when the RADIUS server is not functioning. For more information about connectivity verifiers, see Connectivity.
  • Untrusted users should not have access to the network between a RADIUS server and ISA Server. If untrusted users must have access, use IPSec on this network.

Logging and alerting recommendations

  • Review the logs regularly and carefully, checking for suspicious access and usage of network resources.
  • Configure alerts to send notifications to administrators. Implement a rapid response procedure.
  • Use the log maintenance feature wisely, to ensure that the disk on which log information is stored does not become full. For more information about the log maintenance feature, see Log storage format.
  • Configure the Log Storage Limits alert definition to stop the ISA Server services. In this way, you only allow access when the access can be appropriately audited. For more information about alerts, see Alerts.
  • Save the logs to a separate NTFS disk partition for maximum security. Only Administrators of the ISA Server computer should have access to the logs.
  • When you save log information to a SQL database, use Windows authentication (and not SQL authentication).
  • If you are logging the information to a remote database, configure encryption and data signature for the log information being copied to the remote database.
  • For maximal security, configure IPSec for the communication between the ISA Server computer and SQL Server.
  • If log information cannot be saved for any reason, lock down the ISA Server computer. To do so, configure an alert definition for the Log Failure event which stops the Firewall service. For instructions, see Add an alert definition.

Additional recommendations

In addition, follow the security recommendations for the operating system running on the ISA Server computer. Study and apply the security practices described in the following documentation:

  • For Windows Server 2003, see the Windows Server 2003 Security Guide (http://www.microsoft.com/).
  • For Windows 2000 Server, see the Security Operations Guide for Windows 2000 (http://www.microsoft.com/).


Lockdown mode

A critical function of a firewall is to react to an attack. When an attack occurs, it may seem that the first line of defense is to disconnect from the Internet, isolating the compromised network from malicious outsiders. However, this is not the recommended approach. Although the attack must be handled, normal network connectivity must be resumed as quickly as possible, and the source of the attack must be identified.

The lockdown feature introduced with ISA Server 2004 combines the need for isolation with the need to stay connected. Whenever a situation occurs that causes the Microsoft Firewall service to shut down, ISA Server enters the lockdown mode. This occurs when:

  • An event triggers the Firewall service to shut down. When you configure alert definitions, you decide which events will cause the Firewall service to shut down. Essentially, you configure when ISA Server enters lockdown mode.
  • The Firewall service is manually shut down. If you become aware of malicious attacks, you can shut down the Firewall service, while configuring the ISA Server computer and the network to handle the attacks.

Affected functionality

When in lockdown mode, the following functionality applies:

  • The Firewall Packet Filter Engine (fweng) applies the firewall policy.
  • The following system policy rules are still applicable:
    • Allow ICMP from trusted servers to the local host.
    • Allow remote management of the firewall using MMC (RPC through port 3847).
    • Allow remote management of the firewall using RDP.
  • Outgoing traffic from the Local Host network to all networks is allowed. If an outgoing connection is established, that connection can be used to respond to incoming traffic. For example, a DNS query can receive a DNS response, on the same connection.
  • No incoming traffic is allowed, unless a system policy rule (listed previously) that specifically allows the traffic is enabled. The one exception is DHCP traffic, which is always allowed. That is, the UDP Send protocol on port 68 is allowed from all networks to the Local Host network. The corresponding UDP Receive protocol on port 67 is allowed.
  • VPN remote access clients cannot access ISA Server. Similarly, access is denied to remote site networks in site-to-site VPN scenarios.
  • Any changes to the network configuration while in lockdown mode are applied only after the Firewall service restarts and ISA Server exits lockdown mode. For example, if you physically move a network segment and reconfigure ISA Server to match the physical changes, the new topology is in effect only after ISA Server exits lockdown mode.
  • ISA Server does not trigger any alerts.

Leaving lockdown mode

When the Firewall service restarts, ISA Server exits lockdown mode and continues functioning, as previously. Any changes made to the ISA Server configuration are applied after ISA Server exits lockdown mode.


ISA Server console

ISA Server Management features three panes: the scope pane, the details pane, and the task pane.

Note

  • To best view ISA Server Management, we recommend that you set your screen resolution to 800x600 or higher.

Scope pane, details pane, and task pane

The figure illustrates the ISA Server Management console.

ISA Server console

The scope pane displays the console tree (labeled 1 in the graphic). The console tree shows the nodes that are available in the console. The middle pane contains the details pane (labeled 2 in the graphic). The details pane shows information about, and functions pertaining to, the selected console tree item. As you click different items in the console tree, the information in the details pane changes. The details pane can display many types of information including Web pages, graphics, charts, tables, and columns.

The right pane contains the task pane (labeled 3 in the graphic). The task pane can include a Tasks tab and a Help tab. On the Firewall Policy node, the task pane also includes the Toolbox tab. On the Networks node, the task pane also includes the Templates tab.

You can close the task pane. In the split bar (labeled 4 in the graphic), click the Open/Close Task Pane button (it looks like a tall rectangle with a right-pointing arrow). To reopen the task pane, click the Open/Close Task Pane button again (it looks like a tall rectangle with a left-pointing arrow). Note that closing the task pane allows you to see more of the details pane content, however, some tasks are available only from the task pane. Furthermore, with the task pane closed, the Help tab that provides information about how to perform most tasks using the task pane links is unavailable.

Each console tree node has its own menus and toolbar, separate from those of the main window, that help a user perform tasks.

Apply Changes bar

After you create or configure objects, an Apply Changes bar appears above the details pane. You have an opportunity to review the changes, and then apply or discard those changes. To apply the changes, click the Apply button in the Apply Changes bar. To discard the changes, click the Discard button in the Apply Changes bar.

Toolbox

The Toolbox tab is available only on the Firewall Policy node. It includes a list of rule elements, which can be used in the firewall policy rules: protocol definitions, users, content types, schedules, and network objects.

Drag-and-drop editing

In the Firewall Policy details pane, you can edit rules by opening the property sheets for the specific rule. Alternatively, you can drag applicable rule elements from the Toolbox into a rule listed in the Firewall Policy details pane, thereby modifying the rule.


Export and import

ISA Server 2004 includes an export and import feature that enables you to save and restore most array configuration information. The configuration parameters can be exported and stored locally in an .xml file. You can save your configuration to any directory and file name.

We recommend that you save the backup files to an NTFS disk partition for maximum security. Only administrators of the ISA Server computer should have read permissions to the directory.

Exporting the configuration

You can export the entire ISA Server configuration, or just parts of it, depending on your specific needs. You can export the following objects:

  • Entire ISA Server configuration
  • All the connectivity verifiers, or one selected connectivity verifier
  • All the networks, or one selected network
  • All the network sets, or one selected network set
  • All the network rules, or one selected network rule
  • All the Web chaining rules, or one selected Web chaining rule
  • Cache configuration
  • All the content download jobs, or one or more selected content download jobs
  • Entire firewall policy, or one selected rule

The system policy rules are not exported when you export the firewall policy. To export the system policy, select the Export System Policy task.

When you export an entire configuration, all general configuration information is exported. This includes access rules, publishing rules, rule elements, alert configuration, cache configuration, and ISA Server properties. In addition, you can select to export user permission settings and confidential information, such as user passwords. Confidential information included in the exported file is encrypted. Confidential information includes user credential passwords (for example, used for logging to a SQL server), RADIUS shared secrets, or pre-shared IPSec keys.

You can also export user permission settings. Typically, you will select to export these settings when you clone configuration information within the same corporate network.

When you back up a configuration, both user permission settings and confidential information are backed up.

When you select a specific object to export, the following is exported:

  • Specified object, including all property values
  • All descendant objects that are contained within the hierarchy, starting at the specified object
  • All referenced objects, even when outside the object hierarchy of the selected object

For instructions, see Export a configuration and Export a partial configuration.

Reasons for exporting the configuration

The export feature is useful in several scenarios:

  • Cloning a server. You can export a configuration from one ISA Server computer to another computer, thereby easily duplicating a server setup. For example, after configuring an ISA Server computer at one branch, you can export the configuration to an .xml file. Then, you can import it to another computer at another branch.
  • Saving a partial configuration. You can export a single rule, an entire policy, or an entire configuration. This is helpful, for example, when you want to copy all the firewall policy rules, but not the monitoring configuration, to another ISA Server computer.
  • Sending a configuration for troubleshooting. You can export your configuration information to a file, and send it to support professionals for analysis and troubleshooting.

Importing the configuration

During the import process, the configuration saved in the exported .xml file is copied to the designated location. This file includes server-specific configuration information, such as cache drives and SSL certificates. When confidential details, such as user passwords, have been exported with the file, a password is required to open and decrypt the secure information. This password is set when the file is exported.

When you export an entire configuration, certificate settings are also exported. However, if you import the configuration to an ISA Server computer with different certificates, the Microsoft Firewall service will fail to start and an event message will be logged.

When you import a file with confidential information, a password may be required to open and decrypt this information. This is the password that was specified when the file was created during the export process.

You can use the importing functionality to clone configurations from one computer to another. For example, you might create a policy on an ISA Server computer in your corporate headquarters. Subsequently, you can export the configuration, and then import the configuration information to the ISA Server computers in various branch offices.

This functionality is useful even after you modify a configuration, and then clone the configuration file again to the same computer. When you import the information again, any previous configuration created by the earlier file is erased, and only the new configuration information is retained.

For example, suppose you had two access rules configured on your corporate ISA Server computer. You export that policy to the branch offices. But, subsequently, you change the configuration at headquarters; only one rule is in effect. When you import that configuration to your branch offices, the original two rules are erased, and only the new corporate configuration is applied.

Caution

  • When a file originally exported from a specific computer is imported to the same computer, previously defined rule elements, policy rules, publishing rules, alert configuration, cache configuration, and ISA Server properties are overwritten, if the object also exists in the file being imported. This applies to the level at which the import is invoked and below.

The configuration file must be imported at the appropriate node. For example, after you export a rule, you must import the configuration file at the Firewall Policy node or by selecting another rule.

For configuration instructions, see Import a configuration.


Back up and restore

ISA Server 2004 includes a backup and restore feature that enables you to save and restore most configuration information. The configuration parameters can be backed up and stored locally in an .xml file. You can save your configuration to any directory and file name.

We recommend that you save the backup files to an NTFS disk partition for maximum security. Furthermore, only administrators of the ISA Server computer should have read permissions to the directory.

Backing up the configuration

ISA Server backs up the server's general configuration information. This includes firewall policy rules, rule elements, alert configuration, cache configuration, and VPN configuration.

We recommend that you back up the configuration after any major modifications, including:

  • Changing cache size or location
  • Changing firewall policy
  • Changing the rule base
  • Changing system rules
  • Changing the networks, such as changing the network definition or network rules
  • Delegating administrative rights or removing delegation

For instructions, see Back up a configuration.

Restoring the configuration

The restore process reconstructs most configuration information.

For instructions, see Restore a configuration.

Reasons to back up the configuration

The primary use of backup and restore functionality in ISA Server is for disaster recovery. You must regularly back up the ISA Server computer so that you can reliably restore the computer in case of a failure. The backup functionality saves the appropriate information, to ensure that an identical configuration can be restored.

The import and export functionality of ISA Server is similar to the backup and restore functionality. The primary purpose of importing and exporting, however, is to copy (clone) a configuration from one ISA Server computer to another.

For information about exporting and importing, see Export and import.


Administrative roles

You can use role-based administration to organize your ISA Server administrators into separate, predefined roles, each with its own set of tasks. When you assign a role to a user, you essentially allow that user permissions to perform specific tasks. A user that has one role, such as ISA Server Full Administrator, can perform specific ISA Server tasks that a user with another role, such as ISA Server Basic Monitoring, cannot perform. Role-based administration involves Windows users and groups. These security permissions, group memberships, and user rights are used to distinguish which users have which roles. The following table describes the ISA Server roles.

Role | Description
ISA Server Basic Monitoring | Users and groups assigned this role can monitor the ISA Server computer and network activity, but cannot configure specific monitoring functionality.
ISA Server Extended Monitoring | Users and groups assigned this role can perform all monitoring tasks, including log configuration, alert definition configuration, and all monitoring functions available to the ISA Server Basic Monitoring role.
ISA Server Full Administrator | Users and groups assigned this role can perform any ISA Server task, including rule configuration, applying of network templates, and monitoring.

Note:

  • Administrators with Extended Monitoring permissions can export and import secret configuration information. In other words, administrators with Extended Monitoring permissions can decrypt secret information.

Roles and activities

Each ISA Server role has a specific list of ISA Server tasks associated with it. The following table lists some ISA Server administration tasks along with the roles in which they are performed.

Activity | ISA Server Basic Monitoring | ISA Server Extended Monitoring | ISA Server Full Administrator
View Dashboard, alerts, connectivity, sessions, services | X | X | X
Acknowledge alerts | X | X | X
View log information |  | X | X
Create alert definitions |  | X | X
Create reports |  | X | X
Stop and start sessions and services |  | X | X
View firewall policy |  | X | X
Configure firewall policy |  |  | X
Configure cache |  |  | X
Configure VPN |  |  | X

For instructions about assigning roles, see Assign administrative roles.


Remote administration

ISA Server 2004 enables you to administer ISA Server computers from other computers. You can perform all ISA Server administrative tasks remotely, either from a computer running Remote Desktop Connection or from a Microsoft Management Console (MMC) installed on the remote computer.

Typically, your ISA Server computer will be located centrally with your other corporate servers, and not near your office location. You may want to administer ISA Server from another computer on the same network as the ISA Server computer or from a home computer. You may provide consulting services to clients that are using ISA Server to secure the networks, and are responsible for maintaining and monitoring their ISA Server computers. Remote administration enables you to administer ISA Server in all of these cases.

When you install ISA Server, the default system policy allows remote administration from all members of remote management computers. You can configure remote administration, by editing the appropriate MMC or Terminal Server configuration group in the System Policy editor. You can configure the system policy configuration groups to apply to specific network objects. For example, you may want to limit the system policy rule to apply only to the IP address of the specific remote management computer, rather than to all the computers in the Internal network.

Although the default system policy allows remote management, you must configure the Remote Management Computers computer set to include the IP addresses of all computers that are allowed to remotely manage ISA Server.

Remote administration with Remote Desktop Connection

You can connect to an ISA Server computer from any computer running Terminal Services. There are several advantages to using Terminal Server to connect to the ISA Server computer. Terminal Server allows you to view the desktop of the ISA Server computer as if you were in front of the monitor attached to the ISA Server computer. This results in faster refresh rates, because the work of refreshing the view is done by the ISA Server computer, and only the information that comprises the picture on the monitor has to be transmitted to the remote computer.

To remotely administer ISA Server using a Terminal Services client, you must enable the Remote Management: Terminal Server system policy configuration group. In addition:

  • On Windows Server 2003, you must be a member of the Remote Desktop Users group on the ISA Server computer. For instructions, see Windows Help.
  • On Windows 2000 Terminal Services, the user properties must be configured to allow remote connections.

Note:

  • If you use Terminal Services to remotely manage the ISA Server computer, you must use the default RDP port (3389).

Remote administration with MMC

When you install ISA Server, you can perform a custom installation, installing only ISA Server Management. For installation instructions, see Install ISA Server Management.

When you run ISA Server Management, you can connect to a computer with ISA Server installed. For instructions, see Connect to an ISA Server computer.

There are advantages to remote administration with ISA Server Management. Using ISA Server Management, you can connect to and display information from many ISA Server computers at once. This is useful for central administration of geographically dispersed ISA Server computers, or in a situation where you provide consulting for several companies running ISA Server.

To manage a remote ISA Server computer using ISA Server Management, you must use the System Policy Editor to enable the Remote Management: Microsoft Management Console configuration group.

In addition, if you are connecting from the ISA Server computer, you must add an access rule, allowing the Local Host network to access the managed ISA Server computer using the Firewall Control protocol. For instructions, see Create an access rule.

By default, the rule applies to the built-in Remote Management Computers computer set, created when you install ISA Server. Add to this empty computer set all computers that will remotely manage ISA Server. Until you do so, remote management is effectively not available from any computer.

Note:

  • When you enable the system policy rules to allow remote management, RPC traffic is allowed to the Local Host network. However, by default, DCOM traffic is blocked. If you want to allow DCOM traffic, disable the remote management system policy rule. Instead, create a rule that applies to RPC traffic. Configure the RPC traffic for that rule so that Enforce RPC is disabled.

Remote Monitoring

By default, all remote monitoring and remote logging (except SMTP) is disabled when you install ISA Server. You can enable the relevant system policy configuration groups:

  • Remote Logging (NetBIOS)
  • Remote Logging (SQL)
  • Remote Performance Monitoring
  • Microsoft Operations Manager
  • SMTP (enabled by default)

After you do so, to install the MOM agent automatically (from the MOM server), do the following:

  1. Add the MOM server to the Remote Management Computers computer set.
  2. Enable the Remote Performance Monitoring system policy configuration group.


Error reporting and feedback

ISA Server 2004 introduces Microsoft Error Reporting. This feature allows you to send information to Microsoft about errors you may encounter when running ISA Server.

When you log on as Local Administrator on the ISA Server computer, you might see a dialog box called Microsoft Error Reporting. This dialog box shows errors that have been encountered while using Windows applications, including ISA Server. Sending ISA Server error reports to Microsoft provides technical information for the product team, and helps us track and address specific issues. Error reporting data is used for quality control purposes only. It is not used for tracking individual users or installations for any marketing purpose. You can send ISA Server error reporting information as follows:

  • Send directly over the Internet to Microsoft using HTTPS. To do this, click Send Reports Now in the Microsoft Error Reporting dialog box. ISA Server has a system policy rule enabled by default to allow HTTP/HTTPS traffic from the Local Host network to the Microsoft error reporting site. For more information about the system policy, see System policy overview.
  • Use the Corporate Error Reporting tool. If your organization has configured Group Policy, administrators can use Corporate Error Reporting to collect and selectively report errors to Microsoft. When this is enabled, errors are automatically redirected to the server on which Corporate Error Reporting is installed.

Documentation feedback

In addition, the online Help included with ISA Server has a content rating system built into the document. You can rate each page and send comments to the ISA Server documentation team. The ISA Server documentation team welcomes your suggestions and comments about the documentation.

Note that to send e-mail messages from the ISA Server computer using an SMTP server located on the Internal network, you must enable the system policy rule that allows the Local Host network to access the Internal network using the SMTP protocol. In the System Policy Editor, in the Remote Monitoring configuration group, select SMTP and then click Enable. The Allow SMTP protocol from firewall to trusted servers rule is enabled.


Security and Administration: How To

This section provides steps for administering and securing Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • View the task pane
  • Export a configuration
  • Export a partial configuration
  • Import a configuration
  • Connect to an ISA Server computer
  • Disconnect from an ISA Server computer
  • Back up a configuration
  • Restore a configuration
  • Rename ISA Server
  • View ISA Server computer details
  • Assign administrative roles


View the Task pane

To view the Task pane

  1. On the View menu of ISA Server Management, click Task Pane.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Export a configuration

To export a configuration

  1. In the console tree of ISA Server Management, click the ISA Server computer name.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
  2. On the Tasks tab, click Export ISA Server Configuration to a File.
  3. In Save in, specify the folder in which the export file will be saved.
  4. In File name, type a name for the exported file.
  5. To export confidential information, such as user passwords and certificates, click Export confidential information. This information will be encrypted during the export process.
  6. To export user permissions, click Export user permission settings.
  7. Click Export.
  8. If you selected to export confidential information, specify the password that will be used during importing to decrypt the confidential information.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The system policy rules are not exported when you export the firewall policy. To export the system policy, select the Export System Policy task.
  • Specify a strong password, to ensure proper protection of encrypted information. A password is considered strong if it provides an effective defense against unauthorized access. A strong password does not contain all or part of the user account name. It contains at least three of the four following categories of characters: uppercase characters, lowercase characters, base 10 digits, and symbols found on the keyboard (such as !, @, and #).

Related Topics


Export a partial configuration

To export a partial configuration

  1. In the console tree of ISA Server Management, click the relevant object. For example, to export a rule:
    1. Click Firewall Policy.

      Where?

      • Microsoft ISA Server 2004
      • Server_Name
      • Firewall Policy
    2. In the details pane, right-click the applicable rule, and then click Export selected.
  2. In File name, type a name for the exported file.
  3. To export confidential information, such as user passwords and certificates, click Export confidential information. This information will be encrypted during the export process.
  4. To export user permissions, click Export user permission settings.
  5. Click Export.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You only have to specify a password when exporting confidential information.
  • Specify a strong password, to ensure proper protection of encrypted information. A password is considered strong if it provides an effective defense against unauthorized access. A strong password does not contain all or part of the user account name. It contains at least three of the four following categories of characters: uppercase characters, lowercase characters, base 10 digits, and symbols found on the keyboard (such as !, @, and #).

Related Topics


Import a configuration

To import a configuration

  1. In the console tree of ISA Server Management, click the ISA Server computer name.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
  2. On the Tasks tab, click Import from an Exported ISA Configuration file.
  3. In Look in, browse to the folder with the file you are importing.
  4. In File name, specify the file name of the .xml file you are importing.
  5. To import user permissions, click Import user permission settings. This option is only available if user permissions were exported.
  6. To import server specific details, such as cache drive settings, click Import server specific details. This option is only available if this information was exported.
  7. If confidential information was exported with the file, specify the password required to decrypt the confidential information.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You must import the configuration file at the same node that the file was originally created. For example, if the .xml file was created for a specific rule, you must import the file at the Firewall Policy node.

Related Topics


Connect to an ISA Server computer

To connect to an ISA Server computer

  1. In the console tree of ISA Server Management, click Microsoft Internet Security and Acceleration Server 2004.
  2. On the Tasks tab, click Connect to Local or Remote ISA Server.
  3. In Connect to, select Another computer (remote management) and then type the name of the computer to administer.
  4. Select one of the following options:
    • Connect using the credentials of the logged on user, to administer the remote ISA Server computer, using the credentials of the user currently logged on.
    • Connect using other user credentials, to specify the name of a different user, who will remotely manage the ISA Server computer. Then, type the user name, password, and domain for the user who will remotely manage.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can specify a computer name using computer_name or IP address.
  • To manage a remote ISA Server computer using ISA Server Management, you must use the System Policy Editor to enable the Remote Management: Microsoft Management Console configuration group.
  • In addition, if you are connecting from the ISA Server computer, you must add an access rule, allowing the Local Host network to access the managed ISA Server computer using the Firewall Control protocol.
  • When providing credentials of a domain user, be sure to specify the domain field (for example, europe\DonH).
  • When providing credentials of a local user on a computer running Windows 2000, do not specify a domain name.
  • When managing from a computer in a domain to an ISA Server computer that belongs to a workgroup, specify the domain name as the name of the ISA Server computer.

Related Topics


Disconnect from an ISA Server computer

To disconnect from an ISA Server computer

  1. In the console tree of ISA Server Management, click the ISA Server computer name.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
  2. On the Tasks tab, click Disconnect Selected Server from Management Console.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Back up a configuration

To back up a configuration

  1. In the console tree of ISA Server Management, click the ISA Server computer name.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
  2. On the Tasks tab, click Backup this ISA Server Configuration.
  3. In Save in, specify the folder in which the export file will be saved.
  4. In File name, type a name for the exported file and then click Backup.
  5. In Password and Confirm password, type a password that will be required to open and decrypt confidential information.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Restore a configuration

To restore a configuration

  1. In the console tree of ISA Server Management, right-click the name used to manage the ISA Server configuration, and then click Restore.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
  2. On the Tasks tab, click Restore this ISA Server Configuration.
  3. In Look in, specify the folder in which the file you originally backed up is located.
  4. In File name, type the name of the file you originally backed up and then click Restore.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Rename ISA Server

To rename ISA Server

  1. In the console tree of ISA Server Management, right-click the name used to manage the ISA Server configuration, and then click Properties.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
  2. On the General tab, in Name, type the name used to manage the ISA Server configuration.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You must click the Apply button to save this configuration change.
  • When you rename ISA Server, you are not renaming the computer, but rather only the name used to manage the ISA Server configuration.


View ISA Server computer details

To view ISA Server computer details

  1. In the console tree of ISA Server Management, click the ISA Server computer name.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. On the details pane, click View ISA Server Computer Details.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.


Assign administrative roles

To assign administrative roles

  1. In the console tree of ISA Server Management, click the ISA Server computer name.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
  2. On the Tasks tab, click Define Administrative Roles.
  3. Follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Clients

Microsoft Internet Security and Acceleration (ISA) Server 2004 supports several types of clients: Firewall clients, SecureNAT clients, and Web Proxy clients. This section describes the clients supported by ISA Server and provides step-by-step instructions on how to configure these clients.

  • Clients: Concepts
  • Clients: How To
  • Troubleshooting Firewall Client


Clients: Concepts

This section provides information about the clients for Internet Security and Acceleration (ISA) Server 2004.

  • Client overview
  • Client requirements assessment
  • Firewall Client
  • SecureNAT clients
  • Web Proxy clients
  • Automatic Discovery


Client overview

ISA Server uses various communication layers to protect the corporate network. At the packet layer, ISA Server implements a firewall policy. In this way, ISA Server controls data on the network interface, evaluating traffic before it reaches any resource. Data is allowed to pass only after the Microsoft Firewall service processes rules to determine whether the request will be serviced.

ISA Server architecture

As illustrated in the figure, ISA Server protects three types of clients: Firewall clients, SecureNAT clients, and Web Proxy clients.

Firewall clients. Computers that have Firewall Client software installed and enabled. Requests from Firewall clients are directed to the Firewall service on the ISA Server computer, to determine whether access is allowed. Subsequently, they may be filtered by application filters and other add-ins. The Firewall service may also cache the requested object or serve the object from the ISA Server cache.

SecureNAT clients. Computers that do not have Firewall Client software installed. Requests from SecureNAT clients are directed first to the network address translation (NAT) driver, which substitutes a global IP address that is valid on the Internet for the internal IP address of the SecureNAT client. The client request is then directed to the Firewall service to determine if access is allowed. Finally, the request may be filtered by application filters and other extensions. The Firewall service may also cache the requested object or deliver the object from the ISA Server cache.

Web Proxy clients. CERN-compatible Web application. Requests from Web Proxy clients are directed to the Firewall service on the ISA Server computer, to determine if access is allowed. The Firewall service may also cache the requested object or serve the object from the ISA Server cache.

Regardless of client type, when ISA Server receives an HTTP request, the client is treated as if it is a Web Proxy client. Even when a Firewall client or a SecureNAT client makes an HTTP request, the client is considered a Web Proxy client. This has specific implications for how the client is authenticated.

Both Firewall client computers and SecureNAT client computers may also be Web Proxy clients. If the Web application on the computer is configured explicitly to use ISA Server, all Web requests are sent directly to the Firewall service, including HTTP, FTP, and Secure HTTP (HTTPS). All other requests are handled first by the Firewall service.

The following table compares the ISA Server clients.

Feature | SecureNAT client | Firewall client | Web Proxy client
Installation | Yes, requires some network configuration changes | Yes | No, requires Web browser configuration
Operating system support | Any operating system that supports TCP/IP | Only Windows platforms | All platforms, but by way of a Web application
Protocol support | Application filters for multi-connection protocols | All Winsock applications | HTTP, Secure HTTP (HTTPS), and FTP
User-level authentication support | Yes, for VPN clients only | Yes | Yes

Get latest ISA Server content at http://www.microsoft.com/isaserver/techinfo/howto/default.asp.


Client requirements assessments

Client requirements assessment

Before you deploy or configure client software, assess your organizational needs. Determine which applications and services your internal clients require. Assess how you will be publishing servers. Then map these needs to the client types supported by ISA Server:

  • SecureNAT clients
  • Firewall clients
  • Web Proxy clients

For more information, see Client overview.

To help map user needs to the client types that you will deploy in your organization, ask yourself the following types of questions:

Do you want to avoid deploying client software or configuring client computers?

Recommended: SecureNAT clients.

SecureNAT clients do not require any software or specific configuration. Firewall clients require that you deploy Firewall Client software and Web Proxy clients require that you configure Web applications on client computers.

Are you using ISA Server only for forward caching of Web objects?

Recommended: SecureNAT or Web Proxy clients.

If you use SecureNAT clients in this scenario, you will not have to deploy any special software or configure the client computers. Instead, client requests are transparently passed to ISA Server for caching.

Do you allow access only for authenticated clients?

Recommended: Firewall clients.

For Firewall clients, you can configure user-based firewall policy rules. You can also configure user-based rules for Web Proxy clients, but the rule will be effective only if the Web application can pass the authentication information.

Are you publishing servers that are located on your Internal network?

Recommended: SecureNAT clients.

Internal servers can be published as SecureNAT clients. This eliminates the need for creating special configuration files on the publishing server.


Firewall Client

This section describes Firewall Client for Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Firewall Client overview
  • Firewall Client configuration
  • Firewall Client local addresses
  • Advanced Firewall Client settings
  • Advanced Firewall Client configuration file settings
  • Advanced Firewall Client configuration file samples
  • Firewall Client distribution


Firewall Client overview

A Firewall client is a computer with Firewall Client software installed and enabled. The Firewall Client computer runs Winsock applications that use the Microsoft Firewall service of ISA Server 2004. Setting up a Firewall client does not configure individual Winsock applications. Instead, it uses a common Winsock service provider that the other applications use. The Firewall client then intercepts the application calls and determines whether to route the request to the ISA Server computer.

You can specify whether Firewall client support is enabled for the specific network. If Firewall client support is enabled, ISA Server will accept incoming requests on port 1745. When a Firewall client uses a Winsock application to request an object from a computer, the client checks whether the specified computer is considered local. An address is considered local if it is in the range of addresses included in the specific network. For more information, see Configure local addresses for Firewall Client.

If the computer is not considered local, the request is sent to the Firewall service. The Firewall service handles the request, forwarding it to the appropriate destination, as permitted. The Firewall Client software can send Windows user information, which is required for authentication purposes, to the ISA Server computer.

Installing Firewall Client

After you install Firewall Client Share, client computers can connect to the share to install the Firewall Client software. For instructions on installing Firewall Client Share, see Create a shared folder for Firewall Client installation. To install the Firewall Client software, users connect to the share and run the setup program. Alternatively, they can run unattended setup. For instructions, see Run Firewall Client unattended setup.

After installing the client software, users can modify the server name to which the client connects by specifying a different name either on the ISA Server computer to which the client currently connects or by changing the name in the Firewall Client software. The configuration changes take effect after the firewall configuration is refreshed.


Firewall Client configuration

Firewall Client software is configured using ISA Server Management. You can use ISA Server Management to configure Firewall Client settings, which are periodically updated on the client computer. You can configure the following:

  • Application settings. How the Firewall client connects to ISA Server for specific applications. For more information, see Advanced Firewall Client configuration file settings.
  • Internal network and local domains. The set of IP addresses and domains that the Firewall client recognizes as local, for which no ISA Server computer is required. For instructions, see Configure local addresses for Firewall Client and Configure local domains for Firewall Client.
  • Automatic discovery. By enabling automatic discovery, Firewall clients will automatically discover the appropriate ISA Server computer. For more information, see Automatic discovery for Firewall clients.
  • Web browser settings for the Firewall client. The Firewall Client application can automatically update the Web Proxy settings on the Firewall client computer. These settings are obtained from ISA Server, when the Firewall Client settings are updated. You can configure how the Web browser will be set on the Firewall client computer. Note that these settings do not apply to dial-up or VPN connections. For more information, see Configure Web browser settings for Firewall Client.

Allowing earlier versions of Firewall Client software

ISA Server supports earlier versions of the Firewall Client software, including Firewall Client for ISA Server 2000 and the Winsock Proxy client (from Microsoft Proxy Server 2.0). However, you may want to prevent earlier versions of the Firewall Client software installed on earlier versions of Windows operating systems from connecting to your ISA Server computer. This is because these clients cannot use encryption when connecting to ISA Server. For instructions, see Allow connections from clients running previous versions of Firewall Client.

Encrypted Firewall Client connections

ISA Server supports a more secure way of communication between the Firewall client and ISA Server, which involves the use of encryption using a TCP control channel. You can configure ISA Server to accept connections only from clients communicating in this secure way. However, this prevents earlier versions of Firewall Client software from connecting.


Firewall Client local addresses

By default, Firewall Client considers addresses specified as local to be all addresses on the network for which it is configured, in addition to the addresses specified in the local routing table on the Firewall client computer. For example, if the Firewall client connects to the network adapter for the Internal network, all IP addresses configured on the Internal network are considered local. Each time a Winsock application on that client attempts to establish a connection to an IP address, the Locallat.txt file is used to determine whether the IP address is on the Internal network. If the address is considered local, the connection is made directly. If the address is not considered local, the connection is made through the Microsoft Firewall service on ISA Server.

A local version of this information can also be created. Using a text editor, you can create a custom client local address table (LAT) file named Locallat.txt and place it in the \Documents and Settings\All Users\Local Settings\Application Data\Microsoft\Firewall Client 2004 folder on the Firewall client computer. You can add additional IP address ranges that the client recognizes as part of the local network. The client uses its own routing table, the server-specific settings, and the Locallat.txt file to determine which IP addresses are part of the local network.

When you create the Locallat.txt file, enter IP address pairs in the file. Each address pair defines either a range of IP addresses or a single IP address. The following example shows a Locallat.txt file that has two entries. The first entry is an IP address range and the second entry is a single IP address. Note that the second entry is an IP address and not a subnet mask.

10.51.0.0      10.51.255.255
10.52.144.103  10.52.144.103


Advanced Firewall Client settings

Upon installation, the Firewall Client software adopts the settings configured by the ISA Server 2004 computer from which the Firewall Client application was installed. These server settings determine functionally such as: automatic Web Proxy configuration, ISA Server name, ISA Server automatic detection, and others. After the Firewall Client software is installed, ISA Server updates these client settings each time a client computer is restarted, and every six hours after an initial refresh is made.

In addition to these settings, ISA Server periodically updates the client with information about IP addresses that the client should consider local (computers to which the client connects without going through ISA Server).

For most Winsock applications, the default Firewall Client configuration works with no need for further modification. However, in some cases, you will need to add client configuration information. Firewall Client can be configured locally for each user and for each computer, on the Firewall Client computer. The configuration is done by making changes to .ini files, which are installed on the Firewall Client computer.

You can change the default settings for all components after installation. The new configuration settings take effect only when the client configuration is refreshed.

.ini files

The configuration information is stored in a set of files, which are installed on the Firewall client computer. Specifically, when Firewall Client is installed on the computer, the following files are created on the Firewall client computer:

  • Common.ini, which specifies the common configuration for all applications
  • Management.ini, which specifies Firewall Client Management configuration settings

These files are created at the operating system level, for all users logged on to the computer and may be created for each specific user on the computer. The per-user settings override the general configuration settings. These files are created in different locations, depending on the operating system. For example, on Windows XP computers, the files are copied to two locations:

  • \Documents and Settings\All Users\\Local Settings\Application Data\Microsoft\Firewall Client 2004 folder
  • \Documents and Settings\user_name\Local Settings\Application Data\Microsoft\Firewall Client 2004 folder

In addition to these files, the user may create another file called Application.ini, which specifies configuration information for specific applications.

For more information about the Common.ini and Application.ini settings, see Advanced Firewall Client configuration file settings.

The settings in these files are applied as follows:

  1. The .ini files in the user's folder take precedence. Any configuration settings here are used by Firewall Client to determine how the application will function.
  2. Firewall Client looks next in the All Users folder. Any additional configuration settings are applied. If a configuration setting specified contradicts the user-specific settings, it is ignored.
  3. The Firewall Client application detects the ISA Server computer to which it should connect, in accordance with the settings specified in Firewall Client Management.
  4. Finally, Firewall Client examines the server-level settings. Any configuration settings specified on ISA Server are applied. If a configuration setting specified contradicts the user-specific or computer-specific settings, it is ignored.


Advanced Firewall Client configuration file settings

The user on the Firewall Client computer can create and modify files that determine the Firewall Client configuration settings. The Common.ini file, which is created when Firewall Client is installed, specifies common configuration for all the applications. The Application.ini file specifies configuration settings for specific applications. For more information about these files, see Advanced Firewall Client settings.

These files can be created at the operating system level, for all users logged on to the computer and may be created for each specific user on the computer. The per-user settings override the general configuration settings. These files are created in different locations, depending on the operating system. For example, on Microsoft® Windows® XP computers, the files are copied to two folders:

  • \Documents and Settings\All Users\Local Settings\Application Data\Microsoft\Firewall Client 2004
  • \Documents and Settings\user_name\Local Settings\Application Data\Microsoft\Firewall Client 2004

You can use ISA Server Management to modify Firewall Client configuration settings. For instructions, see Configure application settings for Firewall Client.

The following table lists the entries that you can include when configuring the Firewall Client software application settings. The first column lists the keys that can be included in the configuration files. The second column describes the values to which the keys can be set. Note that some settings can be configured only on the Firewall Client computer. You cannot configure them using ISA Server Management.

Entry | Description
ServerName | Specifies the name of the ISA Server computer to which the Firewall Client should connect.
Disable | Possible values: 0 or 1. When the value is set to 1, the Firewall Client application is disabled for the specific client application.
DisableEx | Possible values: 0 or 1. When the value is set to 1, the Firewall Client application is disabled for the specific client application. Applies only to Firewall Client for ISA Server 2004. When set, overrides the Disable setting.
Autodetection | (Can be set only on the Firewall Client computer.) Possible values: 0 or 1. When the value is set to 1, the Firewall Client application automatically finds the ISA Server computer to which it should connect.
NameResolution | Possible values: L or R. By default, dotted decimal notation or Internet domain names are redirected to the ISA Server computer for name resolution and all other names are resolved on the local computer. When the value is set to R, all names are redirected to the ISA Server computer for resolution. When the value is set to L, all names are resolved on the local computer.
LocalBindTcpPorts | Specifies a Transmission Control Protocol (TCP) port, list, or range that is bound locally.
LocalBindUdpPorts | Specifies a User Datagram Protocol (UDP) port, list, or range that is bound locally.
RemoteBindTcpPorts | Specifies a TCP port, list, or range that is bound remotely.
RemoteBindUdpPorts | Specifies a UDP port, list, or range that is bound remotely.
ServerBindTcpPorts | Specifies a TCP port, list, or range for all ports that should accept more than one connection.
Persistent | Possible values: 0 or 1. When the value is set to 1, a specific server state can be maintained on the ISA Server computer if a service is stopped and restarted and if the server is not responding. The client sends a keep-alive message to the server periodically during an active session. If the server is not responding, the client tries to restore the state of the bound and listening sockets upon server restart.
ForceCredentials | (Can be set only on the Firewall Client computer.) Used when running a Windows service or server application as a Firewall Client application. When the value is set to 1, it forces the use of alternate user authentication credentials that are stored locally on the computer that is running the service. The user credentials are stored on the client computer using the Credtool.exe application that is provided with the Firewall Client software. User credentials must reference a user account that can be authenticated by ISA Server, either local to ISA Server or in a domain trusted by ISA Server. The user account is normally set not to expire. Otherwise, user credentials need to be renewed each time the account expires.
NameResolutionForLocalHost | Possible values are L (default), P, or E. Used to specify how the local (client) computer name is resolved, when the gethostbyname API is called. The LocalHost computer name is resolved by calling the Winsock API function gethostbyname() using the LocalHost string, an empty string, or a NULL string pointer. Winsock applications call gethostbyname(LocalHost) to find their local IP address and send it to an Internet server. When this option is set to L, gethostbyname() returns the IP addresses of the local host computer. When this option is set to P, gethostbyname() returns the IP addresses of the ISA Server computer. When this option is set to E, gethostbyname() returns only the external IP addresses of the ISA Server computer—those IP addresses that are not in the local address table.
ControlChannel | Possible values: Wsp.udp or Wsp.tcp (default). Specifies the type of control channel used.
EnableRouteMode | Possible values are 0 and 1 (default). When EnableRouteMode is set to 1 and a route relationship is configured between the Firewall Client computer and the requested destination, then the IP address of the Firewall client is used as the source address. When the value is set to 0, the IP address of the ISA Server computer is used. This flag does not apply to older versions of Firewall client.


Advanced Firewall Client configuration file samples

This section lists sample files for the Firewall Client configuration on the local Firewall client computer. For more information about these settings, see Advanced Firewall Client configuration file settings.

Common.ini settings

The Common.ini file specifies common configuration for all applications. The following is an example of a typical Common.ini file.

[Common]
ServerName=ISA_1
Disable=0
Autodetection=0

Application.ini settings

The Application.ini file specifies configuration settings for specific applications. The following is an example of an Application.ini file, showing a sample [FW_Client_App] section in a client configuration file for the FW_Client_App.exe section.

[FW_Client_App]
Disable=0
NameResolution=R
LocalBindTcpPorts=7777
LocalBindUdpPorts=7000-7022, 7100-7170
RemoteBindTcpPorts=30
RemoteBindUdpPorts=3000-3050
ServerBindTcpPorts=100-300
ProxyBindIp=80:110.52.144.103, 82:110.51.0.0
Persistent=1
ForceCredentials=1
NameResolutionForLocalHost=L


Firewall Client distribution

You can use the Windows Software Installation snap-in to centrally manage distribution of Firewall Client software. You distribute and configure the client software of ISA Server to groups of computers, so that all users who require the applications automatically have them on their desktops. In this way, you will not need to set up the client software on each desktop.

When you assign an application to a computer, the application is installed the next time the computer restarts.


SecureNAT clients

Client computers that do not have Firewall Client software are SecureNAT clients. SecureNAT clients can benefit from many of the features of ISA Server. This includes most access control features, with the exception of high-level protocol support and user-level authentication.

Although SecureNAT clients do not require special software, you must configure the default gateway so that all traffic destined to the Internet is sent by way of ISA Server, either directly or indirectly, through a router. You can configure clients either by using the Dynamic Host Configuration Protocol (DHCP) service or manually.

Because requests from SecureNAT clients are handled by the Microsoft Firewall service, SecureNAT clients benefit from the Firewall service security features. Application filters can modify the protocol stream to allow handling of complex protocols. In Microsoft® Windows® network address translation (NAT), this mechanism is accomplished through the use of NAT editors, which are written as kernel-mode NAT editor drivers.

Note that ISA Server application filters replace the functionality generally available through Windows-based NAT editors. An application filter must be available for SecureNAT clients to use specific applications or protocols. For more information, see Application Filters.

SecureNAT and network address translation

ISA Server extends the network address translation (NAT) functionality by enforcing ISA Server policy for SecureNAT clients. All ISA Server rules can be applied to SecureNAT clients, even though NAT does not have an inherent authentication mechanism. Policies regarding protocol usage, destination, and content type are also applied to SecureNAT clients.

SecureNAT clients and server publishing

As with Firewall clients, SecureNAT clients can also be servers, such as mail servers, which publish information to the Internet. You configure server publishing rules to publish servers as SecureNAT clients.

Configuring SecureNAT clients

Although SecureNAT clients do not require specific software to be deployed on the client computers, you must configure the network appropriately. This section details network considerations for SecureNAT clients.

Setting up the default gateway for SecureNAT clients

SecureNAT clients do not require specific software to be deployed on the client computers. However, you must configure your network topology for the ISA Server computer to protect the SecureNAT clients and ensure that their requests are serviced.

The default gateway for the SecureNAT clients must be properly configured. When setting the default gateway property, identify which type of network topology you are configuring:

  • Simple network. A simple network topology does not have any routers configured between the SecureNAT client and the ISA Server computer.
  • Complex network. A complex network topology has one or more routers bridging multiple subnets that are configured between a SecureNAT client and the ISA Server computer.

Configuring SecureNAT clients on a simple network

To configure SecureNAT clients on a simple network, you should set the SecureNAT client's IP default gateway settings to the IP address of the ISA Server computer's Internal network address card. You can set this manually, using the TCP/IP settings on the client. (These settings can be accessed by clicking the Network icon in Control Panel.) Alternatively, you can configure these settings automatically for the client using the DHCP service.

Configuring SecureNAT clients on a complex network

To configure SecureNAT clients on a complex network, you should set the default gateway settings on the last router in the chain between the SecureNAT client and the ISA Server computer. In this case, you do not have to change the default gateway settings for the SecureNAT clients.

Optimally, the router should use a default gateway that routes along the shortest path to the ISA Server computer. Also, the router should not be configured to discard packets destined for addresses outside the corporate network. ISA Server will determine how to route the packets.

Resolving names for SecureNAT clients

SecureNAT clients will probably request objects both from computers in the local network and from the Internet. Thus, SecureNAT clients will require DNS servers that can resolve names both for external and internal computers.

Internet access only

For Internet access only, the SecureNAT clients should configure the TCP/IP settings to use the DNS servers on the Internet. You should create an access rule that allows the SecureNAT clients to use the DNS protocol and configure the DNS filter for the SecureNAT clients.

Internal network and Internet access

If the SecureNAT clients will request data both from the Internet and from the Internal network servers, the clients should use a DNS server located on the Internal network. You should configure the DNS server to resolve both internal addresses and Internet addresses.


Web Proxy clients

A Web Proxy client is a client computer that has a Web browser application, which complies with HTTP 1.1 (or lower), can be configured to use a proxy, and is configured to use ISA Server. Each Web Proxy client is configured through its own user interface. Web browsers are Web Proxy clients.

The Firewall Client software can configure the Web browser settings on the Firewall client computer. These settings can be configured automatically or disabled altogether. You can use ISA Server Management to configure the following Web browser properties:

  • ISA Server computer and port to which the client will connect.
  • Automatic discovery settings.
  • Computers that the Firewall client's Web browser will access directly.
  • Backup route, if the ISA Server computer is unavailable.

When the Firewall Client software is installed, and with every user logon, the Web browser on the client computer is configured with those settings. This automatic configuration can be disabled.

If Firewall Client software is not installed, the Web browser can be configured manually.

Web Proxy client configuration

You do not have to install any software to configure Web Proxy clients. However, you must configure the Web applications on the client computers to use the ISA Server computer as the proxy server.

The default configuration URL is:

http://ISA_Server/array.dll?Get.Routing.Script

where ISA_Server is the name or IP address of the ISA Server computer. This is the URL where the configuration script is located. ISA Server automatically generates this configuration script, based on the direct access and backup route options.

You can set an option by which ISA Server automatically downloads a client configuration script, located on the ISA Server computer, every time a Web browser is opened. The output of this script provides an ordered series of ISA Server computers, which the browser uses to retrieve the object that is specified by the URL.

The script is accessible from a specific URL on the ISA Server computer (although it is not actually stored there). You can easily update all Web browser settings, without having to reconfigure each individual Web browser. Microsoft® Internet Explorer version 3.02 and later, and Netscape 2.0 and later, support this feature.

Automatic Web browser configuration for Firewall clients

You can configure ISA Server so that the Firewall client's Web browser is configured during setup. This way, the client's Web browser will use the specified automatic configuration script. The script is based on the options set in Web Browser Configuration. For instructions, see Configure Web browser settings for Firewall Client.

Browser configuration on the ISA Server computer

If you use a Web browser on the ISA Server computer, you must configure the browser to use the IP address of the server network adapter that is connected to the Internal network. Do not use the server computer name or DNS name.

If you configure the server browser to use the computer or DNS name, the name is resolved to the IP address of the External network interface connected to the Internet. Consequently, you must configure the browser on the server to connect through ISA Server.


Automatic Discovery

This section provides information about the automatic discovery feature of ISA Server 2004.

  • Automatic discovery overview
  • Automatic discovery for Firewall clients
  • Automatic discovery for Web Proxy clients


Automatic discovery overview

At first, it may seem like a simple task to configure the ISA Server computer to which Firewall clients and Web Proxy clients connect. However, subsequent modifications can be time consuming, particularly for roaming clients, who may require constant adjustments. The automatic discovery feature of ISA Server allows you to configure clients so that they automatically discover the appropriate ISA Server computer. In this way, roaming clients can connect to the ISA Server computer, as appropriate and when necessary. By enabling automatic discovery, Web Proxy and Firewall clients all automatically discover the appropriate ISA Server computer.

Configuring WPAD and WSPAD on the DNS or DHCP server

When automatic discovery is enabled, the Firewall client or the Web Proxy client requests an object from the WPAD server—in this case, the ISA Server computer that is configured to service requests. The auto-discovery process will be triggered; for example, when the ISA Server computer does not respond or enabling or disabling of a local network adapter.

ISA Server uses the Web Proxy Automatic Discovery (WPAD) entry to determine the WPAD server, which will service both Winsock Proxy Autodetect (WSPAD) and WPAD requests. You do not have to configure the WSPAD entry explicitly on the DNS server.

For instructions, see Configure DNS for automatic discovery of ISA Server and Configure DHCP for automatic discovery of ISA Server.

How automatic discovery works

Automatic discovery is based on information that is stored in the DHCP server or DNS server. First, the client retrieves the name of the WPAD server from the DNS or DHCP server. Then, the client queries the server (which should serve both WPAD and WSPAD requests), to determine the actual ISA Server computer with which to work.

Modifying ISA Server for a client using automatic discovery

To change the ISA Server computer used by a client, you change the entry in the DHCP or DNS server. However, because information is cached on the DNS or DHCP server, the client may actually receive the name of the previous ISA Server computer.

To ensure that the client receives the correct information when automatically detecting a server, perform the following steps:

  1. Set automatic detection on the DHCP or DNS server to point to the Internet Information Services (IIS) computer which acts as a WPAD server. Because the IIS computer contains Wspad.dat and Wpad.dat files, you will not have to update the DHCP or DNS automatic discovery information.
  2. Change the automatic discovery information in the Wspad.dat file on the IIS computer, which acts as the dedicated redirector. The IIS computer is dedicated to act as the redirector.

The following is a sample of a Wspad.dat file on an IIS computer:

[Common]
Port=1745
[Servers Ip Addresses]
Name=ISAServer.microsoft.com

Changes in the Wspad.dat redirector file are applied immediately, regardless of the DNS cache.


Automatic discovery for Firewall clients

When you configure a Firewall client, you indicate a particular ISA Server computer to which the client will connect. You can also configure the automatic discovery feature so that the Firewall client will automatically discover which ISA Server computer it will use.

If automatic discovery is configured, it performs the following steps:

  1. When the client makes a Winsock request, the client connects to the DNS or DHCP server.
  2. The DNS or DHCP server should have a Web Proxy Automatic Discovery (WPAD) entry, which points to a WPAD server that indicates the ISA Server computer.
  3. A Wspad.dat file must exist on the WPAD server. This file will redirect the request to the ISA Server computer.
  4. The client request is fulfilled by the ISA Server computer, as identified by the Winsock Proxy Autodetect (WSPAD) entry in the DNS or DHCP server.


Automatic discovery for Web Proxy clients

ISA Server provides support for Web Proxy clients. You can configure the automatic discovery feature so that roaming Web Proxy clients will always connect to the appropriate ISA Server computer when they log on to the Internet.

Automatic discovery is supported for Microsoft Internet Explorer 5 and later.

If automatic discovery is configured, ISA Server performs the following steps:

  1. When the client makes a Web request, the client connects to the DNS or DHCP server.
  2. The DNS or DHCP server should have a Web Proxy Automatic Discovery (WPAD) entry, which points to a WPAD server that indicates the proxy server (in this case, the ISA Server computer).
  3. The client request is fulfilled by the ISA Server computer, as identified by the WPAD entry in the DNS or DHCP server.


Clients: How To

This section provides steps for installing and configuring clients of Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Install Firewall Client
  • Configure Firewall Client
  • Configure Web Proxy Clients
  • Configure Automatic Discovery


Install Firewall Client

This section provides step-by-step instructions on how to install Firewall Client software on the client computer.

  • Install Firewall Client software
  • Run Firewall Client unattended setup


Install Firewall Client software

To install Firewall Client software

  1. At a command prompt on the Firewall Client computer, type:

    Path\Setup

    where Path is the path to the shared ISA Server client installation files.
  2. Follow the on-screen instructions.

Notes

  • The ISA Server client installation files are usually located in a folder on the ISA Server computer with the share name ISA_Server_name/MSPClnt.
  • To perform this procedure, you must be a member of the Administrators group on the client computer.
  • You cannot install Firewall Client software on a computer running any version of ISA Server.
  • Upon installation, the Firewall Client application is enabled.
  • You can install Firewall Client software on client computers that run Microsoft® Windows Server™ 2003, Windows 2000 Server, Windows XP, Windows Millennium Edition, or Windows NT® 4.0. You can also install Firewall Client software on computers running Windows 98 Second Edition with Microsoft Internet Explorer 5 or later installed.
  • To allow client computers to access the Firewall Client share, the Firewall Client Installation system policy configuration group must be enabled. This configuration group is enabled by default when you install the Firewall Client share.

Related Topics


Run Firewall Client unattended setup

To run Firewall Client unattended setup

  • At a command prompt on the Firewall Client computer, type

    Path\Setup /v"[SERVER_NAME_OR_IP=ISA_Server_Name] [ENABLE_AUTO_DETECT={1|0}] [REFRESH_WEB_PROXY={1|0}] /qn"

    where:

    • Path is the path to the shared ISA Server 2004 client installation files. These files are usually located in a folder on the ISA Server computer with the share name ISA\MSPclnt.
    • ISA_Server_Name is the name of the ISA Server computer to which the Firewall client should connect.
    • ENABLE_AUTO_DETECT=1 specifies that the Firewall client should automatically detect which ISA Server computer to connect to.
    • REFRESH_WEB_PROXY=1 indicates that the Firewall Client configuration should be updated with the Web proxy configuration specified on the ISA Server computer.

Notes

  • To run unattended uninstallation, type the following at a command prompt:

    MsiExec.exe /X {199B7F78-69B7-47C5-8D4B-A3ED1391FB6B} /qn

  • To perform this procedure, you must be a member of the Administrators group on the client computer.
  • The ISA Server client installation files are usually located in a folder on the ISA Server computer with the share name ISA_Server_name/MSPClnt.
  • You cannot install Firewall Client software on the ISA Server computer.
  • Upon installation, the Firewall Client application is enabled.
  • You can install Firewall Client software on client computers that run Microsoft® Windows Server™ 2003, Windows 2000 Server, Windows XP, Windows Millennium Edition, or Windows NT® 4.0. You can also install Firewall Client software on computers running Windows 98 Second Edition with Microsoft Internet Explorer 5 or later installed.
  • To allow client computers to access the Firewall Client share, the Firewall Client Installation system policy configuration group must be enabled. This configuration group is enabled by default when you install the Firewall Client share.


Configure Firewall Client

This section provides steps for configuring Firewall Client for Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Listen for Firewall Client requests
  • Configure local addresses for Firewall Client
  • Configure local domains for Firewall Client
  • Specify configuration URL for Web browser on Firewall Client
  • Configure Web browser settings for Firewall Client
  • Configure application settings for Firewall Client
  • Allow connections from clients running previous versions of Firewall Client
  • Allow Firewall Client connections from earlier operating systems


Listen for Firewall Client requests

To listen for Firewall Client requests

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab and select the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Firewall Client tab, click Enable Firewall Client support.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Firewall Client properties cannot be configured for the following built-in networks: External, Quarantined VPN Clients, and VPN Clients.

Related Topics


Configure local addresses for Firewall Client

To configure local addresses for Firewall Client

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Firewall Client tab, verify that the Enable Firewall Client support check box is selected.
  5. On the Addresses tab, do one of the following:
    • To add a specific range of IP addresses, click Add. Then, type the first address of the network address range in Starting address and the last address of the network address range in Ending address.
    • To add IP addresses associated with a specific adapter, click Add Adapter, and then in Network Interfaces, select one or more adapters.
    • To add private address ranges, click Add Private, and then select a range from the list.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When Firewall Client is installed from the share specified by this ISA Server computer, the client will recognize all addresses included in the specified network as local IP addresses.
  • Firewall Client properties cannot be configured for the following built-in networks: External, Local Host, Quarantined VPN Clients, and VPN Clients.

Related Topics


Configure local domains for Firewall Client

To configure local domains for Firewall Client

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Domains tab, click Add. Then, type the domain name in Enter a domain name to include.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Click the Apply button in the details pane to save the changes and update the ISA Server configuration.
  • To include a single computer, type its fully qualified domain name (FQDN). The server name should be unique. Using the FQDN will avoid any conflict with duplicated server names.
  • To include an entire domain name, type *.domain_name.
  • To include all domains, type *.
  • To remove a domain from the network, on the Domains tab, select the applicable domain, and then click Remove.

Related Topics


Specify configuration URL settings for Web browsers

To specify configuration URL settings for Web browsers

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Web Browser tab, optionally select the following:
    • Bypass proxy for web servers in this network. Select this option if the Web browser on the Firewall client computer should bypass the ISA Server computer when accessing local Web servers.
    • Directly access computers specified in the local domain table (LDT). Select this option if the Web browser on the Firewall client computer can directly access computers defined in the local domain table (LDT).
    • If ISA Server is unavailable, use this backup route to connect to the Internet. Select this option if the Web browser on the Firewall client should use a backup route to service requests when the ISA Server computer is not available. If you select this option, specify either Direct Access or Alternative ISA Server.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Click the Apply button in the details pane to save the changes and update the ISA Server configuration.
  • The options you specify here are reflected in the configuration script used by the Web browser.

Related Topics


Configure Web browser settings for Firewall Client

To configure Web browser settings for Firewall Client

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Firewall Client tab, select Configure Web browser during Firewall client setup, if the Web browser on the Firewall client should use configuration information that is contained in the specified automatic configuration script.
  5. Select Automatically detect settings, if the client computer should automatically attempt to find the ISA Server computer.
  6. Select Set Web browsers to use automatic configuration script, if the Web browser on the Firewall client computer should use configuration information that is contained in the specified automatic configuration script. If you select this option, specify one of the following:
    • Use Default URL. Specifies that the default client configuration script will be used. During setup, ISA Server creates a default URL that points to the location of the automatic configuration script. This default configuration script will automatically be available to the Web browser, so that you can update all client Web browser settings without having to reconfigure each individual Web browser.
    • Use custom URL. Specifies that a custom client configuration script will be used. As an alternative to the default configuration script, you can manually construct your own configuration script. When the Web browser looks for the configuration script, your custom script will be returned to the browser.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Click the Apply button in the details pane to save the changes and update the ISA Server configuration.
  • The configuration script is created, based on options that you specify on the Web browser tab. The configuration script is automatically made available to the Web browser on the Firewall client, so that you can update all Web browser settings without having to reconfigure each individual Web browser.
  • When Automatically detect settings is enabled, you can configure the DNS or DHCP server to include Web Proxy Automatic Discovery (WPAD). The Web Proxy client will use the WPAD feature to automatically discover which ISA Server computer to use for Web requests. This assures that roaming clients will always connect to the appropriate ISA Server computer when logging on to the Internet, reducing time-consuming adjustments. This is relevant only to Internet Explorer 5 and future supporting browsers.

Related Topics


Configure application settings for Firewall Client

To configure application settings for Firewall Client

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. In the details pane, click Define Firewall Client Settings.
  3. On the Application Settings tab, click New.
  4. In Application, select an application or type a new application name.
  5. In Key, type the name of a key.
  6. In Value, type the value to set for the key.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To remove an existing application setting, on the Application Settings tab, select it and click Delete.
  • To modify an existing application setting, on the Application Settings tab, select it and click Edit.

Related Topics


Allow connections from clients running previous versions of Firewall Client

To allow connections from clients running previous versions of Firewall Client

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. In the details pane, click Define Firewall Client Settings.
  3. On the Connection tab, click Allow non-encrypted Firewall client connections.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select this option, computers running earlier versions of Firewall Client software are allowed to connect.
  • When you select this option, non-encrypted traffic from authenticated users will be blocked. Users are only authenticated if firewall policy rules specifically require authentication.

Related Topics


Allow Firewall Client connections from earlier operating systems

To allow Firewall Client connections from earlier operating systems

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. In the details pane, click Define Firewall Client Settings.
  3. On the Connection tab, click Allow Firewall clients to connect to ISA Server without using encryption.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • For maximum security, we recommend that you disable this option.

Related Topics


Configure Web Proxy Clients

This section provides steps for configuring Web Proxy clients.

  • Listen for Web Proxy client requests
  • Configure authentication methods for Web Proxy clients
  • Configure maximum number of Web Proxy client connections


Listen for Web Proxy client requests

To listen for Web Proxy client requests

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab and select the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Web Proxy tab, click Enable Web Proxy clients.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Web Proxy client properties cannot be configured for the following built-in networks: External, Quarantined VPN Clients, and VPN Clients.

Related Topics


Configure authentication methods for Web Proxy clients

To configure authentication methods for Web Proxy clients

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Web Proxy tab, click Authentication.
  5. In Authentication methods, select the authentication method that may be used to authenticate clients connecting to the selected network.
  6. Select Require all users to authenticate, to force clients from this network to authenticate using one of the selected authentication methods.
  7. If you select RADIUS, Digest, or Basic authentication, click Select Domain and type the name of the domain to use when authenticating clients.
  8. If you select RADIUS authentication, you must enable the system policy's RADIUS configuration group (in the Authentication Services category).
  9. If you select RADIUS authentication, click RADIUS Servers to configure the servers to use for RADIUS authentication.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Users who log on to the network with the Basic authentication methods must belong to a specific domain. Usually, the Windows domain that is used for Basic authentication is the local domain in which the Web server is active. A different domain can be specified, if required.
  • When no domain is explicitly specified, ISA Server uses its own domain.
  • If you select RADIUS authentication, you cannot select any other authentication method.
  • If you do not select an authentication method and if the firewall policy includes rules that require users to authenticate, authentication will fail and the request will be denied.

Related Topics


Configure maximum number of Web Proxy client connections

To configure maximum number of Web Proxy client connections

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Web Proxy tab, click Advanced.
  5. Select one of the following:
    • Unlimited. If an unlimited number of Web Proxy clients can connect to ISA Server at any one time.
    • Maximum. To limit the maximum number of Web Proxy connections that can connect to ISA Server at any one time. In the box, type the maximum number of connections.
  6. In Connection timeout, type the number of seconds before ISA Server disconnects an inactive user.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure Automatic Discovery

This section provides steps for configuring the automatic discovery feature of Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Publish automatic discovery information
  • Configure DNS for automatic discovery of ISA Server
  • Configure DHCP for automatic discovery of ISA Server


Publish automatic discovery information

To publish automatic discovery information

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab and then click the applicable network (usually Internal).
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Auto Discovery tab, select Publish automatic discovery information.
  5. In Use this port for automatic discovery requests, type the port number on which the ISA Server computer should listen for Web Proxy Automatic Discovery (WPAD) and Winsock Proxy Autodetect (WSPAD) requests.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Click the Apply button in the details pane to save the changes and update the ISA Server configuration.

Related Topics


Configure DNS for automatic discovery of ISA Server

To configure DNS for automatic discovery of ISA Server

  1. Click Start, point to All Programs, point to Administrative Tools, and then click DNS.
  2. In the console tree, right-click the applicable forward lookup zone and click New Alias.

    Where?

    • DNS
    • DNS server
    • Forward Lookup Zones
    • Applicable zone
  3. In Alias name, type WPAD.
  4. In Fully qualified name for target host, type the fully qualified domain name of the ISA Server computer or array.

Notes

  • If DNS does not appear in Administrative Tools, it is not installed.
  • If the ISA Server computer or array already has a host (A) record defined, you can click Browse to search the DNS namespace for the ISA Server or array name.
  • When using DNS to publish WPAD, automatic discovery must be configured to use port 80. Alternatively, the outgoing Web requests must be configured to listen on port 80.

Related Topics


Configure DHCP for automatic discovery of ISA Server

To configure DHCP for automatic discovery of ISA Server

  1. Click Start, point to All Programs, point to Administrative Tools, and then click DHCP.
  2. In the console tree, right-click the applicable DHCP server, click Set Predefined Options, and then click Add.
  3. In Name, type WPAD.
  4. In Code, type 252.
  5. In Data type, select String and then click OK.
  6. In String, type:

    http://Computer_Name:AutoDiscoveryPortNumber/Wpad.dat

    where Computer_Name is the fully qualified domain name of the ISA Server computer or array and AutoDiscoveryPortNumber is the port number on which automatic discovery information is published. This port is either the outgoing Web request port number or an additional port used for automatic discovery publishing.

  7. Right-click Server options, and then click Configure options.
  8. Confirm that the Option 252 check box is selected.

Related Topics


Troubleshooting Firewall Client

What problem are you having?

Firewall Client software is not properly installed.

Cause: There can be many reasons that Firewall Client cannot properly install. The setup program in the Firewall Client software creates a log file on the client computer each time client software is installed. The log file contains information about the setup, including information about which client applications were installed and which services were started.

Solution: You can use the log file to troubleshoot problems with setup. The log file name is Firewallc.log, and it is in the Firewall Client software installation directory. ISA Server overwrites this log file each time you install the Firewall Client software.


Multi-Networking

Microsoft Internet Security and Acceleration (ISA) Server 2004 introduces a multi-networking model, which enables you to define relationships between any number of networks secured by ISA Server. This section describes the multi-networking feature and provides step-by-step instructions on how to configure networking for ISA Server.

  • Multi-Networking: Concepts
  • Multi-Networking: How To
  • Troubleshooting dial-up entries


Multi-Networking: Concepts

This section provides information about the multi-networking feature of Internet Security and Acceleration (ISA) Server 2004.

  • Multi-networking overview
  • Multi-networking architecture
  • Networks
  • Network Templates
  • Network rules
  • Chaining and Routing


Multi-networking overview

ISA Server introduces the concept of multi-networking. You can use the multi-networking features of ISA Server to protect your network against internal and external security threats, by limiting communication between clients, even within your own organization. You can group computers in your Internal network into network sets, and configure an access policy specific to each network set. You can also define relationships between the various networks, thereby determining how computers on each network communicate with each other, by way of ISA Server.

In a common publishing scenario, you might want to isolate the published servers on their own network, such as a perimeter network. The ISA Server multi-networking functionality supports such a scenario, so that you can configure how clients on the corporate network access the perimeter network, and how external clients access the network. You can configure the relationships between the various networks, defining different access policies between each network.

The following figure illustrates a multi-networking scenario.

Multi-networking

In the figure, the ISA Server computer connects between the Internet (External network) and the Internal network, corporate network, and perimeter network. Each network adapter on the ISA Server computer is connected to each of the networks. Using ISA Server, you can configure different access policies between any pair of networks. That is, you can determine if and how computers on each of the networks communicate with each other. Each network is isolated from the other, and is only made accessible when you configure rules to allow communication.

You can use the multi-networking features of ISA Server to identify, configure, and define the connectivity and relationships between computers, both internal and external to your organization. To configure the multi-networking environment, you identify networks, optionally grouping them into network sets, and define relationships between the networks.

After you define networks, you create network rules, which determine if and how the networks are connected. For both network address translation (NAT) relationships and routing relationships, traffic can be permitted by configuring access rules. Publishing rules can be configured to allow traffic from the destination network to the source network.


Multi-networking architecture

In a classic view of a multi-networking environment, a firewall or router provides connectivity between one or more networks. Depending on how access control is configured on the firewall or router, communication is allowed to pass between the networks. For example, consider the following figure, which illustrates a classic view of the multi-networking scenario.

Multi-networking: network view

In the figure, a corporate network is connected to the Internet, allowing clients access to the Internet. A perimeter network is connected to the corporate network and to the Internet, allowing access to its resources.

ISA Server groups IP addresses into sets, called networks. A network is used by ISA Server to describe addresses of hosts that can exchange traffic without passing through ISA Server. Networks essentially describe the ISA Server view of the network topology. For more information, see Network and network set configuration.

ISA Server includes several special built-in network elements. The following are some examples:

  • The built-in External network automatically includes any address that does not belong to any other network. Unlike other networks, it can exist behind another network. For more information about the External network, see Default External network. For more information about networks behind networks, see Network behind network.
  • The built-in VPN Clients network automatically includes all the addresses assigned to VPN clients. For more information on the VPN Clients network, see VPN clients and firewall policy.
  • The built-in Local Host network includes the addresses on the ISA Server computer.

Notes:

  • A host may have zero or more adapters.
  • An adapter may have zero or more addresses. Each address can be associated with exactly one network adapter.
  • An address belongs to one, and only one, network.
  • All addresses on a single network adapter must belong to the same network.

Access between networks

You can use ISA Server to define network rules, thereby allowing access between the networks. When you do so, you define not only whether the networks are connected, but also how they are connected. In this way, you establish the network access policy between the networks. For more information, see Network rules.

The following figure illustrates the concept of network access policy. Network rules have been configured to allow network access between the same networks shown in the previous figure.

Multi-networking: network view

Network rules define the relationships between the networks as follows:

  1. A routed network relationship is defined between a branch office and headquarters. Routed relationships are reciprocal.
  2. A network address translation (NAT) network relationship is defined from the corporate network to the perimeter network. NAT relationships are unidirectional and unique. Therefore, no relationship can exist from the perimeter network to the corporate network.
  3. A NAT network relationship is defined from the corporate network to the Internet. Again, no relationship exists from the Internet to the corporate network.
  4. Finally, a NAT network relationship is defined from the perimeter network to the Internet.

Note that in a routed network relationship, each network exposes its actual IP addresses. So, you should configure a routed network relationship only when bidirectional traffic is actually required between the networks.


Networks

This section provides information about networks.

  • Network and network set configuration
  • Network configuration steps
  • Local Host network
  • Internal network
  • Default External network
  • Network behind network


Network and network set configuration

From an ISA Server perspective, a network is a rule element, which can contain one or more ranges of Internet Protocol (IP) addresses. Networks include one or more computers, typically corresponding to a physical network. You can apply rules to one or more networks, or to all addresses except those in the specified network.

Each network adapter on the computer can be mapped to a single network. A network can include addresses associated with one or more network adapters. A network also determines whether Firewall clients and Web Proxy clients are supported on the network.

ISA Server comes preconfigured with the following networks:

  • Local Host. This network represents the ISA Server computer. The Local Host network cannot be modified or deleted. For more information, see Local Host network.
  • Default External. This network includes all computers (IP addresses) that are not associated with any other network. The Default External network cannot be modified or deleted. For more information, see Default External network.
  • Internal. Upon installation, this network includes all computers (IP addresses) specified during the installation process. The Internal network cannot be deleted. For more information, see Internal network.
  • VPN Clients. This network contains addresses of currently connected clients. The range of possible addresses is configured when you configure the virtual private network (VPN) properties. The VPN Clients network cannot be deleted. For more information, see VPN clients and firewall policy.
  • Quarantined VPN Clients. This network contains addresses of VPN clients that have not yet cleared quarantine. The Quarantined VPN Clients network cannot be deleted. For more information, see Firewall policy for quarantined VPN clients.

For access rules, you specify a destination network and a source network to which the rule is to be applied. The source network indicates which networks are allowed or denied access to the specified destination networks.

For server publishing rules, you specify a source network, which is allowed access to a specific computer.

Creating networks

In addition to the preinstalled networks, you can create networks. You can select which type of network to create: Internal, External, or perimeter. For instructions, see Create a network.

When you select one of these network types, you can specify the IP addresses that are included in the network. Note that each IP address can be included in only one network. For instructions, see Configure network addresses.

After you create the network, you can configure the following properties:

  • Domains. (Firewall clients only.) Specify which domains will be included in the network. For domains in the network, client requests are not forwarded through ISA Server. For instructions, see Configure domains included in a network.
  • Web browser. Specify how Web browsers will be configured. These properties determine how Web browsers that specify ISA Server in the configuration script will be configured. For instructions, see Specify configuration URL for Web browser on Firewall Client.
  • Automatic discovery. Specify if and how clients in this network will automatically attempt to find the ISA Server computer. For instructions, see Publish automatic discovery information.
  • Firewall client support. Specify if this network listens on port 1745 for requests from Firewall clients. For instructions, see Listen for Firewall Client requests.
  • Web Proxy client support. Specify if this network listens for TCP requests from Web Proxy clients. For instructions, see Listen for Web Proxy client requests.

You can also create a new site-to-site VPN. For more information about site-to-site networks (also called remote site networks), see Site-to-site VPN and firewall policy.

Network sets

After you create networks, you can group one or more networks into network sets. Network sets can include one or more networks, or explicitly exclude one or more networks. Rules can be applied to networks or to network sets.

When you install ISA Server, two network sets are created. These network sets cannot be modified or deleted:

  • All Networks. This network set includes all networks defined for ISA Server. When you create a new network, the new network is automatically included in this network set.
    All Networks is the same as Anywhere; every IP address is included in both Anywhere and in All Networks.
  • All Protected Networks. This network set includes all networks except the built-in External network. When you create a new network, the new network is automatically included in this network set.

For instructions, see Create a network set.


Network configuration steps

For newly created networks to send or receive traffic, additional configuration steps must be completed. These steps depend on the type of network you created.

Internal, External, and perimeter networks

For clients on these networks to send and receive traffic, you must complete the following steps:

  1. Create a network rule allowing traffic to and from this network. For instructions, see Create a network rule.
  2. Create firewall policy rules allowing traffic to and from this network. For instructions, see Create an access rule, Create a Web publishing rule, Create a server publishing rule, or Publish a mail server.

Site-to-site VPN using IPSec

For clients to connect from the virtual private network (VPN) using Internet Protocol security (IPSec), you must complete the following steps:

  1. Create a network rule allowing traffic to and from this network.
  2. Create access rules allowing traffic to and from this network.
  3. Verify IPSec protocol settings using properties of the newly created network.

Site-to-site VPN using PPTP or L2TP

For clients to connect from the VPN using Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol (L2TP), you must complete the following steps:

  1. Create a user with the same name as the new network, and then set remote access permissions to Allow. For instructions, see Create users and groups for remote VPN clients.
  2. Create network rules allowing traffic to and from this network.
  3. Create access rules allowing traffic to and from this network.


Local Host network

The Local Host network represents ISA Server. That is, all traffic that comes from or to ISA Server is considered to have passed by way of the Local Host network.

As with any network, a relationship must be defined between the Local Host network and the other networks. The default Local Host Access network rule defines a route relationship between the Local Host network and every other network.

The access from the Local Host network to basic services that typically reside on other networks is only allowed when a combination of firewall policy and network rules are defined. Because many of these services are critical to the basic functioning of ISA Server, a set of default system policy rules, created when you install ISA Server, enables access to these services. For more information about system policy, see System policy overview.


Internal network

The Internal network is used by ISA Server to represent the primary default protected network. You can specify multiple additional internal networks. At least one default Internal network is configured at installation. By default, system policy rules protect resources on the Internal network from all other networks (other than the Local Host network). You might create access rules to allow traffic from the default Internal network to other networks and publishing rules to allow access to servers located on the Internal network.

The Internal network is generally considered to contain trusted networks. For this reason, the default system policy allows the ISA Server computer to access services on the Internal network. For more information on system policy, see System policy rules.

For configuration instructions, see Configure network addresses.

Configuring the Internal network

ISA Server can construct the Internal network, based on your Microsoft® Windows Server™ 2003 or Windows® 2000 Server routing table. You can also select the private IP address ranges, as defined by IANA in RFC 1918. These three blocks of addresses are reserved for private intranets only and are never used on the public Internet.

The Internal network is maintained centrally at the ISA Server computer. Firewall clients automatically download and receive Internal network updates at preset intervals. When a Firewall client requests an object, the client checks the addresses in the Internal network. If an IP address request is in the Internal network, the Firewall client requests the object directly. If the IP address request is not in the Internal network, the client requests that the ISA Server computer request the object on its behalf.

SecureNAT clients do not have a local copy of the addresses in the Internal network. Therefore, when a SecureNAT client requests an object, the request is sent through ISA Server. If the request is to an external IP address, ISA Server makes the request on behalf of the client.

Routing table

When ISA Server constructs the Internal network, it uses the Windows Server 2003 or Windows 2000 Server routing table to determine which address ranges in your Internal network are internal. If you fail to set the routing table correctly, the ISA Server Internal network may not be built correctly. This can result in a client request for an internal IP address being routed to the Internet or being redirected through the Microsoft Firewall service. You can use the Windows Server 2003 or Windows 2000 Server routing utility to configure the routing table accordingly.


Default External network

When ISA Server is installed, five networks are configured. The Default External network is one of these networks.

The Default External network includes all IP addresses not explicitly included in any other network. Upon installation, the Default External network includes all addresses not in the Internal network, the IP address of the Local Host network (127.0.0.1), and the IP addresses of all other network adapters on the ISA Server computer.

The Default External network is generally considered an untrusted network. For this reason, the network relationship to the Default External network would typically be configured as network address translation (NAT). This would allow clients on the source network to access the destination Default External network, but prevent the Default External network from accessing the source network. For more information on network rules, see Network rules.


Network behind network

A "network behind network" configuration has a network adapter that has routes to a network to which it does not belong. For the most part, ISA Server does not support such configurations, with the following exceptions:

  • The built-in External network may be located behind the network adapter that is the default gateway.
  • An IPSec tunnel may exist between two sites.
  • Quarantined VPN clients are never directly associated with any network. For more information about the Quarantined VPN Clients network, see Firewall policy for quarantined VPN clients.

For example, assume a network adapter, with address 10.0.0.1, is the default gateway. Assume that this network adapter has routes to both addresses 10.X.X.X and 30.X.X.X, and that there are no routes (on this network adapter or any other) for addresses 20.X.X.X. Also, assume that you have two networks:

  • Network A: 10.0.0.0–10.255.255.255
  • Network B: 30.0.0.0–30.255.255.255

There are no routes for the network addresses in the range 20.0.0.0–20.255.255.255, so they are considered part of the Default External network. The Default External network is considered to be behind network A, because network A's adapter has a route to the Default External network, but is not associated with it. (Its address is not in the External network.)

Network B is also considered behind network A. However, it is not the Default External network. ISA Server considers this to be an incorrect configuration, and so the network is considered temporarily disconnected.

To configure ISA Server, the two routes (to 10.X.X.X and 30.X.X.X) will be combined into a single network. ISA Server cannot consider these two address ranges as unique networks, because both are associated with the same network adapter.


Network Templates

ISA Server includes network templates, which correspond to common network topologies. You can use the network templates to configure the firewall policy for traffic between networks. ISA Server includes the following network templates:

  • Edge Firewall. This template assumes a network topology with ISA Server at the edge of the network. One network adapter is connected to the Internal network, the other is connected to an External network (Internet). When you select this template, you can allow all outgoing traffic, or limit outgoing traffic to allow only Web access. For more information, see Edge Firewall network template.
  • 3-Leg Perimeter. This template assumes a network topology with ISA Server connected to the Internal network, the External network, and a perimeter network (also known as a DMZ, demilitarized zone, or screened subnet). For more information, see 3-Leg Perimeter network template.
  • Front End. This template assumes a network topology with ISA Server at the edge of a network, with another firewall configured at the back end, protecting the Internal network. For more information, see Front End network template.
  • Back End. This template assumes a network topology with ISA Server deployed between a perimeter network and the Internal network, with another firewall configured at the back end, protecting the Internal network. For more information, see Back End network template.
  • Single Network Adapter. This template assumes a single network adapter configuration within a perimeter or corporate network. In this configuration, ISA Server is used as a Web proxying and caching server. For more information, see Single Network Adapter network template.


Edge Firewall network template

ISA Server includes network templates, which correspond to common network topologies. One basic scenario involves setting up ISA Server as the firewall at the edge of your network, thereby protecting the network from being accessed by others, while at the same time allowing specific access by users on the corporate network.

When you configure ISA Server by applying the Edge Firewall network template, ISA Server configures network rules and firewall policy, in accordance with the specific policy you select.

For instructions, see Apply a network template.

Firewall policy

As part of the process of applying network templates, you select a firewall policy that best matches your corporate security guidelines. The table below lists the firewall policies available when you select the Edge Firewall network template and also details the rules that are created when you select the policy.

Policy name | Description | Rules created
Block all | This policy blocks all network access through ISA Server. This option does not create any access rules other than the default rule which blocks all access. Use this option when you want to define firewall policy on your own. | None.
Block Internet access, allow access to ISP network services | This policy blocks all network access through ISA Server, except for access to External network services, such as DNS. This option is useful when services are provided by your ISP. Use this option when you want to define firewall policy on your own. | Allow DNS from Internal network and VPN Clients network to External network (Internet).
Allow limited Web access | This policy allows limited Web access using HTTP, HTTPS, and FTP only. All other network access is blocked. | Allow HTTP, HTTPS, and FTP from Internal network to External network. Allow all protocols from VPN Clients network to Internal network.
Allow limited Web access, allow access to ISP network services | This policy allows limited Web access using HTTP, HTTPS, and FTP, and allows access to ISP network services. All other network access is blocked. | Allow HTTP, HTTPS, and FTP from Internal network and VPN Clients network to External network (Internet). Allow DNS from Internal Network and VPN Clients Network to External Network (Internet). Allow all protocols from VPN Clients Network to Internal Network.
Allow access for all protocols | This policy allows unrestricted access to the Internet through ISA Server. ISA Server will prevent access from the Internet to protected networks. | Allow all protocols from Internal network and VPN Clients network to External network (Internet). Allow VPN Clients network to Internal network.


3-Leg Perimeter network template

ISA Server includes network templates, which correspond to common network topologies. One scenario involves setting up an ISA Server computer with three network adapters: one network adapter is connected to the Internet (External network), one is connected to the Internal network, and the third is connected to a perimeter network. The 3-Leg Perimeter network template applies to this scenario.

When you configure ISA Server by applying the 3-Leg Perimeter network template, ISA Server configures network rules and firewall policy, in accordance with the specific policy you select.

For instructions, see Apply a network template.

Firewall policy

As part of the process of applying network templates, you select a firewall policy that best matches your corporate security guidelines. The following table lists the firewall policies available when you select the 3-Leg Perimeter network template and also details the rules that are created when you select the policy.

Policy name | Description | Rules created
Block all | This policy blocks all network access through ISA Server. This option does not create any access rules other than the default rule which blocks all access. Use this option when you want to define firewall policy on your own. | None.
Block Internet access, allow access to network services on the perimeter network | This policy blocks all network access through ISA Server, except for access to network services (DNS) on the perimeter network. Use this option when you want to define the firewall policy on your own. | Allow DNS traffic from Internal network and VPN Clients network to perimeter network.
Block Internet access, allow access to ISP network services | This policy blocks all network access through ISA Server, except for access to external network services, such as DNS. This option is useful when network services are provided by your ISP. Use this option when you want to define firewall policy on your own. | Allow DNS traffic from Internal network, VPN Clients network, and perimeter network to External network (Internet).
Allow limited Web access | This policy allows limited Web access using only HTTP, HTTPS, and FTP. This policy blocks all other network access. | Allow HTTP, HTTPS, and FTP from Internal network and VPN Clients network to perimeter network and External network (Internet). Allow all protocols from VPN Clients network to Internal network.
Allow limited Web access, allow access to network services on perimeter network | This policy allows limited Web access using only HTTP, HTTPS, and FTP, and allows access to network services on the perimeter network. All other network access is blocked. This option is useful when network infrastructure services are available in the perimeter network. | Allow HTTP, HTTPS, and FTP from Internal network and VPN Clients network to perimeter network and External network (Internet). Allow DNS traffic from Internal network and VPN Clients network to perimeter network. Allow all protocols from VPN Clients network to Internal network.
Allow limited Web access, allow ISP network services | This policy allows limited Internet access and allows access to network services, such as DNS, provided by your ISP. All other network access is blocked. | Allow HTTP, HTTPS, FTP from Internal network and VPN Clients network to the External network (Internet). Allow DNS from Internal network, VPN Clients network, and perimeter network to External network (Internet). Allow all protocols from VPN Clients network to Internal network.
Allow all protocols | This policy allows unrestricted access to the Internet through ISA Server. ISA Server will prevent access from the Internet to protected networks. You can modify the access rules later to block specific types of network access. | Allow all protocols from Internal network and VPN Clients network to perimeter network and External network (Internet). Allow all protocols from VPN Clients network to Internal network.


Front End network template

Front Firewall network template

ISA Server includes network templates, which correspond to common network topologies. One scenario involves the ISA Server computer deployed at the edge of a network, with another firewall configured at the back end, protecting the Internal network. In this scenario, ISA Server acts as the front line of defense in a back-to-back perimeter network configuration. The Front End network template applies to this scenario.

When you configure ISA Server by applying the Front End network template, ISA Server configures network rules and firewall policy, in accordance with the specific policy you select.

For instructions, see Apply a network template.

Firewall policy

As part of the process of applying network templates, you select a firewall policy that best matches your corporate security guidelines. The following table lists the firewall policies available when you select the Front End network template and also details the rules that are created when you select the policy.

Policy name | Description | Rules created
Block all | This policy blocks all network access through ISA Server. This option does not create any access rules other than the default rule which blocks all access. Use this option when you want to define firewall policy on your own. | None.
Block Internet access, allow access to ISP network services | This policy blocks all network access through ISA Server, except for access to External network services, such as DNS. This option is useful when network services are provided by your ISP. Use this option when you want to define firewall policy on your own. | Allow DNS from VPN Clients network and perimeter network to External network (Internet).
Block Internet access (network services are on the perimeter network) | This policy blocks all network access through ISA Server, except for access to network services, such as DNS, on the perimeter network. Use this option when you want to define the firewall policy on your own. | Allow DNS from Internal network and VPN Clients network to perimeter network.
Allow limited Web access (network services are on the perimeter network) | This policy allows limited Web access. All other network access is blocked. | Allow HTTP, HTTPS, and FTP from VPN Clients network and perimeter network to External network (Internet). Allow all protocols from VPN Clients network to perimeter network.
Allow limited Web access, allow ISP network services | This policy allows limited Web access, and allows access to network services, such as DNS, provided by your ISP. All other network access is blocked. | Allow HTTP, HTTPS, and FTP from perimeter network and VPN Clients network to the External network (Internet). Allow DNS from Internal network, VPN Clients network, and perimeter network to External network (Internet). Allow all protocols from VPN Clients network to perimeter network.
Allow unrestricted access | This policy allows unrestricted access to the Internet through ISA Server. ISA Server will prevent access from the Internet to protected networks. You can modify the access rules later to block specific types of network access. | Allow all protocols from perimeter network and VPN Clients network to External network (Internet). Allow all protocols from VPN Clients network to perimeter network.


Back End network template

ISA Server includes network templates, which correspond to common network topologies. One scenario involves the ISA Server computer deployed between a perimeter network and the Internal network, with another firewall configured at the back end, protecting the Internal network. In this scenario, ISA Server acts as the back line of defense in a back-to-back perimeter network configuration. The Back End network template applies to this scenario.

When you configure ISA Server by applying the Back End network template, ISA Server configures network rules and firewall policy, in accordance with the specific policy you select.

For instructions, see Apply a network template.

Firewall policy

As part of the process of applying network templates, you select a firewall policy that best matches your corporate security guidelines. The following table lists the firewall policies available when you select the Back End network template and also details the rules that are created when you select the policy.

Policy name | Description | Rules created
No access: Block all | This policy blocks all network access through ISA Server. This option does not create any access rules other than the default rule which blocks all access. Use this option when you want to define firewall policy on your own. | None.
No access: Block Internet access (network services are in the perimeter network) | This policy blocks all network access through ISA Server, except for access to network services (DNS) on the perimeter network. Use this option when you want to define firewall policy on your own. | Allow DNS from Internal network and VPN Clients network to perimeter network.
No access: Block Internet access, allow access to ISP network services | This policy blocks all network access through ISA Server, except for access to External network services, such as DNS. This option is useful when network services are provided by your ISP. Use this option when you want to define the firewall policy access rules on your own. | Allow DNS from Internal network and VPN Clients network to External network (Internet), excluding perimeter address ranges.
Restricted access: Allow limited Web access | This policy allows limited Web access. All other network access is blocked. | Allow HTTP, HTTPS, and FTP from Internal network and VPN Clients network to External network (Internet). Allow all protocols from VPN Clients network to Internal network.
Restricted access: Allow limited Web access (network services are on perimeter network) | This policy allows limited Web access, and allows access to network services on the perimeter network. All other network access is blocked. | Allow HTTP, HTTPS, and FTP from Internal network and VPN Clients network to perimeter network and External network (Internet). Allow DNS from Internal network and VPN Clients network to perimeter network. Allow all protocols from VPN Clients network to Internal network.
Restricted access: Allow limited Web access, allow ISP network services | This policy allows limited Web access, and allows access to network services, such as DNS, provided by your ISP. All other network access is blocked. | Allow HTTP, HTTPS, and FTP from Internal network and VPN Clients network to External network (Internet). Allow DNS from Internal network and VPN Clients network to External network (Internet), except for perimeter address range. Allow all protocols from VPN Clients network to Internal network.
Unrestricted Internet access: Allow all protocols | This policy allows unrestricted access to the Internet through ISA Server. ISA Server will prevent access from the Internet to protected networks. You can modify the access rules later to block specific types of network access. | Allow all protocols from Internal network and VPN Clients network to External network (Internet) and perimeter address range. Allow all protocols from VPN Clients network to Internal network.


Single Network Adapter network template

You can install ISA Server on computers with a single network adapter. Typically, you will do so when another firewall is located on the edge of the network, connecting your corporate resources to the Internet. In this single adapter scenario, ISA Server typically functions as a cache server, caching content from the Internet, for use by clients on the corporate network.

Single Network Adapter network template

When you apply the Single Network Adapter network template, the Internal network is configured to contain all IP addresses. The firewall policy named Allow Web proxy and caching is applied. This policy allows Web Proxy clients to access Web content on the Internet and accelerates Web performance through caching. No rules are created.

For instructions, see Apply a network template.

Internal network

One of the fundamental features of ISA Server is its ability to connect multiple networks. When ISA Server is installed on a single adapter computer, however, it recognizes only one network—the Internal network. The Internal network comprises all IP addresses, with the following exceptions: 0.0.0.0, 255.255.255.255, and the address range 127.0.0.0–127.255.255.255.

Installing ISA Server on a single adapter computer

As part of the setup process, you specify the addresses in the Internal network. When you install ISA Server on a computer with one network adapter, be sure to include all addresses except 0.0.0.0, 255.255.255.255, and the address range 127.0.0.0–127.255.255.255.

You can use the Single Network Adapter network template to configure your single adapter ISA Server computer. To use the template, in ISA Server Management, expand the Configuration node, and select Networks. In the Tasks tab, on the Templates tab, select Single Network Adapter to start the Network Template Wizard. Follow the wizard steps to complete the configuration.

We recommend that you use the default settings provided by the Network Template Wizard.

Caching

You can deploy ISA Server on a single adapter computer as a forward proxy and caching server, which provides clients with optimized access to the Internet. In this scenario, you can configure ISA Server to maintain a centralized cache of frequently requested Internet objects that can be accessed by any Web browser client, and use cache rules to manage the cache.

In this scenario, you will modify the default firewall policy to allow internal clients access to the Internet. Although all IP addresses are considered to be on the same Internal network, ISA Server may deny Web traffic due to the default Deny All rule. You therefore need to create a rule that allows traffic to pass between the networks.

To enable this caching scenario, you must create an access rule that allows all clients to use Hypertext Transfer Protocol (HTTP), and possibly HTTPS and File Transfer Protocol (FTP). Because the Internal network is uniquely defined to include all addresses, the source and destination networks for this rule should be internal.

Web Proxy, Web, and Outlook Web Access publishing

You can deploy ISA Server on a single adapter computer as a reverse Web Proxy, and enable Web publishing and Outlook Web Access publishing scenarios.

Single adapter mode functionality

When you install ISA Server on a computer with a single adapter, the following ISA Server features cannot be used:

  • Firewall clients
  • Virtual private networking
  • IP packet filtering
  • Multi-network firewall policy
  • Server publishing
  • Application level filtering

The following protocols are supported: HTTP, HTTPS, and FTP over HTTP.

This results in a limited security role for ISA Server in your network.


Network rules

You can use ISA Server to configure network rules, thereby defining and describing a network topology. Network rules determine whether there is a relationship between two network entities, and what type of relationship is defined. Network relationships can be configured as follows:

  • Route. When you specify this type of connection, client requests from the source network are directly relayed to the destination network. The source client address is included in the request.
  • Network address translation (NAT). When you specify this type of connection, ISA Server replaces the IP address of the client on the source network with its own IP address.

When no relationship is configured between networks, then ISA Server drops all traffic between the two networks.

Creating network rules

When you create network rules, you cannot define a network rule between a network and itself. Traffic between computers on the same network is defined as routed. NAT is not supported for this traffic.

For instructions, see Create a network rule.

Network relationships

A route relationship indicates that no address translation is performed. Routed networks are bidirectional. That is, if a routed relationship is defined from network A to network B, a routed relationship also exists from network B to network A. NAT relationships, however, are unique and unidirectional. If a NAT relationship is defined from network A to network B, no network relationship can be defined from network B to network A.

A NAT relationship is directional. It indicates that the addresses from the source network are always translated when passing through ISA Server. For example, assume a NAT network relationship from source network A to destination network B. IP addresses on the source network A are replaced with some address on the ISA Server computer before the request is passed to the computer on the destination network B. On the other hand, when a packet from the network B is returned to the computer on network A, the address of the computer on network B is not translated. In other words, computers on network A can see addresses of computers on network B. Effectively, a NAT relationship ensures that the internal address structure of network A is not exposed and not accessible to network B.

For instructions, see Edit a network rule.

Default rules

Upon installation, the following default rules are created:

  • Local Host Access. This rule defines a route relationship between the Local Host network and all other networks. In this way, connectivity is defined between the ISA Server computer and all networks connected to the ISA Server computer.
  • VPN Clients to Internal Network. This rule defines a route relationship between the Internal network and the Quarantined VPN Clients and the VPN Clients networks.
  • Internet Access. This rule defines a NAT relationship between the Internal network and the External network.

Processing order

Network rules are ordered. To determine the address relationship between two addresses A and B, ISA Server processes network rules according to priority order, looking for a rule that matches the addresses. The first rule that matches defines the address relationship.

This implies that you could define a network rule with a route relationship between two networks, and then subsequently override this relationship for a particular address by creating a higher-order network rule.


Chaining and Routing

This section provides information about chaining and routing.

  • Web chaining rules
  • Firewall chaining
  • Dial-up connections
  • Network for automatic dialing
  • Dial-up connection configuration steps
  • PPTP or L2TP dial-up connections


Web chaining rules

Using Web chaining rules, you can conditionally route requests, depending on the destination. For example, an organization with headquarters in the United States and a branch office in the United Kingdom might set up an ISA Server computer at the branch office. The branch office server might be connected to an Internet service provider (ISP) in the United Kingdom. A Web chaining rule on the ISA Server computer at the branch office could direct requests for Internet hosts in the United Kingdom to the local ISP, with all other requests directed to the ISA Server computer at headquarters.

The downstream ISA Server computer at the branch office in the United Kingdom benefits from the ISA Server cache at headquarters. That benefit is augmented by additional caching of local objects—retrieved from the local ISP—on the ISA Server computer in the branch office.

The following figure illustrates how Web Proxy requests can be routed to different servers, depending on the requested destination.

Routing

In this figure, the ISA Server computer in the branch office routes client requests for all domestic sites to the Internet. Client requests for all other sites are routed to the upstream ISA Server computer at headquarters.

For instructions, see Create a Web chaining rule.

Routing Web requests

As part of the Web chaining rule configuration, you can specify how a Web Proxy client request should be routed:

  • Retrieving the object directly from the specified destination.
  • Routing the request to a specific upstream ISA Server computer. In this case, you can also specify a backup route if the primary route is unavailable.
  • Redirecting them to a hosted site. In this case, the request is routed to the specified website.

For instructions, see Configure how Web chaining rules retrieve requests.

ISA Server uses the backup route when the primary route is unavailable. The ISA Server computer periodically polls the upstream server that is specified as the primary route, to determine if it is available. As soon as the primary route is available, requests are sent to that server, rather than the server on the backup route. For instructions, see Configure a primary route for Web requests and Configure a backup route for Web requests.

Authentication

In certain cases, the upstream server may require that the downstream proxy pass authentication. For those cases, credentials must be passed. These credentials are used by the upstream server to authenticate the downstream server.

When authentication is required, you can configure whether the Web server to which the request is redirected can authenticate the client. For instructions, see Allow delegation of credentials.

Important

  • When you pass credentials in plaintext to an upstream server, beware that the upstream server and network could potentially access those credentials. Over standard HTTP connections, all information is passed as plaintext.

Bridging

For outgoing Web requests, ISA Server enhances standard routing functionality with a Secure Sockets Layer (SSL) bridging feature, which you can use to configure how traffic will be routed to the upstream server.

When you create a Web chaining rule, you can configure how Hypertext Transfer Protocol (HTTP) and SSL requests will be redirected: as HTTP requests or as SSL requests. If requests are redirected as SSL requests, the ISA Server computer re-encrypts the packets before passing them on, and a new secure channel is established for the communication with the upstream server.

The upstream Web server may require a client certificate. In this case, configure ISA Server to authenticate with a specific client-side certificate.

For instructions, see Configure how to redirect HTTP requests and Configure how to redirect SSL requests.


Firewall chaining

For Firewall clients, you can use firewall chaining to configure how requests will be routed. You can select to route requests from Firewall clients to one of the following:

  • Directly to the Internet, with or without a dial-up connection.
  • To an upstream proxy server, with or without a dial-up connection.

Note

  • When client requests are routed, the objects are not cached.

Upstream proxy server

You can route client requests to an upstream ISA Server computer or a Microsoft Proxy Server 2.0 computer. In this case, you can specify a primary route.

Authentication

When Firewall client requests are sent to an upstream proxy server, you can enable password authentication. This specifies the authentication parameters that are used between ISA Server and an upstream server.

For instructions, see Configure firewall chaining.


Dial-up connections

Depending on how you configure routing and chaining, ISA Server uses a dial-up entry to dial out to the Internet. You can refine when ISA Server can use a dial-up connection, by specifying which networks can be accessed using a dial-up connection.

ISA Server can be configured to dial out for the following:

  • Firewall chaining. Use this option if you configure firewall chaining to access a network beyond the existing network, and it is necessary to dial out to access the chained network.
  • Web chaining rules. Use this option if the client requests an object, the route for the client request requires establishing a dial-up connection, and access policy allows the client request. ISA Server dials out to the Internet using the active dial-up entry.

In addition, ISA Server dials out to the Internet if a client requests an object and ISA Server cannot definitively determine whether the access policy allows the request, for example, if a Web chaining rule that applies to the request indicates that a dial-up connection should be established. This happens when the access policy rules specify a destination by name, while the client specifies the computer by Internet Protocol (IP) address.

ISA Server checks whether a Web chaining rule that applies to the client request requires establishing a dial-up connection. If such a Web chaining rule exists, ISA Server dials out to the Internet, either to resolve the name of the computer requested by the client or to do a reverse lookup. Then, ISA Server again checks the access policy rules to determine if the request is allowed. For more information about how rules are processed, see How firewall policy works.

Limiting when ISA Server dials out

You can limit when ISA Server dials out to the Internet by performing one or more of the following:

  • Configure the local domain table (LDT) so that it includes the names of all internal computers. In this way, ISA Server will not have to dial out to an external DNS server, only to determine that the requested computer is actually internal. Note that the LDT is checked only for requests from Firewall clients.
  • Allow dialing out only when accessing specific networks.

Closing dial-up connections

After ISA Server dials out to the Internet, the connection is maintained until one of the following occurs:

  • ISA Server dialed the connection, and the Microsoft Firewall service is subsequently stopped.
  • ISA Server dialed the connection, and while connected, you change the Internet service provider (ISP) used by ISA Server.
  • The dial-up entry reaches a predefined idle time and therefore terminates the connection.


Network for automatic dialing

Automatic dialing is configured per network. When ISA Server 2004 receives a request for the selected network, it uses the dial-up connection configured for the specific network.

Automatic dialing can be used for one network only.

If automatic dialing is used for connecting to the Internet, you should select the External network for the automatic dial-up connection. You may want to use automatic dialing for a network other than the Internet. For example, you can configure automatic dialing to connect to a branch office or to a specific location in your organization.

For instructions, see Configure automatic dialing. For instructions on creating networks, see Create a network.


Dial-up connection configuration steps

The dial-up connection specifies the dial-up properties, such as Internet service provider (ISP), ISP phone number, and modem.

Dial-up connections are created in the Microsoft Windows Server New Connection Wizard.

After selecting a dial-up connection, you must specify the dial-up account details required by the ISP. These are the same account details used when creating the dial-up connection. The dial-up account details are used by ISA Server when connecting to the ISP.

To enable dial-on-demand, perform the following steps:

  1. Create a network connection on the operating system. For instructions on creating network dial-up connections, see Windows Help.
  2. Select the networks to which ISA Server will automatically dial out.
  3. Verify that a default gateway is not configured on any of the internal network adapters on the ISA Server computer.


PPTP or L2TP dial-up connections

For some cable modem connections, your Internet service provider (ISP) may support only Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol (L2TP) connections. In this case, you will need to perform the following steps to enable the dial-up connection from ISA Server:

  1. Use the New Connection Wizard to create a dial-up connection. On Network Connection Type, specify Connect to the network at my workplace. On Network Connection, select Virtual Private Network connection.
  2. Create an access rule allowing PPTP or L2TP (client protocol from the Local Host to the IP address of the ISP, or the External network). For instructions, see Create an access rule.
  3. Configure the dial-up preferences for ISA Server to use the network connection. For instructions, see Configure automatic dialing.


Multi-Networking: How To

This section provides steps for setting network policy.

  • Apply a network template
  • Configure Networks
  • Configure Network Sets
  • Configure Network Rules
  • Configure Web Chaining Rules
  • Configure firewall chaining
  • Configure automatic dialing


Apply a network template

To apply a network template

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Template tab, click the applicable network template.
  4. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you install ISA Server, two network sets are created:
    • All Networks. This includes all the networks defined on the ISA Server computer. When you create a new network, this network is automatically added to the All Networks network set.
    • All Protected Networks. This includes all networks defined upon installation, except the External network. When you create a new network, this network is automatically added to the All Networks network set.

Related Topics


Configure Networks

This section provides steps for configuring networks.

  • Create a network
  • Configure network addresses
  • Configure maximum number of concurrent Web Proxy client connections allowed
  • Configure domains included in a network
  • Delete a network


Create a network

To create a network

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Networks tab.
  3. On the Tasks tab, click Create a New Network.
  4. When the New Network Rule Wizard starts, follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure network addresses

To configure network addresses

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Addresses tab, do one of the following:
    • To add a specific range of IP addresses, click Add. Then, type the first address of the network address range in Starting address and the last address of the network address range in Ending address.
    • To add IP addresses associated with a specific adapter, click Add Adapter, and then in Network Adapter Details, select one or more adapters.
    • To add private address ranges, click Add Private, and then select a range from the list.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Except for the Internal network, you cannot modify the addresses for any of the default networks created when ISA Server is installed.

Related Topics


Configure maximum number of concurrent Web Proxy client connections allowed

To configure maximum number of concurrent Web Proxy client connections allowed

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Web Proxy tab, click Advanced.
  5. In Advanced Settings, select one of the following:
    • Unlimited. To allow an unlimited number of clients to connect to the server at any one time.
    • Maximum. To limit the maximum number of clients that can connect to the server at any one time. Type the maximum number of connections.
  6. In Advanced Settings in Connection timeout, type the number of seconds before the server disconnects an inactive user.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure domains included in a network

To configure domains included in a network

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Domains tab, click Add. Then, type the domain name in Enter a domain name to include.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To include a single computer, type its fully qualified domain name (FQDN). The server name should be unique. Using the FQDN will avoid any conflict with duplicated server names.
  • To include an entire domain name, type *.domain_name.
  • To include all domains, type *.
  • To remove a domain from the network, on the Domains tab, select the applicable domain, and then click Remove.

Related Topics


Delete a network

To delete a network

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, click the Networks tab, and then click the applicable network.
  3. On the Tasks tab, click Delete Selected Network.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You cannot delete any of the default networks created when ISA Server is installed.

Related Topics


Configure Network Sets

This section provides steps for configuring network sets.

  • Create a network set
  • Edit a network set
  • Delete a network set


Create a network set

To create a network set

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Network Sets tab.
  3. On the Tasks tab, click Create a New Network Set.
  4. When the New Network Set Wizard starts, follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Edit a network set

To edit a network set

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Network Sets tab, and then select the applicable network set.
  3. On the Tasks tab, click Edit Selected Network Set.
  4. On the Networks tab, select one or more networks to include in the network set.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Delete a network set

To delete a network set

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Network Sets tab, and then select the applicable network set.
  3. On the Tasks tab, click Delete Selected Network Sets.
  4. When the New Network Rule Wizard starts, follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You cannot delete any of the default network sets created when ISA Server is installed.

Related Topics


Configure Network Rules

This section provides steps for configuring network rules.

  • Create a network rule
  • Edit a network rule
  • Disable a network rule
  • Delete a network rule


Create a network rule

To create a network rule

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Network Rules tab.
  3. On the Tasks tab, click Create a New Network Rule.
  4. When the New Network Rule Wizard starts, follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you create a network rule, you must click the Apply button in the details pane to save changes and update the configuration.

Related Topics


Edit a network rule

To edit a network rule

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Network Rules tab.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Source Networks tab, next to This rule applies to traffic from these sources, click Add, and then do the following:
    1. In Add Network Entities, select a network object, and then click Add.
    2. Repeat step a to add more network objects. Then, click Close.
    3. To exclude specific network objects, so that the rule does not apply, next to Exceptions, click Add.
    4. In Add Network Entities, select a network object, and then click Add.
    5. Repeat step d to add more network objects. Then, click Close.
  5. On the Destination Networks tab, next to This rule applies to traffic from these sources, click Add, and then do the following:
    1. In Add Network Entities, select a network object, and then click Add.
    2. Repeat step a to add more network objects. Then, click Close.
    3. To exclude specific network objects, so that the rule does not apply, next to Exceptions, click Add.
    4. In Add Network Entities, select a network object, and then click Add.
    5. Repeat step d to add more network objects. Then, click Close.
  6. On the Network Relationships tab, select one of the following:
    • Network Address Translation (NAT). To specify that a NAT relationship will be used from the source network to the destination network.
    • Route. To specify that a route relationship will be used between the source network and the destination network.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you edit a network rule, you must click the Apply button in the details pane to save changes and update the configuration.
  • In a NAT relationship, IP addresses of computers on the source network are replaced by an IP address of an adapter on the ISA Server computer that is connected to the destination network. NAT relationships are unique and unidirectional. If a NAT relationship is defined between Network A (source network) and Network B (destination network), no network relationship can be defined between Network B (as the source) and Network A (as the destination).
  • In a route relationship, ISA Server routes the traffic between computers on the source and destination networks. IP addresses of computers on both networks are visible. Routed relationships are bidirectional. If a routed relationship is defined for traffic from Network A (source) to Network B (destination), a routed relationship also exists for traffic sent from Network B to Network A.

Related Topics


Disable a network rule

To disable a network rule

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Network Rules tab.
  3. On the Tasks tab, click Disable Selected Rules, and then click Yes.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you delete a network rule, you must click the Apply button in the details pane to save changes and update the configuration.

Related Topics


Delete a network rule

To delete a network rule

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Network Rules tab.
  3. On the Tasks tab, click Delete a New Network Rule, and then click Yes.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you delete a network rule, you must click the Apply button in the details pane to save changes and update the configuration.
  • You cannot delete the Local Host Access rule that defines a routing relationship between the Local Host network and all other networks.

Related Topics


Configure Web Chaining Rules

This section provides steps for configuring Web chaining rules.

  • Create a Web chaining rule
  • Configure how Web chaining rules retrieve requests
  • Configure a primary route for Web requests
  • Configure a backup route for Web requests
  • Allow delegation of credentials
  • Configure how to redirect HTTP requests
  • Configure how to redirect SSL requests
  • Delete a Web chaining rule


Create a Web chaining rule

To create a Web chaining rule

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab.
  3. On the Tasks tab, click Create New Web Chaining Rule.
  4. When the New Web Chaining Rule Wizard starts, follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure how Web chaining rules retrieve requests

To configure how Web chaining rules retrieve requests

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab, and then select the applicable Web chaining rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Action tab, select one of the following options:
    • To retrieve the requested object directly from the Internet, click Retrieving them directly from the specified destination.
    • If an upstream server should service the request, click Redirecting them to a specified upstream server. Then, do the following:
      • To allow the Web server to which the request is redirected to authenticate the client, select Allow delegation of basic authentication credentials.
      • Configure the primary and backup route.
  5. If the request should be redirected to a different computer, click Redirecting them to a hosted site and configure the site, port, and Secure Sockets Layer (SSL) port.
  6. (Optional) If you route the request directly to the specified destination or to an upstream server, select the Use automatic dial-up for primary route check box.
  7. (Optional) If you route the request directly to an upstream server and you specify a backup route, select the Use automatic dial-up for backup route check box.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure a primary route for Web requests

To configure a primary route for Web requests

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab, and then select the applicable Web chaining rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Action tab, click Redirecting them to a specified upstream proxy server, and then click Settings.
  5. In Server, type the name or Internet Protocol (IP) address of the ISA Server computer.
  6. In Port, type the port number on which the upstream server listens for Hypertext Transfer Protocol (HTTP) requests. This is typically port 8080.
  7. In SSL Port, type the port number on which the upstream server listens for Secure Sockets Layer (SSL) requests. This is typically port 8443.
  8. (Optional) If ISA Server should determine the configuration of the upstream server, to retrieve objects from the upstream server, click Automatically poll upstream server for the configuration and type the Uniform Resource Locator (URL) for the server.
  9. (Optional) If the upstream server is accessible only when the server supplies credentials, click Use this account, click Set Account, and type the user name, password, and authentication type.
  10. (Optional) If ISA Server should dial out for primary connections, on the Action tab under Automatic dial-up, select Use automatic dial-up entry for primary route.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select Automatically poll upstream server for the configuration, ISA Server will determine the configuration of the upstream server. The local ISA Server uses this information to retrieve objects from the upstream server.
  • Because ISA Server supports pass-through authentication, the authentication information of the client requesting the object is passed to the upstream server. However, if the upstream server might not be able to identify the client, you instead can specify Use this account and supply which credentials to pass.

Related Topics


Configure a backup route for Web requests

To configure a backup route for Web requests

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab, and then select the applicable Web chaining rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Action tab, click Redirecting them to a specified upstream proxy server, and then click Settings.
  5. In Backup route, select Upstream proxy server.
  6. (Optional) Select Use automatic dial-up entry for backup route if ISA Server dials out for backup connections.
  7. Click Settings.
  8. In Server, type the name of the ISA Server computer.
  9. In Port, type the port number of the upstream server. Typically, this is port 8080.
  10. In SSL Port, type the SSL port number of the upstream server. Typically, this is port 8443.
  11. (Optional) If the upstream server should supply configuration information, click Automatically poll upstream server for the configuration and type the URL of the server.
  12. (Optional) If the upstream server is accessible only when the server supplies credentials, click Use this account. Then, in User name, type the user name, in Password, type the password, and in Authentication, type the authentication method.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Allow delegation of credentials

To allow delegation of credentials

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab, and then select the applicable Web chaining rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Action tab, click Redirecting them to a specified upstream proxy server.
  5. Click Allow delegation of basic authentication credentials if the Web server to which the request is redirected can authenticate the client.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure a primary route for Web requests

To configure how to redirect HTTP requests

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab, and then select the applicable Web chaining rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Bridging tab, in Redirect HTTP requests as, select one of the following options:
    • If Hypertext Transfer Protocol (HTTP) requests should be routed to the upstream server using the HTTP protocol, click HTTP requests.
    • If HTTP requests should be routed to the upstream server using the Secure Hypertext Transfer Protocol (HTTPS) protocol, click SSL requests.
  5. (Optional) If you select SSL requests, select the Use a certificate to authenticate to the SSL Web server check box and click Select to select the certificate to use.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you select HTTP requests, the ISA Server terminates the secure control channel.
  • If you select SSL requests, the ISA Server opens a new secure control channel to the upstream server.
  • You only need to use a certificate if the Web server requires client certificate authentication.

Related Topics


Configure how to redirect SSL requests

To configure how to redirect SSL requests

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab, and then select the applicable Web chaining rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Bridging tab, in Redirect SSL requests as, select one of the following options:
    • If Secure Sockets Layer (SSL) requests should be routed to the upstream server using the Hypertext Transfer Protocol (HTTP) protocol, click HTTP requests.
    • If SSL requests should be routed to the upstream server using the Secure Hypertext Transfer Protocol (HTTPS) protocol, click SSL requests.
  5. (Optional) If you select SSL requests, select the Use a certificate to authenticate to the SSL Web server and click Select to select the certificate to use.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you select HTTP requests, ISA Server terminates the secure control channel.
  • If you select SSL requests, ISA Server opens a new secure control channel to the upstream server.
  • You only need to use a certificate if the Web server requires client certificate authentication.

Related Topics


Delete a Web chaining rule

To delete a Web chaining rule

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Web Chaining tab, and then select the applicable Web chaining rule.
  3. On the Tasks tab, click Delete Selected Rule.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure firewall chaining

To configure firewall chaining

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. In the details pane, click Configure Firewall Chaining.
  3. On the Firewall Chaining tab:
    • To use the primary connection method of ISA Server to access the Internet, click Use primary connection.
    • To forward the request to an upstream ISA Server computer, click Chain to this computer and type the computer name in the text box.
  4. (Optional) If you selected Use primary connection, click Use dial-up entry.
  5. If you selected Chain to this computer, do the following:
    • If the requested application requires authentication, select the Use this account check box and click Set Account.
    • In User, type a domain name and user name using the following format:
      DomainName\UserName
    • In the Password and Confirm password text boxes, type the password.
    • (Optional) Select the Use dial-up entry check box.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure automatic dialing

To configure automatic dialing

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. In the details pane, click Specify Dial-up Preferences.
  3. To allow automatic dialing, select Allow automatic dialing to this network.
  4. In the drop-down list, select the applicable network.
  5. If the dial-up connection is your default gateway, select Configure Dial-up connection to be the default gateway.
  6. In Use the following dial-up connection, provide the name of the dial-up connection, or click Select to select a connection.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Use the New Connection Wizard in Windows Server 2003 or Windows 2000 Server to create dial-up connections.
  • If you choose a dial-up entry that is a VPN connection, you will experience connectivity problems. This is because the PPTP and L2TP over IPSec protocols that are used to establish VPN connections are blocked by default in ISA Server. To avoid this, create access rules that allow PPTP and L2TP over IPSec traffic. For instructions, see Create an access rule.

Related Topics


Troubleshooting dial-up entries

What problem are you having?

Dial out to the Internet failed, although manual dial out works.

Cause: The dial-up entry credentials were not specified correctly, even though you may have specified credentials for the network dial-up connection correctly.

Solution: Reconfigure the dial-up entry credentials.

Cause: The ISA Server computer does not have permissions to use the dial-up connection.

Solution: Reconfigure the dial-up connection and allow Everyone to use the connection. For more information, see Windows Help.

Failed to dial out to the Internet because the connection is already being dialed.

Cause: Another service on the computer is connecting with this dial-up connection.

Solution: Wait for the connection operation to complete. ISA Server will attempt the connection again when a request is made. If the problem persists, restart the ISA Server services. For configuration instructions, see Start or stop a service.

The dial-up connection was dropped.

Cause: Someone may have inadvertently disconnected the dial-up connection.

Solution: Restart the ISA Server services. The services will automatically reestablish the connection. For configuration instructions, see Start or stop a service.

The dial-up connection never hangs up, even though there is no dialing activity.

Cause: Whenever a client request is made, even if for a computer on the local network, ISA Server sends name resolution requests to both the internal DNS server and an external DNS server.

Solution: Configure ISA Server to use only internal DNS servers. The internal DNS server should be configured as a client of ISA Server. Then, configure the internal DNS server to forward unresolved requests to an external DNS server.


Firewall Policy

With Microsoft Internet Security and Acceleration (ISA) Server 2004, you can maximize security with packet level, circuit level, and application level traffic filtering:

  • Stateful packet filtering determines which packets will be allowed to pass through to the secured network circuit and application layer proxy services. Stateful filtering opens ports automatically only as needed, and then closes the ports when the communication ends.
  • Circuit filtering provides application transparent circuit gateways for multiplatform access to many Internet protocols and services. Unlike other circuit layer proxies, ISA Server circuit layer security works together with dynamic packet filtering for enhanced security and ease of use.
  • Application filtering and stateful inspection handle commands within the application protocols (for example, HTTP, FTP, and Gopher) from client computers. ISA Server acts on behalf of the client computer, hiding the network topology and IP addresses from the outside network.

You can control inbound and outbound access by user and group, application, source and destination, and schedule. Firewall policy specifies which sites and content are accessible, whether a particular protocol is accessible for inbound and outbound communication, and allows or denies communication between specified IP addresses, using specified protocols and ports. This section explains the firewall policy.

  • Firewall Policy: Concepts
  • Firewall Policy: How To


Firewall Policy: Concepts

This section provides general background information about firewall policy and how it works in Internet Security and Acceleration (ISA) Server 2004.

  • How firewall policy works
  • Firewall Policy Rules
  • Publishing Rule Configuration
  • System Policy
  • Toolbox
  • Custom HTML error messages
  • Authentication
  • Network Protection


How firewall policy works

Using ISA Server 2004, you can create a firewall policy, which includes a set of publishing rules and access rules. These rules, together with the network rules, determine how clients access resources across networks. For more information, see Firewall Policy Rules.

Outgoing requests

One of the primary functions of ISA Server is to connect between source and destination networks, while protecting from malicious access. To facilitate this connectivity, you use ISA Server to create an access policy that permits clients on the source network to access specific computers on the destination network. The access policy determines how clients access other networks.

When ISA Server processes an outgoing request, it checks network rules and firewall policy rules to determine if access is allowed.

Some rules can be configured to apply to specific clients. In this case, the clients can be specified either by IP address or by user name. ISA Server processes the requests differently, depending on which type of client requests the object, and how you configure ISA Server.

First, ISA Server checks the network rules, to verify that the two networks are connected. If the network rules define a connection between the source and destination network, ISA Server processes the access policy rules. For more information, see Network rules.

Next, ISA Server checks the access rules, in order. If an allow rule applies to the request, ISA Server will allow the request. Specifically, ISA Server applies a rule if the request matches the following rule conditions:

  • Protocol
  • From (source) address and port
  • Schedule
  • To (destination) addresses, names, URLs
  • Users
  • Content groups

Having applied a rule, ISA Server does not match the request to any other rule and stops rule evaluation. Subsequently, ISA Server may actually deny the request, depending on the additional protocol filtering applied to the rule.

Finally, ISA Server checks the network rules again, to determine how the networks are connected. ISA Server checks the Web chaining rules (if a Web Proxy client requested the object) or the firewall chaining configuration (if a SecureNAT or firewall client requested the object) to determine how the request will be serviced.

For example, assume that you installed ISA Server on a computer with two network cards: one connected to the Internet and the other connected to your local network. You have permissive corporate guidelines that allow all users access to all sites. In this case, your policy would consist of the following access policy rules:

  • A network rule that establishes connectivity between the source network (the local network) and the destination network (the Internet).
  • An access rule that allows all internal clients to access all sites at all times, using any protocol.

Incoming requests

ISA Server can make servers securely accessible to clients on another network. You use ISA Server to create a publishing policy to securely publish servers. The publishing policy, which consists of Web publishing rules, server publishing rules, secure Web publishing rules, and mail server publishing rules, together with the Web chaining rules, determines how published servers are accessed.

You can use one of the following ISA Server rules to publish servers:

  • Web publishing rules. To publish Web server content.
  • Server publishing rules. To publish any other content.
  • Secure Web publishing servers. To publish Secure Sockets Layer (SSL) content.

When ISA Server processes an HTTP or HTTPS request from a client, it checks publishing rules and Web chaining rules to determine whether the request is allowed, and which server will service the request.

For non-HTTP requests, ISA Server checks the network rules, and then checks the publishing rules to determine if the request is allowed.

For an incoming Web request, rules are processed in the following order:

  1. Web publishing rules.
  2. Web chaining rules. For more information, see Web chaining rules.

For example, consider a scenario, in which you have installed ISA Server on a computer with two network adapters: one connected to the Internet and the other connected to your local network. The following applies:

  1. If a Web publishing rule specifically denies the requests, the requests are denied.
  2. If a Web chaining rule specifies that the requests be routed to a specific upstream server or an alternate hosted site, the specified server handles the request.
  3. If a Web chaining rule specifies that the requests be routed to the specified server, the internal Web server returns the object.

Web publishing rules and Web chaining rules

Web publishing rules are processed in order, with the default Web publishing rule processed last. Web chaining rules are also processed in order.

When an external client requests an object from an internal Web server, rules are processed in the following order:

  1. Web publishing rules
  2. Web chaining rules

For example, consider the following rules:

  • A Web publishing rule that redirects requests from all clients for widgets.microsoft.com to a hosted site (Web server) specified as msweb.
  • A Web chaining rule that routes requests for a destination that includes msweb by servicing them directly.

When an external (Internet) user requests an object from widgets.microsoft.com, ISA Server intercepts the request. First, it processes the Web publishing rule, determining that the request will be redirected to the msweb computer. Next, it processes the Web chaining rule, determining that the request will be serviced directly by the specified server (msweb).

The following example illustrates what happens when you create a Web publishing rule, without creating an appropriate Web chaining rule:

  • A Web publishing rule that redirects requests from all clients for a destination set that includes example.microsoft.com to a hosted site specified as myinternalms
  • A Web chaining rule that routes requests for all destinations to an upstream server.

In this case, the Web publishing rule is processed first. All requests for example.microsoft.com are redirected to myinternalms. However, the Web chaining rule specifies that the request will be routed to an upstream server (and not sent directly to the destination server). The request will always be routed to the upstream server.


Firewall Policy Rules

This section provides information about firewall policy rules.

  • Access rules
  • Web publishing rules
  • Secure Web publishing rules
  • Server publishing rules
  • Mail server publishing rules
  • Outlook Web Access server publishing


Access rules

Access rules determine how clients on a source network can access resources on a destination network.

You can configure access rules to apply to all IP traffic, to a specific set of protocol definitions, or to all IP traffic except selected protocols.

For instructions, see Create an access rule.

Note

  • New rules apply only to new connections.

Traffic

ISA Server includes a list of preconfigured, well-known protocol definitions, including the Internet protocols which are most widely used. You can also add or modify additional protocols.

When a client requests an object using a specific protocol, ISA Server checks the access rules. A request is processed only if an access rule specifically allows the client to communicate using the specific protocol and also allows access to the requested object.

For instructions, see Configure protocols for an access rule.

Access rules and application filters

Some application filters create and install new protocol definitions. When the application filter is disabled, all its protocol definitions are also disabled. That is, traffic that uses the protocol definition is blocked. For example, if you disable the streaming media filter, all traffic that uses the Windows Media® and RealNetworks protocol definitions is blocked.

Other application filters handle existing protocol definitions, either user-defined or configured by ISA Server. When these application filters are disabled, the protocol definitions that they filter are not disabled. For example, even if you disable the Simple Mail Transfer Protocol (SMTP) filter, SMTP protocol definitions might still be allowed to pass unfiltered.

When an access rule allows all IP traffic, ISA Server will pass any traffic that matches the rule to applicable application filters. If the traffic does not meet the application filter's criteria, ISA Server will reject the traffic and the connection will be closed.

Access rules apply to Firewall clients and SecureNAT clients when the protocol is defined by an application filter or the access rule applies to a protocol that has only a primary connection—for example, Hypertext Transfer Protocol (HTTP).

If a protocol has secondary connections, and it is not defined by an application filter, the access rule applies only to the primary connection. That is, if an application uses a protocol that has a secondary connection, this application will work only on Firewall clients.

For SecureNAT clients, if you configure an access rule to apply to all IP traffic, the rule will apply only to all defined protocols.

Per-rule filtering

Application filtering is applied on a per-rule basis. This means that you can match the firewall policy best suited to your specific security needs. For example, suppose you allow all internal users access to the Internet, using all protocols. In this case, you may elect to have maximal filtering enabled. However, suppose also that you want to allow less-restrictive remote procedure call (RPC) access from the Internal network to a specific, trusted network. In this case, you may consider not applying the RPC filter's strict compliance—in that way, allowing DCOM traffic between the networks.

Per-rule filtering is available for access rules from the following application filters:

  • HTTP filter
  • RPC filter

For instructions, see Configure Per-Rule Filtering.

Default rule

A default rule, created when you install ISA Server, denies all access to and from all networks. This default rule cannot be modified or deleted.

Note

  • Because system policy rules are processed first by ISA Server, a system policy rule that allows the Local Host access to the External network will override any access policy rules you may specifically configure that deny such access.


Web publishing rules

ISA Server uses Web publishing rules to relieve the concerns associated with publishing Web content without compromising network security. Web publishing rules determine how ISA Server will intercept incoming requests for Hypertext Transfer Protocol (HTTP) objects on a Web server, and how ISA Server will respond on behalf of the Web server. Requests are forwarded to the Web server, located behind the ISA Server computer. If possible, the request is serviced from the ISA Server cache.

Web publishing rules essentially map incoming requests to the appropriate Web servers. Web publishing rules also enable you to configure advanced filtering functionality, thereby publicizing your Web-based information, while securing it from malicious access.

For instructions, see Create a Web publishing rule.

Note

  • New rules apply only to new connections.

When you configure Web publishing rules, you specify the following:

  • Name (or IP address) of the Web server. You can limit whether the rule applies to all websites on the server, or to a specific website.
  • Path mapping. Before forwarding a request, ISA Server can modify the external path specified in the request and map it to a corresponding internal path. For more information, see Path mapping.
  • Users or computers that can access the published Web server. For instructions, see Configure users for a firewall policy rule.
  • Source. The network objects that can access the published Web server. For more information, see network objects. Note that the network objects that you specify must also be included in the Web listener specified for this Web publishing rule. For instructions, see Configure source network objects for a firewall policy rule.
  • Web listener. This is the IP address on the ISA Server computer that listens for requests from clients. For more information, see Web listener overview.
  • Bridging. With bridging, you configure how HTTP requests are forwarded to the published server. See Bridging for more information.
  • Link translation. With link translation, you configure how ISA Server scans Web pages for links and updates them with the external name and path. For more information about link translation, see Link Translation. For instructions about working with link translation, see Replace absolute links in Web pages and Add a link translation dictionary entry for a Web publishing rule.

You can further filter requests made to the Web server, by configuring HTTP filtering. For more information about the HTTP filter, see HTTP filter.

Important

  • We recommend that you do not enable directory browsing on the Web server that is published by ISA Server. Also, the Web server cannot require Digest authentication or Basic authentication. If it does, the internal name or IP address of the Web server may be exposed on the Internet.

Action

Web publishing rules specify which server (if any) will return the requested object. The request can be discarded or redirected to an alternate site, usually to a Web server on your corporate network.

When you configure the rule to redirect requests to a hosted site, ISA Server retrieves the object from the path specified in the request on the host computer. For example, suppose you specify that ISA Server redirect requests for example.microsoft.com/development to a host computer called Dev. When a client requests an object from example.microsoft.com/development, then ISA Server retrieves the object from the development folder on Dev.

Web publishing rules determine the requested destination by reading the host header.

For instructions, see Configure an action for a firewall policy rule.

Path mapping

Before forwarding a request to the published Web server, ISA Server checks the (external) path specified in the request. If you configure path mapping, ISA Server will replace the path specified in the request with the corresponding path name. Note that each path you specify must be distinct and unique.

Follow these guidelines when specifying path mapping:

  • When you specify the internal path to which the request will be mapped, use this format: /mypath/*.
  • You cannot use a wildcard character in the path. For example, do not specify mypath*/ or /mypath*.
  • Avoid specifying a file name when you configure path mapping. Otherwise, beware that only a request for the exact path will be served.

For instructions, see Configure path mapping.

Bridging

When you create a Web publishing rule, you can further secure HTTP communication. Even if the initial communication uses HTTP, after ISA Server receives the request, the communication can be redirected using SSL. If the request is redirected as an SSL request, the packets are encrypted. This redirection is referred to as bridging.

You can set that HTTP or SSL requests will be passed on as File Transfer Protocol (FTP) requests to the Web server. If the external client requests an object using HTTP or SSL, ISA Server can then redirect the request to the internal Web server using FTP. If you configure bridging in this way, you can specify which port will be used when bridging FTP requests.

The upstream Web server may require a client certificate. In this case, configure ISA Server to authenticate with a specific client-side certificate.

If you configure the Web publishing rule to require a secure channel, all client requests for the specified destinations must be on the port specified for SSL connections.

For instructions, see Configure how to redirect HTTP requests for Web publishing rules.

Publishing websites with the same domain name

Clients identify published websites by their fully qualified domain name (FQDN), as published by ISA Server. This means that the FQDN for the website is the FQDN that you configure in the Web publishing rule. By publishing more than one Web server using the same FQDN, the client assumes that both published sites are actually the same. In other words, the Web client may send information intended for one Web server to the other Web server.

Rule order

Web publishing rules are processed together with all the firewall policy rules. They are processed in order, for each incoming Web request. When the rule matches a request, the request is routed and cached accordingly. If no rule matches the request, ISA Server processes the default rule and discards the request.


Secure Web publishing rules

With ISA Server, you can create secure Web publishing rules, to publish a website that hosts HTTPS content. Secure Web publishing rules determine how ISA Server will intercept incoming requests for HTTPS objects on an internal Web server and how ISA Server will respond on behalf of the Web server. Requests are forwarded to an internal Web server, located behind the ISA Server computer.

For instructions, see Create a secure Web publishing rule.

Note

  • New rules apply only to new connections.

Bridging

With bridging, you can configure how traffic will be passed to the Web server. For example, suppose a client uses Secure Sockets Layer (SSL) to communicate with the ISA Server computer, and a Web publishing rule maps the request to an internal Web server. The initial communication uses SSL. However, by default, all further communication uses a protocol that is not secure, such as HTTP.

When you create a secure Web publishing rule, you can configure how SSL requests will be redirected as HTTP requests or as SSL requests. If requests are redirected as SSL requests, ISA Server re-encrypts the packets before passing them on to the Web server. Therefore, a new secure channel is established for the communication with the SSL Web server. This redirection is also referred to as SSL bridging.

For more information, see SSL bridging.

Tunneling

When you configure a secure Web publishing rule to use tunneling mode, ISA Server relays unmodified, encrypted traffic to the published Web server. That is, ISA Server does not perform any additional filtering on the traffic.

Secure Web publishing rules that use tunneling mode (as opposed to bridging mode) are more similar to server publishing rules than to Web publishing rules. Many Web publishing features are not applicable to these rules, including link translation and path mapping. The rule cannot apply to specific users (only to network objects).

For more information, see SSL tunneling.

Listener

When you configure secure Web publishing rules, you are defining how HTTPS content on a published Web server will be accessed. An appropriate listener, configured to listen on an HTTPS port, should be specified for the secure Web publishing rule.

For more information, see Web Listeners.


Server publishing rules

ISA Server uses server publishing to process incoming requests to internal servers, such as File Transfer Protocol (FTP) servers, Structured Query Language (SQL) servers, and others. Requests are forwarded downstream to an internal server, located behind the ISA Server computer.

Server publishing allows virtually any computer on your Internal network to publish to the Internet. Security is not compromised because all incoming requests and outgoing responses pass through ISA Server. When a server is published by an ISA Server computer, the IP addresses that are published are actually the IP addresses of the ISA Server computer. Users who request objects think that they are communicating with the ISA Server—whose name or IP address they specify when requesting the object—while they are actually requesting the information from the publishing server. This is true when the network on which the published server is located has a network address translation (NAT) relationship from the network on which the clients accessing the published server are located. When you configure a routed network relationship, the clients use the actual IP address of the published server to access it. For more information on network relationships, see Network rules.

Server publishing rules determine how server publishing functions, essentially filtering all incoming and outgoing requests through the ISA Server computer. Server publishing rules map incoming requests to the appropriate servers behind the ISA Server computer. These rules will grant access dynamically, as specified, from Internet users to the specific publishing server.

The published server is a SecureNAT client. Therefore, no special configuration of the published server is required after you create the server publishing rule on the ISA Server computer. Note that ISA Server must be configured as the default gateway on the published server.

Notes

  • Publishing IP-level and Internet Control Message Protocol (ICMP) primary protocols are not supported. An exception to this is Point-to-Point Tunneling Protocol (PPTP), which is a combination of a TCP connection and Generic Routing Encapsulation (GRE) packets, and is supported.
  • New rules apply only to new connections.

For instructions, see Create a server publishing rule.

Server publishing rules apply to one protocol. For instructions, see Configure protocols for a server publishing rule.

Per-rule filtering

Application filtering is applied on a per-rule basis. This means that you can match the firewall policy best suited to your specific security needs. Per-rule filtering is available for server publishing rules from the Exchange RPC filter.

Overriding default ports

When you use ISA Server to publish a server, by default, the firewall listens for incoming requests on the standard port of the respective protocol and passes incoming connections to the same standard port on the publishing server. For example, when you publish an FTP server, ISA Server listens for incoming requests on port 21, the port associated with the FTP protocol, and passes incoming connections to port 21 on the published server. You can override the standard port by specifying different ports in the publishing rule.

Note

  • When you publish a remote procedure call (RPC) interface where there is a routed network relationship between networks, port overriding is ignored. The publishing rule will use the original IP address and port.

For instructions, see Override default ports for server publishing rules.

How server publishing works

ISA Server performs the following steps during server publishing:

  1. A client computer on the Internet requests an object from an IP address known as the publishing server. The IP address is actually associated with the ISA Server computer. It is the IP address of the external network adapter belonging to the ISA Server computer.
  2. The ISA Server computer processes the request, mapping the IP address to an internal IP address of an internal server.
  3. The internal server returns the object to the ISA Server computer, which passes it on to the requesting client.

Server publishing rule usage

In many cases, you could actually use an access rule, rather than a server publishing rule, to make a server available to clients. Here are some issues to consider:

  • You must use a server publishing rule when there is a NAT network relationship from the published server's network to the client's network.
  • A server publishing rule can only publish a single identified server. To publish several servers, you need several rules.
  • With server publishing rules, you can configure port overriding. For more information, see Overriding default ports.

Publishing DNS servers

ISA Server does not translate the IP address of DNS servers. To publish a DNS server, configure a routed network relationship between the Local Host network and the network that includes the DNS server. Similarly, ISA Server must know the IP address of the DNS server.

Disabling rules

When you disable a server publishing rule, any attempt to connect to the server will be denied. Note, however, that ISA Server does not close active connections. For instructions, see Disable a firewall policy rule.

You can stop active connections by disconnecting the relevant sessions. For instructions, see Disconnect a session.


Mail server publishing rules

When you create mail server publishing rules, ISA Server 2004 creates the necessary publishing rules required to allow clients access to their mail servers. Depending on the type of mail server you specify, Web publishing or server publishing rules are configured, which allow access to the mail servers using the protocols you specify.

For instructions, see Publish a mail server.

You can select one of the following types of access that the published mail server provides:

  • Web client access. Allows clients access to Microsoft Outlook® Web Access, Outlook Mobile Access, or Exchange Application Services servers. If you select this option, ISA Server configures appropriate Web publishing rules. For more information, see Outlook Web Access server publishing.
  • Client access. Allows clients to use remote procedure call (RPC), Internet Message Access Protocol version 4rev1 (IMAP4), Post Office Protocol version 3 (POP3), or Simple Mail Transfer Protocol (SMTP) to access their mail. When you select this option, a server publishing rule is created for each selected protocol. For more information about server publishing rules, see Server publishing rules.
  • Server-to-server communication. Allows SMTP (mail) servers and NNTP (news) servers access.

When you publish a mail server, we recommend that you configure the FQDN name of the mail server to the external DNS name of the ISA Server computer. In this way, the internal name of the mail server will not be made publicly available, and thereby prone to attack.

SMTP filtering

If the SMTP filter is installed and enabled, you can apply SMTP filtering. For more information, see SMTP Filtering.

RPC filtering

When you publish RPC type mail servers, you can apply RPC filtering. For more information, see RPC filter.


Outlook Web Access server publishing

Microsoft Internet Security and Acceleration (ISA) Server 2004 and Microsoft Outlook Web Access work together, to enhance security for e-mail messages. You can securely publish Outlook Web Access servers with mail server publishing rules.

When you publish Outlook Web Access servers through ISA Server, you are protecting the Outlook Web Access server from direct external access because the name and IP address of the Outlook Web Access server are not accessible to the user. The user accesses the ISA Server computer, which then forwards the request to the Outlook Web Access server according to the conditions of your mail server publishing rule.

For instructions, see Publish a mail server.

The Mail Server Publishing Wizard takes you through the steps required to securely publish Outlook Web Access servers. Because the Outlook Web Access server requires the fully qualified domain name (FQDN) requested by the client, the wizard configures ISA Server to forward the original host header to the published Outlook Web Access server.

After completing the wizard, the following paths are specified for the resulting Web publishing rule:

  • /exchange/*
  • /exchweb/*
  • /public/*

For detailed information about publishing Outlook Web Access scenarios using ISA Server, see the "Outlook Web Access Server Publishing in ISA Server 2004" document, available on ISA Server website (http://www.microsoft.com/isaserver).

Publishing Outlook Web Access servers

When you create the mail server publishing rule, note the following:

  • You must specify only standard ports, both on ISA Server and on the OWA Server. The standard port for HTTP is 80. The standard port for HTTPS is 443.
  • When you publish the OWA server, you cannot configure bridging so that HTTP requests are forwarded as HTTPS requests.
  • When you configure bridging, specifying that HTTPS requests should be forwarded as HTTP requests to the OWA Server, do not enable link translation.

Publishing Outlook Mobile Access and Exchange Application Services

As part of the Mail Server Publishing Wizard, you can select to configure publishing of Outlook Web Access and Exchange Application Services, which, like Outlook Web Access, are Web-based mail servers. If you publish Outlook Mobile Access and Exchange Application Services, the following paths are specified for the resulting publishing rule:

  • /OMA/*
  • /Microsoft-Server-ActiveSync/*

Web listeners for Outlook Web Access publishing

The Web listener you configure for Outlook Web Access publishing could be configured to use forms-based authentication. If you configure secure connections to the clients, be sure that the listener listens for requests on an HTTPS port.

In this case, the authentication forms will be served from the ISA server computer, thus enabling forms-based authentication when publishing Exchange 2000 Server and Exchange Server version 5.5

For more information about Web listeners, see Web listeners.

Important

  • For security reasons, we recommend that the Web listener configured for Outlook Web Access publishing should not be used for any other publishing scenarios.

Forms-based authentication

As part of the wizard, you specify which listener to use for incoming Outlook Web Access requests.

When you configure Outlook Web Access publishing, we recommend that you use forms-based authentication. By using forms-based authentication, you avoid the danger inherent in caching client credentials on the client computer. Caching credentials is risky in kiosk scenarios. Because credentials are cached, even after the user logged off, if the browser window is left open, a malicious user can gain access to the original Outlook Web Access session.

To enable forms-based authentication, you must specify a listener configured to use this authentication type. For more information, see Forms-based authentication.

ISA Server supports forms-based authentication when publishing Exchange Server 2003, Exchange 2000 Server and Exchange Server version 5.5.

Note

  • You cannot use forms-based authentication with Outlook Mobile Access clients.

Bridging mode

As part of the Outlook Web Access publishing rule wizard, you can specify the bridging mode to use:

  • Secure connection to clients. When you select this option, ISA Server establishes a secure connection with the client computers and a standard connection to the mail server.
  • Secure connection to mail server and clients. When you select this option, ISA Server establishes a secure connection with both the mail server and the clients.
  • Standard connections only. When you select this option, ISA Server establishes a standard connection with both the mail server and the clients.

The recommended configuration for Outlook Web Access publishing is to use SSL-encrypted communication (HTTPS), both from the external client to the ISA Server computer and from the ISA Server computer to the Outlook Web Access server. This is because the credential information used in the authentication process must be protected, and should not be exposed even within the Internal network. For this reason, you must install digital certificates on both the ISA Server computer and the Outlook Web Access server.

Public (shared) and private computers

Outlook Web Access enables users to access their Exchange-based mailboxes from any computer. The computer might be a private computer or a public (shared) computer. The convenience afforded by the ability to access e-mail messages anywhere is countered by the dangers in leaving data on a public computer.

To combat these threats, ISA Server forms-based authentication helps you ensure that users will not leave their passwords cached on public computers.

Furthermore, you can configure a maximum idle time-out after which users are required to reauthenticate. For instructions, see Configure idle session time-out for Outlook Web Access clients.

Changing user passwords

Outlook Web Access includes optional functionality that allows users to change their passwords. If a user changes a password during an Outlook Web Access session, the cookie provided after the user initially logged on will no longer be valid. When forms-based authentication is configured on ISA Server, the user who changes the password during an Outlook Web Access session will receive the logon page the next time a request is made.

To allow users to change passwords, be sure to add the /IISADMPWD/* folder for the Outlook Web Access mail server publishing rule. Otherwise, the user will get an error each time the Change Password button is clicked in Outlook Web Access.

Blocking attachments

With ISA Server, you can block users from opening and saving attachments. Blocking can be configured for Outlook Web Access clients on a public computer, on a private computer, or on both.

Note that ISA Server attachment blocking differs from the attachment blocking performed by Exchange Server. The user can see that a message has an attachment, but will not be able to open or save the attachment.

For instructions, see Block attachments from OWA clients

Prefetching Pages

Exchange Outlook Web Access servers include a prefetching feature, which enables files to be downloaded to the client computer while the client passes credentials. When using ISA Server forms-based authentication, to enable this feature, you must remove the comment marks from the following line in the logoff_msierich.htm and logoff_msierich_smimecap.htm files, typically located in the CookieAuthFilter subfolder (in the ISA Server installation folder):

"<IFRAME src="/exchweb/controls/preload.htm" style="display:none"></IFRAME>"

This prefetching functionality requires unauthenticated access to the /exchweb/* folder on the Outlook Web Access server. Therefore, if Web-based mail clients are required to authenticate on ISA Server, you should create a Web publishing rule allowing anonymous access to the /exchweb/* folder on the Outlook Web Access server. Subsequently, prefetching functionality should not be enabled if the Web listener is configured to require authentication.


Publishing Rule Configuration

This section provides general background information about configuration common to all publishing rules that you can configure for Internet Security and Acceleration (ISA) Server 2004.

  • Network listeners
  • Default port overrides
  • Request forwarding
  • DNS website registrations
  • Host headers
  • SSL Bridging and Tunneling


Network listeners

When you create a server publishing rule to publish a server, you are actually configuring ISA Server to listen for requests from clients on behalf of that server. That is, you must configure a network listener on the ISA Server computer, which waits for requests from clients. When you configure a network listener, you specify the network corresponding to the network adapter on the ISA Server computer that will listen for incoming requests for the published service. The listener can listen on all IP addresses associated with a network or on specific IP addresses.

ISA Server listens on the specified network adapter, using the port number associated with the protocol that the server is publishing.

For instructions, see Configure network listeners for a server publishing rule.

Selecting listener networks (IP addresses)

The listener network, or networks, that you select depend on the networks from which clients will connect to the published server. For example, if the service you are publishing accepts client requests from the Internet (External network), you should select the External network for the listener. By selecting the External network, you are selecting the IP addresses on the ISA Server computer that are associated with the External network adapter. If you do not limit the IP addresses, all IP addresses associated with the selected network adapter will be included in the listener configuration.

In addition, for the rule to work, traffic sources (network entities) specified in the From tab of the publishing rule properties must be included in a network selected as a network listener.


Default port overrides

By default, when you create a firewall policy rule, ISA Server listens for requests on the specified port, but accepts requests from clients on any port. For access rules and for server publishing rules, you can limit the rule to accept requests only from specified source ports.

In addition, for server publishing rules, you can specify the port that ISA Server will use to accept incoming client requests for the published server. If you select to publish on a port other than the default port, ISA Server receives client requests for the published service on the nonstandard port, and then forwards requests to the designated port on the published server. For example, a server publishing rule may specify that client requests for File Transfer Protocol (FTP) services connect through port 22 on the ISA Server computer before being redirected to the default port 21 on the published server.

Also, for server publishing rules, you can specify that the published server will accept client requests for the published service on a port other than the default port. For example, if you are publishing two FTP servers, you can publish one FTP server on the default port for one set of users, and publish the other FTP server on another nonstandard port for a different set of users.

For instructions, see Override default ports for server publishing rules.


Request forwarding

When ISA Server receives a request for a published server, it determines whether the request is allowed, and then routes the request to the published server. For Web servers, by default, ISA Server does not pass the IP address of the original requesting client to the published server. Instead, ISA Server substitutes the original IP address that is specified in the packet, with its own IP address. As a result, all requests that are routed to the published server appear to have originated from the same IP address—that of the ISA Server computer.

For server publishing rules, ISA Server passes the IP address of the original requesting client to the published server.

Some applications require actual identification by the real requesting client. When you publish these applications, you can configure ISA Server to forward requests with the IP address of the requesting (source) client.

You can configure how ISA Server passes the client's IP address. For instructions, see Configure proxy requests for a firewall policy rule.


DNS website registrations

Domain Name System (DNS) is a TCP/IP naming resolution protocol that simplifies the process of connecting to hosts in complex networks, such as the Internet. A DNS server stores information that enables client computers to translate memorable, alphanumeric DNS names to IP addresses, which computers use to communicate with each other.

For example, most users prefer a friendly name, such as example.microsoft.com, to access a computer, such as a mail server or Web server on a network. A friendly name can be easier to learn and remember. DNS provides a way to map the user-friendly name for a computer or service to its numeric IP address.

If you register a domain name for your site, users can type your site's domain name in a browser to access your website.


Host headers

By default, when ISA Server receives an incoming Web request, it determines whether the request is allowed, and then routes the request to the appropriate location on the Web server as defined in the Web publishing rule. ISA Server does not pass the host header (for example, Host: example.microsoft.com) included in the client request to the published server. Instead, ISA Server substitutes the original host header in the request with the name of the server specified in the Web publishing rule. As a result, all requests that are routed to a particular Web server are sent to the same (default) website on that Web server.

You can configure ISA Server to pass the original host header information, thereby allowing client requests to be routed to a particular site on the Web server. For example, when you are publishing more than one website on the same Web server, the original host header is required for the request to be routed to the intended website.

For instructions, see Configure name of Web server to publish.


SSL Bridging and Tunneling

Secure Sockets Layer (SSL) bridging refers to the ability of ISA Server to encrypt or decrypt client requests, and pass the request to a destination Web server. SSL tunneling refers to the establishment of a tunnel directly from the client to the Web server, with no intervention by ISA Server.

  • SSL bridging is used when ISA Server ends or initiates an SSL connection. For more information, see SSL bridging.
  • SSL tunneling is used when a client browser (from the local, Internal network) requests an object using HTTPS on port 8080 through the ISA Server computer. For more information, see SSL tunneling.

Note

  • When possible, we recommend that you configure bridging for SSL requests.


SSL bridging

When you create a secure Web publishing rule, you specify the publishing mode: tunneling or bridging. For more information, see Secure Web publishing rules.

In both modes, ISA Server 2004 can read the contents of the Hypertext Transfer Protocol (HTTP) packets as they move through the firewall. Problems occur when the remote user connects to ISA Server using Secure Sockets Layer (SSL) protected HTTP connections. SSL encrypts the HTTP application layer information and prevents the firewall from performing stateful inspection on those packets.

The ISA Server SSL-to-SSL bridging feature allows stateful inspection of SSL connections and prevents attackers from hiding exploits inside the SSL channel. ISA Server decrypts the packets, inspects them for attack code, and then re-encrypts them. The re-encrypted packets are forwarded to the secure SSL Web server on the corporate network.

For example, in a publishing (or reverse proxy) scenario, ISA Server can service a client SSL request by terminating the SSL connection from a client and reopening a new connection with a Web server.

SSL bridging is used when ISA Server ends or initiates an SSL connection. Specifically, SSL bridging works in the following scenarios:

  • A client requests an HTTP object. ISA Server encrypts the request and forwards it to the Web server. The Web server returns the encrypted object to ISA Server. Then, ISA Server decrypts the object and sends it to the client. In other words, HTTP requests are forwarded as SSL requests.
  • A client requests an SSL object. ISA Server decrypts the request, and then encrypts it again and forwards it to the Web server. The Web server returns the encrypted object to ISA Server. ISA Server decrypts the object and then encrypts it again and sends it to the client. In other words, SSL requests are forwarded as SSL requests.
  • A client requests an SSL object. ISA Server decrypts the request and forwards it to the Web server. The Web server returns the HTTP object to ISA Server. ISA Server encrypts the object and sends it to the client. In other words, SSL requests are forwarded as HTTP requests.

For incoming Web requests, an external client uses HTTPS to request an object from a Web server located on your Internal network. The client connects to ISA Server on a port—by default, port 443. In this case, ISA Server responds with a server-side SSL certificate to the client.

For this scenario, ISA Server must be configured to listen for SSL requests on port 443, and a server certificate must be specified.

Having received the client's request, ISA Server decrypts it, terminating the SSL connection. The Web publishing rules determine how ISA Server communicates the request for the object to the publishing Web server (FTP, HTTP, or SSL).

If the secure Web publishing rule is configured to forward the request using HTTPS, ISA Server initiates a new SSL connection with the publishing server, sending a request to port 443. Because the ISA Server computer is now an SSL client, it requires that the publishing Web server responds with a server-side certificate. If the Web server requires a client certificate, ISA Server must respond with the appropriate certificate.

Bridging Mode

When you select bridging, you configure the bridging mode to use for the secure Web publishing rule:

  • Secure connection to clients. When you select this mode, ISA Server establishes a secure HTTPS connection with the client, but forwards the request as standard HTTP to the published Web server.
  • Secure connection to Web server. When you select this mode, ISA Server establishes a standard HTTP connection with the client, but forwards the request as secure HTTPS to the published Web server.
  • Secure connection to client and Web server. When you select this mode, ISA Server establishes a secure HTTPS connection with the client, and also forwards the request as secure HTTPS to the published Web server.

The following figure illustrates an SSL bridging scenario.

SSL bridging

The figure illustrates a reverse publishing scenario. In this scenario, the client requests objects from ISA Server, which forwards the request to the published Web server. In the figure, the Web Proxy client (browser) connects to ISA Server. ISA Server returns a server-side certificate, authenticating itself to the client. When the client and ISA Server complete the SSL negotiation, the client sends an encrypted HTTP request to ISA Server. ISA Server decrypts the request and checks whether the requested object is in its cache.

If the object is in the cache, ISA Server returns the object to the client.

If the object is not in the cache, ISA Server encrypts the request and sends the request to the Web server. The Web server returns a server-side certificate to ISA Server. When ISA Server and the Web server complete the SSL negotiation, ISA Server sends the encrypted HTTP request to the Web server. The Web server decrypts the request and returns it to ISA Server.

ISA Server receives the object, encrypts it, and passes it to the requesting client.


SSL tunneling

When you create a secure Web publishing rule, you specify the Secure Sockets Layer (SSL) publishing mode: SSL bridging or SSL tunneling. For more information, see Secure Web publishing rules.

In tunneling mode, a client can establish a tunnel through the ISA Server computer directly to the Web server with the requested Secure Hypertext Transfer Protocol (HTTPS) object. Whenever a client browser requests an HTTPS object through ISA Server, it uses SSL tunneling.

In tunneling mode, when the connection between the client and the server is encrypted, ISA Server does not inspect the contents of the connection. No policy or filtering is applied to those contents.

The following figure illustrates the SSL tunneling process.

SSL Tunneling
  1. A client requests an SSL object from a Web server on the Internet, by typing the following in the Address bar of the Web browser:
    https://URL_name
  2. The following request is sent to port 8080 on the ISA Server computer:

    CONNECT URL_name:443 HTTP/1.1

  3. ISA Server connects to the destination Web server on port 443.
  4. When the TCP connection is established, ISA Server returns:

    HTTP/1.0 200 connection established

From that point on, the client communicates directly with the external Web server.


System Policy

This section provides general background information about the system policy defined by Internet Security and Acceleration (ISA) Server 2004.

  • System policy overview
  • System policy rules
  • System policy defaults


System policy overview

ISA Server 2004 protects your network resources, while connecting them securely for specifically defined needs. ISA Server ensures a balance between security and the need to connect. This often requires defining specific firewall policy rules. It also requires that you put in place a networking infrastructure that allows for basic functionality. Authentication, network diagnostics and logging, and remote management are examples of services you may want to enable to effectively administer and monitor network activity and security. For more information, see System policy rules.

ISA Server introduces a system policy, a set of firewall policy rules that control how the ISA Server computer enables the infrastructure necessary to manage network security and connectivity. ISA Server is installed with a default system policy, designed to address the balance between security and connectivity.

Some system policy rules are enabled upon installation. These are considered the most basic and necessary rules for effectively managing the ISA Server environment. You can subsequently identify those services and tasks that you require to manage your network, and enable the appropriate system policy rules. For more information, see System policy defaults.

Limiting system policy

After you install ISA Server, you can configure the system policy. You identify those services and tasks not critical to how you manage your network, and then disable the associated system policy rules.

In general, from a security perspective, we strongly recommend that you disable all system policy rules that you do not require to manage your network. After installation, carefully review the system policy rules configured. After you perform major administration tasks, review the system policy configuration again.

For instructions, see Enable system policy configuration group.

In addition to disabling unnecessary system policy rules, limit the applicability of the rules to required network entities only. For example, the Active Directory® system policy configuration group, enabled by default, applies to all computers on the Internal network. You could limit this to apply only to a specific Active Directory group on the Internal network.

For instructions, see Edit destinations for a system policy rule.

Note

  • Many system policy rules apply to the Local Host network. However, the Local Host network in the context of system policy rules refers to communication with the Microsoft Firewall service, and not with the ISA Server computer. There are some exceptions, for example, the Remote Management configuration group.


System policy rules

When you enable a system policy configuration group, one or more system policy rules are enabled. Upon installation, the rules apply to specific networks, as listed in the table that follows. You can subsequently modify the networks to which the rules apply.

When you disable a system policy configuration group, you are not necessarily preventing use of a particular protocol. This is because the same protocol may be specified in a different rule, which is enabled by a different configuration group.

You can show or hide the system policy rules, in the Firewall Policy details pane. For instructions, see Show system policy rules.

The following table lists the system policy scenario group, configuration group, the rule names associated with each category, and a brief description of each rule.

Scenario group | Configuration group | Rule name | Rule description
Network Services | DHCP | Allow DHCP requests from ISA Server to Internal Allow DHCP replies from DHCP servers to ISA Server | Allows the ISA Server computer to access the Internal network using the DHCP (reply) and DHCP (request) protocols.
Network Services (Name resolution using DNS) | DNS | Allow DNS from ISA Server to selected servers | Allows the ISA Server computer to access all networks using the DNS protocol.
Network Services (Time configuration) | NTP | Allow NTP from ISA Server to trusted NTP servers | Allows the ISA Server computer to access the Internal network using the NTP (UDP) protocol.
Authentication (Windows user authentication) | Active Directory | Allow access to directory services for authentication purposes Allow RPC from ISA Server to trusted servers Allow Microsoft CIFS from ISA Server to trusted servers Allow Kerberos authentication from ISA Server to trusted servers | Allows the ISA Server computer to access the Internal network using various LDAP protocols, RPC (all interfaces) protocol, various Microsoft CIFS protocols, and various Kerberos protocols, using Active Directory® directory service.
Authentication Services | RSA SecurID | Allow SecurID authentication from ISA Server to trusted servers | Allows the ISA Server computer to access the Internal network using the RSA SecurID® protocol.
Authentication Services | RADIUS | Allow RADIUS authentication from ISA Server to trusted RADIUS servers | Allows the ISA Server computer to access the Internal network using various RADIUS protocols.
Authentication Services | Certificate Revocation List | Allow HTTP from ISA Server to all networks for CRL downloads | Authentication Services: Allow HTTP from ISA Server to selected networks for downloading updated Certificate Revocation Lists (CRL)
Remote management | Microsoft Management Console | Allow remote management from selected computers using MMC Allow MS Firewall Control communication to selected computers | Allows computers on the Internal network to access the ISA Server computer using the MS Firewall Control and RPC (all interfaces) protocols.
Remote management | Terminal server | Allow remote management from selected computers using Terminal Server | Allows computers on the Internal network to access the ISA Server computer using the RDP (Terminal Services) protocol.
Remote management | ICMP (ping) | Allow ICMP (PING) requests from selected computers to ISA Server | Allows computers on the Internal network to access the ISA Server computer using the Ping protocol, and vice versa.
Firewall Client (Access to Firewall client share) | Firewall client setup | Allow access from trusted computers to the Firewall Client installation share on ISA Server | Allows computers on the Internal network to access the ISA Server computer using various Microsoft CIFS and NetBIOS protocols. When you enable this rule, access is allowed to the ISA Server computer using SMB from any network or computer specified here. In other words, access is not limited only to the Firewall Client installation shared folder.
Diagnostic Services | ICMP | Allow ICMP requests from ISA Server to selected servers | Allows the ISA Server computer to access all networks using various ICMP protocols and the Ping protocol.
Diagnostic Services | Windows networking | Allow NetBIOS from ISA Server to trusted servers | Allows the ISA Server computer to access all networks using various NetBIOS protocols.
Diagnostic Services (Microsoft Error Reporting) | Communication to Microsoft | Allow HTTP/HTTPS from ISA Server to specified Microsoft error reporting sites | Allows the ISA Server computer to access members of the Microsoft Error Reporting sites URL set using HTTP or HTTPS protocols.
Logging | Remote logging (NetBIOS) | Allow remote logging to trusted servers using NetBIOS | Allows the ISA Server computer to access the Internal network using various NetBIOS protocols.
Logging | Remote Logging (SQL) | Allow remote SQL logging from ISA Server to selected servers | Allows the ISA Server computer to use Microsoft (SQL) protocols to access the Internal network.
Remote monitoring | Remote Performance Monitoring | Allow remote performance monitoring of ISA Server from trusted servers | Allows computers on the Internal network to access the ISA Server computer using various NetBIOS protocols.
Remote monitoring | Microsoft Operations Manager | Allow remote monitoring from ISA Server to trusted servers, using Microsoft Operations Manager (MOM) Agent | Allows the ISA Server computer to access the Internal network using the Microsoft Operations Manager agent.
Remote monitoring (Mail alerts) | SMTP | Allow SMTP from ISA Server to trusted servers | Allows the ISA Server computer to access the Internal network using the SMTP protocol.
Various (Cache) | Scheduled Download Jobs | Allow HTTP from ISA Server to selected computers for Content Download Jobs | Allows the ISA Server computer to access all networks using the HTTP protocol.
Various (Access to Microsoft sites) | Allowed sites | Allow HTTP/HTTPS requests from ISA Server to specified sites | Allows the ISA Server computer to access members of the System Policy Allowed Sites URL set using HTTP and HTTPS protocols.

In addition to the rules listed in the preceding table, the system policy includes the following rules that apply to a virtual private network (VPN) configuration:

  • Allow VPN site-to-site traffic to ISA Server
  • Allow VPN site-to-site traffic from ISA Server
  • Allow VPN client traffic to ISA Server

These rules are enabled when you enable virtual private networking. For instructions, see Enable remote VPN client access.

When you create an HTTP connectivity verifier, ISA Server checks for connectivity by sending HTTP GET requests to the specified computer. A system policy rule named Allow HTTP/HTTPS from firewall to all networks, for HTTP connectivity verifiers is configured as necessary, to allow these requests.


System policy defaults

The information that follows describes the system policy default settings, upon installation. For background information about system policy, see System policy overview.

Network services

When you install ISA Server, basic network services are enabled. After installation, ISA Server can access name resolution servers and time synchronization services on the Internal network.

If the network services are available on a different network, you should modify the applicable configuration group sources to apply to the specific network. For example, suppose the DHCP server is not located on the Internal network, but on a perimeter network. Modify the source for the DHCP configuration group to apply to that perimeter network.

You can modify the system policy, so that only particular computers on the Internal network can be accessed. Alternatively, you can add additional networks, if the services are found elsewhere. For instructions, see Edit destinations for a system policy rule.

Authentication services

One of the fundamental capabilities of ISA Server is the ability to apply a firewall policy to specific users. To authenticate users, however, ISA Server must be able to communicate with the authentication servers. For this reason, by default, ISA Server can communicate with Active Directory® servers (for Windows authentication) and with RADIUS servers located on the Internal network.

Note that communication with RSA SecurID® authentication servers is not enabled by default. If your firewall policy requires RSA SecurID authentication, be sure to enable this configuration group. For more information about RSA SecurID authentication, see Authentication support for RSA SecurID.

You should consider limiting the destinations for these system policy configuration groups, so that they apply only to specific computers on the applicable network.

Remote management

By default, the system policy rules allowing remote management of ISA Server are enabled. ISA Server can be managed by running a remote Microsoft Management Console (MMC) snap-in, or by using Terminal Services.

By default, these rules apply to the built-in Remote Management Computers computer set. When you install ISA Server, this empty computer set is created. Add to this empty computer set all computers that will remotely manage ISA Server. Until you do so, remote management is effectively not available from any computer. For more information about remote management, see Remote administration.

Firewall Client

If you installed the Firewall Client Share component when you installed ISA Server, the Firewall Client Installation Share configuration group is enabled, by default. All computers on the Internal network can access the shared folder.

If you did not install the Firewall Client Share component, this configuration group is not enabled.

Diagnostic services

By default, the system policy rules allowing access to diagnostics services are enabled, with the following permissions:

  • ICMP is allowed to all networks. This service is important for determining connectivity to other computers.
  • Windows networking. This allows NetBIOS communication, by default to computers on the Internal network.
  • Microsoft error reporting. This allows HTTP access to the Microsoft Error Reporting sites URL set, to allow reporting of error information. By default, this URL set includes specific Microsoft sites.

Logging and monitoring

By default, remote logging and monitoring is disabled. The following configuration groups are disabled by default:

  • Remote Logging (NetBIOS)
  • Remote Logging (SQL)
  • Remote Performance Monitoring
  • Microsoft Operations Manager

SMTP

By default, the SMTP configuration group is enabled, allowing SMTP communication from ISA Server to computers on the Internal network. This is required, for example, when you want to send alert information in an e-mail message.

Scheduled download jobs

By default, the scheduled download jobs feature is disabled. When you create a content download job, you will be prompted to enable this system policy rule. ISA Server will be able to access the sites specified in the content download job.

Allowed sites

By default, the allowed sites configuration group is enabled, allowing ISA Server to access content on specific sites that belong to the System Policy Allowed Sites URL set. This URL set includes various Microsoft websites, by default. You can modify the URL set to include additional websites, which ISA Server will be allowed to access.


Toolbox

This section provides general background information about the Toolbox elements you can create and use when configuring rules for Internet Security and Acceleration (ISA) Server 2004.

  • Protocols
  • User sets
  • Content types
  • Schedules
  • Network objects
  • Domain name sets and URL sets
  • Web Listeners


Protocols

ISA Server includes a wide variety of preconfigured protocols, which you can use when you create access rules or server publishing rules.

You can further expand the set of protocols by using ISA Server Management to create your own. User-defined protocols can be edited or deleted. Protocols included with ISA Server cannot be modified or deleted. Protocols installed with application filters cannot be modified, although they can be deleted. However, you can configure a protocol so that an application filter does not apply to the protocol. For more information, see Application filters and protocols.

When you create a protocol, you specify the following:

  • Protocol Type. This includes TCP, UDP, ICMP, or IP-level.
  • Direction. For UDP, this includes Send, Receive, Send Receive, or Receive Send. For TCP, this includes Inbound and Outbound. For ICMP and IP-level, this includes Send and Receive.
  • Port range. (for TCP and UDP protocols) This is a range of ports between 1 and 65535 that is used for the initial connection.
  • Protocol number. (for IP-level protocols). This is the protocol number.
  • ICMP properties. (for ICMP protocol). This is the ICMP code and type.
  • (Optional) Secondary connections. This is the range of ports, protocol types, and direction used for additional connections or packets that follow the initial connection. You can configure one or more secondary connections.

Note

  • You cannot define secondary connections for IP-level primary protocols.

For instructions, see Create a protocol.

Direction

ISA Server uses protocol direction to specify whether traffic is considered outbound or inbound.

For access rules, protocol direction is usually defined as outbound. This allows traffic from the network entities specified as the rule sources (From) to the network entities specified as the rule destinations (To). Generally, this means that a client behind ISA Server is allowed to send traffic to other network objects or networks, such as the External network (Internet).

For server publishing rules, protocol definition must be defined as inbound. This allows traffic from the network entities specified as the network sources to the published service on the server.

For server publishing rules, predefined protocols are always identified with the suffix, Server. For example, DNS Server protocol allows requests for DNS services to reach the published DNS server. When you define protocols for server publishing, you are not required to add the suffix. However, you must define the protocol as inbound.

For more information, see Access rules and Server publishing rules.

Application filters and protocols

Protocol definitions with attached application filters usually do not have predefined secondary connections. The following describes the process:

  1. The client opens a primary connection to a server on the Internet.
  2. The ISA Server computer notifies the filter about the connection.
  3. The filter examines the data that is flowing through the primary connection and determines which secondary connection the client is going to use.
  4. The filter informs the ISA Server computer to allow that particular secondary connection.
  5. The ISA Server computer opens the specific port, as indicated by the application filter.

Some application filters create and install new protocols. These protocols are complex protocols, meaning that they have secondary connections. By translating the ports used by these complex protocols, the application filter enables them, allowing traffic that uses these protocols to pass. The primary connections for these protocols function, whether the application filter is enabled or not.

Other application filters filter traffic of existing protocols, either user-defined or configured by ISA Server. When these application filters are disabled, the protocols that they filter are not disabled. For example, even if you disable the Simple Mail Transfer Protocol (SMTP) filter, SMTP protocols might still be allowed to pass (unfiltered).

You can apply one or more application filters to a protocol, to control how this protocol is used. For example, the Web Proxy application filter applies to the HTTP protocol. When you disable the Web Proxy application filter, Web filters will not apply to traffic that matches this rule.

For more information, see Application Filters. For instructions, see Apply an application filter to a protocol.

RPC protocols

When you install ISA Server, an outbound remote procedure call (RPC) protocol is defined. All UUID interfaces are used for this protocol definition.

You can create access rules that allow use of this outbound RPC protocol definition. This can allow internal clients to use the RPC protocol to access external resources. For example, you can allow clients on the Internal network access to an external Exchange server. Similarly, you can create outgoing RPC protocol definitions, and use these in protocol rules, to allow internal clients access to external resources.

Outbound RPC protocols can be configured on a per-rule basis, to enforce strict RPC compliance. By default, strict compliance is enforced for RPC protocols. By enforcing strict compliance, RPC-type protocols, such as DCOM, will not be allowed through ISA Server.

When you install ISA Server, two default RPC protocol definitions are provided for incoming requests:

  • Any RPC server. If this protocol definition is allowed in a server publishing rule, ISA Server will map any inbound RPC requests to the published RPC server. If the UUID is registered on the RPC server, access to the procedure is given. If the UUID is not registered on the RPC server, the request is dropped.
  • Exchange RPC server. A list of UUID interfaces used for Exchange is defined as an RPC protocol definition. You can use this protocol definition in server publishing rules to deny or allow access to specific Exchange functions.

The RPC (any interface) protocol is defined for outgoing requests.

You can create additional RPC protocol definitions. Using the wizard, you can select UUID interfaces from a list of interfaces available on the RPC server. Or, you can define the interfaces manually. If you do not specify any interfaces for the incoming RPC protocol definition, server publishing rules that allow this protocol definition do not allow any traffic.

After you create incoming RPC protocol definitions, you can use them in a server publishing rule.

Protocol categories

In the Toolbox, protocols are categorized in functional groups. These categories were created to facilitate selection of the appropriate protocol for your specific scenario. Some protocols are listed in more than one category. All protocols are listed in the All Protocols category. Protocols that you define are listed in the User-Defined category.

Protocol category | Description
Infrastructure | This category includes protocols used for common networking infrastructural needs, such as address assignment (DHCP), Active Directory (LDAP), and name resolution (DNS).
Mail | This category includes protocols used by mail servers, such as SMTP, IMAP4, POP3, and others.
Instant Messaging | This category includes protocols required for instant messaging, including MSN Messenger, ICQ, H.323, and others.
Remote Terminal | This category includes protocols required to allow remote management, including RDP, Telnet, and others.
Streaming Media | This category includes protocols required for streaming media, including MMS, RTSP, and others.
VPN and IPSec | This category includes protocols required for VPN connections, such as IKE Client, IKE Server, L2TP, and others.
Web | This category includes protocols used to access websites, such as HTTP, HTTPS, FTP, and others. You can select protocols only from this category when creating Web publishing rules.
Authentication | This category includes protocols required for authentication, such as RADIUS, RSA SecurID, and Kerberos.
Server Protocols | This category includes server protocols, used in server publishing rules, such as RPC server, Microsoft SQL Server, FTP server, and others.


User sets

When you create firewall policy rules, you can apply them to specific Internet Protocol (IP) addresses or to users. When you apply a rule to a user, the user will have to authenticate, presenting authentication credentials, as required for the specific rule.

Often, you will want to apply rules to a group of users, to facilitate the rule configuration process.

Using ISA Server 2004, you can group users together in user sets. User sets can include one or more users from any authentication scheme (mechanism). For example, a user set might include a Windows user, a user from a RADIUS namespace, and another user from the SecurID namespace.

ISA Server comes preconfigured with the following user sets:

  • All Authenticated Users. Predefined user set representing all authenticated users. A rule defined using this set will apply to authenticated users. (Note that SecureNAT clients are not authenticated, unless they are also virtual private network (VPN) clients. In this case credentials of VPN will be used for authorization.)
  • All Users. Predefined user set representing all users. A rule defined using this set will apply to all users, both authenticated and unauthenticated.
  • System and Network Service. Predefined user set representing the Local System service and the Network service on the ISA Server computer. This user set is used in some system policy rules.

For instructions, see Create a user set.


Content types

Content types specify Multipurpose Internet Mail Extensions (MIME) types and file name extensions. When you create an access rule, you can limit the rule application to specific content types. You can be more specific when you configure security policy, because you can limit access not only to a particular destination, but also to specific content.

Content types apply only to Hypertext Transfer Protocol (HTTP) and tunneled File Transfer Protocol (FTP) traffic, which passes through ISA Server.

When a client requests FTP content, ISA Server checks the file name extension of the requested object. ISA Server determines if a rule applies to a content type that includes the requested file name extension, and processes the rule accordingly.

When a client requests HTTP content, ISA Server sends the request to the Web server. When the Web server returns the object, ISA Server checks the object's MIME type or its file name extension, depending on the header information returned by the Web server. ISA Server determines if a rule applies to a content type that includes the requested file name extension, and processes the rule accordingly.

Content types do not apply to any other protocol (for example, HTTPS and others).

When you create content types, we recommend that you specify the content's MIME type and file name extension. For example, to include all director files in a content type, select the following file name extensions and MIME types:

  • .dir
  • .dxr
  • .dcr
  • application/x-director

When you configure a content type and specify the MIME type, you can use an asterisk (*) as a wildcard character. For example, to include all application types, enter application/*. The asterisk wildcard character can be used only with MIME types (and not with file extensions). The asterisk can be specified only once, at the end of the MIME type after the slash mark (/).

For configuration instructions, see Create a content type.

ISA Server is preconfigured with the following content types: Application, Application data files, Audio, Compressed files, Documents, HTML documents, Images, Macro documents, Text, Video, and VRML.

Depending on the Web server, different MIME types are associated with different file name extensions. The following table lists the Internet Information Services (IIS) default associations.

File name extension | MIME type
.hta | application/hta
.isp | application/x-internet-signup
.crd | application/x-mscardfile
.pmc | application/x-perfmon
.spc | application/x-pkcs7-certificates
.sv4crc | application/x-sv4crc
.bin | application/octet-stream
.clp | application/x-msclip
.mny | application/x-msmoney
.p7r | application/x-pkcs7-certreqresp
.evy | application/envoy
.p7s | application/pkcs7-signature
.eps | application/postscript
.setreg | application/set-registration-initiation
.xlm | application/vnd.ms-excel
.cpio | application/x-cpio
.dvi | application/x-dvi
.p7b | application/x-pkcs7-certificates
.doc | application/msword
.dot | application/msword
.p7c | application/pkcs7-mime
.ps | application/postscript
.wps | application/vnd.ms-works
.csh | application/x-csh
.iii | application/x-iphone
.pmw | application/x-perfmon
.man | application/x-troff-man
.hdf | application/x-hdf
.mvb | application/x-msmediaview
.texi | application/x-texinfo
.setpay | application/set-payment-initiation
.stl | application/vndms-pkistl
.mdb | application/x-msaccess
.oda | application/oda
.hlp | application/winhlp
.nc | application/x-netcdf
.sh | application/x-sh
.shar | application/x-shar
.tcl | application/x-tcl
.ms | application/x-troff-ms
.ods | application/oleobject
.axs | application/olescript
.xla | application/vnd.ms-excel
.mpp | application/vnd.ms-project
.dir | application/x-director
.sit | application/x-stuffit
.* | application/octet-stream
.crl | application/pkix-crl
.ai | application/postscript
.xls | application/vnd.ms-excel
.wks | application/vnd.ms-works
.ins | application/x-internet-signup
.pub | application/x-mspublisher
.wri | application/x-mswrite
.spl | application/futuresplash
.hqx | application/mac-binhex40
.p10 | application/pkcs10
.xlc | application/vnd.ms-excel
.xlt | application/vnd.ms-excel
.dxr | application/x-director
.js | application/x-javascript
.m13 | application/x-msmediaview
.trm | application/x-msterminal
.pml | application/x-perfmon
.me | application/x-troff-me
.wcm | application/vnd.ms-works
.latex | application/x-latex
.m14 | application/x-msmediaview
.wmf | application/x-msmetafile
.cer | application/x-x509-ca-cert
.zip | application/x-zip-compressed
.p12 | application/x-pkcs12
.pfx | application/x-pkcs12
.der | application/x-x509-ca-cert
.pdf | application/pdf
.xlw | application/vnd.ms-excel
.texinfo | application/x-texinfo
.p7m | application/pkcs7-mime
.pps | application/vnd.ms-powerpoint
.dcr | application/x-director
.gtar | application/x-gtar
.sct | text/scriptlet
.fif | application/fractals
.exe | application/octet-stream
.ppt | application/vnd.ms-powerpoint
.sst | application/vndms-pkicertstore
.pko | application/vndms-pkipko
.scd | application/x-msschedule
.tar | application/x-tar
.roff | application/x-troff
.t | application/x-troff
.prf | application/pics-rules
.rtf | application/rtf
.pot | application/vnd.ms-powerpoint
.wdb | application/vnd.ms-works
.bcpio | application/x-bcpio
.dll | application/x-msdownload
.pma | application/x-perfmon
.pmr | application/x-perfmon
.tr | application/x-troff
.src | application/x-wais-source
.acx | application/internet-property-stream
.cat | application/vndms-pkiseccat
.cdf | application/x-cdf
.tgz | application/x-compressed
.sv4cpio | application/x-sv4cpio
.tex | application/x-tex
.ustar | application/x-ustar
.crt | application/x-x509-ca-cert
.ra | audio/x-pn-realaudio
.mid | audio/mid
.au | audio/basic
.snd | audio/basic
.wav | audio/wav
.aifc | audio/aiff
.m3u | audio/x-mpegurl
.ram | audio/x-pn-realaudio
.aiff | audio/aiff
.rmi | audio/mid
.aif | audio/x-aiff
.mp3 | audio/mpeg
.gz | application/x-gzip
.z | application/x-compress
.tsv | text/tab-separated-values
.xml | text/xml
.323 | text/h323
.htt | text/webviewhtml
.stm | text/html
.html | text/html
.xsl | text/xml
.htm | text/html
.cod | image/cis-cod
.ief | image/ief
.pbm | image/x-portable-bitmap
.tiff | image/tiff
.ppm | image/x-portable-pixmap
.rgb | image/x-rgb
.dib | image/bmp
.jpeg | image/jpeg
.cmx | image/x-cmx
.pnm | image/x-portable-anymap
.jpe | image/jpeg
.jfif | image/pjpeg
.tif | image/tiff
.jpg | image/jpeg
.xbm | image/x-xbitmap
.ras | image/x-cmu-raster
.gif | image/gif


Schedules

When you create rules, you can apply a schedule to the rule to determine when it is in effect.

ISA Server 2004 is preconfigured with the following two schedules:

  • Weekends. Permits access at all times on Saturday and Sunday.
  • Work Hours. Permits access between 09:00 (9:00 A.M.) and 17:00 (5:00 P.M.) on Monday through Friday.

For instructions, see Create a schedule.


Network objects

When you create a rule, you specify the source and destination for which the rule is applied. The source and destination are always a network object. To provide you greater flexibility, you can categorize computers into different types of network objects:

  • Networks. A network is a range of IP addresses. For more information about networks, see Network and network set configuration.
  • Network sets. A network set includes one or more networks.
  • Computer. A computer represents a single IP address.
  • Address ranges, subnets, and computer sets. Address ranges and subnets represent a range of IP addresses.
  • Web listeners. Web listeners determine which IP addresses and ports on the specified networks will listen for Web requests. For more information, see Web listeners.

Predefined computer sets

When you install ISA Server, the following computer sets are created:

  • Anywhere. A predefined computer set of all IP address ranges.
  • Remote Management Computers. A computer set that includes computers to manage ISA Server remotely. Initially, this computer set is empty. You should configure it to include IP addresses of all computers that can manage ISA Server remotely. For more information, see Remote administration.
  • IPSec Remote Gateways. A computer set that includes IP addresses of the Internet Protocol security (IPSec) remote virtual private network (VPN) gateways, when they are configured. For more information, see Site-to-site VPN and firewall policy.


Domain name sets and URL sets

Domain name sets define one or more domain names as a single set, so that you can apply firewall policy to the specified domains.

Uniform Resource Locator (URL) sets specify one or more URLs grouped together to form a set. URL sets can be used in access rules to allow or deny access to specified websites.

Rules applied to domain name sets and URL sets are enforced in accordance with domain information stored in the DNS. If the DNS is not configured correctly, rules may not be applied as expected.

Specifying domain names

When specifying the domain name, you can use an asterisk (*) to specify a set of computers. For example, to specify all computers in the microsoft.com domain, type the domain name as *.microsoft.com. Note that the asterisk can appear only at the start of the domain name, and can be specified only once in the name.

When you specify a domain name, specify the computer name using the fully qualified domain name (FQDN). For example, write computer_name.microsoft.com, and not \\computer_name.

Specifying URLs

When you create a URL set, you can specify one or more URLs in URL format. You can also specify a protocol and port, as follows:

Protocol:address/path:Port

Possible protocols are HTTP, HTTPS, and FTP. However, when ISA Server processes a rule that applies to a URL set, the protocol specified is ignored—only the host name and path are considered.

Although the URL can include a specific port number, ISA Server ignores that port number when processing the rule.

You can also specify a path. Wildcard characters can be used in the path, but only at the end. For example, www.microsoft.com/* is acceptable. However, www.microsoft.com/*/sales is not.

When ISA Server checks the URL sets configured for a rule, text after a question mark (?) is ignored. URLs with ?, which are included in a URL set, are ignored.

ISA Server processes rules that apply to URL sets only for Web traffic (for client requests for HTTP or FTP over HTTP). When a client uses any other protocol, ISA Server does not process rules that apply only to a URL set.

Predefined URL sets

ISA Server 2004 includes the following predefined URL sets:

  • Microsoft Error Reporting Sites. A predefined URL set used to allow error reporting.
  • System Policy Allowed Sites. A predefined URL set used to allow access to trusted sites for maintenance and management.

For instructions, see Create a URL set and Create a domain name set.


Web Listeners

This section provides general background information about Web listeners.

  • Web listener overview
  • Port specification


Web listener overview

When you create a Web publishing rule, you specify a Web listener to be used when applying the rule. The Web listener properties determine the following:

  • Which Internet Protocol (IP) addresses and ports on the specified networks will listen for Web requests.
  • Which authentication method will be used, when authentication is required.
  • Number of connections that are allowed.

Web listeners can be used by more than one Web publishing rule.

Web listener network (IP address) selection

The Web listener network, or networks, that you select depends on which network clients will use to connect to the published Web server. For example, if the website you are publishing allows client requests from the Internet (External network), you should select the External network for the Web listener. By selecting the External network, you are selecting the IP addresses on the ISA Server computer that are associated with the External network adapter. If you do not limit the IP addresses, all IP addresses associated with the selected network adapter will be included in the listener configuration.

Web listeners are used by a Web publishing rule. The rule specifies source network objects, in addition to specifying a Web listener. The network objects specified for the Web publishing rule must also be specified for the Web listener.

Authentication

You can create Web publishing rules, allowing or denying access to a set of computers or to a group of users. If the rule applies specifically to users, ISA Server checks the outgoing Web request properties to determine how the user will be authenticated. For example, a Web publishing rule might allow access only to specific users. ISA Server will authenticate the user requesting the object, to determine if the Web publishing rule allows the requesting user access. The user must authenticate, using one of the authentication methods specified for the incoming Web requests.

ISA Server provides a secure, encrypted logon environment for browsers that support Microsoft® Windows NT® Challenge/Response authentication, and for other browsers that use Basic authentication. Authentication methods can be set for all IP addresses on the server, or separately for each IP address.

For more information, see Authentication.

Limiting concurrent connections

By limiting the number of connections allowed simultaneously to the ISA Server computer, you can prevent attacks that overwhelm the system's resources. This is particularly useful when publishing servers. You can limit the number of computers that connect, while allowing for specific clients to continue connecting, even when the limit is surpassed.

For instructions, see Configure maximum number of concurrent connections allowed to a published Web server.


Port specification

By default, ISA Server listens on port 80 for Hypertext Transfer Protocol (HTTP) requests. If, however, connecting clients are expected to use a different port, you should change the port number accordingly. You can also enable the Web listener to listen for Secure Sockets Layer (SSL) requests, on the default port 443. If you choose SSL, an appropriate certificate must first be installed on the ISA Server computer. You must select a server certificate to be used by the Web listener so that the ISA Server computer can authenticate itself to the client.


Custom HTML error messages

ISA Server includes a set of Hypertext Markup Language (HTML) error messages that are returned to Web browser clients, when appropriate.

ISA Server distinguishes between external and internal client requests. For internal clients, the files are named Error_number.htm. For external clients, the files are named Error_numberR.htm (where R indicates reverse).

The following table lists the error messages included with ISA Server.

File names | Description
10060.htm and 10060R.htm | The specified Web server could not be contacted.
11001.htm and 11001R.htm | The specified host could not be found.
11002.htm and 11002R.htm | The DNS name server for the specified host could not be contacted.
11004.htm and 11004R.htm | The host was not found.

You can create additional HTML error messages that are customized for your organization. You can use the default HTML error files as a basis for creating additional HTML error message pages. The files are named Default.htm for internal client errors and DefaultR.htm for external client errors, and they are located in the \ErrorHtmls folder. Error message pages are named Errorcode.htm.

You can edit the Default.htm file just as you would any HTML page:

  • Replace [ERRORNUM] with the appropriate error code.
  • Replace [ERRORTEXT] with the appropriate error message text.
  • Replace [SERVERNAME] with the name of the server that returns the HTML page.
  • Replace [VIAHEADER] with the Via header message string that the ISA Server computer receives.

You can use inline graphics in the form of .gif or .jpg files in your custom HTML error messages. However, these files must be stored in a separate, shared directory on the ISA Server computer, and fully qualified URLs must be used in the HTML error message files to point to inline graphics.


Authentication

This section provides background information about authentication support for Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Authentication Methods for Web Requests
  • Authentication Processes


Authentication Methods for Web Requests

The access policy and publishing rules of ISA Server can be configured to allow or deny a set of computers or a group of users from accessing specific servers. If the rule applies specifically to users, ISA Server checks the Web request properties for listeners to determine how the user will be authenticated.

You can configure which authentication method to use. You can configure different authentication methods for incoming Web requests and outgoing Web requests.

ISA Server supports the following authentication methods: Basic authentication, Digest authentication, Integrated Windows authentication, client certificates, and server certificates.

Caution

  • Microsoft® Internet Explorer 5 and later support all the authentication methods. Other Web browsers may support only the Basic authentication method. Be sure that the client Web browsers can use at least one of the authentication methods that you specify for the incoming Web request and outgoing Web request properties. Otherwise, the client will not be able to access the requested object.

This section provides information about authentication methods for Web requests.

  • Basic authentication
  • Digest authentication
  • Integrated Windows authentication
  • RADIUS authentication
  • Authentication support for RSA SecurID
  • Configuration for ISA Server computer to enable authentication for RSA SecurID
  • Forms-based authentication
  • SSL certificate authentication


Basic authentication

The Basic authentication method is a widely used, industry-standard method for collecting user name and password information.

The standard Hypertext Transfer Protocol (HTTP) method of authentication is Basic authentication. Basic authentication sends and receives user information as text characters that can be read. While passwords and user names are encoded, no encryption is used with Basic authentication.

Important

  • Passwords transmitted through Basic authentication are insecure and can be read during transmission. Use the Integrated Windows authentication whenever possible.

Client authentication process

The following steps outline how a client is authenticated using Basic authentication:

  1. The user is prompted to enter a Windows account user name and password, also known as credentials.
  2. ISA Server attempts to establish a connection, using the user's credentials. The clear text password is Base64-encoded before it is sent over the network.

    Important

    • Base64 encoding is not encryption. If a Base64-encoded password is intercepted over the network by a network sniffer, unauthorized users can decode and reuse the password.
  3. When ISA Server verifies that the user name and password correspond to a valid Microsoft Windows user account, a connection is established.

The advantage of Basic authentication is that it is part of the HTTP specification and is supported by most browsers. The disadvantage is that Web browsers using Basic authentication transmit passwords in an unencrypted form. By monitoring communications on your network, an attacker or malicious user can intercept and decode these passwords using publicly available tools. Therefore, Basic authentication is not recommended unless you are confident that the connection is secure, such as with a dedicated line or a Secure Sockets Layer (SSL) connection.


Digest authentication

Digest authentication offers the same features as Basic authentication but involves a different way of transmitting the authentication credentials. The authentication credentials pass through a one-way process, often referred to as "hashing." The result of this process is called a hash or message digest, and it is not feasible to decrypt it—the original text cannot be deciphered from the hash.

Additional information is added to the password before hashing so that no one can capture the password hash and use it to impersonate the true user. Values are added that help to identify the user, the user's computer, and the domain that the user belongs to. A time stamp is added to prevent a user from using a password after it has been revoked. This is a clear advantage over Basic authentication because the password cannot be intercepted and used by an unauthorized person.

Digest authentication relies on the HTTP 1.1 protocol as defined in the RFC 2617 specification at the World Wide Web Consortium (W3C) website. Because Digest authentication requires HTTP 1.1 compliance, not all browsers support it. If a non-HTTP 1.1 compliant browser requests a file when Digest authentication is enabled, the request will be rejected because Digest authentication is not supported by the client.

Digest authentication can be used only in Windows domains.

Important

  • Digest authentication completes only if the domain controller has a reversibly encrypted (clear text) copy of the requesting user's password stored in Active Directory. To allow passwords to be stored in clear text, you need to activate the Store password using reversible encryption setting on the Account tab of the user in Active Directory. Alternatively, you can set a Group Policy to enable this capability. After making this setting, you need to set a new password to activate this feature because the old password cannot be determined.
    This is not required when WDigest authentication is used.

WDigest

WDigest is a new version of Digest authentication, also supported by ISA Server. Unlike regular Digest authentication, WDigest does not require that passwords be stored in reversible encryption. WDigest is supported only for ISA Server computers running on Windows Server 2003.

With WDigest, user name and domain name are case-sensitive. That is, users must type their user name (and domain name) exactly as it is written in Active Directory. This differs from Digest, Basic, and Integrated Windows authentication, where only the password is case-sensitive.

When both ISA Server and the domain are based on Windows Server 2003, then the default authentication is WDigest. This means that when you select Digest authentication in a Windows Server 2003 environment, you are actually selecting WDigest.

Digest authentication works with Windows 2000 and Windows Server 2003 domain accounts only, and may require the accounts to store passwords as encrypted clear text.

Client authentication process

The following steps outline how a client is authenticated using Digest authentication:

  1. The client makes a request.
  2. ISA Server denies the request and asks the client for authentication information.
  3. The domain controller informs ISA Server of the authentication results.
  4. If the client is authenticated, ISA Server checks the firewall policy, to determine whether the object should be obtained, as appropriate.


Integrated Windows authentication

Integrated Windows authentication represents NTLM, Kerberos, and Negotiate authentication mechanisms. Integrated Windows authentication is a secure form of authentication because the user name and password are hashed before being sent across the network. When you enable Integrated Windows authentication, the user's browser proves its knowledge of the password through a cryptographic exchange with your Web server, involving hashing. Integrated Windows authentication is the default authentication method used by members of the Windows 2000 and Windows Server 2003 family.

Client authentication process

The following steps outline how a client is authenticated using Integrated Windows authentication:

  1. Depending on browser configuration, Integrated Windows authentication does not initially prompt for a user name and password. The current Windows user information on the client computer is used for Integrated Windows authentication.
  2. If the authentication exchange initially fails to identify the user, the browser prompts the user for a Windows account user name and password, which it processes using Integrated Windows authentication.
  3. The Web browser continues to prompt the user until the user either enters a valid user name and password or closes the prompt dialog box.

Security considerations

Note that Integrated Windows authentication depends on an Active Directory server to validate client credentials. That is, ISA Server will communicate with the Active Directory server whenever client authentication is required. For this reason, we recommend that you create a protected network for the Active Directory and ISA Server, to prevent users (both external and internal) from accessing the communication.


RADIUS authentication

Remote Authentication Dial-In User Service (RADIUS) is an industry standard protocol described in RFC 2865, "Remote Authentication Dial-in User Service (RADIUS)." RADIUS is used to provide authentication. A RADIUS client (typically a dial-up server, virtual private network (VPN) server, or wireless access point) sends user credentials and connection parameter information in the form of a RADIUS message to a RADIUS server. The RADIUS server authenticates the RADIUS client request, and sends back a RADIUS message response.

Because RADIUS servers authorize client credentials, in addition to authenticating them, the response that ISA Server receives from the RADIUS server, indicating that the client credentials are not approved, might actually indicate that the RADIUS server does not authorize the client. Even if the credentials have been authenticated, ISA Server may reject the client request, based on the RADIUS server authorization policy.

Note

  • When RADIUS users provide credentials to ISA Server, the credentials must be passed as domain\user (and not as user@domain.

You can configure ISA Server to use specific RADIUS servers, which will be responsible for performing RADIUS user authentication.

RADIUS authentication for outgoing requests

When using Internet Authentication Service (IAS) as your RADIUS server, be sure to enable unencrypted authentication, which is Password Authentication Protocol (PAP) or Shiva Password Authentication Protocol (SPAP), in the dial-in profile of IAS remote access policy. Enabling IAS for PAP or SPAP is a per-profile IAS setting. All RADIUS clients that match the policy conditions will be able to connect to the IAS server by using PAP or SPAP.

Configuring ISA Server for RADIUS authentication

When you configure ISA Server, select RADIUS authentication as the authentication provider. When you add a RADIUS server, you must configure the following:

  • Server name. The host name or IP address of the RADIUS server.
  • Secret. The server running Routing and Remote Access and the RADIUS server share a secret that is used to encrypt messages sent between them. You must configure both the remote access server and the RADIUS server to use the same shared secret.
  • Port. The remote access server must send its authentication requests to the User Datagram Protocol (UDP) port on which the RADIUS server is listening. The default value of 1812 does not need to be changed when you are using a RADIUS server.

Note

  • When configuring ISA Server for RADIUS authentication, the configuration of RADIUS servers applies to all rules or network objects that use RADIUS authentication.

For instructions, see Configure RADIUS servers.

Security considerations

RADIUS authentication includes the following security considerations:

  • The RADIUS User-Password hiding mechanism might not provide sufficient security for passwords. The RADIUS hiding mechanism uses the RADIUS shared secret, the Request Authenticator, and the use of the MD5 hashing algorithm to encrypt the User-Password and other attributes, such as Tunnel-Password and MS-CHAP-MPPE-Keys. RFC 2865 notes the potential need for evaluating the threat environment and determining whether additional security should be used.
    You can provide additional protection for hidden attributes by using Internet Protocol security (IPSec) with Encapsulating Security Payload (ESP) and an encryption algorithm, such as Triple DES (3DES), to provide data confidentiality for the entire RADIUS message. Follow these recommended guidelines:
    1. Use IPSec to provide additional security for RADIUS clients and servers.
    2. Require the use of strong user passwords.
    3. Use authentication counting and account lockout to help prevent a dictionary attack against a user password.
    4. Use a long shared secret with a random sequence of letters, numbers, and punctuation. Change it often to help protect your IAS server .
  • When you use password-based authentication, enforce strong password policies on your network to make dictionary attacks more difficult.


Authentication support for RSA SecurID

ISA Server 2004 introduces the ability to authenticate users, based on authentication credentials from the RSA SecurID® product from RSA Security, Inc. ISA Server can secure websites requiring authentication credentials from RSA SecurID.

The SecurID product from RSA enforces a requirement that a remote user must have two factors of authentication to gain access to protected resources. These two factors are something that the user knows, (a personal identification number or PIN), and something that a user has (a physical token). Neither the PIN nor the token will grant access in isolation from each other. Both are required.

When a user attempts to access Web pages that are protected by RSA SecurID, the ISA Server computer, on behalf of the server running Internet Information Services (IIS) that it secures, checks for a cookie. This cookie will only be present if the user has authenticated recently, and is not persistent. If the user's cookie is missing, the user is prompted for a username and PASSCODE for SecurID. This challenge is rendered appropriately to the browser type. If the user is using Internet Explorer, the challenge content type will be Hypertext Markup Language (HTML). The passcode consists of a combination of the user's PIN and tokencode. The tokencode is displayed on the user's token and changes once every minute. The RSA ACE/Agent® on the ISA Server computer passes these credentials to the RSA ACE/Server® computer for validation. If the credentials are successfully validated, a cookie is delivered to the user's browser for subsequent activity during the session, and the user is granted access to the content.

For additional information about RSA ACE/Server installation and configuration and authentication concepts, see the documentation, available on the RSA website (http://www.Microsoft.com/).

Important

  • We recommend that you use Secure Sockets Layer (SSL) to encrypt the communication between the client and ISA Server.

Note

  • RSA SecurID is based on technology from RSA Security Inc.

How authentication for RSA SecurID functions

The RSA SecurID protocol uses standard HTTP messages to authenticate a client. The protocol is a variation of a request-based protocol, wherein the client sends special data attached to each request, to be allowed by the server to perform its request.

The following terminology is used:

  • RSA ACE/Server. This computer retains information about users, groups, hosts, and tokens. For each user, the RSA ACE/Server maintains a list of hosts to which the user can log on, and a logon name, which can differ from one host to the other.
  • RSA ACE/Agent. This computer provides Web content, and requires the user to provide credentials for RSA SecurID.
  • Client. Usually, this is a Web browser that receives Web content.

When a client sends a GET /x request to ISA Server, the following process occurs:

  1. The Web filter for RSA SecurID ISAPI authentication intercepts the request, and returns an RSA SecurID authentication form to the client.
  2. The client is required to fill in the form with a logon name and a passcode.
  3. The browser uses the HTTP POST method to return the form to the Web filter.
  4. The Web filter for RSA SecurID authentication communicates these details to the RSA ACE/Server, to verify that the user is allowed to access using the ISA Server computer. If the answer is positive, the Web filter returns a response which includes a Set-Cookie header to the client.
  5. The Set-Cookie header writes a cookie to the browser's memory. When the browser is closed, the cookie will be lost. The cookie contains information about the user. This information is signed with a secret known only to ISA Server. This means that the cookie cannot be modified by other users.
  6. The response contains a Refresh header, which instructs the browser to resend the original GET /x request to the server.
  7. When the Web filter receives a request with a cookie, it verifies that the cookie is valid, by checking:
    • Expiration time
    • IP address (if specified)
    • Signature (to ensure that the data was not tampered)

    If all checks pass successfully, the request is passed to any other installed Web filters on ISA Server, and then passed to ISA Server.

  8. ISA Server tries to request the object, and the object is sent back to the client.


Configuration for ISA Server computer to enable authentication for RSA SecurID

After you set up RSA ACE/Server® on your network, you must perform the following steps to set up the ISA Server configuration:

  1. Set up the ISA Server computer as an RSA ACE/Agent®. For more information, see Set up the ISA Server as an RSA ACE/Agent.
  2. For the ISA Server computer to verify the authentication credentials for RSA SecurID®, verify that the system policy rule allowing communication with RSA SecurID is enabled. Be sure that the destination specified for the configuration group includes RSA ACE/Server. (By default, the Internal network is configured as the destination.) For more information, see System policy overview and Edit destinations for a system policy rule.
  3. Test connectivity between RSA ACE/Server and the ISA Server computer. For more information, see Verify that ISA Server can authenticate against the RSA ACE/Server.

When you enable SecurID authentication on a computer running Windows Server 2003, the Network Service account must have read/write access to the following registry key: HKLM\Software\SDTI\ACECLIENT. In addition, the Network Service account must have read permission for the Sdconf.rec file, located in %SystemRoot%\system32\.

The SecurID Web filter is enabled upon installation. For more information, see Enable or disable the Web filter for RSA SecurID authentication.


Forms-based authentication

Forms-based authentication is used when publishing Outlook Web Access servers.

After the user provides credentials, the system issues a cookie, identifying the user. On subsequent requests, the system first checks the cookie to see if the user was already authenticated, so that the user does not have to supply credentials again.

The credential information is not cached on the client computer, and is valid only during the current session. This is particularly important in a scenario where users are connecting to your Outlook Web Access server from public computers, where you would not want user credentials to be cached. Users are required to reauthenticate if they close the browser, log off from a session, or navigate to another website. Also, you can configure a maximum idle session time-out, so that if a user is idle for a prolonged period of time, reauthentication is required.

We recommend HTTPS for Outlook Web Access server publishing.

Note

  • ISA Server supports forms-based authentication for Exchange Server 5.5, Exchange 2000 Server, and Exchange Server 2003.

Outlook Web Access includes optional functionality that allows a user to change his password. If a user changes his password during an Outlook Web Access session, the cookie provided after the user initially logged on will no longer be valid. When forms-based authentication is configured on ISA Server, the user who changes his password during an Outlook Web Access session will receive the logon page the next time he makes a request.

For instructions on configuring forms-based authentication for outgoing requests, see Configure authentication method for Web Proxy clients (outgoing requests). For instructions on configuring forms-based authentication for Web publishing, see Configure authentication method for a Web listener.

Exchange 2000 and forms-based authentication

Configure the user principal name (UPN) in Exchange Manager so that users can log on using both the username@domain (unqualified user name) format and the domain\username (unqualified domain name) format. Do the following:

  1. In Exchange Manager, click Servers, click Server_Name, click Protocols, click ExchangeVirtualServer, right-click Exchange, and then click Properties.
  2. On the Access tab, click Authentication.
  3. In Default Domain, type \ (backslash) to accept the user's e-mail address and domain name. In any case, the user must supply credentials as domain\username.


Digital certificates

Digital certificates are the industry standard means of providing encryption of sensitive data that is sent within or between networks. A typical example of digital certificate use is in communication between a computer on the Internet and a Web server, in which credit card or bank account and password information may be transmitted. To prevent the reading of this information as it passes through the routers that connect the Internet, the HTTPS protocol, requiring digital certificates, is used. ISA Server 2004 enables the use of digital certificates for Web publishing rules, server publishing rules, and site-to-site virtual private network (VPN) connections.

Digital certificates are issued by a certification authority (CA). A CA can be a commercial firm that provides certificates for a fee, or it can be a computer running Windows Server™ 2003 or Windows® 2000 Server in your organization on which you have installed Certificate Services.

Digital certificates require trust. Certificate trust is based on the presence of a root certificate from the CA that issued the certificate. When you install a certificate from a commercial CA, there is no need for root certificate distribution because the root certificates are installed with Windows. When you install Certificate Services on one of your organization's computers running Windows and issue your own, you must make arrangements to transfer the root certificate for your CA to any computer that you will allow connections secured with digital certificates. If there is no direct connectivity to the Certificate Services computer, information exchange can be done using a disk or CD, or by e-mail. (Be sure that your e-mail system is secure before doing so.) A CA can also be published using Internet Information Services (IIS) and Active Server Pages.

Digital certificates are used in a variety of scenarios. Using ISA Server 2004, there are two common publishing scenarios which may require digital certificate installation:

  • Publishing using Web publishing rules, including publishing Outlook® Web Access servers
  • Publishing using server publishing rules

For a detailed scenario, see "Digital Certificates for ISA Server 2004," available on the ISA Server website (http://www.microsoft.com/).

Certificate revocation

You can configure how ISA Server processes client requests when the client presents a certificate that has already been revoked and is on the Certificate Revocation List (CRL). You can configure ISA Server to deny requests from clients whose certificate is on the CRL. For instructions, see Configure client certificate validation.

Similarly, you can configure ISA Server to check if certificates from a server are on the CRL. If a server presents a certificate that is on the CRL, you can configure ISA Server to deny the request. This is relevant when ISA Server generates an SSL request for an upstream server, or to a published server. For instructions, see Configure client certificate validation.


Authentication Processes

This section describes how ISA Server processes authentication.

  • Firewall policy and authentication
  • Pass-through authentication
  • Chained authentication
  • Basic authentication delegation
  • Certificates


Firewall policy and authentication

Authentication is an integral part of any firewall policy. Although rules can be applied to IP addresses, often you will allow access only to specific users who have authenticated themselves, using specifically configured authentication mechanisms.

Authentication is significant both for incoming requests—that is, requests from a destination—and for outgoing requests.

Outgoing requests

When a Firewall client requests content that is not HTTP, ISA Server determines if any rules have been configured to apply to specific users or groups. If so, ISA Server will require that the client authenticates itself, so that ISA Server can determine if the rule applies to the client requesting the object.

For outgoing Web requests, authentication is configured for the specific network on which the user is located. After enabling Web Proxy client access, you can configure the authentication mechanisms that will be used to authenticate Web Proxy clients. For instructions, see Configure authentication methods for Web Proxy clients.

When a Web Proxy client or Firewall client requests HTTP content (or HTTPS, in publishing scenarios), if Require all users to authenticate is selected (for the network on outgoing requests, or for the listener on incoming requests), ISA Server will always ask for user credentials before checking the firewall policy.

Otherwise, ISA Server will try to determine if the first rule (of the ordered firewall policy) matches the client request. If the rule seems to match, but ISA Server requires client authentication to validate the match, ISA Server will request that the client authenticate.

Otherwise, if the rule applies to the All Users user set, or the rule applies to the IP address of the specific client, ISA Server will not request user credentials and will try to apply the firewall policy.

For Web publishing rules that deny requests and that apply to users, by default, the client will be asked to reauthenticate each time ISA Server fails to match a rule.

For Firewall clients, ISA Server requests credentials when a session is established. Then, when the Firewall client requests an object, ISA Server does not ask that the client reauthenticate, because the session already has an identity.

When you configure access rules that apply to users (and not to IP addresses), you must specify at least one authentication mechanism, so that the users making the requests can actually authenticate themselves. If you do not, all requests will be denied.

Incoming requests

When you create a Web publishing rule, a secure Web publishing rule, or mail publishing rule for Outlook Web Access, you must specify a Web listener. The Web listener indicates which network (or which IP addresses on the network) accepts the incoming requests and also indicates the acceptable authentication mechanisms. For more information on Web listeners, see Web listeners overview.

Depending on the specified authentication mechanism, clients requesting objects from the published Web server must authenticate.

Using more than one authentication mechanism

These authentication mechanisms can be used simultaneously on a Web listener: Basic, Digest, Integrated, and client certificate authentication. When selected, RADIUS, SecurID, or forms-based authentication methods must be the only authentication mechanism configured.

When HTTPS is used, client certificate authentication is preferred over any other selected authentication mechanism. Other authentication mechanisms are used only if the client fails to authenticate with a client certificate.


Pass-through authentication

Pass-through authentication refers to the ability of ISA Server to pass a client's authentication information to the destination server. ISA Server supports pass-through authentication for both outgoing and incoming Web requests.

The figure illustrates an example of a pass-through authentication scenario for publishing.

Pass-through authentication

The client sends a Get request for an object on a Web server to ISA Server. ISA Server passes the request to the Web server. From there, the pass-through authentication works as follows:

  1. The Web server receives the Get request, and responds that authentication is required (401 error). The Web server also indicates the types of authentication that it supports.
  2. ISA Server passes the Authentication Required response to the client.
  3. The client returns authentication information to ISA Server.
  4. ISA Server passes the client authentication information to the Web server.
  5. After successful authentication, the client communicates directly with the Web server.


Chained authentication

Chained authentication refers to the authentication that ISA Server provides when it routes requests to an upstream server. Requests are chained to an upstream server when ISA Server Web chaining rules are configured to route to an upstream server. Chained authentication is supported only when chaining to an upstream server running ISA Server. You can configure ISA Server so that client requests are routed to an upstream server by creating Web chaining rules.

When the upstream server requires credentials (but the downstream ISA Server does not), ISA Server passes the client's credentials to the upstream server.

When both (the downstream) ISA Server and the upstream server require authentication, then the client authenticates itself to (the downstream) ISA Server. When the request is routed, the client is asked to reauthenticate to the upstream server. This is true except in scenarios where Basic authentication credentials are requested, and you use Basic authentication delegation. In this case, (the downstream) ISA Server passes the credentials to the upstream server. For more information, see Basic authentication delegation.

Sometimes, the upstream server might not be able to identify the clients requesting the object. In this case:

  • If the Web chaining rule specifies to use an account when connecting to the upstream server, the downstream ISA Server computer passes the authentication information for that account.
  • If the Web chaining rule does not specify to use an account, the downstream ISA Server computer passes the client's authentication information to the upstream server.

For instructions about configuring firewall chaining, see Configure firewall chaining.

Client certificates

In Web publishing scenarios, the upstream server may require client certificate authentication. In this case, a certificate must be configured on the ISA Server computer, which is a valid client certificate that can be used to authenticate on behalf of the client to the upstream server.

For Web Proxy clients, client certificates are configured on Web chaining rules.

For more information about using certificates, see Certificates.


Basic authentication delegation

You can configure ISA Server so that clients using Basic authentication can authenticate to the ISA Server computer, rather than to the computer being published. Users accessing the website benefit, because they only have to sign in once, and ISA Server authenticates on behalf of the server running Internet Information Services (IIS). ISA Server performs authentication of users, identifies them, and logs their activity. ISA Server also forwards user credentials to the server running IIS, thus allowing IIS to authenticate users without requesting credentials a second time.

By using authentication delegation, the Web server to which the request is redirected will authenticate the client. Because authentication delegation is configurable on a per-rule basis, you can decide which sites require single sign-on.

Important

  • Basic authentication data is passed in plaintext from the ISA Server computer to the internal published server. To further secure this traffic, you can use Secure Sockets Layer (SSL) to encrypt traffic between the client and ISA Server.

Basic authentication delegation for Web Proxy clients is configured on the Web chaining rule. For more information, see Web chaining rules.


Certificates

When using Web publishing rules to publish a server, and Secure Sockets Layer (SSL) communication from external clients is required, a server certificate must be installed on the ISA Server computer. In addition, you may have a certificate installed on the internal Web server. The listener configured for the Web publishing rule must be configured to use the server certificate.

To install SSL certificates in a Web publishing scenario, follow these steps:

  1. Install a trusted root certificate on computers that will be SSL clients of the ISA Server computer. If you are using a certificate from a commercial certification authority (CA) that is included in the Internet Explorer database of CAs, you do not have to perform this step.
  2. Generate a certificate request for the ISA Server computer. When you specify the common name for the certificate, type the fully qualified host name or Uniform Resource Locator (URL) that external clients will type in their Web browser to access the website (for example: news.adatum.com). This would be the same name specified in the Web publishing rule's public name.
  3. Process a certificate request file.
  4. Install the certificate on the published Web server.
  5. Export the certificate to a file and copy it to the ISA Server computer.
  6. Install the certificate on the ISA Server computer.


Network Protection

This section provides background information about how to provide security and monitoring support for Internet Security and Acceleration (ISA) Server 2004.

  • Connection limits
  • IP preferences
  • Broadcast
  • Attack detection


Connection limits

ISA Server limits the number of connections at any given time. You can configure the limit, specifying a maximum number of concurrent connections. When the maximum number of connections has been reached, any new client requests for that Web listener will be denied.

You can limit the total number of UDP, ICMP, and other Raw IP connection creations allowed by a server publishing or access rule, per second. These limitations do not apply to TCP connections. When the specified number of connections is surpassed, new connections will not be created. Existing connections will not be disconnected. By default, up to 1000 new connections are allowed per rule, per second. When the specified limit is exceeded, an alert is triggered. A log entry with the following parameters is logged:

  • Action is Connection Denied
  • Result code is FWX_E_RULE_QUOTA_EXCEEDED_DROPPED

We recommend that you limit the number of connections, as this can help prevent flood attacks. When a UDP or raw IP flood attack occurs, many requests are sent from spoofed source IP addresses, eventually resulting in a denial of service.

When an alert occurs, determine whether your network is being attacked, or whether there is simply a heavy load of valid traffic. If the limit was exceeded due to malicious traffic, try the following:

  • If the malicious traffic appears to originate from the Internal network, this may indicate a virus on the Internal network. Identify the source IP address, and disconnect the computer from the network immediately.
  • If the malicious traffic appears to originate from a small range of IP addresses on an external network, then create a rule denying access to a computer set that includes the source IP addresses.
  • If the traffic appears to originate from a large range of IP addresses, then evaluate the overall status of your network. Consider setting a smaller connection limit, so that ISA Server can better protect your network.

If the limit has been exceeded due to heavy load, consider setting a higher per-rule connection limit.

In firewall chaining scenarios and in some back-to-back scenarios, specify customized connection limits for the IP addresses of the chained server or back firewall. Also, if your system publishes more than one UDP-based or raw IP-based service to the External network, you should configure smaller limits, to help keep your network secure from flood attacks.

Limiting client connections

Similarly, you can limit the total number of UDP, ICMP, and other Raw IP connections allowed per client. You can specify custom limits to apply to specific IP addresses. This is useful, for example, when you want to allow specific servers to establish more connections than allowed to other clients.

For TCP connections, no new connections are allowed after more connection limit is exceeded. For other connections (Raw IP and UDP), older connections are terminated when the connection limit is exceeded so that new connections can be created.

For instructions, see Limit the number of connections.


IP preferences

You can configure how ISA Server 2004 handles Internet Protocol (IP) packets, by configuring the following:

  • IP fragments
  • IP routing
  • IP options

IP fragments

A single IP datagram can be divided into multiple datagrams of a smaller size, known as IP fragments. These fragments can be filtered by ISA Server.

All fragmented packets are dropped when ISA Server filters packet fragments. The teardrop attack and its variants involve sending fragmented packets and then reassembling them in such a way that may cause harm to the system. The teardrop attack works a little differently from the Ping of Death attack, but with similar results. The teardrop program creates IP fragments, which are pieces of an IP packet into which an original packet can be divided as it travels through the Internet. The problem is that the offset fields on these fragments, which are supposed to indicate the portion (in bytes) of the original packet that is contained in the fragment, overlap.

For example, normally two fragments offset fields might appear as:

Fragment 1:  (offset) 100 - 300
Fragment 2:  (offset) 301 - 600

This indicates that the first fragment contains bytes 100 through 300 of the original packet, and the second fragment contains bytes 301 through 600.

Overlapping offset fields would appear something like this:

Fragment 1: (offset) 100 - 300
Fragment 2: (offset) 200 - 400

When the destination computer tries to reassemble these packets, it is unable to do so. It may fail, stop responding, or restart.

Fragment filtering can interfere with streaming audio and video. In addition, L2TP over IPSec connections may not be successfully established because packet fragmentation may take place during certificate exchange. Disable fragment filtering if you have problems with streaming media and IPSec based VPN connections.

For instructions, see Enable IP fragment filtering.

IP routing

When IP routing is disabled, ISA Server sends only the data (and not the original network packet) to the destination. Also, when disabled, ISA Server copies each packet, and then resends it through the driver in user mode.

When IP routing is enabled, ISA Server acts as a router. Some filtering is performed by the driver in user mode on the traffic passing through ISA Server.

For instructions, see Enable IP routing.

IP options

You can configure ISA Server to refuse all packets that have the flag IP Options in the header. The most problematic options are the source routing options. TCP/IP supports source routing, which is a means to permit the sender of network data to route the packets through a specific point on the network. There are two types of source routing:

  • Strict source routing. The sender of the data can specify the exact route (rarely used).
  • Loose source record route (LSRR). The sender can specify certain routers (hops) through which the packet must pass.

The source route option in the IP header allows the sender to override routing decisions that are normally made by the routers between the source and destination machines. You can use source routing to map the network or to troubleshoot routing and communications problems. Source routing can also be used to force traffic through a route providing the best performance. Unfortunately, source routing can be exploited by attackers.

For example, an intruder can use source routing to reach addresses on the Internal network that normally are not reachable from other networks, by routing the traffic through another computer that is reachable from both the other network and the Internal network.

For instructions, see Enable IP options filtering.


Broadcast

Broadcasting is the sending of a single message (datagram) to multiple recipients, using a connectionless protocol such as User Datagram Protocol (UDP). There are three types of broadcast addresses:

  • Limited broadcast address. The limited broadcast address is 255.255.255.255.
  • Network broadcast address. The network broadcast address has an IP address of all one bits and a specific network ID. For example, consider a class A network 22.0.0.0. Its network broadcast address is 22.255.255.255.
  • Subnet broadcast address. The subnet broadcast address has an IP address of all one bits and a specific subnet ID. For example, consider a class A network 22.0.0.0 with a subnet mask 255.255.0.0. The address 22.0.255.255 is a subnet broadcast.

ISA Server and broadcast

ISA Server does not allow any broadcast messages to be sent between network adapters on the ISA Server computer. ISA Server determines whether a rule applies to broadcast addresses:

  • If the destination address is not a subnet broadcast address, ISA Server considers the address as the subnet broadcast address of the network adapter on the ISA Server computer on which the packet was received.
  • If the packets are an incoming broadcast (to the Local Host network), ISA Server considers the destination as the network adapter on the ISA Server computer (Local Host).
  • If this is an outgoing broadcast (from the Local Host network), ISA Server considers the source as the network adapter on the ISA Server computer (Local Host).

For example, assume a service listens on UDP port 1500 of the Local Host network (the ISA Server computer) on the network adapter with subnet address 22.0.1.1. To allow broadcast traffic to that service from, for example, the Internal network, you must create an access rule that allows traffic on UDP port 1500 from the Internal network to the subnet broadcast address (22.0.255.255). Alternatively, you can create an access rule that allows UDP port 1500 traffic from the Internal network to the Local Host.

For instructions, see Create an access rule.


Attack detection

A common concern of any network administrator is the prevalence of attacks. Some common attacks include the following:

  • DNS cache poisoning
  • IP spoofing
  • DHCP poisoning
  • SYN flood attack

With ISA Server, you can configure predefined alerts to warn you if such an attack occurs. For more information about alerts, see Alerts.

DNS cache poisoning

DNS cache poisoning occurs when the DNS server is tricked into believing it has received authentic information. In DNS cache poisoning, an attacker corrupts your DNS server cache so that your DNS server provides incorrect answers that include IP addresses of the attacker's choice, instead of the real IP addresses. For example, assume that an attacker has used DNS cache poisoning to insert an infected website for www.microsoft.com in your DNS server. A user that attempts to access the Microsoft website to download the latest Internet Explorer patch is unknowingly redirected to the attacker's website and downloads a worm virus.

IP spoofing

An IP spoofing attack occurs when a packet is spoofed. A packet is considered spoofed when the source specified in the packet meets one of the following conditions:

  • The source IP address is not routable through the network adapter on which the packet was received.
  • The source IP address is not a member of the network (created using ISA Server) or network set associated with the network adapter on which the packet was received.
  • The source IP address is not a unicast address.

DHCP poisoning

DHCP poisoning occurs when a malicious user assigns a wrong address to a network adapter on the firewall, thus causing the IP spoof detection mechanism to work incorrectly.

SYN flood attack

A SYN flood attack occurs when an attempt is made to deny services to legitimate users by intentionally overloading a network with illegitimate TCP connection requests.

In a normal TCP connection, a computer sends a SYN packet. SYN is short for "synchronize," the first packet sent when one computer tries to connect to another using TCP. The destination computer acknowledges the connection attempt, and returns a SYN packet. Upon receipt of the SYN packet, the source computer responds with an ACK. ACK is short for "acknowledge."

In a SYN flood attack, the source computer never sends an ACK. The destination computer waits, until the connection times out and is dropped. When many such failures to send ACK packets occur, a computer is kept busy, thereby effecting a denial of service attack.

Alerts

To help you detect an attempted attack, ISA Server preconfigures and enables the following alerts:

  • Invalid DHCP offer. The DHCP offer IP address is not valid.
  • IP spoofing. The IP packet source address is not valid.
  • Oversized UDP packet. ISA Server dropped a UDP packet because it exceeded the maximum UDP packet size, as specified in the registry key.
  • SYN attack. ISA Server detected a SYN attack.

Intrusion detection

You can configure the intrusion detection filters to detect specific attacks. For more information, see Intrusion detection filters.

The following alerts are configured:

  • DNS intrusion. A host name overflow, length overflow, or zone transfer attack occurred.
  • DNS zone transfer intrusion. A zone transfer attack occurred.
  • Intrusion detected. An intrusion was attempted by an external user.
  • POP intrusion. POP buffer overflow detected.

Common attack detection

In addition, the following common attacks can be detected:

  • Windows out-of-band (WinNuke)
  • Land
  • Ping of Death
  • IP half scan
  • UDP bomb
  • Port scan

For more information about these attacks, see Intrusion detection filters.


Firewall Policy: How To

This section provides steps for configuring firewall policy.

  • Configure Access Rules
  • Configure Web Publishing Rules
  • Configure Server Publishing Rules
  • Configure Firewall Policy Rules
  • Configure Per-Rule Filtering
  • Configure System Policy
  • Configure Toolbox Elements
  • Configure Authentication
  • Configure Network Protection


Configure Access Rules

This section provides steps for configuring access rules. For instructions on configuring general firewall policy rule properties, see Configure Firewall Policy Rules.

  • Create an access rule
  • Configure destination network objects for an access rule
  • Configure protocols for an access rule
  • Configure content for an access rule
  • Allow specified source ports for an access rule


Create an access rule

To create an access rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Tasks tab, click Create New Access Rule.
  3. In the New Access Rule Wizard, follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you click Apply on the Apply Changes bar, the policy is updated. The new policy applies only to new connections.

Related Topics


Configure destination network objects for an access rule

To configure destination network objects for an access rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the To tab, click Add.
  5. In Network Entities, select the applicable network object, click Add, and then click Close.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To apply the rule to all network objects except specified network objects, click the lower Add button.

Related Topics


Configure protocols for an access rule

To configure protocols for an access rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Protocols tab, do one of the following:
    • If the rule applies to all protocols, even those not explicitly defined by ISA Server, click All Protocols.
    • If the rule applies only to protocols that you select in Protocol, click Selected protocols.
    • If the rule applies to all IP traffic except those selected, click All outbound protocols except selected.
  5. If you chose Selected protocols or All outbound protocols except selected, click Add and select one or more protocols.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure content for an access rule

To configure content for an access rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Content Types tab, do one of the following:
    • To specify that the rule applies to all content, click All content types.
    • To specify that the rule only applies to certain content, click Selected content types, and then click one or more content groups.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you specify the Selected content types option, the rule will be applied only to HTTP traffic.

Related Topics


Allow specified source ports for an access rule

To allow specified source ports for an access rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Protocols tab, click Ports.
  5. Select one of the following:
    • Click Allow traffic from any allowed source port if traffic is allowed from any port on the allowed source clients, as specified on the From page.
    • Click Limit access to traffic from this range of source ports if traffic is only allowed from ports on the allowed source clients, as specified on the From page. Then, in From and To, type the range of source ports allowed.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can only limit access from specific ports for primary connections.

Related Topics


Configure Web Publishing Rules

This section provides steps for configuring Web publishing rules. For instructions on configuring general firewall policy rule properties, see Configure Firewall Policy Rules.

  • Create a Web publishing rule
  • Create a secure Web publishing rule
  • Configure name of Web server to publish
  • Configure a public name for a Web publishing rule
  • Configure path mapping
  • Configure how to redirect HTTP requests for Web publishing rules
  • Configure a listener for a Web publishing rule
  • Replace absolute links in Web pages
  • Add a link translation dictionary entry for a Web publishing rule
  • Specify content types for link translation


Create a Web publishing rule

To create a Web publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Tasks tab, click Publish a Web Server.
  3. In the New Web Publishing Rule Wizard, follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you click Apply on the Apply Changes bar, the policy is updated. The new policy applies only to new connections.

Related Topics


Create a secure Web publishing rule

To create a secure Web publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Tasks tab, click Publish a Secure Web Server.
  3. In the SSL Web Publishing Rule Wizard, follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure name of Web server to publish

To configure name of Web server to publish

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the To tab, in Server, type the name or IP address of the computer (Web server) on which the website is located.
  5. Select Forward the original host header instead of the actual one if ISA Server should pass on the original host header information. When ISA Server passes host header information, client requests are routed to a particular site on the published computer.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure a public name for a Web publishing rule

To configure a public name for a Web publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Public Name tab, in This rule applies to, select one of the following:
    • All requests. Select this option when the rule will apply to any request for the specified Web server.
    • Requests for the following websites. Select this option when the rule will apply to specific websites on the server.
  5. If you select Requests for the following websites, click Add and specify the names of the websites that can be accessed.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • We recommend that you publish only one website per rule. This is because personal data that belongs to one website may be visible when accessing another website published using the same public name.
  • Public websites must be registered with the Domain Name System (DNS). For more information, see DNS website registrations.

Related Topics


Configure path mapping

To configure path mapping

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Paths tab, click Add.
  5. In the text box, type the path on the (published) Web server.
  6. Select one of the following:
    • Same as published folder. If the path specified in the request is identical to the path on the published Web server.
    • The following folder. If the path specified in the request will be mapped to the path that you specify in the text box. Type the path to which requests on the published Web server will be mapped.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you specify the internal path to which the request should be mapped, use this format: /mypath/*.
  • You cannot use a wildcard character in the path. For example, do not specify mypath*/ or /mypath*.
  • Avoid specifying a file name when you configure path mapping. If a file name is specified, only a request for the full path will be served.

Related Topics


Configure how to redirect HTTP requests for Web publishing rules

To configure how to redirect HTTP requests for Web publishing rules

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Bridging tab, select whether the request will be forwarded to an FTP server or to a Web server. Select one of the following:
    • FTP server. If you select this option, in the text box, type the port on the FTP server to which the request will be redirected.
    • Web server
  5. If you select Web server:
    • If HTTP requests will be passed to the Web server using the HTTP protocol, click Redirect requests to HTTP port.
    • If HTTP requests will be passed to the Web server using HTTPS, click Redirect requests to SSL port.
  6. (Optional) If you clicked Redirect requests to SSL port, click Use a certificate to authenticate to the Secure Sockets Layer (SSL) Web server and click Select to select the certificate to use.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you selected Redirect requests to SSL port, the ISA Server computer will open a new secure control channel to the published Web server.

Related Topics


Configure a listener for a Web publishing rule

To configure a listener for a Web publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Listener tab, select the applicable listener from the drop-down list. Alternatively, click New to create a new Web listener for this rule.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • For security reasons, we recommend that the Web listener configured for Outlook Web Access publishing should not be used for any other publishing scenarios.

Related Topics


Replace absolute links in Web pages

To replace absolute links in Web pages

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Tasks tab, click Edit Selected Rule.
  3. In the details pane, click the applicable Web publishing rule.
  4. On the Link Translation tab, click Replace absolute links in Web pages.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select this option, a link translation dictionary is automatically created. In most cases, you will not need to add more entries to the default dictionary.
  • ISA Server only performs link translation on HTML document strings, such as internal computer names, that are specified in UCS Transformation Format 8 (UTF-8) format.

Related Topics


Add a link translation dictionary entry for a Web publishing rule

To add a link translation dictionary entry for a Web publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Link Translation tab, click Replace absolute links in Web pages.
  5. Click Add.
  6. In Replace this text, type a string. The Link Translation Web filter searches the internal (published) website for the string.
  7. In With this text, type a string that the Link Translation Web filter will use to replace occurrences in the response page returned to the client.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Typically, the name specified in Replace this text might contain names of internal sites and servers, which are inaccessible to external clients.
  • Typically, the name specified in With this text might contain names accessible to external clients, such as fully qualified domain names of ISA Server.
  • When a client requests a range from an HTML (translatable) page, the URL is not translated. That is, the response to the client will be a range of the original server's response.
  • All entries specified in the link translation dictionary must be explicit. For example, an entry that maps http://myInternal to http://www.microsoft.com does not map http://myInternal:8080 to http://www.microsoft.com:8080.
  • Dictionaries with a large number of entries, which are applied to websites that include many links that require translation, could detrimentally impact ISA Server performance.

Related Topics


Specify content types for link translation

To specify content types for link translation

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Link Translation tab, click Replace absolute links in Web pages.
  5. Click Content Types.
  6. On the Content Types tab, in Selected content types, click one or more content types.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • By default, link translation is applied only to HTML content: text/html, text/css, and text/webviewhtml.
  • To view the MIME types and file types included in a content group, view the content group properties.

Related Topics


Configure Server Publishing Rules

This section provides steps for configuring server publishing rules. For instructions on configuring general firewall policy rule properties, see Configure Firewall Policy Rules.

  • Create a server publishing rule
  • Publish a mail server
  • Configure protocols for a server publishing rule
  • Configure network listeners for a server publishing rule
  • Override default ports for server publishing rules


Create a server publishing rule

To create a server publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the task pane, click Create New Server Publishing Rule.
  3. In the New Server Publishing Rule Wizard, follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you click Apply on the Apply Changes bar, the policy is updated. The new policy applies only to new connections.

Related Topics


Publish a mail server

To publish a mail server

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Tasks tab, click Publish a Mail Server.
  3. In the New Mail Server Publishing Rule Wizard, follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure protocols for a server publishing rule

To configure protocols for a server publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable server publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab, select the protocol (network traffic) to which the server publishing rule will be applied.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure network listeners for a server publishing rule

To configure network listeners for a server publishing rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable server publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Networks tab, select the network adapter on which ISA Server should listen for client requests.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • For the rule to work, traffic sources (network entities) specified in the From tab of the publishing rule properties must be included in a network selected as a network listener.

Related Topics


Override default ports for server publishing rules

To override default ports for server publishing rules

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab, click Ports.
  5. In Firewall ports, select one of the following:
    • Publish using the default port specified in the protocol definition. When you select this option, ISA Server will accept incoming client requests on the default port.
    • Publish on this port instead of the default port. When you select this option, ISA Server will accept incoming client requests on a port other than the default port. If an alternate port is selected, ISA Server receives client requests for the published service on the nonstandard port, and then forwards requests to the designated port on the published server.
  6. In Published server ports, select one of the following:
    • Send requests to the default port on the published server. When you select this option, ISA Server will accept requests for the published service on the default port as indicated in the protocol definition.
    • Send requests to this port on the published server. When you select this option, ISA Server will accept requests for the published service on a port other than the default port.
  7. In Source Ports, select one of the following:
    • Allow traffic from any allowed source port. When you select this option, ISA Server will accept requests from any port on allowed client computers.
    • Limit access to traffic from this range of source ports. When you select this option, ISA Server will accept requests only from the ports that you specify.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure Firewall Policy Rules

This section provides steps for configuring properties common to all firewall policy rules for Internet Security and Acceleration (ISA) Server 2004.

  • Configure an action for a firewall policy rule
  • Configure users for a firewall policy rule
  • Configure schedule for a firewall policy rule
  • Configure source network objects for a firewall policy rule
  • Configure proxy requests for a firewall policy rule
  • Configure application filtering for a firewall policy rule
  • Change order of a firewall policy rule
  • Delete a firewall policy rule
  • Disable a firewall policy rule


Configure an action for a firewall policy rule

To configure an action for a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Action tab, do one of the following:
    • To allow client access, click Allow.
    • To deny client access, click Denied.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • For access rules, if you selected to deny access to sites, you can optionally select the Redirect HTTP request to the Web page check box, and then specify an alternate URL to which client requests should be redirected. Note that:
    • The URL specified must be accessible to the clients or users. Either the URL must be on an internal computer, or a rule must explicitly allow access to the URL.
    • When you specify the destination to which to redirect the request, you can specify a different location, by typing http://URL.

Related Topics


Configure users for a firewall policy rule

To configure users for a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing or access rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Users tab, click Add.
  5. In User Sets, select the applicable user set, click Add, and then click Close.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To apply the rule to all users except specified user sets, click the lower Add button.

Related Topics


Configure schedule for a firewall policy rule

To configure schedule for a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable Web publishing or access rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Schedule tab, in Schedule, select the schedule to apply.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure source network objects for a firewall policy rule

To configure source network objects for a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the From tab, click Add.
  5. In Network Entities, select the applicable network object, click Add, and then click Close.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To apply the rule to all network objects except specified network objects, click the lower Add button.
  • For Web publishing rules, the rule applies only to specified network objects that are also included in the networks specified for the Web listeners applied to the rule. For more information, see Web listeners.

Related Topics


Configure proxy requests for a firewall policy rule

To configure proxy requests for a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the To tab, select one of the following:
    • Requests appear to come from the ISA Server computer. When this is selected, the IP address making the request will appear to be the ISA Server computer. In this way, you effectively hide the address of the client making the request.
    • Requests appear to come from the original client. When this is selected, the IP address making the request will appear to be the client. Some applications require actual identification by the real requesting client. When you publish these applications, you can configure ISA Server to forward requests with the IP address of the requesting (source) client.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select the Requests appear to come from the original client option, ISA Server must be configured as the gateway for the published Web server. Alternatively, ISA Server can be configured as the default gateway for the IP address of the original client.

Related Topics


Configure application filtering for a firewall policy rule

To configure application filtering for a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Protocols tab, click Filtering, and then select one of the following:
    • To configure HTTP filtering, click Configure HTTP.
    • To configure RPC filtering, click Configure RPC protocol. This applies for access rules only.
    • To configure FTP filtering, click Configure FTP.
    • To configure SMTP filtering, click Configure SMTP. This applies for publishing rules only.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can only configure application filtering if the rule applies to the specific protocol:
    • HTTP filtering. The rule must apply to HTTP.
    • RPC filtering. The rule must apply to an RPC protocol.
    • FTP filtering. The rule must apply to FTP.

Related Topics


Change order of a firewall policy rule

To change order of a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Move Selected Rules Up or Move Selected Rules Down.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The default firewall policy rule is always ordered last of the firewall policy rules.
  • System policy rules are processed before all firewall policy rules.

Related Topics


Delete a firewall policy rule

To delete a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable rule.
  3. On the Tasks tab, click Delete Selected Rule.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You cannot delete the default firewall policy rule (named Default Rule).

Related Topics


Disable a firewall policy rule

To disable a firewall policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Tasks tab, click Disable Selected Rules.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you disable a rule, any attempt to connect will be denied. Note, however, that ISA Server does not close active connections. You can stop active connections by disconnecting the relevant sessions.

Related Topics


Configure Per-Rule Filtering

This section provides steps for configuring per-rule filtering for firewall policy rules with Internet Security and Acceleration (ISA) Server 2004.

  • Configure FTP filtering
  • Configure HTTP Filtering
  • Configure RPC filtering


Configure FTP filtering

To configure FTP filtering

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click a server publishing rule or access rule that applies to FTP traffic.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for a server publishing rule) or on the Protocols tab (for an access rule), click Filtering, and then click Configure FTP.
  5. On the Protocol tab, select Read Only, if FTP uploads should be blocked.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure HTTP Filtering

This section provides steps for configuring Hypertext Transfer Protocol (HTTP) filtering for firewall policy rules that use HTTP.

  • Limit the maximum size of a header in HTTP requests
  • Limit request payload length
  • Limit URLs that can be specified in a request
  • Block responses containing Windows executables
  • Block specified HTTP methods
  • Block specified HTTP extensions
  • Block specified HTTP headers
  • Specify how HTTP headers are returned
  • Specify how HTTP Via headers are forwarded or returned
  • Block specified HTTP signatures


Limit the maximum size of a header in HTTP requests

To limit the maximum size of a header in HTTP requests

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the General tab, in Maximum headers length (bytes), type the maximum number of bytes that a request can have in its headers (URL and headers) before it is blocked.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • This setting is common for all rules to which the HTTP filter is applied.

Related Topics


Limit request payload length

To limit request payload length

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the General tab, verify that Allow any payload length is not selected.
  6. In Maximum payload length, type the maximum payload length allowed per request.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To allow requests, regardless of payload length, select Allow any payload length.

Related Topics


Limit URLs that can be specified in a request

To limit URLs that can be specified in a request

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the General tab, do the following:
    • In Maximum URL length (bytes), type the maximum URL length allowed. Requests with URLs exceeding this value will be blocked.
    • In Maximum query length (bytes), type the maximum length of a query allowed in a request. Requests with queries exceeding this value will be blocked.
    • Select Verify normalization to specify that URLs containing escaped characters after normalization will be blocked.
    • Select Block high bit characters to specify that URLs with high-bit characters will be blocked.

Important

  • When you select Block high bit characters, URLs that contain DBCS or Latin 1 characters will be blocked. This can impact scenarios such as Outlook® Web Access publishing, SharePoint™ Portal Server publishing, and any scenario in which a GET request passes a parameter that includes a character from a double-byte character set.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Block responses containing Windows executables

To block responses containing Windows executables

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the General tab, click Block responses containing Windows executables.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select this option, responses in which the first word of the downloaded binary file is MZ are blocked. For example, all .exe files are blocked, but .com and .pif files are not blocked.

Related Topics


Block specified HTTP methods

To block specified HTTP methods

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the Methods tab, select one of the following:
    • Allow all methods. Select this option when no methods will be blocked.
    • Allow selected methods. Select this option when requests with specific methods will be allowed.
    • Block specified methods (allow all others). Select this option when requests will be allowed except those with specified methods.
  6. If you selected Allow selected methods or Block specified methods (allow all others), click Add, and then type the HTTP method in Method.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Block specified HTTP extensions

To block specified HTTP extensions

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the Extensions tab, select one of the following:
    • Allow all extensions. Select this option when no extensions will be blocked.
    • Allow selected extensions. Select this option when requests with specific extensions will be allowed.
    • Block specified extensions (allow all others). Select this option when all requests will be allowed except those with specified extensions.
  6. If you selected Allow selected extensions or Block specified extensions (allow all others), click Add, and then type the HTTP extension in Extension.
  7. Select Block requests containing ambiguous extensions if requests whose file extension cannot be determined should also be blocked.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Block specified HTTP headers

To block specified HTTP headers

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the Headers tab, click Add.
  6. In Search in, select Request headers or Response headers.
  7. In HTTP header, type the header that will be blocked.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The length of the header is counted from the : (colon) to the last new line character (CRLF).

Related Topics


Specify how HTTP headers are returned

To specify how HTTP headers are returned

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the Headers tab, in Server Header, select one of the following:
    • Send original header. If ISA Server should return the original header in the response.
    • Strip header from response. If ISA Server should not return any header in the response.
    • Modify header in response. If ISA Server should modify the header returned in the response.
      If you select this option, in Change to, type the value that will appear in the response.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • We recommend that you select Strip header from response when publishing Web servers. We do not recommend that you select this option when publishing Windows Media® server.

Related Topics


Specify how HTTP Via headers are forwarded or returned

To specify how HTTP Via headers are forwarded or returned

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab (for Web publishing rules) or on the Protocols tab (for access rules), click Filtering, and then click Configure HTTP.
  5. On the Headers tab, in Via Header, select one of the following to configure how the Via header will be forwarded in the request or returned in the response:
    • Send default header. To use the default header.
    • Modify header in request and response. If ISA Server should replace the Via Header with a modified header. If you select this option, in Change to, type the header that will appear instead of the Via Header.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Block specified HTTP signatures

To block specified HTTP signatures

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the applicable access rule or Web publishing rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Traffic tab, click Filtering, and then click Configure HTTP.
  5. On the Signatures tab, click Add.
  6. On the Signature page, do the following:
    • In Name, type the name that you will use to identify the signatures.
    • In Search In, select Request URL, Request headers, Request body, Response headers, or Response body.
    • In Signature, type the signature string which, when found in the selected request header, request body, response header, or response body will be blocked.
    • If you selected Request body or Response body, in From and in To, type the range in the body to search.
    • If you selected Request body or Response body, in Format, select Text or Binary, to indicate the format of the search string.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you specify a signature search on a request body or a response body, for performance reasons, we recommend that you specify a small byte range (specified by From and To).
  • When you block specific signatures, you are essentially blocking applications that tunnel traffic over HTTP and can be characterized by specific patterns in request headers, request body, response headers, and response body (for example, Windows Messenger). HTTP signature blocking will not block applications that use different types of content-encoding or range requests.
  • All HTTP requests and responses must be UTF-8 encoded for text signature blocking to be performed.

Related Topics


Provides step-by-step instructions on how to Configure RPC filtering

To configure RPC filtering

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click any access rule that applies to remote procedure call (RPC) traffic.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Protocols tab (for an access rule), click Filtering, and then click Configure RPC protocol.
  5. On the Protocol tab, select Enforce strict RPC compliance, if no RPC protocols should be allowed.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you publish an RPC interface where there is a route network relationship between networks, port overriding is ignored. The publishing rule will use the original IP address or port.
  • When you disable the Enforce strict RPC compliance option, DCOM traffic and other RPC protocols will be allowed.

Related Topics


Configure System Policy

This section provides steps for configuring the system policy for Internet Security and Acceleration (ISA) Server 2004.

  • Enable system policy configuration group
  • Edit destinations for a system policy rule
  • Show system policy rules


Enable system policy configuration group

To enable system policy configuration group

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Tasks tab, click Edit System Policy.
  3. In Configuration Groups, select the applicable configuration group.
  4. On the General tab, click Enable.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Edit destinations for a system policy rule

To edit destinations for a system policy rule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Tasks tab, click Edit System Policy.
  3. In the System Policy Editor, on the From tab, click Add.
  4. In Network Entities, select a network object. Click Add, and then click Close.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To modify a destination, click a destination in the list, and then click Edit.
  • To delete a destination, click a destination in the list, and then click Remove.

Related Topics


Show system policy rules

To show system policy rules

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Tasks tab, click Show System Policy Rules.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure Toolbox elements

This section provides steps for creating and configuring Toolbox elements for Internet Security and Acceleration (ISA) Server 2004.

  • Create a content type
  • Create a protocol
  • Apply an application filter to a protocol
  • Create a schedule
  • Create a URL set
  • Create a domain name set
  • Create a user set
  • Configure Web Listeners


Create a content type

To create a content type

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Content Types.
  3. On the toolbar beneath Content Types, click Content Types, and then click New.
  4. In Name, type the name of the content type.
  5. (Optional) In Description, type a description for the content type.
  6. In Available Types, do one of the following:
    • To select an existing content type, click a file name extension or Multipurpose Internet Mail Extensions (MIME) type.
    • To add a new content type, type a new file name extension or a MIME type.
  7. Click Add.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you create content types, we recommended that you specify the content's MIME type and file name extension.
  • When you configure a content type and specify the MIME type, you can use an asterisk (*) as a wildcard character. For example, to include all application types, enter application/*. The asterisk wildcard character can be used only with MIME types (and not with file extensions). The asterisk can be specified only once, at the end of the MIME type after the slash mark (/).
  • To remove a file name extension or MIME type from the content type, in Selected types, click the file name extension or MIME type, and then click Remove.

Related Topics


Create a protocol

To create a protocol

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Protocols.
  3. On the toolbar beneath Protocols, click New, and then click Protocol.
  4. In the New Protocol Definition Wizard, follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • After you create a protocol, you can apply one or more application filters to the protocol. When you apply an application filter, that filter will perform additional filtering functionality.

Related Topics


Apply an application filter to a protocol

To apply an application filter to a protocol

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Protocols.
  3. On the toolbar beneath Protocols, select the applicable protocol, and then click Edit.
  4. On the Parameters tab, in Application Filters, select the filters to apply to the protocol.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you apply an application filter, that filter will perform additional filtering functionality.
  • When you disable an application filter that typically applies to a protocol, you disable all application filter functionality. For example, by disabling the Web Proxy filter for the HTTP protocol, you disable all caching and proxying for that protocol.

Related Topics


Create a schedule

To create a schedule

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Schedules.
  3. On the toolbar beneath Schedules, click New.
  4. In Name, type the name of the schedule.
  5. (Optional) In Description, type a description for the schedule.
  6. Use the schedule table to set the schedule.
    • Click a cell to select the specific hour on a specific day.
    • Click a day in the left column to select the entire day.
    • Click an hour in the top row to select the same hour on all days.
  7. Click Active, to enable the rule during the selected times or click Inactive to disable the selected times.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • In the table, a dark cell means the rule is in effect during that hour on that day. A white cell means the rule is not in effect.

Related Topics


Create a URL set

To create a URL set

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. On the toolbar beneath Network Objects, click New, and then click URL Set.
  4. In Name, type a name for the URL set.
  5. Click New, and then type a URL to include in the URL set.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When ISA Server checks the URL sets configured for a rule, text after a question mark (?) is ignored. URLs with ?, which are included in a URL set, are ignored.

Related Topics


Create a domain name set

To create a domain name set

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. On the toolbar beneath Network Objects, click New, and then click Domain Name Set.
  4. In Name, type a name for the domain name set.
  5. Click New, and then type a domain to include in the domain name set.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When specifying the domain name, you can use an asterisk (*) to specify a set of computers. For example, to specify all computers in the microsoft.com domain, type the domain name as *.microsoft.com. Note that the asterisk can appear only at the start of the domain name, and can be specified only once in the name.
  • When you specify a domain name, specify the computer name using the fully qualified domain name (FQDN). For example, type computer_name.microsoft.com, and not //computer_name.

Related Topics


Create a user set

To create a user set

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Users.
  3. On the toolbar beneath Users, click New.
  4. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When RADIUS or SecurID authentication is used, ISA Server compares the credentials passed by the user with the string specified on the Users tab.
    For example, if you apply the rule to a user set that includes only Domain\User and the user passes credentials as User@Domain, ISA Server will not apply this rule to the user.


Configure Web Listeners

This section provides steps for configuring Web listeners for Internet Security and Acceleration (ISA) Server 2004.

  • Create a Web listener
  • Configure a Web listener to listen for HTTP or SSL requests
  • Configure maximum number of concurrent connections allowed
  • Configure RSA SecurID
  • Configure Outlook Web Access Forms-Based Authentication


Create a Web listener

To create a Web listener

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. On the toolbar beneath Network Objects, click New, and then click Web Listener.
  4. In Name, type the name of the content type.
  5. In the New Web Listener Wizard, follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure a Web listener to listen for HTTP or SSL requests

To configure a Web listener to listen for HTTP or SSL requests

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Select the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the Preferences tab, select Enable HTTP if ISA Server should listen for HTTP requests.
    In HTTP port, type the port number on which ISA Server listens for requests.
  6. Select Enable SSL if ISA Server should listen for Secure Sockets Layer (SSL) requests.
    In SSL port, type the port number on which ISA Server listens for SSL requests.
  7. If you select Enable SSL, click Select to select a certificate to use for SSL requests.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The default HTTP port number for incoming Web requests is 80. The default port number for outgoing Web requests is 8080.
  • Most Web browsers can only use port 443 for SSL requests.

Related Topics


Configure maximum number of concurrent connections allowed

To configure maximum number of concurrent connections allowed

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Select the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the Preferences tab, select Advanced.
  6. In Advanced Settings, select one of the following:
    • Unlimited. To allow an unlimited number of clients to connect to the server at any one time.
    • Maximum. To limit the maximum number of clients that can connect to the server at any one time.
      Type the maximum number of connections.
  7. In Advanced Settings in Connection timeout, type the number of seconds before the server disconnects an inactive user.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure RSA SecurID

This section provides steps for configuring RSA SecurID authentication.

  • Configure a Web listener to use authentication for RSA SecurID
  • Enable domain cookies for authentication for RSA SecurID
  • Export a domain secret
  • Expire idle cookies after the timeout period has elapsed
  • Ignore browser IP address when validating
  • Prevent caching of protected pages
  • Enable name locking


Configure a Web listener to use authentication for RSA SecurID

To configure a Web listener to use authentication for RSA SecurID

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the Preferences tab, click Authentication.
  6. In Method, click SecurID.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select RSA SecurID authentication, no other authentication method can be selected.
  • When RSA SecurID® authentication is used, all user requests are logged with their SecurID log on name in the cs-username field of the Web Proxy log.
  • Requests from users authenticated with RSA SecurID authentication can be identified by the prefix "(SecurID)" in the Client Username field. For example, (SecurID)Eitan.

Related Topics


Enable domain cookies for authentication for RSA SecurID

To enable domain cookies for authentication for RSA SecurID

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the RSA SecurID tab, click Manage Domain Configuration.
  6. Click Enable Domain Cookies.
  7. In Domain name, type the fully qualified DNS name of the domain, for which you want the cookie to be valid.
  8. In Cookie Name, type a name for the domain's cookies (for example, mscookie).
  9. Click Manage Domain Secret to create, import, or export a domain secret.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When specifying the domain name in step 7, be sure to specify at least two levels. For example, .Microsoft.com and .sales.Microsoft.com are valid entries. However, .com is not a valid entry.
  • Cookie names can have a maximum of 30 characters. You can use any combination of letters, numbers, hyphens, and underscores. Do not use blank spaces or special characters.
  • By default, the SecurID Web filter distributes cookies that are valid only on the Web listener for which they are issued. To issue cookies that are valid on multiple publishing rules, you can enable domain cookies.
  • If you enable domain cookies, do not use shortcuts when referencing links to other servers in a WWW DNS domain. For the domain cookies to function properly, you must use the fully qualified domain name in the URLs.

Related Topics


Export a domain secret

To export a domain secret

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the RSA SecurID tab, click Manage Domain Configuration.
  6. Select Enable Domain Cookies.
  7. Click Manage Domain Secret.
  8. Click Export Domain Secret to Other Web Publishing Rules or Servers, and then click OK.
  9. Select the destination drive where removable media is located, and click Save to store the domain secret file (Domain.sdi) on the media.
  10. In Password and Confirm, type the password that protects the domain secret file.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To import a domain secret, click Import the Domain Secret to other servers or listeners.

Related Topics


Expire idle cookies after the time-out period has elapsed

To expire idle cookies after the time-out period has elapsed

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the RSA SecurID tab, select Cookies always expire after the specified time.
  6. In Expiration Time, type how many minutes must elapse before an idle cookie expires.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To expire cookies always, select Cookies expire if not used within the specified time.
  • The minimum expiration time is 1 minute. The maximum time is 1440 minutes (one day).

Related Topics


Ignore browser IP address when validating

To ignore browser IP address when validating

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the RSA SecurID tab, verify that the Ignore Browser IP Address for Cookie Validation is not selected.

Important

  • Another way to further protect cookies is by minimizing the cookie expiration time.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you enable this option, the cookie retains and signs the client's IP address, thereby guaranteeing that a user cannot use the same cookie from a different IP address.

Related Topics


Prevent caching of protected pages

To prevent caching of protected pages

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the RSA SecurID tab, select Prevent Caching of Protected Pages On Clients.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Versions of Microsoft Internet Explorer earlier than 3.01 do not support this feature, even if you set the cache size to 0. Ensure that your users do not enable the setting in their Internet Explorer Web browsers that prevents protected pages from being cached by their browsers. If users download files or attempt to run an application on files from the protected resource, the files will be downloaded to the cache on their computers. However, the files will be cleared from the cache before users can open the files. As a workaround, instruct your users to enable the setting for clearing the cache in their browsers.
  • Enabling this option will only prevent caching of protected data on the browser. It does not prevent caching of protected pages on the ISA Server computer.

Related Topics


Enable name locking

To enable name locking

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the RSA SecurID tab, click Use RSA ACE/Server 5.0 Name Locking Feature.
  6. Click Use Separate User Name and PASSCODE Pages, if ISA Server (the RSA ACE/Agent) should prompt for the user name first, and then prompt for the PASSCODE only after the user enters the user name.

Caution

  • If the server requires name locking in the Agent Host record in the RSA ACE/Server database, you must enable name locking on the Agent Host. If the server requires name locking and the Agent Host does not use the name locking feature, all authentication requests from the Agent Host will be denied. If the server does not require name locking, but it is enabled on the Agent Host, the server can process the request without using name locking.
  • A malicious user can permanently lock a user with many logon attempts.

Note

  • This feature requires RSA ACE/Server 5.0 Patch 03 to be installed on the RSA ACE/Server.

Related Topics


Configure Outlook Web Access Forms-Based Authentication

This section provides steps for configuring Outlook Web Access forms-based authentication with Internet Security and Acceleration (ISA) Server 2004.

  • Block attachments from Outlook Web Access clients
  • Configure idle session time-out for Outlook Web Access clients


Block attachments from Outlook Web Access clients

To block attachments from Outlook Web Access clients

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Select the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the Preferences tab, click Authentication.
  6. Verify that the Outlook Web Access forms-based authentication method is selected, and then click Configure.
  7. In Block e-mail attachments, do the following:
    • Select Clients on public machines, if Outlook Web Access clients will not be allowed to receive attachments on public computers.
    • Select Clients on private machines, if Outlook Web Access clients will not be allowed to receive attachments on private computers.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The settings that you configure in this procedure apply to all Web listeners that use Outlook Web Access forms-based authentication.

Related Topics


Configure idle session time-out for Outlook Web Access clients

To configure idle session time-out for Outlook Web Access clients

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Select the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the Preferences tab, click Authentication.
  6. Verify that OWA Forms-Based authentication is selected, and then click Configure.
  7. In Idle session timeout, do the following:
    • In Clients on public machines, type the amount of time that client sessions on public computers may remain idle before they time out.
    • In Clients on private machines, type the amount of time that client sessions on private computers may remain idle before they time out.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The settings you configure apply to all Web listeners that use Outlook Web Access forms-based authentication.
  • When a session reaches the time-out threshold, clients are required to log on to the session using their user credentials.

Related Topics


Configure Authentication

This section provides steps for configuring authentication.

  • Configure RADIUS servers
  • Configure authentication method for a Web listener
  • Configure authentication method for Web Proxy clients (outgoing requests)
  • Configure client certificate validation
  • Configure server certificate validation


Configure RADIUS servers

To configure RADIUS servers

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. In the details pane, click Define RADIUS Servers.
  3. On the RADIUS Servers tab, click Add.
  4. In Server Name, type the name of the RADIUS server to use for authentication.
  5. Click Change and in New secret, type the shared secret that is used for secure communications between ISA Server and the RADIUS server. You must configure the same shared secret on both ISA Server and the RADIUS server for successful RADIUS communications to occur.
  6. In Port, type the User Datagram Protocol (UDP) port that is used by the RADIUS server for incoming RADIUS authentication requests. The default value of 1812 is based on RFC 2138. For older RADIUS servers, set the port value to 1645.
  7. In Time out (seconds), type the amount of time (in seconds) that ISA Server will try to obtain responses from the RADIUS server before trying another RADIUS server.
  8. Select Always use message authenticator if a message authenticator based on the shared secret is sent with each RADIUS message.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When configuring ISA Server for RADIUS authentication, the configuration of RADIUS servers applies to all rules or network objects that use RADIUS authentication.
  • Shared secrets are used to verify that RADIUS messages, with the exception of the Access-Request message, are sent by a RADIUS-enabled device that is configured with the same shared secret.
  • Be sure to change the default preshared key on the RADIUS server.
  • Configure strong shared secrets and change them frequently to prevent dictionary attacks. Strong shared secrets are a long (more than 22 characters) sequence of random letters, numbers, and punctuation.
  • If you select Always use message authenticator, make sure that your RADIUS servers are capable of receiving, and configured to receive message authenticators.
  • For VPN clients, Extensible Authentication Protocol (EAP) messages are always sent with a message authenticator. For Web Proxy clients, only Password Authentication Protocol (PAP) is used.
  • You must select Always use message authenticator if your RADIUS server is running Internet Authentication Service (IAS), and the RADIUS client that is configured for this server has the Request must contain the Message Authenticator attribute option selected.

Related Topics


Configure authentication method for a Web listener

To configure authentication method for a Web listener

  1. In the console tree of ISA Server Management, click Firewall Policy.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. On the Toolbox tab, click Network Objects.
  3. Click Web Listeners, and then click the applicable Web listener.
  4. On the toolbar beneath Network Objects, click Edit.
  5. On the Preferences tab, click Authentication.
  6. In Method, select the applicable authentication method.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • These authentication mechanisms can be used simultaneously on a Web listener: Basic, Digest, Integrated Windows, and client certificate authentication. When selected, RADIUS, SecurID, or forms-based authentication methods must be the only authentication mechanism configured.

    • When you enable SecurID authentication on a computer running Windows Server 2003, the Network Service account must have read/write access to the following registry key: HKLM\Software\SDTI\ACECLIENT. In addition, the Network Service account must have read permission for the Sdconf.rec file, located in %SystemRoot%\system32\.

Related Topics


Configure authentication method for Web Proxy clients (outgoing requests)

To configure authentication method for Web Proxy clients (outgoing requests)

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the applicable network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Web Proxy tab, click Authentication.
  5. In Method, select the applicable authentication method.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • These authentication mechanisms can be used simultaneously on a Web listener: Basic, Digest, Integrated Windows, and client certificate authentication. When selected, RADIUS, SecurID, or forms-based authentication methods must be the only authentication mechanism configured.
  • When you enable SecurID authentication on a computer running Windows Server 2003, the Network Service account requires read/write access to the following registry key: HKLM\Software\SDTI\ACECLIENT. In addition, the Network Service account must have read permission for the Sdconf.rec file, located in %SystemRoot%\system32\.

Related Topics


Configure client certificate validation

To configure client certificate validation

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. In the details pane, click Specify Certificate Revocation.
  3. Select Verify that incoming client certificates are not revoked.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select this option, ISA Server will automatically check if incoming client certificates are in the certificate revocation list (CRL). If the certificate is in the CRL, the client request will be denied.

Related Topics


Configure server certificate validation

To configure server certificate validation

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. In the details pane, click Specify Certificate Revocation.
  3. Select Verify that incoming server certificates are not revoked in forward scenario, when ISA Server will check if server certificates from an upstream server are in the certificate revocation list (CRL).
  4. Select Verify that incoming server certificates are not revoked in reverse scenario, when ISA Server will check if server certificates from a published server are in the CRL.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select these options, if the certificate is in the CRL, the request will be denied.

Related Topics


Configure Network Protection

This section provides steps for configuring network protection features.

  • Limit the number of connections
  • Enable IP fragment filtering
  • Enable IP options filtering
  • Enable IP routing


Limit the number of connections

To limit the number of connections

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. In the details pane, click Define Connection Limits.
  3. On the Connection Limit tab, select Limit the number of connections. Then, do the following:
      In Limit the number of non-TCP connections per rule, per second, to, type the number of connections allowed per rule, per second.
    • In Limit the number of connections per client to, type the number of connections allowed per client.
  4. To override the default connection limit for specific IP addresses, in Custom connection limit, type the maximum number of connections allowed for specific users.
  5. Click Add to add computer sets to which these limits apply.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • For TCP connections, no new connections are allowed after more connection limit is exceeded. For other connections (Raw IP and UDP), older connections are terminated when the connection limit is exceeded so that new connections can be created.
  • In firewall chaining scenarios and in some back-to-back scenarios, specify customized connection limits for the IP addresses of the chained server or back firewall.

Related Topics


Enable IP fragment filtering

To enable IP fragment filtering

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. In the details pane, click Define IP preferences.
  3. On the IP Fragments tab, select Block IP fragments.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Enable IP options filtering

To enable IP options filtering

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. In the details pane, click Define IP Preferences.
  3. On the IP Options tab, select Enable IP options filtering.
  4. Select one of the following:
    • Deny all packets with any IP option
    • Deny packets with the selected IP options
    • Deny packets with all except selected IP options
  5. If you select Deny packets with the selected IP options or Deny packets with all except selected IP options, select IP options.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Enable IP routing

To enable IP routing

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. In the details pane, click Define IP Preferences.
  3. On the IP Routing tab, select Enable IP routing.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Although IP routing improves performance, disabling IP routing is considered more secure. When IP routing is disabled, ISA Server sends only the data (and not the entire packet) to the destination.

Related Topics


Virtual Private Networking

Microsoft Internet Security and Acceleration (ISA) Server 2004 supports virtual private networking for remote access clients and for site-to-site networking. Remote access clients are also known as virtual private network (VPN) clients. This section describes the VPN feature of ISA Server and provides step-by-step instructions on how to configure a VPN.

  • Security recommendations for a VPN
  • VPN: Concepts
  • VPN: How To
  • Troubleshooting VPN


Security recommendations for a VPN

It is important to follow best practices for security when using ISA Server 2004 as a virtual private network (VPN) server. The following is a list of recommendations for securing your ISA Server computer in its role as a VPN server:

  • Follow these guidelines when determining which authentication methods to enable. For more information about authentication methods, see VPN Authentication.
    • Use authentication methods that provide adequate security. The most secure method of authentication is Extensible Authentication Protocol-Transport Level Security (EAP-TLS) when used in conjunction with smart cards. Despite the deployment challenges involved in using EAP-TLS and smart cards, which require a public key infrastructure (PKI), this is considered the most secure authentication method.
    • If you use password-based authentication, enforce strong password policies on your network to make dictionary attacks more difficult.
    • You should consider requiring your remote VPN clients to be authenticated with more secure authentication protocols, such as Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2) or Extensible Authentication Protocol (EAP), rather than allowing them to use protocols such as Password Authentication Protocol (PAP), Shiva Password Authentication Protocol (SPAP), and Challenge Handshake Authentication Protocol (CHAP).
    • We strongly recommend that Password Authentication Protocol (PAP), Shiva Password Authentication Protocol (SPAP), and Challenge Handshake Authentication Protocol (CHAP) are disabled. PAP, SPAP, and CHAP are disabled by default.
    • Enable EAP-TLS, which is disabled by default on the profile of a remote access policy. When you use the EAP-TLS authentication protocol, you must install a computer certificate on the Internet Authentication Service (IAS) server. For client and user authentication, you can install a certificate on the client computer, or you can use smart cards. Before you deploy certificates, you must design the certificate with the correct requirements.
  • Layer Two Tunneling Protocol (L2TP) over Internet Protocol security (IPSec) connections are recommended for the strongest encryption.

    Notes

    • It is recommended that you implement and enforce a strong password policy, thereby reducing the chance of a dictionary attack. When you implement such a policy, you can disable account lock-out, thereby reducing the chance that an attacker will trigger account lock-out.
  • Consider requiring your remote VPN clients to run particular operating systems (such as members of the Microsoft® Windows Server™ 2003 family, Windows® 2000, and Windows XP ). Not all operating systems have equal levels of security in their file systems and in their user accounting. Also, not all remote access features are available on all operating systems.
  • Use the ISA Server Quarantine Control feature, to provide phased network access for remote VPN clients. With Quarantine Control, clients are restricted to a quarantine mode before allowed access to the network. Although Quarantine Control does not protect against attackers, computer configurations for authorized users can be verified and, if necessary, corrected before they can access the network. For more information, see VPN and Quarantine.
  • Virus infected VPN client computers are not automatically blocked from flooding the ISA Server computer or the networks it protects with requests. To prevent this occurrence, implement monitoring practices to detect anomalies such as alerts or unusual peaks in traffic loads, and configure alert notification to use e-mail messages. If an infected VPN client computer is identified, either:
    • Restrict VPN access by user name by using the Remote Access Policy (RAP) to exclude the user from the VPN clients who are allowed to connect.
    • Restrict VPN access by IP address. Do this by creating a new network to contain external IP addresses that are blocked, and move the IP address of the client out of the External network to the new network.


VPN: Concepts

This section provides information about the virtual private network (VPN) feature of Internet Security and Acceleration (ISA) Server 2004.

  • VPN overview
  • How a VPN works
  • ISA Server and Routing and Remote Access interoperability
  • Remote VPN Clients
  • Site-to-Site VPN
  • Common VPN Configuration
  • VPN connection monitoring


VPN overview

A virtual private network (VPN) is the extension of a private network that encompasses links across shared or public networks like the Internet. With a VPN, you can send data between two computers across a shared or public network in a manner that emulates a point-to-point private link. Virtual private networking is the act of creating and configuring a virtual private network.

VPN connections allow users who work at home or travel to obtain a remote access connection to an organization server, using the infrastructure provided by a public internetwork such as the Internet. From the user's perspective, the VPN is a point-to-point connection between the computer, the VPN client, and an organization server (the VPN server). The exact infrastructure of the shared or public network is irrelevant, because it appears as if the data is sent over a dedicated private link.

VPN connections also allow organizations to have routed connections with other organizations over a public internetwork such as the Internet while maintaining secure communications, for example, for offices that are geographically separate. A routed VPN connection across the Internet logically operates as a dedicated wide area network (WAN) link.

With ISA Server 2004, you can configure a secure VPN, accessible by remote access clients and by remote sites, according to your specifications. By using the ISA Server computer as the VPN server, you benefit by protecting your corporate network from malicious VPN connections. Because the VPN server is integrated into the firewall functionality, VPN users are subject to the ISA Server firewall policy. Also, by using the ISA Server computer as the VPN server, you can manage site-to-site VPN connections and VPN client access to the corporate network.

ISA Server supports two types of VPN connections:

  • Remote access VPN connection. A remote access client makes a remote access VPN connection that connects to a private network. ISA Server provides access to the entire network to which the VPN server is attached. For more information, see Remote VPN Clients.
  • Site-to-site VPN connection. A router makes a site-to-site VPN connection that connects two portions of a private network. ISA Server provides a connection to the network to which the ISA Server computer is attached. For more information, see Site-to-site VPN.

With ISA Server, each type of VPN connection is configured slightly differently. When a single remote VPN client requires access, the configuration is for that single user. In a site-to-site network configuration, an entire network of remote users must be granted access, that is, a network of VPN users is configured.

However, much VPN configuration is common to both scenarios. For example, ISA Server perceives the initial connection request from a remote site network as it would any request from a single remote VPN client. Tunneling protocols, authentication methods, access network, and address assignment for the initial connection must be configured as they would be configured for a remote access client. For information about common VPN configuration, see Common VPN Configuration.

Get latest ISA Server content at http://www.microsoft.com/isaserver/techinfo/howto/default.asp.


How a VPN works

To emulate a point-to-point link, data is encapsulated, or wrapped, with a header that provides routing information, which allows the data to traverse the shared or public network to reach its endpoint. To emulate a private link, the data is encrypted for confidentiality. Packets that are intercepted on the shared or public network are indecipherable without the encryption keys. The link in which the private data is encapsulated and encrypted is a virtual private network (VPN) connection.

The following steps describe what happens during a call from a remote VPN client (or a remote site gateway) to ISA Server 2004:

  1. A remote access client or a remote site gateway dials the ISA Server computer.
  2. ISA Server sends a challenge to the client.
  3. The client (or remote site gateway) sends an encrypted response to the server that consists of a user name, a domain name, and a password.
  4. The server checks the response against the appropriate user accounts database.
  5. If the account is valid and the authentication credentials are correct, the server uses the dial-in properties of the user account and remote access policies to authorize the connection.

Notes

  • Steps 2 and 3 assume that the remote access client and ISA Server use the MS-CHAP v1 or CHAP authentication protocols. The sending of client credentials may vary for other authentication protocols.
  • If ISA Server is a member of a domain and the user response does not contain a domain name, the domain name of the ISA Server computer is used

Security after the connection is made

Credentials used for remote access only provide a communication channel to the target network. The client does not log on to the network as a result of a remote access connection. Each time the client attempts to access a network resource, it will be challenged for credentials. If it does not respond to the challenge with acceptable credentials, the access attempt will fail.

Microsoft® Windows Server™ 2003 and Windows® XP add a feature to simplify remote access. After a successful connection, Windows Server 2003 and Windows XP remote access clients will cache these credentials as default credentials for the duration of the remote access connection. When a network resource challenges the remote access client, the client provides the cached credentials without requiring the user to enter them again.


ISA Server and Routing and Remote Access interoperability

ISA Server 2004 depends on and enhances the basic virtual private network (VPN) functionality enabled by Routing and Remote Access, available with Microsoft® Windows Server™ 2003 and Windows® 2000. While most VPN configuration is done by using ISA Server Management, you may also configure some advanced settings using Routing and Remote Access. When you do use Routing and Remote Access to configure VPN, be careful not to override specific settings that should be configured only in ISA Server. In particular, note the following:

  • If you use Routing and Remote Access to enable network address translation (NAT), some ISA Server features may not function properly.
  • Do not use Routing and Remote Access to enable or disable IP routing. ISA Server always synchronizes Routing and Remote Access settings, but Routing and Remote Access does not check how ISA Server configures this functionality. You can, however, use Routing and Remote Access to configure the routing table.
  • Any packet filters you configure using Routing and Remote Access are never applied.
  • Routing and Remote Access packet filters are not applied when ISA Server is running. It is recommended that you copy the functionality defined by the packet filters used for quarantine in Routing and Remote Access to ISA Server.
  • ISA Server overwrites any RADIUS server and RADIUS server scores specified in Routing and Remote Access.


Remote VPN Clients

This section provides information about the virtual private network (VPN) feature of Internet Security and Acceleration (ISA) Server for remote VPN clients.

  • Remote VPN client access
  • VPN client computers
  • Users for remote VPN client access
  • RADIUS authentication for remote VPN clients
  • User mapping of VPN clients
  • VPN clients and firewall policy
  • Certificates for L2TP connections
  • VPN and Quarantine


Remote VPN client access

Using ISA Server 2004, you can enable part of your workhouse to connect to the Internal network from anywhere in the world, using a local Internet connection. For example, your offices are located in New York City, and your salesperson is working in Chicago. Rather than have the salesperson call in to New York City to connect directly to your Internal network (using Routing and Remote Access), you want the salesperson to connect to the Internet locally and use a VPN connection to access the Internal network. This is the remote access VPN scenario.

With ISA Server, you can implement remote client access solutions using either the Point-to-Point Tunneling Protocol (PPTP) or the Layer Two Tunneling Protocol (L2TP). For more information about tunneling protocols, see VPN tunneling protocols.

Consider, for example, a typical network topology for roaming VPN clients, as illustrated in the figure. This picture shows three networks:

  • The Internet, where the VPN client is located.
  • The VPN gateway, which is an ISA Server computer.
  • The Internal network, which can include a DHCP server for dynamic IP address assignment and (optionally, if you are configuring L2TP tunneling protocol) a certification authority.
Remote client access

VPN clients

Remote VPN clients that connect to ISA Server can be computers running Microsoft® Windows Server™ 2003, Windows® XP, Windows 2000, Windows NT® 4.0, Windows 98, Windows 95, or Windows Millennium Edition. The client must be able to send TCP/IP packets to the remote access server over the Internet. Therefore, either a network adapter or modem with an analog telephone line or other WAN connection to the Internet is required. For more information, see VPN client computers.

Enable remote VPN client access

To enable remote VPN client access to a network protected by ISA Server, you must perform the following steps:

  1. Identify and configure user accounts allowed to connect to ISA Server as remote VPN clients. Users can be identified as RADIUS users or as Windows users. For more information, see Users for remote VPN client access.
  2. Enable VPN client access on the ISA Server computer. For instructions, see VPN clients and firewall policy.
  3. Select which VPN tunneling protocol to use when connecting to ISA Server: PPTP or L2TP. For more information, see VPN tunneling protocols.
  4. Optionally, enable Quarantine Control. You may want to quarantine each VPN client when it connects, to ensure that it complies with your security policy. VPN clients that do not comply will be allowed to connect to resources on the Internal network from which they can retrieve the software or updates needed to achieve compliance, but will not be allowed general access to corporate resources. For more information, see VPN and Quarantine.

Note

  • Some properties are configurable both in Routing and Remote Access and in ISA Server. In this case, be sure to configure these only in ISA Server. Properties unique to Routing and Remote Access can be configured using Routing and Remote Access. For more details, see ISA Server and Routing and Remote Access interoperability.


VPN client computers

Virtual private network (VPN) client computers that connect to ISA Server 2004 can be computers running Microsoft® Windows Server™ 2003, Windows® 2000, Windows XP, Windows NT® 4.0, Windows 98, Windows 95, or Windows Millennium Edition. The client must be able to send TCP/IP packets to the remote access server over the Internet. Either a network adapter, modem with an analog telephone line, or other wide area network (WAN) connection to the Internet is required.

Note

  • ISA Server does not support configuring Routing and Remote Access to allow dial-up connections.

Tunneling protocols for VPN clients

Support for tunneling protocols for Microsoft VPN clients is outlined in the following table. For more information about tunneling protocols, see VPN tunneling protocols.

VPN client | Supported tunneling protocols | Unsupported tunneling protocols
Windows Server 2003 family, Windows 2000, and Windows XP | Point-to-Point Tunneling Protocol (PPTP) and Layer Two Tunneling Protocol (L2TP) | None
Windows NT version 4.0 | PPTP | L2TP
Windows Millennium Edition and Windows 98 | PPTP | L2TP
Windows 95 with the Windows Dial-Up Networking 1.3 Performance and Security Upgrade for Windows 95 | PPTP | L2TP
Windows Millennium Edition, Windows 98, Windows NT 4.0 Workstation, and Windows 95 with Microsoft L2TP/IPSec VPN Client installed | L2TP | PPTP

Authentication methods for remote VPN clients

Support for authentication protocols by remote VPN clients is outlined in the following table. For more information about authentication methods, see VPN Authentication.

Remote VPN Client | Supported Authentication Methods | Unsupported Authentication Methods
Windows Server 2003 family, Windows XP, and Windows 2000 | Microsoft Challenge Handshake Authentication Protocol (MS-CHAP), Challenge Handshake Authentication Protocol (CHAP), Shiva Password Authentication Protocol (SPAP), Password Authentication Protocol (PAP), MS-CHAP version 2 (MS-CHAP v2), and Extensible Authentication Protocol (EAP) | None
Windows NT version 4.0 | MS-CHAP, CHAP, SPAP, PAP, and MS-CHAP v2 (with the Windows NT 4.0 Service Pack 4 and later) | EAP
Windows 98 | MS-CHAP, CHAP, SPAP, PAP, and MS-CHAP v2 (with the Windows 98 Service Pack 1 and later) | EAP
Windows 95 | MS-CHAP, CHAP, SPAP, PAP, and MS-CHAP v2 (with the Dial-Up Networking 1.4 Upgrade) | EAP

Note

  • Windows 95 with the Dial-Up Networking 1.4 Upgrade supports MS-CHAP v2 over VPN connections, but not over dial-up connections.


Users for remote VPN client access

You can create users and groups that will be allowed to use the remote virtual private network (VPN) client access feature to connect to ISA Server 2004. You can create VPN users on the domain controller computer. This computer contains the user group and user information that is necessary to authenticate remote users.

Alternatively, you can create VPN users on a RADIUS server. For more information, see RADIUS authentication for remote VPN clients.

Dial-in properties of a user account

In Microsoft® Windows Server™ 2003, the user account contains a set of dial-in properties that are used when allowing or denying a connection attempt made by a user. You can set the dial-in properties on the Dial-in tab in the user account in Local Users and Groups or Active Directory Users and Computers. You must set the Remote Access Permission (Dial-in or VPN) to Allow access or Control access through remote access policy.

For instructions, see Create users and groups for remote VPN clients and Create a dial-in account for the remote site gateway.


RADIUS authentication for remote VPN clients

ISA Server 2004 supports Remote Authentication Dial-In User Service (RADIUS) authentication for virtual private network (VPN) clients. With RADIUS authentication enabled, VPN clients authenticate to a RADIUS server, which provides centralized remote access authentication, authorization, accounting, and auditing.

Configuring ISA Server for RADIUS authentication

When you configure ISA Server, select RADIUS authentication as the authentication provider. When you add a RADIUS server, you must configure the following:

  • Server name. The host name or IP address of the Internet Authentication Service (IAS) server.
  • Secret. The server running Routing and Remote Access and the IAS server share a secret that is used to encrypt messages sent between them. You must configure both the remote access server and the IAS server to use the same shared secret.
  • Port. The remote access server must send its authentication requests to the UDP port on which the IAS server is listening. The default value of 1812 does not need to be changed when you are using an IAS server.

For instructions, see Configure RADIUS servers.

RADIUS authentication system policy rule

When you install ISA Server, a default system policy rule allowing RADIUS authentication from the ISA Server computer (Local Host network) to the Internal network is enabled. When this rule is enabled, ISA Server can validate VPN clients using RADIUS authentication. For more information about system policy rules, see System policy overview.

User mapping

If clients are running an operating system other than Windows, and these clients are connecting as remote VPN access clients, you must specify the RADIUS server to use for authentication. Using the ISA Server user mapping feature, you can map users that do not use Windows to Windows accounts. In this way, if you have created any firewall policy rules that apply to user sets, they can also be applied to VPN remote access clients that do not use Windows.

With user mapping enabled, when a RADIUS user presents credentials, the user name and domain are mapped to the same user name and domain, and the user is authenticated as if Windows credentials had been presented.

For instructions, see Enable user mapping.

Configuring ISA Server for RADIUS accounting

When you configure the properties of the server running Routing and Remote Access, select RADIUS accounting as the accounting provider.

When you add a RADIUS server, you must configure the following:

  • Server name. The host name or IP address of the IAS server.
  • Secret. The server running Routing and Remote Access and the IAS server share a secret that is used to encrypt messages sent between them. You must configure both the remote access server and the IAS server to use the same shared secret.
  • Port. The remote access server must send its accounting requests to the UDP port on which the IAS server is listening. The default value of 1813 is based on RFC 2866, "RADIUS Accounting" and does not need to be changed when using an IAS server.

For instructions, see Use RADIUS for accounting.


User mapping of VPN clients

User mapping is used to map virtual private network (VPN) clients connecting to ISA Server using an authentication method that is not based on Windows (RADIUS or EAP) to the Windows namespace. As a result, firewall policy access rules specifying user sets for Windows users and groups are also applied to authenticated users that do not use Windows. If you do not define user mapping for users from namespaces that are not based on Windows, default firewall policy access rules will not be applied to them.

To define user mapping

  1. In the VPN Client properties, on the User Mapping tab, select the Enable user mapping check box.
  2. If the user name does not include a domain name, select the When user name does not contain a domain name use this domain check box, and then type the domain name in the Domain Name text box.

Note

  • If you do not enable user mapping for users who do not use Windows, you must create a user set for these users so that firewall policy rules can be applied to them. Regardless of the authentication method (RADIUS or EAP), the user set must be defined for the RADIUS namespace.


VPN clients and firewall policy

To allow remote virtual private network (VPN) clients access by using ISA Server 2004, you must enable VPN client access. For instructions, see Enable remote VPN client access. When you enable VPN client access, ISA Server enables the appropriate network and firewall policy rule to allow the initial access.

When remote VPN clients are allowed to connect, ISA Server 2004 makes these clients members of the VPN Clients network. A default system policy rule allows these clients access to the ISA Server computer (Local Host network).

System policy rules

When you enable VPN client access, a system policy rule named Allow VPN client traffic to ISA Server is enabled. Depending which protocols you configured for remote client access, the system policy rule allows the use of Point-to-Point Tunneling Protocol (PPTP), Layer Two Tunneling Protocol (L2TP), or both, from the External network (where the VPN clients are assumed to be located) to the ISA Server computer (Local Host). This rule is modified when you configure these remote VPN client access properties:

  • VPN access network. Initially set to the External network, you can modify this property. You can specify one or more networks from which VPN clients can connect to ISA Server. When you modify this property, the system policy rule is changed automatically to apply to the additional or changed networks.
  • VPN protocol. The VPN protocol used for remote VPN client access can be PPTP, L2TP, or both. When you modify this setting, the system policy rule is updated to allow the appropriate protocol.

Network rules

A default network rule, created when you install ISA Server, defines a routing relationship between the Internal network and the VPN Clients network. Another default rule, allowing access from the VPN Clients network to the External network, is also created when you install ISA Server. You can create new network rules, to allow traffic from the VPN Clients network to other networks. For more information about network rules, see Network rules.

ISA Server acts as an Address Resolution Protocol (ARP) proxy for VPN clients. For example, when addresses assigned to the VPN Clients network are part of the Internal network segment, whether addresses are assigned from a static pool or by a DHCP server, computers from the Internal network will send ARP queries to VPN clients. ISA Server will intercept the queries and reply on behalf of the connected VPN client.

You do not have to separate the subnet for the VPN Clients network from the Internal network.

Firewall policy rules

To allow remote VPN clients access to resources on the Internal network, you must create an access rule, allowing the appropriate access. If you consider the VPN Clients network to be identical to the Internal network from a firewall policy perspective, you may also want to create an access rule allowing all traffic from the Internal network to the VPN Clients network. For more information about firewall policy, see Firewall policy rules overview.

If you enable and configure quarantine, you must create an access rule for the Quarantined VPN Clients network, allowing appropriate permissions. For more information about quarantine, see VPN and Quarantine.

When ISA Server processes rules to determine if a request from a VPN client is allowed, the VPN credentials are used.

Firewall clients and Web Proxy clients

If ISA Server is configured as a VPN server and acts as a firewall server for Firewall clients, VPN client computers with Firewall Client installed will use port 1745 of the ISA Server Internal network interface. For more information about Firewall clients, see Firewall Client.

Similarly, if ISA Server is configured as a VPN server and acts as a proxy server for Web Proxy clients, VPN client computers using the ISA Server as a proxy will use port 8080 of the ISA Server Internal network interface. For more information about Web Proxy clients, see Web Proxy clients.

By default, when you define a rule allowing access from the VPN Clients network to the Internal network, access is allowed to all ports. However, if you choose to limit the ports, you must allow access to ports 1745 (for Firewall clients) and 8080 (for Web Proxy clients).

VPN client computers configured as Firewall clients will present Firewall client credentials (logged on user) for authentication, rather than the VPN session credentials. Access rules based on VPN credentials will take effect.

Firewall clients connected to ISA Server cannot connect to another VPN server. This is because the Firewall Client application sends all traffic—including VPN traffic—by way of ISA Server. Therefore, disable the Firewall client while you connect to the VPN server. Alternatively, include all the addresses in the remote network in the network configured for the Firewall client.


Certificates for L2TP connections

If you enable remote virtual private network (VPN) clients to connect to ISA Server 2004 using the Layer Two Tunneling Protocol (L2TP), you will require a certificate.

You need a certification authority (CA) to issue Internet Protocol security (IPSec) certificates. Because the certificates are for internal use only (to be used on your servers and by your remote VPN clients), it is advisable to create a local CA. This procedure takes place on a computer running Windows in the Internal network. For a stand-alone root CA, this can be any computer running Windows in the Internal network. An enterprise root CA must be installed on a domain controller.

Because L2TP over IPSec requires IPSec certificates to be installed from a CA, you will also need to install the services that will enable computers to obtain the certificates through a Web page. If you prefer a different approach for obtaining the certificates for computers, you do not have to perform the Internet Information Services (IIS) and Active Server Pages (ASP) installations.

After you create the certificate, you must install the certificate on the ISA Server computer. Then, the certificate must be installed on the remote VPN client computer.

The directions for creating and installing certificates are detailed in the Digital Certificates for ISA Server and Published Servers scenario documentation, available on the ISA Server Guides and Articles website.


VPN and Quarantine

This section provides information about the quarantine policy features of Internet Security and Acceleration (ISA) Server 2004.

  • Quarantine Control overview
  • Quarantine Control requirements
  • How Quarantine Control works
  • Quarantine Control configuration steps
  • Firewall policy for quarantined VPN clients


Quarantine Control overview

Quarantine Control provides phased network access for remote clients, also known as virtual private network (VPN) clients, by restricting them to a quarantine mode before allowing them access to the network. After the client computer configuration is either brought into or determined to be in accordance with your organization's specific quarantine restrictions, standard VPN policy is applied to the connection, in accordance with the type of quarantine you specify. Quarantine restrictions might specify, for example, that specific antivirus software is installed and enabled while connected to your network. Although Quarantine Control does not protect against attackers, computer configurations for authorized users can be verified and, if necessary, corrected before they can access the network. A timer setting is also available, which you can use to specify an interval at which the connection is dropped, if the client fails to meet configuration requirements.

With ISA Server, you can select how to enable quarantine mode:

  • Enable quarantine mode, using RADIUS server policies. This option is available only when ISA Server is installed on a computer running a member of the Microsoft® Windows Server™ 2003 family. When you select the Quarantine according to RADIUS Server policies option, when a VPN client attempts to connect, ISA Server determines whether the client will be subject to quarantine. After the client clears quarantine, the client unconditionally joins the VPN Clients network.
  • Enable quarantine mode, using ISA Server. This option provides use of the Quarantined VPN Clients network, for which you can set firewall policy. This option does not require Routing and Remote Access functionality, and therefore is available when ISA Server is installed on a computer running Windows® 2000 Server.

You can also choose to disable quarantine mode.

For instructions, see Enable Quarantine Control.

Quarantine Control is an option available to you as a means of controlling the compliance of VPN clients with your corporate security requirements. Note that when quarantine mode is disabled, all remote VPN clients with appropriate authentication permissions are placed in the VPN Clients network, and will have the access you have allowed the VPN Clients network in your firewall policy.

Quarantine Control for ISA Server works with Routing and Remote Access to provide a means of restricting VPN client access to corporate networks. With ISA Server, you can require that a newly connected VPN client is assigned to the Quarantined VPN Clients network, with a restrictive firewall policy, until the client's Connection Manager indicates that the client is in compliance with corporate connection policy.

Quarantine Control relies on the Connection Manager (CM) profile you create for your VPN clients. CM profiles are created with the Connection Manager Administration Kit (CMAK) provided in Windows Server 2003 and Windows 2000 Server. The CM profile contains:

  • A post-connect action that runs a network policy requirements script, configured when the CM profile is created with CMAK.
  • A network policy requirements script that performs validation checks on the remote access client computer to verify that it conforms to network policies. This can be a custom executable file or a simple command file (also known as a batch file). When the script has run successfully and the connecting computer has satisfied all of the network policy requirements (as verified by the script), the script runs a notifier component (an executable) with the appropriate parameters. If the script does not run successfully, it should direct the remote access user to a quarantine resource such as an internal Web page, which describes how to install the components that are required for network policy compliance.
  • A notifier component that sends a message indicating a successful execution of the script to the quarantine-compatible ISA Server computer. You can use your own notifier component or you can use Rqc.exe, which is a sample provided with the Windows Server 2003 Resource Kit. With these components installed, the remote access client computer uses the CM profile to perform network policy requirements tests and indicate its success to the ISA Server computer as part of the connection setup.

Note

  • For VPN connections to be established using ISA Server policies, you must disable the quarantine feature in the remote access policies (RAP) that could be stored in a Remote Authentication Dial-In User Service (RADIUS) server or a Windows authentication provider. Do the following:
    1. Open Computer Management and expand the Routing and Remote Access node.
    2. Select Remote Access Policies.
    3. In the details pane, double-click each policy to open its properties, and click Edit Profile.
    4. On the Advanced tab, remove MS-Quarantine-IPFilter and MS-Quarantine-Session-Timeout from the attributes list.


Quarantine Control requirements

This section describes what you need to run ISA Server Quarantine Control.

ISA Server computer

A quarantine-compatible ISA Server computer has the following components:

  • A computer running a member of the Microsoft® Windows Server™ 2003 or Windows® 2000 Server family (necessary if you want to implement RADIUS quarantine policy rather than ISA Server policy), and ISA Server.
  • A listener component. This component listens for messages from quarantine-compatible remote access clients, which indicate that their scripts have been run successfully. You can create your own custom listener component (matched with your own custom notifier component), or you can install the Remote Access Quarantine Agent service (Rqs.exe) sample from the Windows Server 2003 Resource Kit.

If you create your own listener component, it must be designed to listen for a message from the notifier component and use the MprAdminConnectionRemoveQuarantine() (http://www.microsoft.com/) application programming interface (API) to remove the quarantine restrictions from the remote access connection. Note that the API must call Vpnplgin.dll (in the ISA Server installation directory), rather than Mprapi.dll, as shown in the API documentation. ISA Server will then chain the call to Routing and Remote Access.

With these components installed, the ISA Server computer can use quarantine mode for connecting remote access clients and listen for notifier messages, indicating that the clients have satisfied network policy requirements and can be moved from the Quarantined VPN Clients network to the VPN Clients network.

If you are using Rqc.exe and Rqs.exe, the notification message sent by Rqc.exe contains a text string that indicates the version of the quarantine script being run. This string is configured for Rqc.exe as part of its command-line parameters, as run from the quarantine script. Rqs.exe compares this text string to a set of text strings stored in the registry of the ISA Server computer. If there is a match, the quarantine conditions are removed from the connection. The ConfigureRQSForISA.vbs script, available on the ISA Server website (http://www.microsoft.com/), helps install RQS (the listener component).

Notes

  • The notification sent by Rqc.exe is not encrypted or authenticated and can be spoofed by a malicious client.
  • The RQS.exe agent should be dependent on Routing and Remote Access.

Routing and Remote Access can be configured with either the Windows or RADIUS authentication provider.

Quarantine-compatible RADIUS server (optional)

If Routing and Remote Access on the ISA Server computer is configured with the RADIUS authentication provider, a quarantine-compatible RADIUS server requires a computer running Windows Server 2003 and Internet Authentication Service (IAS), which supports the configuration of the MS-Quarantine-IPFilter and MS-Quarantine-Session-Timeout RADIUS vendor-specific attributes (VSAs). The MS-Quarantine-IPFilter attribute is for the quarantine filters. The MS-Quarantine-Session-Timeout attribute is for the quarantine session timer.

Quarantine resources

Quarantine resources consist of servers that a remote access client in quarantine mode can access to perform name resolution (such as DNS servers), obtain the latest version of the CM profile (file servers with anonymous access allowed), or access instructions and components needed to make the remote access client comply with network policies (Web servers with anonymous access allowed). Anonymous access to file and Web resources is needed, because although remote access users may have the correct credentials to create the remote access connection, they might not be using the correct domain credentials to access protected file and Web resources.


How Quarantine Control works

The following process describes how ISA Server Quarantine Control works when Rqc.exe, Rqs.exe, and ISA Server policy are used:

  1. The user on the quarantine-compatible remote access client uses the installed quarantine Connection Manager (CM) profile to connect with the quarantine-compatible ISA Server computer.
  2. The remote access client passes its authentication credentials to the ISA Server computer.
  3. The ISA Server computer validates the authentication credentials of the remote access client and, assuming that the credentials are valid, checks its remote access policies. The connection attempt matches the quarantine policy.
  4. The connection is accepted with quarantine restrictions, and the client is assigned an IP address and placed in the Quarantined VPN Clients network. At this point, the remote access client can only successfully send traffic that matches the firewall policy for the Quarantined VPN Clients network and has up to the number of seconds specified in the ISA Server quarantine properties to notify the ISA Server computer that the script has run successfully.
  5. The CM profile runs the quarantine script as the post-connect action.
  6. The quarantine script runs and verifies that the remote access client computer's configuration complies with network policy requirements. If all the tests for network policy compliance pass, the script runs Rqc.exe with its command-line parameters, one of which is a text string for the version of the quarantine script included within the CM profile.
  7. Rqc.exe sends a notification to the ISA Server computer, indicating that the script was successfully run. The notification includes the quarantine script version string.
  8. The notification is received by the listener component (Rqs.exe). The notification traffic was allowed because it matched the permitted traffic specified by the firewall policy (in the ISA Server access rule that allows communication on the RQS port 7250 from the VPN Clients and Quarantined VPN Clients networks to the Local Host network).
  9. The listener component verifies the script version string in the notification message with those configured in the registry and sends back either a message indicating that the script version was valid or a message indicating that the script version was invalid.
  10. If the script version was valid, the listener component calls the MprAdminConnectionRemoveQuarantine() API, which causes ISA Server to move the client from the Quarantined VPN Clients network to the VPN Clients network.
  11. The listener component creates an event detailing the quarantined connection in the system event log.


Quarantine Control configuration steps

This section provides information about configuring ISA Server Quarantine Control. Before you enable quarantine mode, you must complete the following steps:

  1. Create a client-side script that validates client configuration information.
  2. Create a notification component that provides verification to the ISA Server computer that the script has successfully run. If you do not want to create a notification component, you can use Rqc.exe.
    The notifier component is included in the Connection Manager (CM) profile and installed on the client computer. The notifier component sends notification to the ISA Server computer when the administrator-provided script has run successfully on the client.
  3. Create a listener component to install on ISA Server computers (that can receive information from the notification component), and then remove the client from quarantine mode, applying the full access policy. If you do not want to create a listener component, you can use the Rqs.exe sample. The listener component is installed on the ISA Server computer, and receives notification from the notifier component that the script on the client has successfully performed all configuration checks. After the listener component receives notification, it removes the client from quarantine mode, and the ISA Server computer applies standard firewall policy rules to the client.
  4. If you are using the Rqs.exe sample, run the script ConfigureRQSForISA.vbs, available on the ISA Server website (http://www.microsoft.com/). The script performs the following actions:
    1. Installs RQS as a service and sets it to run in the local system account.
    2. Creates an ISA Server access rule that allows communication on the RQS port (7250) from the VPN Clients and Quarantined VPN Clients networks to the Local Host network. This is necessary so that the ISA Server computer can receive notice that the client has met the connection requirements.
    3. Modifies registry keys on the ISA Server computer so that RQS will work with ISA Server.
    4. Starts the RQS service.
    The script has one switch (install or remove) and requires two parameters: the set of allowed RQS shared keys, and the path to RQS.exe.
    A shared key is required by the RQS service from RQC.exe before the VPN client can leave the Quarantined VPN Clients network. If the client provides a shared key that is not in the allowed set, it will be disconnected. There can be more than one shared key, separated by "\0" when providing arguments to the ConfigureRQSForISA.vbs script, available on the ISA Server website (http://www.microsoft.com/).

    Note

    • The ConfigureRQSForISA.vbs script requires that the files Reg.exe and Sc.exe be in the system path. In Microsoft® Windows Server™ 2003, these files are present by default in %windir%\system32. In Windows® 2000 Server, you must install the files to the system path before running ConfigureRQSForISA.vbs. You can obtain Reg.exe from the Windows 2000 CD under support\tools. Sc.exe is part of the Microsoft Windows 2000 Resource Kit, which you can download from the Free Tool Downloads website. (http://www.microsoft.com/)
  5. Create a CM profile with the Connection Manager Administration Kit (CMAK). For more information about CMAK, see Connection Manager Administration Kit in Windows Server 2003 Help (http://www.microsoft.com/).
  6. Distribute the CM profile for installation on remote access client computers.

Quarantine notifier and listener components

You can create your own notifier and listener components, or you can use Rqs.exe (a listener component) and Rqc.exe (a notifier component). For more information, see Windows Resource Kit Tools Help. The Remote Access Quarantine Agent service is included when Rqs.exe is installed on an ISA Server computer. When you create the CM profile, you can include the administrator-provided script and Rqc.exe, which are distributed to and installed on remote access client computers. This profile can be installed on the following client operating systems: Windows XP Professional, Windows XP Home Edition, Windows 2000 Professional, Windows Millennium Edition, and Windows 98 Second Edition.

Quarantine settings

After you complete the preliminary steps for setting up quarantine, you can configure the quarantine settings on the ISA Server computer. After you enable quarantine mode, you can configure the Quarantined VPN Clients network properties, selecting one of the following:

  • Quarantine according to RADIUS Server policies. If you enabled quarantine, this option uses the RADIUS Server policies for quarantine.
  • Quarantine according to ISA Server policies. If you enabled quarantine, this option uses ISA Server policies for quarantine. You can also specify how long users can remain in quarantine mode, before being disconnected.

Even with quarantine enabled, you can exempt specific users from quarantine control.


Firewall policy for quarantined VPN clients

Your firewall policy controls the access you will allow from the Quarantined VPN Clients network to network resources. These resources could include the RADIUS server or domain controller against which the user is authenticated, a server that provides antivirus software and signature updates, and the DHCP server that provides IP addresses to VPN clients.

To allow access to a resource, you create an access rule, with the Quarantined VPN Clients network as the source, and the server to which access is required as the destination. This requires creating a computer rule element for each server, so that it can be used in access rules. Alternatively, you can create a computer set containing all of the computers to which the quarantined clients require access, and create an access rule with the Quarantined VPN Clients network as the source and the computer set as the destination. Another possibility is to design your network so that all of the servers to which access is required are on a subnet, and define a subnet rule element for use in the access rule.

For more information about firewall policy, see Firewall policy rules overview.

The following are some examples of the types of access you may want to allow to the Quarantined VPN Clients network. The first three items on this list represent the access needed by the network policy requirements script, without which the client will not be released to the VPN Clients network. Remember that the Connection Manager specific to your clients may require access to specific servers on specific protocols. Consult with the creator of your Connection Manager to ascertain what access rules are needed.

  • Allows queries to LDAP servers on the Internal network.
  • Allows traffic to domain controllers.
  • Allows quarantined VPN clients DNS queries to DNS servers.
  • Allows quarantined VPN clients WINS traffic to WINS servers.

Note

  • The ConfigureRQSForISA.vbs script, available on the ISA Server website, creates an ISA Server access rule that allows communication on the RQS port (7250) from the VPN Clients and Quarantined VPN Clients networks to the Local Host network. This is necessary so that the ISA Server computer can receive notice that the client has met the connection requirements.


Site-to-Site VPN

This section provides information about the features of Internet Security and Acceleration (ISA) Server 2004 for a site-to-site virtual private network (VPN).

  • Site-to-site VPN overview
  • L2TP over IPSec and PPTP networks
  • IPSec tunneling protocol network
  • Site-to-site VPN and firewall policy
  • Site-to-site VPN connections
  • Dial-in accounts for remote site connections


Site-to-site VPN overview

A large corporation often has multiple sites that require communication, for example, a corporate office in New York and a sales office in Washington. The two offices can be connected securely over the Internet using a site-to-site virtual private network (VPN).

ISA Server 2004 provides three VPN protocols for site-to-site connections:

  • Point-to-Point Tunneling Protocol (PPTP)
  • Layer Two Tunneling Protocol (L2TP) over Internet Protocol security (IPSec)
  • Internet Protocol security (IPSec) tunnel mode

For more information about VPN tunneling protocols, see VPN tunneling protocols.

The process of configuring remote VPN networks differs, depending on the tunneling protocol you select. For all remote site networks, you must configure the network, set up a network and firewall policy for the remote network, and configure the remote site gateway (VPN server).

In addition, for IPSec networks, you can further configure the security settings on the ISA Server computer. You must also configure the IPSec policy settings on the remote site gateway.

For more information about configuring L2TP over IPSec and PPTP remote networks, see L2TP over IPSec and PPTP networks. For more information about configuring IPSec remote networks, see IPSec tunneling protocol network.


L2TP over IPSec and PPTP networks

ISA Server 2004 supports a site-to-site virtual private network (VPN) using Point-to-Point Tunneling Protocol (PPTP) and Layer Two Tunneling Protocol (L2TP) over Internet Protocol security (IPSec). For example, you can use these tunneling protocols if you are using ISA Server 2004 as your VPN server, and the site you are connecting to is using Microsoft® Windows Server™ 2003, Windows® 2000 Server, ISA Server 2004, or ISA Server 2000 as a VPN server. ISA Server 2004 uses Routing and Remote Access to establish the L2TP over IPSec VPN connection.

The figure illustrates a possible network topology for the L2TP over IPSec solution.

VPN site to site with L2TP over IPsec

Setting up remote networks using PPTP or L2TP over IPSec involves these general steps:

  1. Create a remote site network, selecting PPTP or L2TP over IPSec as the tunneling protocol. For instructions, see Add a remote site network.
  2. Select PPTP or L2TP over IPSec as the tunneling protocol. For instructions, see Configure tunneling protocol for a remote site network.
  3. Configure ISA Server network rules and access policy. For more information, see Site-to-site VPN and firewall policy.
  4. Configure the general VPN properties for connections initiated by remote VPN sites, because ISA Server views those sites as VPN clients. For more information, see Site-to-site VPN connections.
  5. Configure automatic dialing, if your ISA Server computer is connected to the Internet through a dial-up connection. For instructions, see Configure automatic dialing.
  6. Configure the remote VPN server.


IPSec tunneling protocol network

ISA Server 2004 supports a site-to-site virtual private network (VPN) using the Internet Protocol security (IPSec) tunneling protocol. For example, you can use IPSec tunneling protocol if you are using ISA Server 2004 as your VPN server, and the site you are connecting to is using a third-party product or ISA Server 2004 as its VPN server. The figure shows a possible network topology for the IPSec tunnel solution.

VPN site-to-site with IPSec

As shown in the figure, the main office is using ISA Server 2004 as its VPN server. ISA Server 2004 is on a computer running either Microsoft® Windows Server™ 2003 or Windows® 2000 Server.

The branch office may be running one of several third-party VPN servers. Alternatively, the branch may be using ISA Server 2004, Windows Server 2003 or Windows 2000 Server as its VPN server.

Setting up remote networks using IPSec involves these general steps:

  1. Create a remote site network. Select IPSec as the tunneling protocol. For instructions, see Add a remote site network.
  2. Configure ISA Server network rules and access policy. For more information, see Site-to-site VPN and firewall policy.
  3. Configure automatic dialing, if your ISA Server computer is connected to the Internet through a dial-up connection. For instructions, see Configure automatic dialing.
  4. Configure the remote VPN server. The remote VPN server must be configured to connect to the ISA Server computer in IPSec tunnel mode, according to manufacturer instructions. ISA Server provides a summary of the information needed to configure the remote server. For instructions on viewing the summary information, see View IPSec policy.
  5. Configure advanced IPSec settings. For instructions, see Configure advanced IPSec settings for Phase I and Configure advanced IPSec settings for Phase II.

IPSecPol tool

To create a remote site network that uses the IPSec protocol tunneling mode on a computer running Windows 2000, you must install the IPSecPol tool, available on the Microsoft website (http://www.microsoft.com/). The tool must be installed to the ISA Server installation folder.

When you create a remote site network that uses the IPSec tunneling protocol, the Microsoft Firewall service modifies the IPSec filters on the computer, when restarting the Firewall service. This process can take up to several minutes, depending on the number of subnets included in the address ranges for the network. To minimize the effect, we recommend that you define IP address ranges that are aligned in subnet boundaries.

PolicyAgent service

If you stop or restart the IPSec PolicyAgent service, all dynamic IPSec configuration information is lost, including ISA Server VPN site-to-site IPSec configuration settings, and the clients are disconnected. Furthermore, when the PolicyAgent service is stopped, and the IPSec policy is erased, all traffic from the clients is forwarded to the Internet, unencrypted.

To restore settings, start the PolicyAgent service and restart the Firewall service. Alternatively, reboot the computer.

IPSec policy for domain members

Typically, the ISA Server computer is not a member of a domain. In this case, a local IPSec policy can be used. However, if ISA Server is a member of a domain that has IPSec policy applied to all its members, the local IPSec policies are overwritten by the domain IPSec policies. Work with the domain administrator to ensure that the domain IPSec policy does not conflict with the IPSec policy configured for the remote site network. To view the remote site network's IPSec policy:

  1. In ISA Server Management, click Virtual Private Networks (VPN).
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable remote network.
  4. On the Tasks tab, click View IPSec Policy.

IPSec support for multiple IP addresses

For IPSec remote site networks, when using a non-primary IP address as the local endpoint, the following is not supported:

  • A NAT relationship cannot be configured from any internal network to the remote site network (for traffic initiated from the internal networks to the remote site network).
  • Web Proxy traffic is not supported from any internal network to the remote site network. You can allow HTTP traffic by defining a new protocol (e.g., named HTTP1) that is not configured for the Web Proxy application filter. Use that protocol in a rule that allows HTTP traffic to the specific remote site network.

When connecting multiple IPSEC remote site networks to the same ISA Server computer running Windows Server 2003, we recommend that you define unique IP addresses for each remote site network's local endpoint.

If multiple IPSec remote site networks require NAT/HTTP functionality (from the Internal network to the remote site network), we recommend that you use a dedicated network adapter for each remote site network (using the primary IP address on the network adapter as the local endpoint). To identify the primary IP address:

  1. Select the relevant network adapter and then right-click Properties.
  2. Click TCP-IP protocol and then click Properties.


Site-to-site VPN and firewall policy

When you configure a site-to-site virtual private network (VPN) in ISA Server, you are establishing a new network: the remote site, recognized by the ISA Server computer as a remote VPN. Remote site networks should include all the addresses on the remote site. For instructions on creating remote site networks, see Add a remote site network.

When you create a remote network, the VPN site-to-site connection is enabled. ISA Server enables system policy rules, allowing access from all External networks to the ISA Server computer (Local Host network), using the VPN tunneling protocols. This rule is modified if you modify the VPN access network, which is initially set to the External network. You can specify one or more networks from which VPN clients can connect to ISA Server. When you modify this, the system policy rule is changed automatically to apply to the additional or changed networks. For more information on system policy rules, see System policy overview.

The default system policy rules also allow access from a computer set named IPSec Remote Gateways. IPSec Remote Gateways is a predefined computer set, which cannot be modified. When an IPSec site-to-site network is added, the IP address configured as the remote tunnel endpoint is added to the IPSec Remote Gateways computer set.

To allow remote networks access to resources on the Internal network, you must create an access rule, allowing the appropriate access. If you consider the remote network to be identical to the Internal network from a firewall policy perspective, you may also want to create an access rule allowing all traffic from the Internal network to the remote network. For more information about firewall policy, see Firewall policy rules overview.


Site-to-site VPN connections

In a site-to-site network, virtual private network (VPN) connections can be initiated either by ISA Server 2004 or by the remote site gateway.

Connections initiated by the remote site gateway

ISA Server considers a remote site gateway that uses Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol (L2TP) as any remote access client. For this reason, the remote site gateway must:

  • Configure the VPN access network on which it is located, so that it can initiate connections. For instructions, see Configure VPN access networks.
  • Configure a user with a dial-in account on the ISA Server computer. The user can be a Windows user or a RADIUS user. The same considerations apply to the remote site network as to the remote VPN client. For instructions, see Create a dial-in account for the remote site gateway.
  • Have an IP address, assigned by ISA Server. The address should be located on the Internal network. For instructions, see Configure VPN address assignment.
  • Have authentication protocols configured, which will be used when authenticating its user account information to ISA Server. For instructions, see Configure VPN authentication methods.

You can also configure whether connections initiated by the remote site should be terminated after a specific amount of time. For instructions, see Terminate inactive VPN connections automatically.

Connections initiated by ISA Server

For each remote site network that uses PPTP or L2TP, you can configure whether ISA Server can also initiate VPN connections. If ISA Server can initiate connections, you must configure appropriate credentials, which will be used to authenticate to the remote site gateway.

You can also configure the authentication methods used when ISA Server initiates connections to the remote site gateway. The authentication protocol that you configure should be the protocol required by the remote site gateway. For example, if the remote site gateway uses IPSec, you should configure authentication using either certificates or a preshared key. For instructions, see Configure VPN authentication methods for site-to-site connections initiated by ISA Server.


Dial-in accounts for remote site connections

When creating a site-to-site network for remote access, you must also create a user account for initiating the remote access dial-up connection. For the connection to succeed:

  • The name of the user account and the name of the site-to-site network must be identical.
  • The remote access user dial-in properties must be set to allow remote access.

This information applies to site-to-site connections using Layer Two Tunneling Protocol (L2TP) or Point-to-Point Tunneling Protocol (PPTP). It does not apply to connections using Internet Protocol security (IPSec).

For instructions, see Create a dial-in account for the remote site gateway.


Common VPN Configuration

This section provides information about the features of Internet Security and Acceleration (ISA) Server 2004 for common virtual private network (VPN) configuration.

  • VPN access network
  • VPN tunneling protocols
  • VPN Authentication
  • VPN client address assignment and name resolution


VPN access network

For virtual private network (VPN) client connections, networks from which clients can connect to the ISA Server 2004 computer with VPN enabled are called access networks.

For site-to-site (remote) connections, an access network is a network where the remote VPN server is located.

By default, for both site-to-site connections and for client connections, the VPN access network is set only to the External network. Therefore, when you enable VPN access, VPN connections can be established for computers on the External network.

For instructions, see Configure VPN access networks.

Remote VPN client access

When you first enable VPN client access on ISA Server, a system policy rule called Allow VPN client traffic to ISA Server is enabled. This allows access from the External network to the Local Host, because the External network is configured by default as an access network. You can subsequently configure additional access networks, by specifying additional VPN access networks. The system policy rule is automatically updated to apply to the additional access networks.

Site-to-site access

For site-to-site access, when you create a new remote site network, ISA Server adds the remote network to the list of networks included in the Protected Networks network set. In addition, ISA Server enables these system policy rules:

  • Allow VPN site-to-site traffic from ISA Server. This rule allows the ISA Server computer access to clients on the External network, using the selected VPN protocol.
  • Allow VPN site-to-site traffic to ISA Server. This rule allows clients on the External network access to the ISA Server computer, using the selected VPN protocol.


VPN tunneling protocols

ISA Server 2004 supports two virtual private network (VPN) protocols for remote client access connections:

  • Point-to-Point Tunneling Protocol (PPTP)
  • Layer Two Tunneling Protocol (L2TP)

In addition, for site-to-site VPN connections, Internet Protocol security (IPSec) tunnel mode is supported.

For instructions on configuring protocols for remote client access, see Configure tunneling protocols for remote client access.

PPTP

Point-to-Point Tunneling Protocol (PPTP) is a network protocol that enables the secure transfer of data from a remote client to a private enterprise server by creating a VPN across TCP/IP-based data networks. PPTP supports on-demand, multi-protocol, virtual private networking over public networks such as the Internet. PPTP allows IP traffic to be encrypted, and then encapsulated in an IP header to be sent across a corporate IP network or a public IP network such as the Internet.

L2TP

Layer Two Tunneling Protocol (L2TP) is an industry-standard Internet tunneling protocol that provides encapsulation for sending Point-to-Point Protocol (PPP) frames across packet-oriented media. L2TP allows IP traffic to be encrypted, and then sent over any medium that supports point-to-point datagram delivery, such as IP. The Microsoft implementation of L2TP uses Internet Protocol security (IPSec) encryption to protect the data stream from the VPN client to the VPN server. IPSec tunnel mode allows IP packets to be encrypted, and then encapsulated in an IP header to be sent across a corporate IP network or a public IP network such as the Internet.

PPTP connections require only user-level authentication through a PPP-based authentication protocol. L2TP over IPSec connections require the same user-level authentication and, in addition, computer-level authentication using computer certificates.

IPSec tunnel mode

Tunneling is the entire process of encapsulation, routing, and decapsulation. Tunneling wraps, or encapsulates, the original packet inside a new packet. This new packet might have new addressing and routing information, which enables it to travel through a network. When tunneling is combined with data confidentiality, the original packet data (as well as the original source and destination) is not revealed to those listening to traffic on the network. After the encapsulated packets reach their destination, the encapsulation is removed, and the original packet header is used to route the packet to its final destination.

The tunnel itself is the logical data path through which the encapsulated packets travel. To the original source and destination peer, the tunnel is usually transparent and appears as just another point-to-point connection in the network path. The peers are unaware of any routers, switches, proxy servers, or other security gateways between the tunnel's beginning point and the tunnel's endpoint. When tunneling is combined with data confidentiality, it can be used to provide a VPN.

The encapsulated packets travel through the network inside the tunnel. In this example, the network is the Internet. The gateway might be an edge gateway that stands between the outside Internet and the private network. The edge gateway can be a router, firewall, proxy server, or other security gateway. Also, two gateways can be used inside the private network to protect traffic across untrusted parts of the network.

When IPSec is used in tunnel mode, it provides encapsulation for IP traffic only. The primary reason for using IPSec tunnel mode is interoperability with other routers, gateways, or end systems that do not support L2TP over IPSec or PPTP VPN tunneling.

Note

  • If you stop or restart the IPSec PolicyAgent service, all dynamic IPSec configuration information is lost, including ISA Server VPN site-to-site IPSec configuration settings, and VPN clients are disconnected. To restore settings, either start the PolicyAgent service and restart the Microsoft Firewall service, or restart the computer.

VPN protocol comparison

The following table compares the VPN protocols.

Protocol | When to use | Security level | Comments
IPSec tunnel mode | Connecting to third-party VPN server | High | This is the only option you can use if you are connecting to a non-Microsoft VPN server.
L2TP over IPSec | Connecting to an ISA Server 2004 computer, ISA Server 2000 computer, or Windows VPN server | High | Uses Routing and Remote Access. Less complicated than the IPSec tunnel solution, but requires that the remote VPN server be an ISA Server computer or a Windows VPN server.
PPTP | Connecting to an ISA Server 2004 computer, ISA Server 2000 computer, or Windows VPN server | Moderate | Uses Routing and Remote Access. Same restrictions as L2TP, but slightly easier to configure. L2TP is considered more secure because it uses IPSec encryption.


VPN Authentication

The authentication of virtual private network (VPN) clients is an important security concern. Authentication methods typically use an authentication protocol that is negotiated during the connection establishment process. This section describes the authentication methods supported by ISA Server 2004:

  • EAP authentication method
  • EAP authentication configuration
  • MS-CHAP authentication method
  • CHAP, SPAP, and PAP authentication methods
  • Preshared keys (custom IPSec policy for L2TP connections)

Authentication methods for remote site gateways

When a remote site gateway initiates a connection with ISA Server, it is initially authenticated as any remote VPN client. The authentication methods that you apply for remote VPN clients also apply for the remote site gateway. For more information about how the remote site gateway connects to ISA Server, see VPN site-to-site connections.

Authentication methods when ISA Server initiates remote site connections

You can configure ISA Server to allow the ISA Server computer to initiate connections to the remote site gateway. In this case, you must also configure the authentication methods to be used. For instructions, see Configure VPN authentication methods for site-to-site connections initiated by ISA Server.


EAP authentication method

With the Extensible Authentication Protocol (EAP), an arbitrary authentication mechanism authenticates a remote access connection. The exact authentication scheme to be used is negotiated by the remote VPN client and the authenticator (either ISA Server or the RADIUS server). ISA Server includes support for Message Digest 5 Challenge (MD5-Challenge) and EAP-Transport Level Security (EAP-TLS) by default.

EAP allows for an open-ended conversation between the remote VPN client and the authenticator. The conversation consists of authenticator requests for authentication information and the responses by the remote VPN client. For example, when EAP is used with security token cards, the authenticator can separately query the remote access client for a name, PIN, and card token value. As each query is asked and answered, the remote access client passes through another level of authentication. When all questions have been answered satisfactorily, the remote access client is authenticated.

A specific EAP authentication scheme is known as an EAP type. Both the remote access client and the authenticator must support the same EAP type for successful authentication to occur.

For instructions on configuring authentication methods, see Configure VPN authentication methods.

EAP infrastructure

EAP is a set of internal components that provide architectural support for any EAP type in the form of a plug-in module. For successful authentication, both the remote access client and authenticator must have the same EAP authentication module installed. ISA Server supports two EAP types: MD5-Challenge and EAP-TLS.

MD5-Challenge

Message Digest 5 Challenge (MD5-Challenge) is a required EAP type that uses the same challenge/handshake protocol as PPP-based CHAP, but the challenges and responses are sent as EAP messages. A typical use for MD5-Challenge is to authenticate the credentials of remote VPN clients by using user name and password security systems. You can also use MD5-Challenge to test EAP interoperability.

EAP-TLS

EAP-Transport Level Security (EAP-TLS) is an EAP type that is used in certificate-based security environments. If you are using smart cards for remote access authentication, you must use the EAP-TLS authentication method. The EAP-TLS exchange of messages provides mutual authentication, negotiation of the encryption method, and encrypted key determination between the remote VPN client and the authenticator. EAP-TLS provides the strongest authentication and key determination method.

EAP-RADIUS

EAP-RADIUS is not an EAP type, but the passing of EAP messages of any EAP type by an authenticator to a RADIUS server for authentication. For example, when ISA Server is configured for RADIUS authentication, the EAP messages sent between the remote VPN client and ISA Server are encapsulated and formatted as RADIUS messages between the remote access server and the RADIUS server.

EAP-RADIUS is used in environments where RADIUS is used as the authentication provider. An advantage of using EAP-RADIUS is that EAP types do not need to be installed at each remote access server, only at the RADIUS server. In the case of Internet Authentication Service (IAS), you only need to install EAP types on the IAS server.

For more information about RADIUS authentication, see RADIUS authentication for remote VPN clients.


EAP authentication configuration

If you create a virtual private network (VPN) remote site network that uses a Point-to-Point Tunneling Protocol (PPTP) connection, and select Extensible Authentication Protocol (EAP) as its authentication protocol, you must complete the EAP configuration. EAP configuration is done using Routing and Remote Access.

To complete the EAP configuration, do the following:

  1. In Routing and Remote Access Management console, select the Network Interfaces node.
  2. When you applied the changes to the ISA Server configuration, a demand dial interface with the same name you gave the network was created. Select this demand dial interface, and then click Properties.
  3. On the Security tab, the advanced custom settings option should be selected. Click Settings to open Advanced Security Settings.
  4. Select the EAP you will be using, and then click Properties to configure the EAP according to your EAP provider.

Note

  • To open Routing and Remote Access Management console, click Start, click Administrative Tools, and then click Routing and Remote Access.


MS-CHAP authentication method

ISA Server 2004 supports the Microsoft Challenge Handshake Authentication Protocol (MS-CHAP), also known as MS-CHAP version 1. MS-CHAP is a nonreversible, encrypted password authentication protocol. The challenge handshake process works as follows:

  1. The authenticator, which is the remote access server or the Internet Authentication Service (IAS) server, sends a challenge to the remote access client that consists of a session identifier and an arbitrary challenge string.
  2. The remote access client sends a response that contains the user name and a nonreversible encryption of the challenge string, the session identifier, and the password.
  3. The authenticator checks the response and, if valid, the user's credentials are authenticated.

If you use MS-CHAP as the authentication protocol, you can use Microsoft Point-to-Point Encryption (MPPE) to encrypt the data sent on the PPP or PPTP connection.

ISA Server also supports MS-CHAP version 2. MS-CHAP version 2 provides stronger security for remote access connections than MS-CHAP. You should consider using MS-CHAP version 2 instead of MS-CHAP.

Notes

  • MS-CHAP (version 1 and version 2) is the only authentication protocol provided with the Microsoft® Windows Server™ 2003 family that supports password change during the authentication process.
  • If MS-CHAP v1 is used as the authentication protocol, a 40-bit encrypted connection cannot be established if the user's password is larger than 14 characters. This affects both dial-up and virtual private network (VPN) remote access, and demand dial connections.

For instructions on setting authentication methods, see Configure VPN authentication methods.

MS-CHAP version 2

ISA Server supports version 2 of the Microsoft Challenge Handshake Authentication Protocol (MS-CHAP v2), which provides stronger security for remote access connections.

MS-CHAP v2 is a one-way encrypted password, mutual authentication process that works as follows:

  1. The authenticator, which is the remote access server or the Internet Authentication Service (IAS) server, sends a challenge to the remote access client that consists of a session identifier and an arbitrary challenge string.
  2. The remote access client sends a response that contains:
    • The user name.
    • An arbitrary peer challenge string.
    • A one-way encryption of the received challenge string, the peer challenge string, the session identifier, and the user's password.
  3. The authenticator checks the response from the client and sends back a response that contains:
    • An indication of the success or failure of the connection attempt.
    • An authenticated response based on the sent challenge string, the peer challenge string, the encrypted response of the client, and the user's password.
  4. The remote access client verifies the authentication response and, if correct, uses the connection. If the authentication response is not correct, the remote access client terminates the connection.


CHAP, SPAP, and PAP authentication methods

ISA Server 2004 supports the Challenge Handshake Authentication Protocol (CHAP), Shiva Password Authentication Protocol (SPAP), and Password Authentication Protocol (PAP).

CHAP

The Challenge Handshake Authentication Protocol (CHAP) is a challenge/response authentication protocol that uses the industry-standard Message Digest 5 (MD5) hashing scheme to encrypt the response. CHAP is used by various vendors of network access servers and clients. A server running Routing and Remote Access supports CHAP so that remote access clients that require CHAP are authenticated. Because CHAP requires the use of a reversibly encrypted password, you should consider using another authentication protocol such as Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) version 2.

Notes

  • If your password expires, CHAP cannot change passwords during the authentication process.
  • You cannot use Microsoft Point-to-Point Encryption (MPPE) with CHAP.

For instructions on setting authentication methods, see Configure VPN authentication methods.

SPAP

The Shiva Password Authentication Protocol (SPAP) is a reversible encryption mechanism employed by Shiva. When a computer running Windows XP Professional connects to a Shiva LAN Rover, it uses SPAP, as does a Shiva client that connects to a server running Routing and Remote Access. This form of authentication is more secure than plaintext but less secure than CHAP or MS-CHAP.

Important

  • When you enable SPAP as an authentication protocol, the same user password is always sent in the same reversibly encrypted form. This makes SPAP authentication susceptible to replay attacks, where an attacker captures the packets of the authentication process and replays the responses to gain authenticated access to your intranet. The use of SPAP is discouraged, especially for virtual private network connections.

Notes

  • If your password expires, SPAP cannot change passwords during the authentication process.
  • Make sure your network access server (NAS) supports SPAP before you enable it on a remote access policy on an Internet Authentication Service (IAS) server.
  • You cannot use Microsoft Point-to-Point Encryption (MPPE) with SPAP.

PAP

Password Authentication Protocol (PAP) uses plaintext passwords and is the least secure authentication protocol. It is typically negotiated if the remote access client and remote access server cannot negotiate a more secure form of validation.

To enable PAP-based authentication, you must do the following:

  1. Enable PAP as an authentication protocol on the remote access server. PAP is disabled by default.
  2. Enable PAP on the appropriate remote access policy. PAP is disabled by default.
  3. Enable PAP on the remote access client.

Notes

  • By disabling PAP on ISA Server, plaintext passwords are never sent by the dial-up client. Disabling support for PAP increases authentication security, but remote VPN clients who only support PAP cannot connect.
  • If your password expires, PAP cannot change passwords during the authentication process.
  • You cannot use Microsoft Point-to-Point Encryption (MPPE) with PAP.


Preshared keys (custom IPSec policy for L2TP connections)

A preshared key is a string of Unicode characters used to authenticate Layer Two Tunneling Protocol (L2TP) over Internet Protocol security (IPSec) connections. The use of preshared keys is supported on many operating systems, including the Microsoft® Windows Server™ 2003 family and Windows® XP. You can also configure ISA Server to use a preshared key to authenticate connections from other routers.

For instructions, see Configure a preshared key for VPN connections.

Advantages and disadvantages of preshared keys

Preshared key authentication does not require the hardware and configuration investment of a public key infrastructure (PKI), which is necessary for using computer certificates for L2TP over IPSec authentication. Preshared keys are simple to configure on a remote access server, and they are relatively simple to configure on a remote access client. They can be made transparent to the user if they are issued within Connection Manager profiles. If you are in the process of establishing a PKI or if you manage an Active Directory domain, you can configure Routing and Remote Access to accept an L2TP over IPSec connection using a computer certificate or a preshared key.

However, a single remote access server can utilize only one preshared key for all L2TP over IPSec connections that require a preshared key for authentication. You must issue the same preshared key to all L2TP over IPSec VPN clients that connect to the remote access server using a preshared key. Unless you distribute the preshared key within a Connection Manager profile, each user must manually type the preshared key. This limitation further reduces the security of the deployment and increases the probability of error. If the preshared key on a remote access server is changed, a client with a manually configured preshared key will be unable to connect to that server until the preshared key on the client is changed. If the preshared key was distributed to the client within a Connection Manager profile, that profile must be reissued with the new preshared key and reinstalled on the client computer. Unlike certificates, the origin and the history of a preshared key cannot be determined. For these reasons, the use of preshared keys to authenticate L2TP over IPSec connections is considered a relatively weak authentication method. If you want a long term, strong authentication method, you should consider using a PKI.

Considerations when choosing a preshared key

A preshared key is a sequence of characters that is configured on both the remote access server and the L2TP over IPSec client. The preshared key can be any non-null string of any combination of up to 256 Unicode characters. When you choose a preshared key, consider the fact that users who utilize the New Connection Wizard to create the VPN client connection must type the preshared key manually. A key that is long and complex enough to provide adequate security might be difficult for the majority of your users to type accurately. If the preshared key presented by the VPN client deviates in any way from the preshared key configured on the remote access server, client authentication will fail.

Note

  • On ISA Server, you can use only English characters in the preshared key.

When the preshared key is first stored, the remote access server and the VPN client attempt to convert the Unicode string into ASCII. If the attempt is successful, the ASCII version of the string will be used for authentication. This strategy ensures that the preshared key is not corrupted in transmission by any devices that do not comply with the Unicode standard, such as routers from other companies. If the preshared key cannot be stored as ASCII, the Unicode string will be used. If the Unicode preshared key must be processed by any device that does not comply with the Unicode standard, the connection attempt will probably fail.


VPN client address assignment and name resolution

When you configure ISA Server 2004 to allow a virtual private network (VPN), you must configure how remote clients will be assigned addresses: dynamically or statically. When a VPN client is assigned an address, the address becomes part of the VPN Clients network.

For instructions on setting authentication methods, see Configure VPN address assignment.

Note

  • ISA Server acts as an Address Resolution Protocol (ARP) proxy for VPN clients. For example, when addresses assigned (from a static pool or by a DHCP server) to VPN clients are part of the Internal network segment, computers from the Internal network will send ARP queries to VPN clients. ISA Server will intercept the queries and reply on behalf of the connected VPN client.

Dynamic address assignment

If the remote clients are assigned addresses dynamically, you will require a DHCP server. The DHCP server will dynamically assign IP addresses to VPN clients when they connect. This is the recommended approach to assigning IP addresses to VPN clients.

Any computer running Windows Server 2003 or Windows 2000 Server in the Internal network can serve as the DHCP server. The existing DHCP server of your Internal network will serve VPN client needs.

If you use a DHCP server for address assignment, when a VPN client establishes a connection, its address is automatically moved from the Internal network to the VPN Clients network (or Quarantined VPN Clients network, if quarantine is enabled and the client is quarantined). The address is restored to the Internal network when the client disconnects. This address assignment is not visible in ISA Server Management.

If you use a DHCP server to assign IP addresses on the Internal network, but will assign a group of IP addresses from the Internal network to be a static pool for VPN Clients, you must configure the DHCP server to not assign those addresses.

When you use dynamic address assignment, the address that the VPN client is assigned is actually an address from the Internal network. When the VPN client establishes a connection, its address is dynamically moved from the Internal network to the VPN Clients network. When the client subsequently disconnects, the address is returned to the Internal network. These shifts in IP address membership are not visible in ISA Server Management.

Note

  • If no DHCP server is configured on the Internal network, you must configure a static pool of IP addresses in the VPN Clients network.

Static address assignment

Alternatively, you can provide the IP addresses from a static pool of addresses. For example, this approach can be used when your Internal network IP addresses are statically assigned.

If you use a static address pool for address assignment, the addresses that you want to assign to the pool must first be removed from other defined networks, because overlapping of IP addresses between networks is not allowed. You must provide one more IP address in the static address pool than the expected number of remote VPN connections. (This includes remote site and roaming client connections.)

Broadcast name resolution for VPN clients

You can enable broadcast name resolution for VPN connections to ISA Server, specifying which DNS server or which WINS server the client will use to resolve computer names. In this case, a remote access client can resolve full computer names, NetBIOS names of computers, and other resources on a remote network that does not have either a DNS or a WINS server configured.


VPN connection monitoring

You can monitor virtual private network (VPN) sessions, filtering the Sessions view to show only the VPN connections. To monitor VPN clients, configure the filter so that Session Type is set to VPN client. To monitor connections from a remote site network, configure the filter on the Sessions view so that the Source Network is set to VPN Site-to-Site.

Logging

ISA Server 2004 supports the following types of logging for VPN connections:

  • Event logging. Event logging is the recording of events in the system event log. Event logging is typically used for troubleshooting or for notifying network administrators of unusual events.
  • ISA Server logging. ISA Server also supports the logging of authentication and access information for remote VPN connections. This logging is separate from the events recorded in the system event log. You can use the information that is logged to track remote access usage and authentication attempts. For more information, see Log storage format.
  • RADIUS-based authentication and accounting logging. A server running Routing and Remote Access supports the logging of accounting information for remote access connections at a Remote Authentication Dial-In User Service (RADIUS) server when RADIUS authentication and accounting are enabled. This logging is separate from the events recorded in the system event log. You can use the information that is logged on your RADIUS server to track remote access usage. For instructions, see Use RADIUS authentication and Use RADIUS for accounting.


VPN: How To

This section provides instructions for configuring remote VPN clients, site-to-site VPN, and common VPN configuration settings.

  • Configure Remote VPN Client Access
  • Configure Site-to-Site VPN Connections
  • Configure Common VPN Settings
  • Troubleshooting VPN


Configure Remote VPN Client Access

This section provides steps for configuring remote VPN client access.

  • Enable remote VPN client access
  • Configure maximum number of simultaneous remote client connections
  • Allow remote access for domain groups
  • Configure tunneling protocols for remote client access
  • Enable user mapping
  • Create users and groups for remote VPN clients
  • Enable Quarantine Control
  • Exempt users from Quarantine Control


Enable remote VPN client access

To enable remote VPN client access

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. In the details pane, click the VPN Clients tab.
  3. On the Tasks tab, click Enable VPN Client Access.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you enable VPN client access, a system policy rule named Allow VPN clients to firewall is enabled.

Related Topics


Configure maximum number of simultaneous remote client connections

To configure maximum number of simultaneous remote client connections

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. On the details pane, click the VPN Clients tab.
  3. On the Tasks tab, click Configure VPN Client Access.
  4. In Maximum number of VPN clients allowed, type the maximum number of VPN clients that can connect simultaneously.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you enable VPN client access, a system policy rule named Allow VPN clients to firewall is enabled.

Related Topics


Allow remote access for domain groups

To allow remote access for domain groups

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. In the details pane, click the VPN Clients tab.
  3. On the Tasks tab, click Configure VPN Client access.
  4. On the Users tab, click Add.
  5. Type the names of users or groups that are allowed remote access to the ISA Server computer.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You cannot add the Windows built-in user groups as VPN users. Built-in domain groups may be used (even in a situation where the ISA Server computer is also the domain controller).
  • You must set the Dial-in properties for users belonging to these domain groups to Control access through remote access policy.

Related Topics


Configure tunneling protocols for remote client access

To configure tunneling protocols for remote client access

  1. In the console tree of ISA Server Management, click Virtual Private Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networks
  2. In the details pane, click the VPN Clients tab.
  3. On the Tasks tab, click Configure VPN Client Access.
  4. On the Protocols tab, select one or more of the following:
    • Enable PPTP
    • Enable L2TP/IPSec

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you enable remote VPN clients to connect to ISA Server 2004 using the L2TP tunneling protocol, you will require a certificate.

Related Topics


Enable user mapping

To enable user mapping

  1. In the console tree of ISA Server Management, click Virtual Private Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networks
  2. In the details tab, click the VPN Clients tab.
  3. On the Tasks tab, click Configure VPN Client Access.
  4. On the User Mapping tab, click Enable User Mapping.
  5. If the user name to be mapped does not include a domain name, select When user name does not contain a domain, use this domain. Then, in Domain Name, type the name of the domain to use.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Create users and groups for remote VPN clients

To create users and groups for remote VPN clients

  1. In Computer Management, click Local Users and Groups, right-click Groups, and then select New Group.
  2. In New Group, type a name for the group, and then click Create.
  3. Click Users. For each user that you want to have remote VPN access, perform the following actions:
    1. Double-click the user to display its properties.
    2. On the Member Of tab, click Add.
    3. In Enter the object names to select, type the name of the group, and then click OK.
    4. On the Dial-in tab, select Control access through Remote Access Policy, and then click OK.

Note

  • Only users with the dial-in properties configured can use ISA Server for remote VPN client access.


Enable Quarantine Control

To enable Quarantine Control

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Networks tab, and then select the Quarantined VPN Clients network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Quarantine tab, select Enable Quarantine Control.
  5. Select one of the following options:
    • Quarantine according to RADIUS server policies. When a VPN client attempts to connect, Routing and Remote Access policy determines whether the connection request is passed to ISA Server. After Routing and Remote Access policy has been verified, the client unconditionally joins the VPN Clients network.
    • Quarantine according to ISA Server policies. When a VPN client attempts to connect to the ISA Server computer, Routing and Remote Access unconditionally passes the request to ISA Server. ISA Server places the connecting client in the Quarantined VPN Clients network, subjecting the client to the firewall policy defined for that network. When the client clears quarantine, it moves into the VPN Clients network. When you select this option, you must disable the Routing and Remote Access quarantine feature so that the VPN connection can be established.
  6. If quarantined clients should be disconnected after a specified time, select Disconnect quarantine users after (seconds) and type the number of seconds that will pass before a client will be removed from the Quarantined VPN Clients network and disconnected from ISA Server.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select this option, you must configure Quarantine Control on the ISA Server computer and on the remote VPN clients attempting to connect. Otherwise, remote VPN clients will remain in quarantine mode until the specified time passes and they are disconnected from ISA Server.

Related Topics


Exempt users from Quarantine Control

To exempt users from Quarantine Control

  1. In the console tree of ISA Server Management, click Networks.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Networks
  2. In the details pane, select the Networks tab and then select the Quarantined VPN Clients network.
  3. On the Tasks tab, click Edit Selected Network.
  4. On the Quarantine tab, select Enable Quarantine Control.
  5. Click Add.
  6. In Select User Sets, select which users should be exempted from Quarantine Control.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you enable Quarantine Control, you must configure Quarantine Control on the ISA Server computer and on the remote VPN clients attempting to connect. Otherwise, remote VPN clients will remain in quarantine mode until the specified time passes and they are disconnected from ISA Server.
  • Users exempted from Quarantine Control automatically become members of the VPN Clients network.

Related Topics


Configure Site-to-Site VPN Connections

This section provides steps for configuring site-to-site VPN connections.

  • Add a remote site network
  • Configure tunneling protocol for a remote site network
  • Configure addresses for a remote site network
  • Allow ISA Server to initiate connections to the remote VPN gateway
  • Configure VPN authentication methods for site-to-site connections initiated by ISA Server
  • Disable a remote site network
  • Configure PPTP and L2TP Networks
  • Configure IPSec Networks


Add a remote site network

To add a remote site network

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. In the details pane, click the Remote Sites tab.
  3. On the Tasks tab, click Add Remote Site Network.
  4. In the wizard, follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To create a remote site network that uses Internet Protocol security (IPSec) tunneling mode on a computer running Microsoft Windows 2000, you must install the IPSecPol tool, available on the Microsoft website (http://www.microsoft.com/). The tool must be installed to the ISA Server installation folder.
  • When you create a remote site network that uses the IPSec tunneling protocol, the Microsoft Firewall service modifies the IPSec filters on the computer, when restarting the Firewall service. This process can take up to several minutes, depending on the number of subnets included in the address ranges for the network. To minimize the effect, we recommend that you define IP address ranges that are aligned in subnet boundaries.
  • If you stop or restart the IPSec PolicyAgent service, all dynamic IPSec configuration information is lost, including ISA Server VPN site-to-site IPSec configuration settings, and VPN clients are disconnected. To restore settings, start the PolicyAgent service or restart the Firewall service.

Related Topics


Configure tunneling protocol for a remote site network

To configure tunneling protocol for a remote site network

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable remote network.
  4. On the Tasks tab, click Configure Remote Site.
  5. On the Protocol tab, select one of the following:
    • L2TP/IPSec. To enable Layer Two Tunneling Protocol (L2TP) over Internet Protocol security (IPSec) authentication and encryption protocol to pass through the ISA Server computer.
      If you select this option, you can optionally select Allow preshared key IPSec authentication as a secondary (backup) authentication method, and type a preshared key that will be used for secondary authentication. This preshared key must be configured on each client that will connect using this policy.
    • PPTP. To enable Point-to-Point Tunneling Protocol (PPTP) to pass through the ISA Server computer. PPTP is a tunneling protocol used to manage tunnels and encapsulate data.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • This task can be performed only on PPTP/L2TP networks. To specify IPSec tunnel mode tunneling protocol, you must create a new remote network.

Related Topics


Configure addresses for a remote site network

To configure addresses for a remote site network

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable remote site network.
  4. On the Tasks tab, click Configure Remote Site.
  5. On the Addresses tab, click Add.
  6. Type the first address of the network address range in Starting address.
  7. Type the last address of the network address range in Ending address.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you create a remote site network that uses the IPSec tunneling protocol, the Microsoft Firewall service modifies the IPSec filters on the computer, when restarting the Firewall service. This process can take up to several minutes, depending on the number of subnets included in the address ranges for the network. To minimize the effect, we recommend that you define IP address ranges that are aligned in subnet boundaries.

Related Topics


Allow ISA Server to initiate connections to the remote VPN gateway

To allow ISA Server to initiate connections to the remote VPN gateway

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable remote network.
  4. On the Connection tab, in Remote gateway name or IP address, type the name or IP address of the remote VPN gateway.
  5. Click Local site can initiate connections to remote site. Then, in User Name, Domain, Password, and Confirm Password, type a user name that ISA Server can use to initiate connections.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The user name you specify here must be configured on the remote VPN gateway.

Related Topics


Configure VPN authentication methods for site-to-site connections initiated by ISA Server

To configure VPN authentication methods for site-to-site connections initiated by ISA Server

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable remote network.
  4. On the Authentication tab, select the appropriate check boxes for the authentication protocols that the remote VPN gateway will use to authenticate connections initiated by ISA Server.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Disable a remote site network

To disable a remote site network

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable remote site network.
  4. On the Tasks tab, click Disable Remote Site.

Related Topics


Configure PPTP and L2TP Networks

This section provides steps for configuring PPTP and L2TP networks.

  • Create a dial-in account for the remote site gateway
  • Terminate inactive VPN connections automatically


Create a dial-in account for the remote site gateway

To create a dial-in account for the remote site gateway

  1. On the ISA Server computer, click Start, point to Administrative Tools, and then click Computer Management.
  2. In Computer Management, click Computer Management, click System Tools, click Local Users and Groups, and then click Users.
  3. In the details pane, right-click the applicable user and then click Properties.
  4. On the Dial-in tab, under Remote Access Permission (Dial-in or VPN), select Allow access.

Note

  • You only have to create a dial-in account for PPTP and L2TP networks. You do not have to create a dial-in account for IPSec networks.

Related Topics


Terminate inactive VPN connections automatically

To terminate inactive VPN connections automatically

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable remote network (PPTP and L2TP networks only).
  4. On the Connection tab, click Terminate inactive connections after. Then, select how long a session can remain inactive before it is terminated.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure IPSec networks

This section provides steps for configuring Internet Protocol security (IPSec) with Internet Security and Acceleration (ISA) Server 2004.

  • View IPSec policy
  • Configure advanced IPSec settings for Phase I
  • Configure advanced IPSec settings for Phase II


View IPSec policy

To view IPSec policy

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable IPSec remote site network.
  4. On the Tasks tab, click View IPSec policy.

Related Topics


Configure advanced IPSec settings for Phase I

To configure advanced IPSec settings for Phase I

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable IPSec remote site network.
  4. On the Tasks tab, click Configure Remote Site.
  5. On the Connection tab, click IPSec Settings.
  6. On the Phase I tab, in Encryption algorithm, select one of the following:
    • MD5, to use a 128-bit key (faster).
    • SHA1, to use a 160-bit key (stronger).
  7. In Integrity algorithm, select one of the following:
    • 3DES, to use Triple Data Encryption Standard algorithm, and three unique 56-bit keys. This option offers higher security.
    • DES, to use the DES algorithm and a single 56-bit key.
  8. In Diffie-Hellman, select one of the following:
    • Group 1 (768 bit), to generate 768 bits of master key keying material.
    • Group 2 (1024 bit), to generate 1024 bits of master key keying material (stronger security).
    • Group 3 (2048 bit), to generate 2048 bits of master key keying material (strongest security).
  9. In Authenticate and generate a new key every, type the time interval at which the master key should be generated, triggering reauthentication.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you use a stronger group for the Diffie-Hellman settings, the secret key derived from Diffie-Hellman exchange has greater strength. Use Group 2 when required for interoperability with Windows 2000 and Windows XP.

Related Topics


Configure advanced IPSec settings for Phase II

To configure advanced IPSec settings for Phase II

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. In the details pane, click the Remote Sites tab.
  3. In the details pane, select the applicable remote IPSec site network.
  4. On the Tasks tab, click Configure Remote Site.
  5. On the Connection tab, click IPSec Settings.
  6. On the Phase II tab, in Encryption algorithm, select one of the following:
    • MD5, to use a 128-bit key (faster).
    • SHA1, to use a 160-bit key (stronger).
  7. In Integrity algorithm, select one of the following:
    • 3DES, to use Triple Data Encryption Standard algorithm, and three unique 56-bit keys. This option offers higher security.
    • DES, to use the DES algorithm and a single 56-bit key.
  8. Select Generate new key every to limit the amount of time a key is reused before reauthentication is required. Specify the time limit by typing a value in Kbytes, in Seconds, or in both fields.
  9. Select Use Perfect Forward Secrecy (PFS) if master key material should not be used to generate more than one session key. Enabling PFS requires reauthentication and, therefore, may affect performance. Then, in Diffie-Hellman, select one of the following:
    • Group 1 (768 bit), to generate 768 bits of master key keying material.
    • Group 2 (1024 bit), to generate 1024 bits of master key keying material (stronger security).
    • Group 3 (2048 bit), to generate 2048 bits of master key keying material (strongest security).

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you set a Kbytes or Seconds limit for session key settings, whichever interval is reached first will start a new key.
  • When you use a stronger group for the Diffie-Hellman settings, the secret key derived from Diffie-Hellman exchange has greater strength. Use Group 2 when required for interoperability with Windows 2000 and Windows XP.

Related Topics


Configure Common VPN Settings

This section provides steps for configuring common VPN settings.

  • Configure VPN access networks
  • Configure VPN address assignments
  • Configure VPN authentication methods
  • Configure a preshared key for VPN connections
  • Use RADIUS authentication
  • Use RADIUS for accounting


Configure VPN access networks

To configure VPN access networks

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. In the details pane, click Remote Access Configuration (step 3).
  3. On the Access Networks tab,
    • Select the network to which remote VPN clients should connect, if you are configuring remote VPN client access.
    • Select the network to which the remote site gateway should connect, if you are configuring site-to-site VPN access.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The access networks you configure here are used for both remote VPN client access and for site-to-site network access.

Related Topics


Configure VPN address assignment

To configure VPN address assignment

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. On the Tasks tab, click Address Assignment.
  3. On the Address Assignment tab, select one of the following options:
    • Static address pool. To assign static addresses to the remote VPN gateway or the remote VPN clients.
    • Dynamic Host Configuration Protocol. To assign addresses to the remote VPN gateway or the remote VPN clients dynamically.
  4. If you select Static address pool, do the following:
    1. Click Add.
    2. In Starting address, type the first address in the range of addresses to assign to the VPN clients.
    3. In Ending address, type the last address in the range of addresses to assign to the VPN clients.
  5. In Use the following network to obtain DHCP, DNS, and WINS services, select the network on which the name resolution servers are located.
  6. Click Advanced. Then, do the following:
    1. On the Name Resolution tab, select one of the following:
      • Obtain DNS server addresses using DHCP configuration. If VPN clients should obtain the DNS server by using a DHCP configuration.
      • Use the following DNS server addresses. To provide the static IP address of the DNS server that VPN clients should use for name resolution.
    2. If you select Use the following DNS server addresses, in Primary, type the IP address of a DNS server located on the Internal network that the VPN clients can use to resolve names on the Internal network. In Backup, type the IP address of a DNS server located on the Internal network that the VPN clients can use to resolve names on the Internal network, when the primary DNS server is not available.
    3. Select one of the following:
      • Obtain WINS server addresses using DHCP configuration. If VPN clients should obtain the WINS server by using a DHCP configuration.
      • Use the following WINS server addresses. To provide the static IP address of the WINS server that VPN clients should use for name resolution.
    4. If you select Use the following WINS server addresses, in Primary, type the IP address of a WINS server located on the Internal network that the VPN clients can use to resolve names on the Internal network. In Backup, type the IP address of a WINS server located on the Internal network that the VPN clients can use to resolve names on the Internal network, when the primary DNS server is not available.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Routing and remote access users are not supported.

Related Topics


Configure VPN authentication methods

To configure VPN authentication methods

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. On the Tasks tab, click Authentication Methods.
  3. On the Authentication tab, select the appropriate check boxes for the authentication protocols that ISA Server will use to authenticate remote VPN clients and remote VPN gateways (if configured).

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • For remote networks, the authentication method that you select is the method that will be used when the remote VPN gateway initiates a connection to the ISA Server computer.
  • EAP authenticated users are authenticated by RADIUS servers. Therefore, firewall policy rules that apply to users will only be applied to these users if you also configure the user mapping feature.

Related Topics


Configure a preshared key for VPN connections

To configure a preshared key for VPN connections

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. On the Tasks tab, click Authentication Methods.
  3. On the Authentication tab, select the appropriate check boxes for the authentication protocols that ISA Server will use to authenticate remote VPN clients and remote VPN gateways (if configured).

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • For remote networks, the authentication method that you select is the method that will be used when the remote VPN gateway initiates a connection to the ISA Server computer.
  • EAP authenticated users are authenticated by RADIUS servers. Therefore, firewall policy rules that apply to users will only be applied to these users if you also configure the user mapping feature.

Related Topics


Use RADIUS authentication

To use RADIUS authentication

  1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN).

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. On the Tasks tab, click Specify RADIUS configuration.
  3. On the RADIUS tab, select Use RADIUS for authentication.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Use RADIUS for accounting

To use RADIUS for accounting

  1. In the console tree of ISA Server Management, click Virtual Private Networking.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Virtual Private Networking
  2. On the Tasks tab, click RADIUS configuration.
  3. On the RADIUS tab, select Use RADIUS for accounting.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Troubleshooting VPN

ISA Server does not accept any VPN connections (Windows 2000 only).

Cause: If Internet Authentication Service (IAS) was running while ISA Server was installed, ISA Server will not accept VPN connections.

Solution: Restart IAS.

A remote VPN client cannot connect to ISA Server.

Cause: There are many reasons that a user may not be able to access ISA Server, including:

  • The user account was not configured correctly.
  • The user does not have appropriate access to the ISA Server computer.

Solution: If the cause seems to be incorrect account configuration, try the following:

  • Check that the dial-in privilege is enabled per user, or that the user account belongs to a group that is set in the Remote Access Policy configuration. For more information, see Users for remote VPN client access.
  • Check that the remote VPN client is properly configured with appropriate authentication methods and tunneling protocols. These must match the configuration settings on ISA Server.

See also: Users for remote VPN client access and VPN tunneling protocols.

Traffic originating from the IP address of the remote site gateway is denied (considered IP spoofing)

Cause: In a remote site network scenario that uses PPTP or L2TP tunneling protocols, the ISA Server computer may not have a default gateway configured. When no default gateway is defined, a static route is not added between ISA Server and the remote site gateway. Because there is no route, traffic from the remote site gateway is perceived as spoofing—and the traffic is denied.

Solution: Add a default gateway. You can specify a dummy default gateway.

IPSec remote site-to-site connections cannot be established.

Cause: There are many reasons that a remote site-to-site connection cannot be established, including:

  • The IPSec connection failed.
  • The remote site gateway cannot be reached.
  • The address of the local ISA Server computer is not configured properly on the remote site gateway.
  • The address range for the remote site network is not configured properly—either on the remote site gateway or on ISA Server.
  • The shared key is not configured correctly (if you are using a preshared key).
  • If certificate authentication is being used, the proper certificates are not available.

Solution: Try the following:

  • If the cause seems to be related to improper configuration of the network address changes, check the configuration. For instructions, see Configure addresses for a remote site network.
  • Verify that the certificates are configured properly.
  • If the cause seems to be related to the security audit, check the event viewer for the latest security failures.
  • If the cause seems to be related to authentication negotiation, check if any of the following Internet Key Exchange (IKE) events occurred:
    • Event 541 (success). Recorded when IKE successfully negotiates either a main mode security association (SA) or an IPSec SA. The SA parameters are noted in the text of the event.
    • Event 542 (success). Recorded when IKE successfully deletes an IPSec SA. An IPSec SA might be deleted because the SA lifetime expired, a new SA was generated during quick mode rekey, the IPSec peer sent a delete message, the IPSec policy changed, or the IPSec service was stopped.
    • Event 543 (success). Recorded when IKE successfully deletes a main mode SA. An IKE main mode SA might be deleted because the SA lifetime expired, the IPSec peer sent a delete message, the IPSec policy changed, or the IPSec service was stopped.
    • Event 544 (failure). Recorded when the IKE negotiation is terminated due to a certificate trust failure and subsequent authentication failure. This failure might occur because a valid certificate chain could not be found on the IPSec peer, or the certificate chain that was found could not be sent to a trusted root certification authority (CA).
    • Event 545 (failure). Recorded when the IKE negotiation is terminated due to the validation failure of a computer certificate signature. This event is rare because it indicates that the computer certificate on the IPSec peer has a mismatched RSA type public/private key pair.
    • Event 546 (failure). Recorded when an SA cannot be established due to an invalid IKE proposal from the IPSec peer. This error typically occurs when an IPSec policy is incorrectly configured.
    • Event 547 (failure). Recorded when the IKE negotiation fails. The causes of the failure are noted in the text of the event.

PPTP or L2TP remote site-to-site connections cannot be established.

Cause: There are many reasons that a remote site-to-site connection cannot be established, including:

  • The remote site gateway cannot be reached.
  • The address of the local ISA Server computer is not configured properly on the remote site gateway.
  • The site-to-site connection does not have an appropriately configured user account.
  • For L2TP connections, the preshared key may not match (if you are using a preshared key).
  • If certificate authentication is being used, the proper certificates are not available.


Caching

Microsoft Internet Security and Acceleration (ISA) Server 2004 implements a cache of frequently requested objects to improve network performance. You can configure the cache to ensure that it contains the most frequently used data.

  • Caching: Concepts
  • Caching: How To
  • Troubleshooting caching


Caching: Concepts

This section provides information about the cache feature of Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Cache overview
  • How caching works
  • Cache configuration
  • Cache rules
  • Content download jobs


Cache overview

ISA Server implements a cache of frequently requested objects to improve network performance. You can configure the cache to ensure that it contains the most frequently used data.

By default, when you install ISA Server, caching is effectively disabled. This is because no space on any disk drive on the ISA Server computer has been specified to be used for caching. When you configure a drive for caching, by specifying how much space to use on the drive, you effectively enable caching. You can further configure the cache, specifying which content can be cached.

With caching enabled, you can configure cache rules, which determine whether content from specified sites should be stored or retrieved from the ISA Server cache. A cache rule applies to requested sites, regardless of the source network.

Also, when caching is enabled, you can configure content download jobs. With content download jobs, ISA Server can be configured to download content automatically, at a specified time. In this way, network performance can be improved, as ISA Server can be configured to access frequently requested content during off-peak hours.

Using caching

ISA Server can be deployed as a forward caching server that provides clients with faster access to requested content. ISA Server maintains a centralized cache of frequently requested objects that can be accessed by any Web browser client. Objects served from the disk cache require significantly less processing than objects served from another network. This improves client browser performance, decreases user response time, and reduces bandwidth consumption on your Internet connection.

In the following figure, clients on the Internal network request objects from servers on the External network. The figure illustrates how ISA Server responds when a user requests an object.

How caching works

The figure also illustrates how users benefit when ISA Server caches objects. Although the figure focuses on a forward caching scenario, the process is identical for reverse caching, when Internet users access a corporate Web server. The figure illustrates these steps:

  1. The first user (Client 1) requests a Web object.
  2. ISA Server checks whether the object is in the cache. Because the object is not in the ISA Server cache, ISA Server requests the object from the server on the Internet.
  3. The server on the Internet returns the object to the ISA Server computer.
  4. ISA Server retains a copy of the object in its cache, and returns the object to Client 1.
  5. Client 2 requests the same object.
  6. ISA Server returns the object from its cache, rather than obtaining it from the Internet.

ISA Server can be deployed in front of an organization's Web server that is hosting a commercial Web business or providing access to business partners. With incoming Web requests, ISA Server can impersonate a Web server to the outside world, fulfilling client requests for Web content from its cache. ISA Server forwards requests to the Web server only when the requests cannot be served from its cache.


How caching works

ISA Server maintains a cache of Web objects and attempts to fulfill Web requests from the cache. If the request cannot be fulfilled from the cache, the ISA Server computer initiates a new request on behalf of the client. Once the remote Web server responds to the ISA Server computer, the ISA Server computer caches the response to the original client request and sends a response to the client.

ISA Server supports forward caching, used for outgoing requests, and reverse_caching, used for incoming requests. Clients in both forward caching and reverse caching benefit from the full gamut of ISA Server caching features. For more information, see Cache overview.

ISA Server includes a Web Proxy filter, which handles the caching functionality. For any specific network, if Firewall Client support is enabled, or if ISA Server is configured as the default gateway for SecureNAT clients, the Web Proxy filter caches objects requested by Firewall and SecureNAT clients.

ISA Server determines whether to retrieve the object from its cache or from another server by examining cache properties and cache rules that you have configured. ISA Server analyzes cache configuration, cache rules, and existing cache content to determine whether an object should be retrieved from the cache.

If the user request is allowed, ISA Server tries to return a response from the cache:

  1. ISA Server checks whether HTTP caching is enabled for the requested destination. If it is not enabled, ISA Server checks the Web chaining rules, to determine how to route the request.
  2. If HTTP caching is enabled, ISA Server looks for the requested object in the cache. If a valid object exists in the cache, ISA Server retrieves it from the cache and returns it to the user.
    The object is considered invalid, if the expiration time specified for the object or in the client request directives has passed.
  3. If the Web chaining rule is configured to route the request, ISA Server determines whether to route the request to the upstream server or to the requested Web server.
  4. If a Web chaining rule is configured to route the request to the Web server, ISA Server sends the request to the Web server.
  5. If the Web server is not accessible, ISA Server checks whether you configured the server to return expired objects from the cache. If you instructed the server to return the expired object as long as the specific expiration time did not pass, the object is returned from the cache to the user.
  6. If the Web server is available, ISA Server determines whether the object can be cached, and whether you configured the applicable cache rule's properties to cache the response. If so, ISA Server caches the object and returns it to the user.

For more information on cache rules, see Cache rules. For more information on Web chaining rules, see Web chaining rules.


Cache configuration

By default, when you install ISA Server, caching is disabled. To enable caching, you must configure space on any cache drive on the ISA Server computer. For instructions, see Enable caching.

You must use a formatted NTFS partition for caching, and the drive must be a local drive. Typically, the best performance is obtained if you use a drive different from the one on which the main ISA Server system and the Microsoft® Windows® operating system are installed. We recommend that you format the drive before using it for caching.

If you want to use the ISA Server caching feature, you must install ISA Server on a computer that has at least one partition formatted as an NTFS volume. If your current server disk volume uses FAT partitions, you can convert these partitions to NTFS by using Convert, which is included with Windows. Convert does not overwrite the data on the disk. For more information on using Convert, type convert /? at a command prompt.

For each server, you can configure the size and location of the cache used by ISA Server. We recommend that you allocate a large cache, since objects are dropped from the cache when it reaches its capacity. For instructions, see Configure cache size.

Cache content files

When you configure a drive for caching, ISA Server creates a cache content file on that drive with the .cdat extension. The file, named dir1.cdat, is created in the drive:\urlcache folder.

As objects are cached, ISA Server appends them to the cache content file. If the cache content file is too full to hold a new object, ISA Server removes older objects from the cache, by using a formula that evaluates age, how often the object is accessed, and size.

Warning

  • Do not modify or delete the cache content files.

Configuring which content to cache

You can configure whether ISA Server should cache the following types of Hypertext Transfer Protocol (HTTP) objects:

  • Objects whose last modification date is not specified.
  • Objects that do not have a 200 response.

You can also configure the maximum size of objects in the memory cache.

For instructions, see Configure which content to cache, Configure maximum size of objects in the cache, and Configure negative caching.

When the Time to Live (TTL) for an object passes, that object is considered expired. You can configure whether expired content should be returned from the cache, if the requested website is not available. For instructions, see Configure whether to return expired objects from the cache.

Important

  • If a website does not have appropriately configured cache control directives for content that should not be cached, ISA Server may return user content to a malicious user.

RAM caching

ISA Server caches objects to random access memory (RAM) and to the disk. Objects cached to memory can be retrieved faster than objects cached to the disk. By default, 10 percent of the RAM is used for caching objects. All additional objects are cached only to the disk. For instructions, see Configure percentage of available memory to use for caching.

Headers

ISA Server does not cache responses to requests that contain the following HTTP response headers:

  • cache-control: no-cache
  • cache-control: private
  • pragma: no-cache
  • www-authenticate
  • set-cookie

In addition, the ISA Server computer does not cache responses to requests that contain the following HTTP request headers:

  • authorization, unless the origin server explicitly allowed this by including 'cache-control: public' header in the response
  • cache-control: no-store

Active caching

With active caching enabled, ISA Server analyzes objects that are in the cache to determine which are most frequently accessed. When popular objects in the cache get ready to expire, ISA Server automatically refreshes the content in the cache.

When active caching is enabled, if you are using a dial-up connection to the Internet, the computer will dial out to the Internet service provider (ISP) when retrieving this content.

You can configure the active caching policy. Select one of the following:

  • Frequently. In this case, frequently requested objects should be downloaded to the cache regularly, as they are about to expire. This will help ensure that an object requested by a client will be in the cache.
  • Less Frequently. Some frequently requested objects will be downloaded to the cache. Although there is less likelihood that the object will be fresh and in the cache, network performance may be improved, since active caching is at a minimum.
  • Normally. This balanced approach is the default. Objects are updated somewhat frequently, but network performance is not ignored.

For more information, see Configure active caching.


Cache rules

Cache rules let you specify the types of content stored in the cache and how objects are served from the cache. Depending on your organization's needs, cache rules can be applied to content from all sites or to specified sites (destination sets), and to all content groups or limited to specified content types. In addition, you can limit the amount of time that objects are considered valid, and the way cache rules handle expired objects.

For instructions, see Create a cache rule.

Configuring cache storage

On a per-rule basis, you can configure which objects are stored in the cache. For any given destination, you can specify whether content will be cached, and which types of content will be cached:

  • Dynamic content. Specifies that ISA Server will cache retrieved objects even if they are marked as not cacheable.
  • Content for offline browsing. Specifies that ISA Server will serve all the requests from the content in the cache, therefore requiring that even not cacheable content (with 302 and 307 response codes) are stored in the cache.
  • Content requiring user authentication for retrieval. Specifies that ISA Server will cache content that may require authentication to be accessed.
  • Maximum object size. Specifies maximum size of objects that ISA Server will cache. For instructions, see Limit size of objects cached for a cache rule.

Retrieving objects from the cache

As part of the cache rules configuration, you can define how objects in the cache are retrieved and served from the cache.

Before ISA Server serves an object from the cache, it checks whether a valid copy of the object exists in the cache. An object is considered valid if its Time to Live (TTL) did not expire, as specified in the HTTP or FTP caching properties, or in the object itself. Depending on how you configure the rule's cache properties, ISA Server will retrieve the object from the cache. You can configure ISA Server to do one of the following:

  • Retrieve an object from the cache only if the object is still valid. If an object is not valid, the request is routed to the server and retrieved.
  • Retrieve an object from the cache regardless of whether the object is still valid or not.
  • Never route the request. If no version of the object is found in the cache, an error page is returned.

You can also configure the cache rule so that the requested object is never saved to the cache.

Caching HTTP and FTP content

For a specified destination, you can configure whether to cache HTTP content and FTP content. If HTTP content is cached, you can also configure expiration policy for the HTTP objects. Similarly, you can configure expiration policy for FTP objects.

With cache rules configuration, you can define whether caching will be enabled for HTTP, FTP, and SSL responses. You can also configure the cache rule to limit cached content according to file size.

HTTP object caching

Cached HTTP objects expire according to TTL settings. For HTTP objects, expiration is configured based on the TTL defined in the response header, and the TTL boundaries defined in the cache rule. TTL boundaries are calculated as a percentage of content age, which is the amount of time since an object was created or modified. HTTP objects expire according to the TTL defined for HTTP objects in the cache rule. For instructions, see Configure HTTP caching for a cache rule.

FTP object caching

You can configure how FTP objects are maintained in the ISA Server cache. For FTP objects, you can choose whether to activate caching, and you can configure the TTL period for all objects.

By default, the TTL for all FTP objects is set to one day.

For configuration instructions, see Configure FTP caching for a cache rule.

SSL object caching

You can configure whether SSL objects are maintained in the ISA Server cache. For configuration instructions, see Configure SSL caching for a cache rule.

Rule order

Cache rules are ordered, with the default cache rule processed last. For each new connection, the ISA Server computer processes the cache rules in order (that is, the first rule is processed first). If the request matches the conditions specified by the rule, the request is cached accordingly. Otherwise, the next rule is processed. This continues until the last rule, the default rule, is processed, and applied to the request.

Default cache rule

When you install ISA Server, it configures a default cache rule. The default rule is initially configured so that only valid requested objects will be retrieved from the ISA Server cache. If the object in the cache is not valid, it will be retrieved directly from the Internet.

You cannot modify how the default cache rule retrieves objects.


Content download jobs

Using the cache content download job feature of ISA Server 2004, you can schedule content download from the Internet directly to the ISA Server cache. A background process downloads the content according to a predefined schedule.

Cache content download jobs allow you to update the ISA Server cache with Hypertext Transfer Protocol (HTTP) contents that may soon be requested by Web Proxy clients. Scheduled cache content download can save valuable network bandwidth and improve the overall cache performance without affecting throughput.

For ISA Server to download content as specified in the content download job, the Scheduled Download Jobs system policy configuration group must be enabled. For instructions, see Enable system policy configuration group. Note that when you enable this system policy configuration group, ISA Server blocks unauthenticated HTTP traffic from the ISA Server computer. This is true even if some other policy rule allows the traffic.

If you want to allow such traffic, instead of enabling the system policy configuration group, you could create an access rule that allows the HTTP access to All Networks, which is required to effectively run content download jobs. Additionally, add a higher-ordered access rule that allows unauthenticated HTTP access from the Local Host network.

The routing configuration specified in Web chaining rules always takes precedence over the routing configuration specified in content download jobs. That is, even if the content download job specifies not to route the request, and even if the object exists in the cache, the request will be routed if a Web chaining rule specifies to route the request. For more information about Web chaining rules, see Web chaining rules.

For instructions, see Create a scheduled cache content download job.

Note

  • If the cache content download job fails, an event is logged to the Windows event viewer.

Automating cache content download

ISA Server extends caching performance with customized cache download. By monitoring and analyzing Internet access, you can determine which HTTP content will be needed and when. You can then use the scheduled cache content download feature to download the HTTP content directly to the ISA Server cache, upon request or as scheduled. This enables you to update the ISA Server cache with HTTP content that you anticipate will be requested by clients in your organization. This content will be available for access directly from the ISA Server cache, rather than from the Internet.

You can download a single Uniform Resource Locator (URL), multiple URLs, or an entire website. When you create a scheduled cache content download job, you can limit which content will be downloaded. For example, you can limit the download to a single domain. Similarly, you can limit how many links to follow.

When you schedule cache content download, you can configure dynamic content to be cached by configuring the ISA Server cache to store the objects, even if the HTTP cache control headers indicate that they are not necessarily cacheable. For instructions, see Configure a location from which to download cache content.

Warning

  • If the Web server from which the object is being downloaded requires client authentication, the scheduled content download job will fail.

The download occurs according to a preconfigured schedule. You can also specify if the schedule will recur periodically. For instructions, see Configure a cache content download job schedule.


Caching: How To

This section provides instructions for configuring the cache feature of Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Configure General Cache Properties
  • Configure Cache Rules
  • Configure Content Download Jobs


Configure General Cache Properties

This section provides step-by-step instructions about how to configure general caching properties.

  • Enable caching
  • Configure cache size
  • Configure active caching
  • Configure which content to cache
  • Configure maximum size of objects in the cache
  • Configure negative caching
  • Configure whether to return expired objects from the cache
  • Configure the percentage of available memory to use for caching


Enable caching

To enable caching

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab.
  3. On the Tasks tab, click Define Cache Drives.
  4. Select one of the drives listed in the list box.
  5. In Maximum cache size, type the amount of space on the selected drive to allocate for caching.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Caching is enabled only when the size of at least one cache drive is greater than zero.
  • When the Microsoft Firewall service is stopped, the cache drives are not displayed in ISA Server Management.

Related Topics


Configure cache size

To configure cache size

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab.
  3. On the Tasks tab, click Define Cache Drives.
  4. Select one of the drives listed in the list box.
  5. In Maximum cache size, type the amount of space on the selected drive to allocate for caching.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Caching is enabled only when the size of at least one cache drive is greater than zero.
  • When the Microsoft Firewall service is stopped, cache drive information is not displayed in ISA Server Management.
  • Although unformatted drives are listed, they cannot be used for caching.

Related Topics


Configure active caching

To configure active caching

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. On the Tasks tab, click Configure Cache Settings.
  3. On the Active Caching tab, select the Enable active caching check box.
  4. Do one of the following:
    • If you want to refresh and revalidate previously cached objects before they expire, click Frequently.
    • If you want to balance between fast response and network load, click Normally.
    • If you do not want to add to the network load, click Less frequently.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When active caching is enabled, ISA Server retrieves current content from the Internet, according to specified settings. If you are using a dial-up connection to the Internet, the computer will dial out to the Internet service provider when retrieving this content.

Related Topics


Configure which content to cache

To configure which content to cache

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. On the Tasks tab, click Configure Cache Settings.
  3. On the Advanced tab, to cache objects for which a last modification time is not specified, select the Cache objects that have an unspecified last modification time check box.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure maximum size of objects in the cache

To configure maximum size of objects in the cache

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. On the Tasks tab, click Configure Cache Settings.
  3. On the Advanced tab, to limit maximum size of URLs cached in memory, in Maximum size (bytes) or URL cached in memory, type the maximum number of bytes in the text box.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure negative caching

To configure negative caching

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. On the Tasks tab, click Configure Cache Settings.
  3. On the Advanced tab, select the Cache objects even if they do not have an HTTP status code of 200 check box.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure whether to return expired objects from the cache

To configure whether to return expired objects from the cache

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. On the Tasks tab, click Configure Cache Settings.
  3. On the Advanced tab, select one of the following:
    • Do not return the expired object. If you select this option, an error page will be returned.
    • Return the expired object only if expiration was. Select this option to return an expired version of the object from the ISA Server cache.
  4. If you selected to return the expired object, specify the Time to Live (TTL) limits for the object.
    • In At less than this percentage of original Time to Live, specify the maximum percentage of the TTL. If the expiration time exceeds this limit, the object is not returned.
    • In But no more than, specify the maximum number of minutes since the object expired. If the expiration time exceeds this limit, the object is not returned.

Related Topics


Configure the percentage of available memory to use for caching

To configure the percentage of available memory to use for caching

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. On the Tasks tab, click Configure Cache Settings.
  3. On the Advanced tab, in Percentage of available memory to use for caching, type a number between 1 and 100 that specifies the maximum percentage of memory that should be allocated for caching.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure Cache Rules

This section provides steps for configuring cache rules.

  • Create a cache rule
  • Configure network entities for a cache rule
  • Configure how Web objects are cached
  • Configure HTTP caching for a cache rule
  • Configure FTP caching for a cache rule
  • Configure SSL caching for a cache rule
  • Limit size of objects cached for a cache rule
  • Disable a cache rule
  • Delete a cache rule


Create a cache rule

To create a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab.
  3. On the Tasks tab, click Create a Cache Rule.
  4. Follow the on-screen instructions.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure network entities for a cache rule

To configure network entities for a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab, and then select the applicable cache rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the To tab, do the following:
    • To apply the rule to specific network entities, click the upper Add button, and then select the network entities to which the rule should be applied.
    • To specify network entities to which the rule should not be applied, click the lower Add button, and then select the network entities to which the rule should not be applied.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The rule will never be applied to network objects in the Exceptions list, even if the network object is also included in the This rule applies to content requested from these destinations list.

Related Topics


Configure how Web objects are cached

To configure how Web objects are cached

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab, and then select the applicable cache rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Cache Store and Retrieval tab, select one of the following options:
    • If the objects should only be retrieved from the cache if it has not expired, click Only if a valid version of the object exists in cache. If no valid version exists, route the request.
    • If the object should be retrieved from the cache when available and otherwise using the specified route, click If any version of the object exists in cache. If none exists, route the request.
    • If the object should only be retrieved if it is in the cache, click Any version of the requested object. Never route the request.
  5. In Cache content, select one of the following options:
    • If retrieved objects should not be cached, click Never. No content will ever be cached.
    • If content should be cached only if the source and request headers indicate that the object should be cached, click If source and request headers indicate to cache. Then, select one or more of the following:
      • Dynamic content (If ISA Server will cache retrieved objects even if they are marked as not cacheable.)
      • Content for offline browsing
      • Content requiring user authentication for retrieval

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure HTTP caching for a cache rule

To configure HTTP caching for a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab, and then select the applicable cache rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the HTTP tab, select the Enable HTTP caching check box.
  5. To specify how long HTTP objects will remain in the cache, expressed as a percentage of the time of the content's existence, type a number in Set TTL of objects.
  6. To specify how long HTTP objects will remain in the cache, expressed as a time, type the minimum and maximum time in No less than and No more than.
  7. To retain objects beyond their expiration time in the cache, but in accordance with the settings you configured, select Also apply these TTL boundaries to sources that specify expiration.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The higher the percentage you specify in Set TTL of objects, the less frequently the cache is updated.
  • When you shorten the Time to Live (TTL) by specifying the Also apply these TTL boundaries to sources that specify expiration option, objects in the cache will be more recent. However, there may be some degradation in network performance, because objects are retrieved frequently from the Internet.
  • To restore the TTL defaults, click Restore defaults.
  • Even when you disable HTTP caching for all cache rules, ISA Server allocates cache memory. To stop ISA Server from allocating memory, set the cache size to 0.

Related Topics


Configure FTP caching for a cache rule

To configure FTP caching for a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab and select the applicable cache rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the FTP tab, select the Enable FTP caching check box.
  5. To specify how long the FTP objects should remain in the cache, in Time-to-Live for FTP objects, type a number. Select a time unit from the drop-down list: Seconds, Minutes, Hours, Days, or Weeks.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To reset FTP expiration policy to equal importance, click Restore defaults.
  • When you disable FTP caching for all cache rules, ISA Server nonetheless allocates cache memory. To stop ISA Server from allocating memory, set the cache size to 0.

Related Topics


Configure SSL caching for a cache rule

To configure SSL caching for a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab, and then select the applicable cache rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Advanced tab, select the Cache SSL responses check box.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Limit size of objects cached for a cache rule

To limit size of objects cached for a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab and select the applicable cache rule.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Advanced tab, select the Do not cache objects larger than check box.
  5. Type the size and select a unit of measurement from the drop-down list.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • ISA Server includes the size of the object's headers when calculating the object size.

Related Topics


Disable a cache rule

To disable a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab and select the applicable rule.
  3. On the Tasks tab, click Disable Selected Rules.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To enable a cache rule, on the Tasks tab, click Enable Selected Rule.

Related Topics


Delete a cache rule

To delete a cache rule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Cache Rules tab and select the applicable rule.
  3. On the Tasks tab, click Delete Selected Rules.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure Content Download Jobs

This section provides steps for configuring content download jobs.

  • Create a scheduled cache content download job
  • Configure a cache content download job schedule
  • Configure a location from which to download cache content
  • Limit the number of connections created for a content download job
  • Configure Time to Live for downloaded cache content
  • Configure which content to include in a content download job
  • Run a content download job now
  • Disable a content download job
  • Delete a content download job


Create a scheduled cache content download job

To create a scheduled cache content download job

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab.
  3. On the Tasks tab, click Schedule a Content Download Job.
  4. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Content download jobs can only run if:
    1. The Local Host network is configured to listen for Web Proxy client requests.
    2. The system policy rules allowing content download are enabled.
    3. The Microsoft ISA Server Job Scheduler service must be running.

Related Topics


Configure a cache content download job schedule

To configure a cache content download job schedule

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab.
  3. On the Tasks tab, click Edit the Select Job.
  4. On the Schedule tab, in Date and Time, select the date and time when the content should be downloaded from the Internet.
  5. In Download Frequency, do one of the following:
    • To download the content only once at the specified time, click Once.
    • To download the content every day at the specified time, click Daily.
    • To download the content on a specified day at a specified time, click Weekly on and select the check boxes for the days on which to download content.
  6. If you selected Daily or Weekly on, in Daily Frequency, do one of the following:
    • To download the content only once a day, click Run the job one time every day.
    • To download the content several times during the day, click Repeat every, and then type how often to run the job.
    • In Do not start a new run of the job after, type the latest time at which a content download job should begin.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure a location from which to download cache content

To configure a location from which to download cache content

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab.
  3. On the Tasks tab, click Edit the Select Job.
  4. On the Content tab, in Download content from this URL, type the Uniform Resource Locator (URL) from which to download the content.
  5. To download only content from the domain specified in Begin downloading from URL, select the Do not follow link outside the specified URL domain name check box.
  6. To limit the number of links to follow from a single page when downloading content, select the Maximum depth of links per page check box and type the number of links.
  7. To limit the total number of objects to cache, in Maximum number of cache objects, type the number of objects.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Type the URL using this format: http://widgets.microsoft.com/path.

Related Topics


Limit the number of connections created for a content download job

To limit the number of connections created for a content download job

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab.
  3. On the Tasks tab, click Edit the Select Job.
  4. On the Content tab, in Maximum number of concurrent TCP connections to create for this job, type the maximum number of connections that can be created for this job.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure Time to Live for downloaded cache content

To configure Time to Live for downloaded cache content

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab.
  3. On the Tasks tab, click Edit the Select Job.
  4. To override the Time to Live (TTL) for an object, click the Override object's TTL check box.
  5. If the TTL is not defined, to override the TTL for an object, click the Set TTL if not defined check box.
  6. To configure a specific TTL for the downloaded objects, type a TTL in Mark downloaded objects with a new TTL of Number minutes.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you click Override object's TTL, the TTL will be determined either by the TTL specified here or by the TTL specified in the cache configuration properties.

Related Topics


Configure which content to include in a content download job

To configure which content to include in a content download job

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab.
  3. On the Tasks tab, click Edit Selected Job.
  4. On the Cache tab, in Cache content, select one of the following options:
    • If all content should always be cached, even if the headers in the request or response indicate that the object should not be cached, click All content will be cached.
    • If content should be cached only if the headers in the request or response indicate that the object should be cached, or if the content is dynamic, click If source and request headers indicate to cache, or if content is dynamic, then the content will be cached.
    • If content should be cached only if the headers in the request or response indicate that the object should be cached, click If source and request headers indicate to cache, then the content will be cached.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you select All content will be cached, all content is cached, including the redirection responses (301, 302, and 307).
  • When you select If source and request headers indicate to cache, or if content is dynamic, then the content will be cached, even when the headers do not indicate to cache the content—because it is dynamic—the content is cached.

Related Topics


Run a content download job now

To run a content download job now

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab.
  3. On the Tasks tab, click Start Selected Jobs Now.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Content download jobs can run only if:
    • The Local Host network is configured to listen for Web Proxy client requests.
    • The system policy rules allowing content download are enabled.
    • The Microsoft ISA Server Job Scheduler service must be running.
  • To stop a content download job, on the Tasks tab, click Stop Running Jobs.

Related Topics


Disable a content download job

To disable a content download job

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab.
  3. On the Tasks tab, click Disable the Selected Jobs.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To enable a content download job, on the Tasks tab, click Enable the Selected Jobs.

Related Topics


Delete a content download job

To delete a content download job

  1. In the console tree of ISA Server Management, click Cache.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Cache
  2. In the details pane, click the Content Download Jobs tab.
  3. On the Tasks tab, click Delete the Selected Jobs.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Troubleshooting caching

What problem are you having?

Not all traffic is saved to the ISA Server cache.

Cause: ISA Server caches only items that meet the caching criteria.

Solution: When clients access objects that can be cached, network performance seems to improve, as the objects are retrieved from the ISA Server cache rather than from the network. However, if your clients are commonly accessing objects that are not cached, you may not perceive improved performance.


Monitoring

This section provides information about the monitoring feature of Internet Security and Acceleration (ISA) Server 2004.

  • Monitoring: Concepts
  • Monitoring: How To
  • Troubleshooting monitoring


Monitoring: Concepts

This section provides background information about the monitoring feature of Internet Security and Acceleration (ISA) Server 2004.

  • Dashboard
  • Alerts
  • Sessions
  • Services
  • Logs
  • Reports
  • Connectivity
  • Performance monitor


Dashboard

The Dashboard view of ISA Server summarizes monitoring information about sessions, alerts, services, reports, connectivity, and general system health. The default Dashboard view displays the following information:

  • Connectivity. Checks connectivity from ISA Server to other computers or URLs.
  • Alerts. Lists the events that have occurred on the ISA Server computer.
  • Services. Lists the services on the ISA Server computer and the current status.
  • Sessions. Lists the total number of client sessions.
  • Reports. Lists newly created reports.
  • System health. Displays performance information about the ISA Server computer.

In each Dashboard area, there is visual status indication. An X in a red circle indicates a potential problem, a yellow icon indicates a warning, and a check mark in a green circle indicates that everything is okay.

You can customize the Dashboard view to hide information.

For instructions on viewing the Dashboard, see View the Dashboard.

Using the Dashboard to monitor ISA Server status

The Dashboard is useful to quickly identify critical issues related to ISA Server. It can be part of a daily routine, to verify the status of critical servers and services.

For example, you might verify that the ISA Server services are up and that key servers have connectivity. A glance at the Dashboard will show you if everything is running smoothly. After you check the operating status, you can review any alerts, to check if any attacks have been thwarted—or if any specific problem requires your immediate attention.

When you encounter an issue on the Dashboard, you can easily search for more information. Click on the relevant pane header to jump to a tab with more detailed information.

You can acknowledge and reset alert instances in the Dashboard view. For more information about acknowledging and resetting alerts, see Alerts.


Alerts

The alert service of ISA Server notifies you when specified events occur. You can configure alert definitions to trigger a series of actions when an event occurs. The ISA Server alert service acts as a dispatcher and as an event filter. It is responsible for catching events, checking whether certain conditions are met, and taking corresponding actions.

ISA Server Management displays the full list of events that have occurred, categorized by alert type: information, warning, and error.

All alerts are displayed in the Alerts view.

Acknowledging and resetting alerts

When an event occurs, ISA Server triggers the action configured in the alert definition. The alert is displayed in the Alerts view, and a summary of all the events are listed in the Dashboard view.

You can reset an entire group of alert instances, by selecting the alert header. In the Alerts view, alert instances are grouped together by category (for example, Service shutdown). You can expand or collapse the group headings to display or hide the items they contain.

You can use ISA Server Management to indicate that you are handling a specific event, or a group of events, by acknowledging the events. When you mark an event (or groups of events) as acknowledged, the status for those events is changed in the Alerts view—and those events are no longer displayed on the Dashboard. For instructions, see Acknowledge an alert.

Similarly, you can reset an alert, thereby effectively removing it from the Alerts view. For instructions, see Reset an alert.

Note

  • All alerts are reset when the ISA Server computer reboots.

Creating alert definitions

When you install ISA Server, an alert is preconfigured for every event type. You can define more specific events. For example, consider the preconfigured alert definition for the Network configuration changed event. As the network administrator, you might want to refine this general alert, creating two unique alert definitions:

  • An alert definition for when a network is disabled.
  • An alert definition for when a network is enabled.

The alert definition for the former would trigger an action to run a batch file to disconnect the computer from a load balancing cluster each time a network becomes disabled. The alert definition for the latter might be to send you an e-mail message.

Note

  • Alerts with specific events take precendence over less-specific events. For example, suppose you have two alerts configured, one for "Any network configuration change" and the other for "Network connected". When a network is connected, the alert actions for the latter will be performed.

For instructions, see Add an alert definition.

Configuring alert definitions

You can select which event and additional condition trigger an alert action.

You can also configure the following thresholds, which determine when the alert action will be performed:

  • How many times per second the event will occur before issuing an alert (also called the event frequency threshold).
  • How many events will occur before the alert is issued.
  • How long to wait before issuing the alert again.

For instructions, see Edit an alert condition.

Alert action

You can set one or more of the following actions to be performed when an alert condition is met:

  • Send an e-mail message.
  • Run a specific action.
  • Log the event in the Windows event log.
  • Stop or start the Microsoft Firewall service or Scheduled Content Download service.

You can configure which credentials will be used when an application is executed. Use the Local Security Policy to configure user privileges.

Note

  • Be sure that the specified user has Logon as batch job privileges.

When the alert action is to execute a command, the path specified for the command action must exist on the ISA Server computer. We recommend that you use environment variables (such as %SystemDrive%) within the path name.

For instructions, see Edit an alert action.

If you configure an e-mail action to use an SMTP server located on the Internal network, you must enable the system policy rule that allows the Local Host network to access the Internal network using the SMTP protocol. In the System Policy Editor, in the Remote Monitoring configuration group, select SMTP and then click Enable. The Allow SMTP protocol from firewall to trusted servers rule is enabled.

If you configure an e-mail action to use an external SMTP server, you must create an access rule that allows the Local Host network to access the External network (or the network on which the SMTP server is located), using the SMTP protocol.

Events

The following table lists the events and, where relevant, additional keys that are defined by ISA Server. When you create an alert, you specify one of the following events that triggers the alert.

Event | Description
Alert action failure | The action associated with this alert failed.
Cache container initialization error | The cache container initialization failed, and the container was ignored.
Cache container recovery complete | The recovery of a single container was completed.
Cache file resize failure | The operation to reduce the size of the cache file failed.
Cache initialization failure | The Web cache proxy was disabled because of global failure.
Cache restoration completed | The cache content restoration was completed.
Cache write error | There was a failure in writing content to the cache.
Cached object discarded | During cache recovery, an object with conflicting information was detected. The object was ignored.
Component load failure | There was a failure to load an extension component.
Configuration error | An error occurred while reading configuration information.
Connection limit exceeded | A user or an IP address exceeded its connection limit.
Connection limit for a rule was exceeded | The number of connections per second allowed for a rule was exceeded.
DHCP anti-poisoning intrusion detection disabled | The DHCP anti-poisoning intrusion detection mechanism was disabled.
Dial on demand failure | There was a failure to create a dial-on-demand connection, because there is no answer or the line is busy.
DNS Zone Transfer Intrusion | A zone transfer attack occurred.
Event log failure | There was a failure to log the event information to the system event log. This alert is disabled by default.
Firewall communication failure | There is a failure in communication between the Firewall client and the ISA Server service.
FTP Filter Initialization Warning | The FTP filter failed to parse the allowed ftp commands. Verify that the commands are stored in the correct format. Each command should be no more than 4 characters long and each command should be seperated from the previous one with a space character.
Intrusion detected | An external user attempted an intrusion attack.
Invalid CRL Found | Client certificate was revoked due to invalid or missing Certificate Revocation List (CRL). The CRL may have expired and ISA Server was unable to download a valid CRL. Verify that the CRL download system policy configuration group is enabled and that there is connectivity to the CRL Distribution Points (CDPs).
Invalid DHCP offer | The DHCP offer IP address is not valid.
Invalid dial-on-demand credentials | Invalid dial-on-demand credentials were detected.
Invalid ODBC log credentials | The specified user name or password for this ODBC database is invalid.
IP Spoofing | The IP packet source address is not valid.
ISA Server computer restart is required | Changes made to the configuration will only take effect after restarting the computer.
Log failure | The <service name> log failed.
Log storage limits | One or more of the log storage limits was reached.
Network configuration changed | A network configuration change that affects ISA Server was detected.
No available ports | Failed to create a network socket because there are no available ports.
No connectivity | ISA Server failed to establish a connection to the requested server.
OS component conflict | There is a conflict with one of the operating system components: IP network address translation (NAT) editor, Internet Connection Sharing (ICS), or Routing and Remote Access.
Oversized UDP packet | ISA Server dropped a User Datagram Protocol (UDP) packet because it exceeded maximum size, as specified in the registry key.
POP Intrusion | Detected a Post Office Protocol (POP) buffer overflow.
Quarantined VPN Clients network changes | A user was removed from Quarantined VPN Clients network. This alert is disabled by default.
Report Summary Generation Failure | Received an error while generating a report summary from log files.
Resource allocation failure | There was a resource allocation failure. For example, the system ran out of memory.
Routing (chaining) failure | ISA Server failed to route the request to an upstream server.
Routing (chaining) recovery | The ISA Server resumed routing to an upstream server.
RPC Filter - Bind failure | RPC Filter cannot use the defined port because it is already in use.
RPC filter - connectivity changed | The connectivity to the publishing RPC service <server name> changed. <additional key>
Server Publishing Failure | The server publishing rule is configured incorrectly.
Server publishing is not applicable. | The server publishing rule cannot be applied.
Server Publishing Recovery | The server publishing rule can now be applied.
Service Initialization failure | There was a service initialization failure.
Service not responding | An ISA Server service terminated or stopped functioning unexpectedly.
Service shutdown | A service stopped properly. <%service name%>
Service started | A service started properly. <%service name%>
Slow connectivity | ISA Server encountered a slow connection to the requested server.
SMTP Filter Event | A Simple Mail Transfer Protocol (SMTP) command rule was violated.
SOCKS configuration failure | The port specified in SOCKS properties is in use by another protocol.
SYN Attack | ISA Server detected a SYN attack.
Unregistered event | An unregistered event was raised.
Upstream chaining credentials | The upstream chaining credentials are incorrect.
VPN connection failure | VPN client connection attempt failed.


Sessions

Using the ISA Server real-time monitoring feature, you can centrally monitor ISA Server computer activity. The Sessions view is refreshed automatically, each time a new session is identified by ISA Server. For instructions, see View sessions.

A session is the unique combination of a client's IP address and user name. When ISA Server does not require authentication, all traffic from the same IP address is considered a single session. In this way, if a Web browser opens more than one TCP connection to the same IP address, ISA Server considers the connections to be a single session.

ISA Server lists sessions of the following types: Firewall client, SecureNAT, virtual private network (VPN) client, VPN site-to-site, and Web proxy.

Web proxy sessions indicate the last minute of Web browser activity, even if the client is not currently browsing.

If a publishing server is currently being published, ISA Server will show it as a Firewall client session. Therefore, some Firewall client sessions may be listed, even if no client is actually connected.

All session details are listed in the Sessions view. A summary of total Firewall client, SecureNAT, and Web proxy sessions is displayed on the Dashboard. For more information, see Dashboard.

Note

  • When IP Routing is disabled, traffic from users and IP addresses is listed in the Sessions view. When IP Routing is enabled, only sessions from traffic that passes via an application filter is listed.

Filtering Sessions view

You can filter the Sessions view to focus on specific issues. For example, if a client reports problems connecting, you can filter the Sessions view to display only sessions initiated by that client. The Sessions viewer displays only data for sessions that match all the expressions included in the filter. In other words, the filter expressions are combined using the logical AND operator. For instructions, see Monitor specific sessions.

After you create a query, effectively filtering the Sessions view, you can save it for future use. It is often useful to have a set of queries, with each query used to focus on a different session type. For instructions, see Save a monitoring filter definition and Reload a monitoring filter definition.

Disconnecting sessions

The Sessions view provides a visual indication of any potentially malicious or unwanted session activity. In the Sessions view, you can stop the unwanted session immediately. For instructions, see Disconnect a session.

When you stop a session, all associated connections are also closed.

Note that stopping sessions will not prevent a client from reactivating the session. Instead, you must change the firewall policy configuration, creating a rule that specifically denies access to the unwanted clients. For more information, see Firewall policy overview.

Pausing and stopping session monitoring

You can stop session monitoring, essentially clearing the Sessions view on ISA Server. When you stop session monitoring, ISA Server loses all information about any sessions that had been monitored. When you restart session monitoring, ISA Server must collect all information about active sessions.

Alternatively, you can pause monitoring. In this case, sessions displayed in the Sessions view are not removed. However, new sessions are not added to the view. When you resume session monitoring, ISA Server updates the Sessions view with the relevant, new session information.

For instructions, see Pause session monitoring and Stop monitoring sessions.


Services

When you install ISA Server, the following Microsoft® Windows® operating system services are also installed:

  • Microsoft Firewall service
  • Microsoft ISA Server Control service
  • Microsoft ISA Server Job Scheduler service
  • Microsoft Data Engine

You can use the Services view to stop or start the Microsoft Firewall, Microsoft ISA Server Job Scheduler, and the Microsoft Data Engine services. For instructions, see Start or stop a service.

In addition, the packet filter driver (fweng) is a kernel mode driver that gets all traffic on the firewall and makes the packet filtering and address translation decisions on the network traffic.

Microsoft Firewall service

Microsoft Firewall service (fwsrv) is a Windows service that supports requests from Firewall clients and SecureNAT clients.

You can use ISA Server Management to monitor Microsoft Firewall service status. Similarly, you can use ISA Server Management to stop or start the Firewall service.

The Firewall service supports requests from any Web browser. This allows Web access to nearly every desktop operating system, including Microsoft Windows Server™ 2003, Windows XP, Windows 2000, Windows Millennium Edition, Windows NT®, Windows 98, Windows 95, Macintosh, and UNIX. The Firewall service works at the application level on behalf of a client requesting an Internet object that can be retrieved using one of the protocols supported by the Web Proxy protocols: File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), and HTTPS.

Clients—typically browsers—must be specifically configured to use the ISA Server computer. When a user requests a website, the browser parses the URL. If a dot-com address is used, as in a fully qualified domain name (FQDN) or IP address, the browser considers the destination to be remote and sends the HTTP request to the ISA Server computer for processing.

When you stop the Firewall service, the information in the cache is not deleted. However, when you restart the service, several seconds may pass before the cache is fully enabled and functional. If the service failed, ISA Server will restore the information in the cache. This will take some time, and performance may not be optimal until the cache is eventually restored.

ISA Server Control Service

The ISA Server Control service (mspadmin) is a Microsoft Windows service that is responsible for:

  • Restarting other ISA Server services, as necessary.
  • Generating alerts and running actions.
  • Deleting unused log files.

You cannot use ISA Server Management to stop or start the ISA Server Control service. To stop the service, type the following at a command prompt:

net stop isactrl

If you stop the ISA Server Control service, all other ISA Server services will also be stopped.

Microsoft ISA Server Job Scheduler

The Microsoft ISA Server Job Scheduler service (w3prefch) is a Microsoft Windows service that downloads cache content from Web servers, according to the jobs you configure using ISA Server Management.

You can use ISA Server Management to monitor the Microsoft ISA Server Job Scheduler service status. Similarly, you can use ISA Server Management to stop or start the Microsoft ISA Server Job Scheduler service.

If this service is stopped, you cannot run scheduled content download jobs.


Logs

By default, when you install Internet Security and Acceleration (ISA) Server 2004, logging is enabled for all components. You can disable logging for any component, including Web Proxy, Microsoft Firewall service, or SMTP Message Screener. By default, the log information for Web Proxy and Firewall service logs are saved to a Microsoft Data Engine (MSDE) database, which can be displayed in the log viewer. You can configure the log storage, saving the information to a file, an SQL database, or an MSDE database.

This section provides information about the logging feature of ISA Server 2004.

  • Log storage format
  • Log viewer
  • Microsoft Firewall service log fields
  • Web Proxy log fields
  • SMTP Message Screener log fields
  • SQL database logging


Log storage format

ISA Server log information can be viewed in a log viewer, directly from ISA Server Management. In addition, the log information can be stored in one of the following formats:

  • Microsoft Data Engine (MSDE) database
  • SQL database
  • File

MSDE database

When you save log information in MSDE format, it can be viewed in the log viewer. This enables you easy access to online information about network activity. Because you can export the data displayed in the log viewer, you can also save, in a text file, the data displayed in MSDE format. For instructions, see Configure logging to an MSDE database.

MSDE logs are limited to two gigabytes. When a log exceeds this limit, ISA Server automatically creates a new database. Similarly, a new log is created at the beginning of every day. The log viewer, however, displays all the data as if it were in a single database.

SQL database

You can save log information to an SQL database. This is useful for remote logging. For security considerations when logging to an SQL database, see Best practices: logging.

For instructions, see Configure logging to an SQL database.

The system policy rule named Allow remote logging using NetBios transport to trusted servers must be enabled to log to an SQL database.

File

You can save ISA Server logs to a file, in one of the following formats:

  • World Wide Web Consortium (W3C) format
  • ISA Server format

The SMTP Message Screener log information is saved by default in file format. It cannot be saved to a database.

For instructions, see Configure logging to a file.

Log files are limited to two gigabytes. When a file exceeds this limit, ISA Server automatically creates a new file. Similarly, a new log file is created at the beginning of every day.

W3C logs contain both data and directives, describing the version, date, and logged fields. Because the fields are described in the file, unselected fields are not logged. The tab character is used as a delimiter. Date and time are in Coordinated Universal Time (UTC).

ISA Server format contains only data with no directives. All fields are always logged. Unselected fields are logged with a dash, to indicate that they are empty. The comma character is used as a delimiter. The date and time fields are in local time.

Options

By default, the log information for MSDE logs and log files is stored in the ISALogs folder, under the ISA Server installation folder. You can change the location.

If you specify a relative directory, the log is saved in the ISALogs folder, under the ISA Server installation folder. If you specify an absolute path, the actual log folder may be different on every server.

Important

  • We recommend that you log to NTFS volumes.

You can compress log files to reduce the disk space required. Files are compressed only if stored on NTFS partitions. You may notice a decrease in performance when working with NTFS-compressed files. When you read from (access) a compressed file, Windows automatically decompresses it for you, and when you write to the file, Windows compresses it. This process may decrease your computer's performance.

Log maintenance

ISA Server features a log maintenance feature, which you can configure so that log files do not exceed specific space requirements. When you log to an MSDE database or to a file, you can configure how long log information should be stored on the local disk—and how much disk space should be allocated for logging. For instructions, see Configure log storage limits and Configure logging to an MSDE database.

ISA Server checks that logs do not exceed the specified limits every ten minutes. This means that for up to a period of ten minutes, logs might exceed the limits.


Log viewer

You can use the ISA Server log viewer to monitor and analyze traffic and troubleshoot network activity. The log viewer can display log entries as they occur (live). In this case, each time an event is logged, it is displayed in the log viewer.

Filtering the log viewer data

You can filter the data displayed in the log viewer, displaying data that meets specific criteria. The log viewer displays only log data if it matches all the expressions included in the filter. In other words, the filter expressions are combined using the logical AND operator.

For example, you may want all log entries currently being logged for a specific IP address. In this case, you would edit the logging filter as follows:

  • Set Client IP to the relevant IP address.
  • Set Log Time to Live.

When you filter the log, you must always select exactly one log record type (Firewall or Web Proxy) and one Log Time. For instructions, see Filter the log viewer data.

Log information can be displayed in the log viewer, regardless of log format. However, the Log Time must be set to Live for all log formats, other than Microsoft Data Engine (MSDE). For MSDE logs, you can filter the Log Time, thereby displaying historic log information. For more information on log formats, see Log storage format.

Notes

  • When you filter the log view, only up to ten thousand results are displayed in the log viewer.
  • Some log information, including IP data, Raw IP header, and Interface, is not displayed for traffic that is not allowed for reasons other than a policy rule or application filter. For example, if traffic is dropped because it is considered spoofed, the log information will not be displayed.

Offline log viewer

You can filter the data displayed in the log viewer, to display offline data. To do so, edit the logginf filter, setting Log Time to any time. As long as the Log Time is not set to Live, the log viewer displays offline data.

When you display offline data, the log viewer actually queries the database. Offline log viewing can be used only when the log storage format is MSDE.

Log viewer fields

The following table lists how fields for each of the ISA Server log files is displayed in the log viewer. Note that the SMTP Message Screener log information is not displayed in the log viewer.

Firewall | Web Proxy | Description
Action | Not applicable | For a table of possible values, see Action log values.
Not applicable | Authenticated Client | Indicates whether the client has been authenticated with ISA Server. Possible values are Y and N.
Bidirectional | Not applicable | Indicates whether the traffic is send/receive.
Bytes Received | Bytes Received | The number of bytes sent from the destination computer and received by the client during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the destination computer or that no bytes were received from the destination computer.
Bytes Sent | Bytes Sent | The number of bytes sent from the source client to the destination server during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the destination computer or that no bytes were sent to the destination computer.
Not applicable | Cache Info | This number reflects the cache status of the object, which indicates why the object was or was not cached. This field applies only to the Web Proxy log. For a table of possible values, see Cache info log values.
Client Agent Client Agent The client application type sent by the client in the Hypertext Transfer Protocol (HTTP) header. When ISA Server is actively caching, the client agent is ISA Server.
For Microsoft Firewall service, this field includes information about the client's operating system. For a table of possible values, see Operating system log values.
Client IP | Client IP | The IP address of the requesting client.
Client Username | Client Username | The account of the user making the request. If ISA Server access control is not being used, ISA Server uses anonymous.
Destination Host IP | Destination Host IP | The network IP address for the remote computer that provides service to the current connection. For Web Proxy, a hyphen (-) in this field may indicate that an object was sourced from the Web Proxy server cache and not from the destination. One exception is negative caching. In that case, this field indicates a destination IP address for which a negative-cached object was returned.
Destination Host Name | Destination Host Name | The domain name for the remote computer that provides service to the current connection. For Web Proxy, a hyphen (-) in this field may indicate that an object was retrieved from the Web Proxy server cache and not from the destination.
Destination Network | Destination Network | The network that provides service to the current connection.
Destination Port | Destination Port | The reserved port number on the remote computer that provides service to the current connection. This is used by the client application initiating the request.
Destination Proxy | Not applicable | The remote computer that provides service to the current connection.
Not applicable | Error Info | Error information
Not applicable HTTP Method Specifies the application method used. For Web Proxy, common values are GET, PUT, POST, and HEAD.
For Firewall service, common values are CONNECT, BIND, SEND, RECEIVE, GHBN (GetHostByName), and GHBA (GetHostByAddress).
Log Time | Log Time | The time that the logged event occurred.
Not applicable | Object Source | Indicates the source that was used to retrieve the current object. This field applies only to the Web Proxy log. For a table of possible values, see Object source log values.
Not applicable | MIME type | The Multipurpose Internet Mail Extensions (MIME) type for the current object. This field may also contain a hyphen (-) to indicate that this field is not used or that a valid MIME type was not defined or supported by the remote computer. This field applies only to the Web Proxy log.
Network Interface | Not applicable | Primary IP address of the interface that received the traffic.
Not applicable Processing Time This indicates the total time, in milliseconds, that is needed by ISA Server to process the current connection. It measures elapsed server time from the time that the server first received the request to the time when final processing occurred on the server—when results were returned to the client and the connection was closed.

For cache requests that were processed through Web Proxy, processing time measures the elapsed server time needed to fully process a client request and return an object from the server cache to the client.
Protocol Protocol Specifies the application protocol used for the connection. Common values are HTTP, File Transfer Protocol (FTP), and Secure Hypertext Transfer Protocol (HTTPS).
For Firewall service, the port number is also logged.
Raw Payload | Not applicable
Not applicable | Referring Server | If ISA Server is used upstream in a chained configuration, this indicates the server name of the downstream server that sent the request.
Result Code | Result Code | This field indicates the status of the request. For a table of possible values, see Result code log values.
Rule | Rule | This reflects the rule that either allowed or denied access to the request.
Not applicable | Server Name | The name of the computer running ISA Server. This is the computer name that is assigned in Microsoft Windows.
Not applicable Service The name of the service that is logged.
  • w3proxy indicates outgoing Web requests.
  • fwsrv indicates Firewall service.
  • w3reverseproxy indicates incoming Web requests.
Source Network | Source Network | The network from which the request originated.
Source Port | Not applicable | The port on which the requesting client makes the request.
Source Proxy | Not applicable | IP address representing the client computer.
Transport | Transport | Specifies the transport protocol used for the connection. Common values are TCP and User Datagram Protocol (UDP).
Not applicable | URL | This field shows the contents of the URL request. This field applies only to the Web Proxy log.


Microsoft Firewall service log fields

You can use the ISA Server log to monitor and analyze the status of the Microsoft Firewall service.

The following table lists the fields that you can include in each of the ISA Server log files. Note that, in ISA Server log format, if a field is disabled, it will appear in the log with a hyphen (-). In World Wide Web Consortium (W3C) log file format, the field will not appear.

The Field column refers to the position in the ISA Server file format.

You can limit the fields that are saved to the log. For instructions, see Specify fields to log.

Field | Firewall (W3C) | Firewall (MSDE) | Description
1 | computer | servername | The name of the computer running ISA Server. This is the computer name that is assigned in Microsoft Windows.
2 | date | TimeStamp | The date that the logged event occurred, according to the time and date set on the ISA Server computer. In Microsoft Data Engine (MSDE) format, this is the time stamp, which includes both the date and the time.
3 | time | Not applicable | The time that the logged event occurred, according to the time and date set on the ISA Server computer. In W3C format, this is in Coordinated Universal Time (UTC).
4 | IP Protocol | Protocol | Specifies the transport protocol used for the connection. Common values are TCP and User Datagram Protocol (UDP).
5 | source | SourceIP | The IP address of the requesting client. The source fields contains IP address and port in all formats except MSDE. In MSDE, the SourceIP and SourcePort fields are split into address and port, to allow you to query each by number.
5 |  | SourcePort | (MSDE only) For ICMP packet, this field indicates the ICMP type. In MSDE, the SourceIP and SourcePort fields are split into address and port, to allow you to query each by number.
6 | destination | DestinationIP | The network IP address for the remote computer that provides service to the current connection. The Destination field contains IP address and port in all formats except MSDE. In MSDE, the DestinationIP and DestinationPort fields are split into address and port, to allow you to query each by number.
6 |  | DestinationPort | (MSDE only) For ICMP packets, this field indicates the ICMP code. In MSDE, the DestinationIP and DestinationPort fields are split into address and port, to allow you to query each by number.
7 | original client IP | OriginalClientIP | The IP address of the client making the request.
8 | source network | SourceNetwork | The name of the network from which the request originated.
9 | destination network | DestinationNetwork | The name of the network that provides service for the current request.
10 | action | Action | Specifies the application method used. Common values are CONNECT, BIND, SEND, RECEIVE, GHBN (GetHostByName), and GHBA (GetHostByAddress).
11 | status | resultcode | This field indicates the status of the request. For a table of some possible values, see Result code log values.
12 | rule | rule | This reflects the rule that either allowed or denied access to the request.
13 | application protocol | ApplicationProtocol | Specifies the name of the application protocol, based on the protocol definitions, or Unidentified IP Traffic if the application protocol cannot be determined.
14 | Bidirectional | Bidirectional | Specifies whether the ApplicationProtocol is bidirectional (Send and Receive).
15 | bytes sent | bytessent | The number of bytes sent from the source client to the destination server during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the destination computer or that no bytes were sent to the destination computer.
16 | bytes sent intermediate | bytessentDelta | The number of bytes that have already been sent to the destination computer by the source client during the current connection.
17 | bytes received | bytesrecvd | The number of bytes sent from the destination computer and received by the client during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the destination computer or that no bytes were received from the destination computer.
18 | bytes received intermediate | bytesrecvdDelta | The number of bytes that have already been received by the destination computer from the source client during the current connection.
19 | connection time | connectiontime | The length of the connection, in milliseconds.
20 | connection time intermediate | connectiontimeDelta | The length of the connection so far, in milliseconds.
21 | source proxy | SourceProxy | Reserved for future use.
22 | destination proxy | DestinationProxy | Reserved for future use.
 | Source Name | SourceName | Reserved for future use.
24 | destination name | DestinationName | Reserved for future use.
25 | Username | ClientUserName | The account of the user making the request. If ISA Server access control is not being used, ISA Server uses anonymous.
26 | agent | ClientAgent | For Firewall clients, specifies operating system in this format: <Application_Name>:<OS_Signature>. For SecureNAT clients, this fields is empty.
27 | Session ID | sessionid | This identifies a session's connections. For Firewall clients, each process that connects through the Firewall service initiates a session. For SecureNAT clients, a single session is opened for all the connections that originate from the same IP address.
28 | Connection ID | connectionid | This identifies entries that belong to the same socket. Outbound TCP usually has two entries for each connection: when the connection is established and when the connection is terminated. UDP usually has two entries for each remote address.
29 | Interface | Interface | The primary IP address of the network adapter on which the request was received.
30 | IP header | IPHeader | The IP header of the packet.
31 | protocol payload | Payload | The IP payload of the packet.


Web Proxy log fields

You can use the ISA Server log to monitor and analyze the status of the Web proxy requests.

The following table lists the fields that you can include in each of the ISA Server log files. Note that, in ISA Server log format, if a field is disabled, it will appear in the log with a hyphen (-). In World Wide Web Consortium (W3C) log file format, the field will not appear.

The Field column refers to the position in the ISA Server file format.

You can limit the fields that are saved to the log. For instructions, see Specify fields to log.

Note

  • The authentication process for a Web Proxy client may consist of several requests, each of which is logged.
  • In the Web Proxy log, the destination IP address and port number are not logged for denied requests.
Field | Web Proxy (W3C) | Web Proxy (MSDE) | Description
1 | c-ip | ClientIP | The IP address of the requesting client.
2 | cs-username | ClientUserName | The account of the user making the request. If ISA Server access control is not being used, ISA Server uses anonymous.
3 | c-agent | ClientAgent | Indicates the "User-Agent" header specified in client request.
4 | sc-authenticated | ClientAuthenticate | Indicates whether the client has been authenticated with ISA Server. Possible values are Y and N.
5 | date | TimeStamp | The date that the logged event occurred, according to the time and date set on the ISA Server computer. In MSDE format, this is the time stamp, which includes both the date and the time.
6 | time | Not applicable | The time that the logged event occurred, according to the time and date set on the ISA Server computer. In W3C format, this is in Coordinated Universal Time (UTC).
7 s-svcname service The name of the service that is logged.
  • w3proxy indicates outgoing Web requests.
  • w3reverseproxy indicates incoming Web requests.
8 | s-computername | servername | The name of the computer running ISA Server. This is the computer name that is assigned in Windows.
9 | cs-referred | referredserver | Reserved for future use.
10 | r-host | DestHost | The domain name for the remote computer that provides service to the current connection. A hyphen (-) in this field may indicate that an object was retrieved from the Web Proxy server cache and not from the destination.
11 | r-ip | DestHostIP | The network IP address for the remote computer that provides service to the current connection. A hyphen (-) in this field may indicate that an object was sourced from the Web Proxy server cache and not from the destination. One exception is negative caching. In that case, this field indicates a destination IP address for which a negative-cached object was returned.
12 | r-port | DestHostPort | The reserved port number on the remote computer that provides service to the current connection. This is used by the client application initiating the request.
13 time-taken processingtime This indicates the total time, in milliseconds, that is needed by ISA Server to process the current connection. It measures elapsed server time from the time that the server first received the request to the time when final processing occurred on the server—when results were returned to the client and the connection was closed.

For cache requests that were processed through Web Proxy, processing time measures the elapsed server time needed to fully process a client request and return an object from the server cache to the client.
14 | cs-bytes | bytesrecvd | The number of bytes sent from the destination computer and received by the client during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the destination computer or that no bytes were received from the destination computer.
15 | sc-bytes | bytessent | The number of bytes sent from the source client to the destination server during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the destination computer or that no bytes were sent to the destination computer.
16 | cs-protocol | protocol | Specifies the application protocol used for the connection. Common values are HTTP, File Transfer Protocol (FTP), and Secure Hypertext Transfer Protocol (HTTPS).
17 | cs-transport | transport | Specifies the transport protocol used for the connection. The value is always TCP.
18 | s-operation | operation | Specifies the application method used. For Web Proxy, common values are GET, PUT, POST, and HEAD.
19 | cs-uri | uri | This field shows the contents of the URL request. This field applies only to the Web Proxy log.
20 | cs-mime-type | mimetype | The Multipurpose Internet Mail Extensions (MIME) type for the current object. This field may also contain a hyphen (-) to indicate that this field is not used or that a valid MIME type was not defined or supported by the remote computer. This field applies only to the Web Proxy log.
21 | s-object-source | objectsource | Indicates the source that was used to retrieve the current object. This field applies only to the Web Proxy log. See Object source log values for a table of the possible values.
22 | sc-status | resultcode | This field indicates the status of the request. See Result code log values for a table of some possible values.
23 | s-cache-info | CacheInfo | This number reflects the cache status of the object, which indicates why the object was or was not cached. This field applies only to the Web Proxy log. See Cache info log values for a table of the possible values.
24 | rule | rule | This reflects the rule that either allowed or denied access to the request.
25 | FilterInfo | FilterInfo | This field includes information that a Web filter can log. For example, when the HTTP filter denies a request, the reason for the denial is stored here.
26 | cs-Network | SrcNetwork | The network from which the request is issued.
27 | sc-Network | DstNetwork | The network to which the request is forwarded.
28 | error-info | ErrorInfo | This field includes additional information about how the request was processed.


SMTP Message Screener log fields

You can use the ISA Server log to monitor and analyze the status of the SMTP Message Screener.

The following table lists the fields that you can include in each of the ISA Server log files. Note that, in ISA Server log format, if a field is disabled, it will appear in the log with a hyphen (-). In World Wide Web Consortium (W3C) log file format, the field will not appear.

The Field column refers to the position in the ISA Server file format.

You can limit the fields that are saved to the log. For instructions, see Specify fields to log.

Field | W3C | Description
1 | date | The date that the logged event occurred.
2 | time | The time that the logged event occurred. In W3C format, this is in Coordinated Universal Time (UTC).
3 | cs-sender | The sender name, as specified in the "MAIL FROM:" SMTP header. Limited to 72 characters.
4 | cs-recipient | The list of recipients, as specified in the "RCPT TO:" SMTP header. Limited to 72 characters.
5 | cs-subject | The message subject. Limited to 72 characters.
6 | cs-messageid | The ID of the message. The ID is either the unique message ID generated by the sender, or the ID automatically assigned by the Windows SMTP service, when it is received. Limited to 72 characters.
7 x-action The action that ISA Server took. One of the following:
  • Delete. The message is deleted.
  • Hold. The message is stored in the BadMail queue.
  • Forward. The message is forwarded to a different recipient (not the recipient specified in the original message).
  • Pass. The message is sent to the specified recipients (in cs-recipient).
8 x-reason The reason ISA Server executed the action (x-action). One of the following:
  • Some message properties could not be read. Taking default action.
    (The default action is Hold).
  • Policy rule stamp could not be found in the message. Taking default action.
    (The default action is Hold). The policy rule stamp is an indication that ISA Server puts in the message to let the Message Screener know which rule should be applied to the message. This is generated if the message did not pass through the SMTP application filter before being passed to the SMTP Message Screener.
  • Logger is not initialized yet. Taking default action.
    (The default action is Hold).
  • Policy rule could not be read. Taking default action.
    (The default action is Hold).
  • Failed while trying to forward the message.
    The specific error code is also listed here.
  • The SMTP Message Screener policy rule does not allow messages from sender.
  • The SMTP Message Screener policy rule does not allow attachment.
  • The SMTP Message Screener policy rule does not allow attachment extension.
  • The SMTP Message Screener policy rule does not allow attachments of specified size.
  • The SMTP Message Screener policy rule does not allow messages with specified subject.
  • The SMTP Message Screener policy rule does not allow messages with specified message body.


SQL database logging

Saving the log information to an SQL database is useful for remote logging. If you select this method, note the following:

  • We recommend that you configure appropriate security when logging to an SQL database.
  • We recommend that you use Windows authentication (and not SQL authentication).
  • If you are logging the information to a remote database, we recommend that you configure encryption and data signature for the log information being copied to the remote database.
  • For maximal security, we recommend that you configure Internet Protocol security (IPSec) for the communication between the ISA Server computer and the SQL server.

For instructions on configuring logging to an SQL server, see Set up an SQL server for ISA Server logging.


Reports

This section provides information about the reporting feature of Internet Security and Acceleration (ISA) Server 2004.

  • Reports overview
  • How the report mechanism works
  • Report viewing and publishing


Reports overview

You can use the reporting feature of ISA Server to summarize and analyze communication patterns. Specifically, you can create reports to show you common usage patterns. For example:

  • Who is accessing sites, and which sites are being accessed.
  • Which protocols and applications are being used most often.
  • General traffic patterns.
  • Cache ratio.

You can also use reports to monitor the security of your network. For example, you can generate reports that track malicious attempts to access internal resources. Similarly, by tracking the number of connections to a published server, or the traffic to the server, you might identify an attempt at denial of service.

Recurring reports

The ISA Server reporting mechanism enables you to schedule recurring reports, based on the data collected from the log files. You can schedule reports to be generated on a recurring, periodic basis of daily, weekly, monthly, or yearly. The report can include daily, weekly, monthly, or yearly data.

When you schedule a report job, specify the following:

  • Period of activity that the report will cover.
  • When and how often the report will be generated.

For instructions, see Create a recurring report job.


How the Report Mechanism Works

The ISA Server reporting mechanism combines the summary logs from ISA Server computers into a database on each ISA Server computer. The database resides in a folder on the ISA Server computer; by default, in the ISASummaries folder. When a report is created, all relevant summary databases are combined into a single report database. The report is created, based on the combined summaries.

ISA Server reports are based on the Web Proxy and Microsoft Firewall service logs. The following table lists the Firewall service log fields and Web Proxy log fields used to generate reports.

Web Proxy log fields | Firewall service log fields
Bytes Received | Action
Bytes Sent | Bytes Received
Client Agent | Bytes Sent
Client IP | Bytes Sent Delta
Client Username | Client Agent
Destination Host Name | Client Username
Destination IP | Client IP
Destination Port | Client Port
HTTP Status code | Destination IP
Log Time | Destination Port
Log Date | Log Date
Object source | Log Time
Processing Time | Original Client IP
Protocol | Processing Time
Transport | Processing Time Delta
URL | Protocol
 | Result Code
 | Transport

At a specific time, the DailySum.exe application, which is installed with ISA Server, summarizes the log information listed above. DailySum.exe always runs by default on the ISA Server computer, whether or not you create or schedule reports. For instructions on disabling the application, see Disable report summary database generation.

Two log summaries are saved: one with a daily summary and one with a montly summary. At the beginning of each month, Dailysum.exe creates also a monthly summary that summarizes all the past month's daily summaries. At least thirty five daily summaries are saved, and at least thirteen monthly summaries are saved. You can configure how and where ISA Server saves log summaries. For instructions, see Configure the log summary database.

To generate a report, ISA Server runs the ISARepGen.exe application, also installed with ISA Server.


Report viewing and publishing

You can view a report by double-clicking the report name in ISA Server Management. The report is displayed in Internet Explorer. For instructions, see View a report.

The report can be viewed only on the computer running ISA Server Management. On any other computer, the report shows either empty data, or a page with empty frames and a message that the "Page cannot be displayed."

Note the following about data displayed in the report:

  • Requests are calculated only when the connection is terminated.
  • Bytes are counted for every line in the log.

Publishing reports

To make reports more available, you can publish them to a shared folder. Everyone who needs access to the reports should have Read permissions to this folder. In this way, others can view the reports without accessing the ISA Server computer and not through ISA Server Management. For instructions, see Publish a report.

When a report is published, several report files and the associated graphics are saved to the specified published folder.

Credentials for report publishing

When you publish any report, the IsaRepGen.exe process must have write permissions to the publishing folder. You can configure the credentials that IsaRepGen.exe uses to create reports.

By default, the Local System account is used. Note, however, that if you publish reports to a different computer, the Local System account credentials are actually passed as the (ISA Server) computer account. The computer account must have permissions to write to the network shared folder.

If ISA Server is installed in a Windows NT 4.0 domain or in workgroup mode, IsaRepGen.exe uses the Unauthenticated account. In this case, we recommend that you specify user credentials when publishing reports to another computer.

Report content

You can configure the content to include in any report. The following type of content can be included in a report:

  • Summary. When you include summary content, the report includes summarized information about network traffic usage, sorted by application. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity.
  • Web usage. When you include Web usage content, the report displays information about top Web users, common responses, and browsers. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity. It shows how the Web is being used in a company.
  • Application usage. When you include application usage content, the report illustrates Internet application usage information about top users, client applications, and destinations.
  • Traffic and utilization. When you include traffic and utilization content, the report illustrates total Internet usage by application, protocol, and direction. These reports also show average traffic and peak simultaneous connections, cache hit ratio, errors, and other statistics.
  • Security. When you include security content, the report lists attempts to breach network security.


Connectivity

Using the ISA Server connectivity feature, you can verify connectivity by regularly monitoring connections from the ISA Server computer to any specific computer or URL on any network. You can configure which method to use to determine connectivity:

  • Ping. When you configure this method, ISA Server sends an ICMP ECHO_REQUEST to the specified server and waits for an ICMP ECHO_REPLY. Use this method to verify that a server is running and can be reached by ISA Server.
  • TCP connect. When you configure this method, ISA Server tries to establish a TCP connection to a specific port on the specified server. Use this method to verify that a specific service is running on the server and can be reached by ISA Server.
  • HTTP request. When you configure this method, ISA Server sends an HTTP Get request and waits for the reply. Use this method to verify that a Web server is running and can be reached by ISA Server.

You can select which server to monitor, by specifying an IP address, computer name, or URL. For instructions, see Create a connectivity verifier.

When you configure a connectivity verifier for a server, you categorize it into one of the following groups: Active Directory, DHCP, DNS, Published Servers, Web (Internet), and others. Server group status is displayed on the Dashboard view, enabling you to quickly determine if there is a problem with a particular service.

For example, suppose you publish FTP, SQL, and Exchange servers, and you depend on their regular availability to clients. You can create a connectivity verifier for each server, grouping them all in the Published Servers group. On the Dashboard, you can see a first indication that one of the servers is not functioning properly. On the Connectivity tab, you can determine which specific server is not functioning properly. For instructions, see Configure a connectivity verifier group.

In another scenario, you might want to validate that ISA Server really has connectivity to websites on the External network. To do this, you might define HTTP connectivity verifiers to three common websites, generally known for being available. Group the connectivity verifiers in the Web (Internet) group.

When you create a connectivity verifier that issues an HTTP request to check connectivity, ISA Server enables a system policy rule that allows HTTP and HTTPS traffic from the Local Host to All Networks, named Allow HTTP/HTTPS from firewall to all networks, for HTTP connectivity verifiers. After you disable (or delete) all connectivity verifiers that use HTTP, the system policy rule is disabled. For more information, see System policy overview.

Analyzing HTTP responses

When you configure a connectivity verifier method to send an HTTP request, the monitored server is expected to return an HTTP response. Depending on the response, ISA Server will mark the connectivity verifier status, as detailed in the following table.

HTTP response from monitored server | Connectivity verifier status
1xx, 2xx, or 3xx | OK. This is the response time in milliseconds.
401 (Web server authentication required) | OK. This is not considered an error, because the Web server returned the message.
407 (proxy authentication required) | Error (Windows Server 2003). This is considered an error because connectivity to the actual Web server cannot be determined.
407 (proxy authentication required) | Authentication required (Windows 2000 Server).
4xx (except 401 and 407) or 5xx | Error.
Request timed out | Time-out.
The server name could not be resolved | Unresolved name.
ISA Server is down | Unable to verify. The Microsoft Firewall service is unavailable.


Performance monitor

Performance data can be viewed in a report or in various graph and log formats. A performance log can be useful in monitoring counters over an extended period of time. Performance alerts can be configured to create an event as a result of counters reaching certain values. These events could include a log entry, sending a network message, or running a program. You can view performance data for ISA Server either on the Dashboard or using the ISA Server Performance Monitor, which displays the default counters for ISA Server in the Windows System Monitor. For instructions on viewing the Dashboard, see View the Dashboard. For instructions on using System Monitor, see the Windows Help.

When remotely administering ISA Server, you can view the performance counters by opening the Performance Logs and Alerts snap-in. On computers running Windows 2000, only Administrators of the ISA Server computer can view the performance counters. On computers running Windows Server 2003, all members of the Performance Monitoring Users groups can view the performance counters.


Monitoring: How To

This section provides specific steps for monitoring Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Refresh the monitoring view
  • Set the refresh rate
  • View the Dashboard
  • Configure alerting
  • Configure session monitoring
  • Start or stop a service
  • Configure logging
  • Configure reports
  • Configure connectivity verifiers


Refresh the monitoring view

To refresh the monitoring view

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the tab with the view you want to refresh. The available tabs include Dashboard, Alerts, Services, Reports, and Connectivity.
  3. On the Tasks tab, click Refresh Now.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you click Refresh Now, only the data on the selected tab is refreshed.


Set the refresh rate

To set the refresh rate

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the tab with the view you want to refresh. The available tabs include Dashboard, Alerts, Services, Reports, and Connectivity.
  3. On the Tasks tab, in Automatic Refresh Rate, select one of the following: None, Low, Medium, or High.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When the refresh rate is set to Low, the data is refreshed every 120 seconds.
  • When the refresh rate is set to Medium, the data is refreshed every 60 seconds.
  • When the refresh rate is set to High, the data is refreshed every 30 seconds.


View the dashboard

To view the Dashboard

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Dashboard tab.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure alerting

This section provides specific steps for configuring alerts in Internet Security and Acceleration (ISA) Server 2004.

  • Enable an alert definition
  • Add an alert definition
  • Edit an alert definition
  • Edit an alert condition
  • Edit an alert threshold
  • Edit an alert action
  • Acknowledge an alert
  • Reset an alert


Enable an alert definition

To enable an alert definition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. On the Tasks tab, click Configure Alert Definitions.
  4. On the Alert Definitions tab, select the check box to enable the selected alert.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Add an alert definition

To add an alert definition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. On the Tasks tab, click Configure Alert Definitions, and then click Add.
  4. Follow the on-screen instructions in the New Alert Configuration Wizard.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can create new alert definitions only for events that do not already have an associated alert definition.

Related Topics


Edit an alert definition

To edit an alert definition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. On the Tasks tab, click Configure Alert Definitions.
  4. On the Alert Definitions tab, select an alert definition, and then click Edit.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To disable an alert definition, clear the check box next to the name of the alert.

Related Topics


Edit an alert condition

To edit an alert condition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. On the Tasks tab, click Configure Alert Definitions.
  4. Select the alert definition you want to edit, and then click Edit.
  5. On the Events tab, do the following:
    • In Event, click the event that triggers the alert. If the event needs an additional condition, in Additional condition, click the condition.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can modify the event associated with an alert definition only if that event is not already associated with a different alert definition.

Related Topics


Edit an alert threshold

To edit an alert threshold

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. On the Tasks tab, click Configure Alert Definitions.
  4. Select the alert definition you want to edit, and then click Edit.
  5. On the Events tab, select the Number of occurrences check box, and type how many events must occur before the alert is issued.
  6. Select the Number of events per second check box, and type how many events must occur per second before the alert is issued.
  7. Select one of the following options:
    • If the alert should be reissued immediately if the event recurs, click Immediately.
    • If the alert should be reissued only after the alert is reset, click Only if the alert was manually reset.
    • If the alert should be reissued after a specified amount of time, click If time since last execution is more than Number minutes, and then type the number of minutes that should elapse before the action should be performed.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can modify the event associated with an alert definition only if that event is not already associated with a different alert definition.
  • An alert will be triggered after the number of occurrences you specify occurs. For example, if you specify 5, then the alert will be triggered on the sixth occurrence of the event. Similarly, an alert will be triggered after the number of seconds you specify occurs. For example, if you specify 5 seconds, then the alert will be triggered after six seconds pass.

Related Topics


Edit an alert action

To edit an alert action

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. On the Tasks tab, click Configure Alert Definitions.
  4. Select the alert definition you want to edit, and then click Edit.
  5. On the Actions tab, modify one or more of the following actions:
    • To send an e-mail when the alert condition occurs, select the Send e-mail check box, and then type the Simple Mail Transport Protocol (SMTP) server, recipient, and sender.
    • To run an application when the alert condition occurs, select the Program check box, and then type the command to run at a command prompt and the account from which to run the program.
    • To log the event, select the Report to Windows Event Log check box.
    • To stop ISA Server services, select the Stop selected services check box, and then click Select to select which ISA Server services to stop when the alert condition occurs.
    • To start ISA Server services, select the Start selected services check box, and then click Select to select which ISA Server services to start when the alert condition occurs.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can specify multiple recipients of e-mail messages by typing addresses in the To and Cc fields, separated by semicolons (;).
  • If you configure an e-mail action to use an SMTP server located on the Internal network, you must enable the system policy rule that allows the Local Host network to access the Internal network using the SMTP protocol. In the System Policy Editor, in the Remote Monitoring configuration group, select SMTP, and then click Enable. The Allow SMTP protocol from firewall to trusted servers rule is enabled.
  • If you configure an e-mail action to use an external SMTP server, you must create an access rule that allows the Local Host network to access the External network (or the network on which the SMTP server is located), using the SMTP protocol.
  • If ISA Server runs a program, you can specify which user account should be used. The specified user must have Logon as batch job permissions.
  • In Use this account, you can click Set account to specify a user account to run the program.

Related Topics


Acknowledge an alert

To acknowledge an alert

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. In the details pane, select an alerts, or group of alerts you want to acknowledge.
  4. On the Tasks tab, click Acknowledge Selected Alerts.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can acknowledge an entire group of alerts, by selecting the group heading.
  • In the Alerts view, alert instances are grouped together by category (for example, Service shutdown). You can expand or collapse the group headings to display or hide the items they contain.
  • To select adjacent alerts, click the first alert, and then hold down SHIFT and click the last item.
  • To select nonadjacent alerts, click the first alert, and then hold down CTRL and click additional items.

Related Topics


Reset an alert

To reset an alert

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Alerts tab.
  3. In the details pane, select an alerts, or group of alerts you want to acknowledge.
  4. On the Tasks tab, click Reset Selected Alerts.
  5. Click Yes if you are sure that you want to reset the selected alerts.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You can reset an entire group of alerts, by selecting the group heading.
  • In the Alerts view, alert instances are grouped together by category (for example, Service shutdown). You can expand or collapse the group headings to display or hide the items they contain.
  • To select adjacent alerts, click the first alert, and then hold down SHIFT and click the last item.
  • To select nonadjacent alerts, click the first alert, and then hold down CTRL and click additional items.
  • When the Microsoft ISA Server Control service (isactrl) is restarted, all alerts are automatically reset.

Related Topics


Configure session monitoring

This section provides specific steps for configuring session monitoring in Internet Security and Acceleration (ISA) Server 2004.

  • View sessions
  • Disconnect a session
  • Monitor specific sessions
  • Save a filter definition
  • Load a filter definition
  • Pause monitoring sessions
  • Stop monitoring sessions


View sessions

To view sessions

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Sessions tab.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The sessions are listed in the details pane.

Related Topics


Disconnect a session

To disconnect a session

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Sessions tab.
  3. Select the applicable session.
  4. On the Tasks tab, click Disconnect session.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Monitor specific sessions

To monitor specific sessions

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Sessions tab.
  3. On the Tasks tab, click Edit Filter Properties.
  4. In Filter by, select one of the following options:
    • Activation. Used to filter only for sessions activated since the specified time.
    • Application Name.
    • Client Host Name, Client IP, or Client Username. Used to filter for sessions from specific clients.
    • Session Type. Used to filter for sessions from specific types of clients: Firewall client, SecureNAT, VPN client, VPN site-to-site, or Web proxy.
    • Source Network. Used to filter for sessions from specific source networks.
      • .
  5. In Condition and Value, specify the appropriate condition, and then click Add to List.
  6. Repeat steps 4 and 5 to add more conditions to the filter. Then, click Start Query.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • By default, all sessions are listed in the Sessions details pane.
  • The Sessions viewer displays only data for sessions that match all the expressions included in the filter. In other words, the filter expressions are combined using the logical AND operator.
  • By default, the Application Name and Server Name columns are not displayed in the Sessions details pane. To display these columns, right-click the column headings in the details pane and then select the appropriate column.
  • To remove an expression from the filter list, click Edit Filter Properties. Then, select the expression and click Remove.
  • To edit an expression in the filter list, click Edit Filter Properties. Then, select the expression, perform the desired edits, and then click Update.

Related Topics


Save a filter definition

To save a filter definition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Sessions tab.
  3. On the Tasks tab, click Save Filter Definitions.
  4. In File Name, specify the file name of the .xml file with the filter definition. Then, click Save.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Load a monitoring definition

To load a filter definition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Sessions tab.
  3. On the Tasks tab, click Load Filter Definitions.
  4. In File Name, specify the file name of the .xml file with the filter definition. Then, click Load.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Pause monitoring sessions

To pause monitoring sessions

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Sessions tab.
  3. On the Tasks tab, click Pause monitoring sessions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To resume monitoring sessions, on the Tasks tab, click Resume Monitoring Sessions.
  • When you pause session monitoring, sessions displayed in the Sessions view are not removed. However, new sessions are not added to the view. When you resume session monitoring, ISA Server updates the Sessions view with the relevant, new session information.

Related Topics


Stop monitoring sessions

To stop monitoring sessions

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Sessions tab.
  3. On the Tasks tab, click Stop monitoring sessions.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you stop monitoring sessions, ISA Server loses information about any sessions that had been monitored.

Related Topics


Start or stop a service

To start or stop a service

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Services tab.
  3. Select the applicable service: Microsoft Data Engine (MSDE), Microsoft Firewall service, or Microsoft ISA Server Job Scheduler service.
  4. On the Tasks tab, click Start Selected Services to start the selected service, or click Stop Selected Services to stop the selected service.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If the service is already stopped, Stop Selected Services will not be available on the Tasks tab.

Related Topics


Configure logging

This section provides instructions on how to configure the logging feature of Microsoft Internet Security and Acceleration (ISA) Server 2004.

  • Enable logging for a specific service
  • Log requests matching a rule
  • Specify fields to log
  • Configure logging to an SQL database
  • Configure logging to an MSDE database
  • Set up SQL Server for ISA Server logging
  • Configure log storage limits
  • Configure logging to a file
  • Filter the Log Viewer data
  • Save a log filter definition
  • Load a log filter definition
  • Save log viewer data


Enable logging for a specific service

To enable logging for a specific service

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, select the appropriate task:
    • Configure Firewall Logging. To configure the location of the Firewall log.
    • Configure Web Proxy Logging. To configure the location of the Web Proxy log.
    • Configure SMTP Message Screener Logging. To configure the location of the SMTP Message Screener log.
  4. On the Log tab, select the Enable logging for this service check box.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To disable logging for a specific service, on the Log tab, verify that the Enable logging for this service check box is not selected.


Log requests matching a rule

To log requests matching a rule

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Firewall Policy
  2. In the details pane, click the rule for which logging should be enabled.
  3. On the Tasks tab, click Edit Selected Rule.
  4. On the Action tab, select the Log requests matching this rule check box.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If a lot of data is being logged from a specific protocol or source, you can create a new rule, which applies to that type of traffic, for which requests are not logged. For example, suppose your policy does not allow DHCP requests, and as a result, you see many DHCP requests that are being denied. You can create a new access rule that denies DHCP requests, but does not log the requests.


Specify fields to log

To specify fields to log

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, select the appropriate task:
    • Configure Firewall Logging. To configure the location of the Firewall log.
    • Configure Web Proxy Logging. To configure the location of the Web Proxy log.
    • Configure SMTP Message Screener Logging. To configure the location of the SMTP Message Screener log.
  4. On the Fields tab, do one of the following:
    • To select specific fields, select the appropriate check box.
    • To clear all the check boxes in the field list, click Clear All.
    • To select all the check boxes in the field list, click Select All.
    • To select a default set of fields in the ISA Server log file, click Restore Defaults.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure logging to an SQL database

To configure logging to an SQL database

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, select the appropriate task:
    • Configure Firewall Logging. To configure the location of the Firewall log.
    • Configure Web Proxy Logging. To configure the location of the Web Proxy log.
  4. On the Log tab, click SQL Database.
  5. Confirm or modify the following parameters:
    • ODBC data source name (DSN)
    • Table name
    • Use this account
  6. (Optional) If you need to change the user account, click Set Account, type the user name in User, and type the password in Password and Confirm password.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The Remote Logging (SQL) system policy configuration group must be enabled to log to an SQL database.
  • If you configure the DSN to use Windows authentication, grant appropriate access to the ISA Server computer. Note that in this case, credentials configured in ISA Server Management's logging properties are ignored for the specific log.

Related Topics


Configure logging to an MSDE database

To configure logging to an MSDE database

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, select the appropriate task:
    • Configure Firewall Logging. To configure the location of the Firewall log.
    • Configure Web Proxy Logging. To configure the location of the Web Proxy log.
  4. On the Log tab, click MSDE Database.
  5. (Optional) Click Options to confirm or modify the following parameters:
    • ISALogs folder or This folder. To select the location of the log file.
    • Delete log files older than. Specify the number of days to keep log files before they are automatically deleted.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Set up SQL Server for ISA Server logging

To set up SQL Server for ISA Server logging

  1. Set up SQL Server with a database file:
    1. On the SQL Server computer, start Enterprise Manager.
    2. Connect to the SQL Server computer that you want to host the database files.
    3. On the Tools menu, click SQL Query Analyzer.
    4. On the File menu, click Open and open "ISA CD":\Isa.
    5. Open one of the following .sql files, based on how you want to log to an SQL database:
      • For the Microsoft Firewall service, open the Fwsrv.sql file.
      • For Web Proxy, open the W3proxy.sql file.
    6. Add the following lines to the top of each script:
      Create database <database name> Go
Use <database name>
Go
    7. On the Query menu, click Execute.
  2. Set up SQL Server to accept the Open Database Connectivity (ODBC) data connection from the ISA Server computer. If ISA Server is not located in the same Windows Server 2003 domain or Windows 2000 domain, you must set up a SQL Server account:
    1. Start the SQL Enterprise Manager and connect to the SQL Server computer that you set up to host your databases.
    2. Click Microsoft SQL Servers, click SQL Server Group, click server_name, click Security, and then right-click Logins.
    3. Click New Login.
    4. If you are located in the same domain as ISA Server, you can click Windows Authentication.
      1. In Name, type: domainname\isaservername$
      2. On the Database Access tab, click the databases that this logon method can access (the databases that you created earlier).
    5. If you are located on a different domain than ISA Server, you must use SQL Server Authentication:
      1. (Optional) In Name, type a specific name.
      2. Use a name to describe the logon method.
      3. Enter a password for this logon method.
      4. On the Database Access tab, select the databases that this logon method can access (the databases that you created earlier).
    6. Select Change the default database, and then select the database to which ISA Server will log data.
    7. If you are using SQL Server 2000 or later, you must configure "SELECT" and "INSERT" permissions.
    8. Stop, and then start the SQL Server service.
  3. Set up the ODBC data source on the ISA Server computer:
    1. Under Administrative Tools, click Data Sources (ODBC).
    2. On the System DSN tab, click Add.
    3. Click the SQL Server driver, and then click Finish.
    4. Assign the data source with the same name that you used for the database file.
    5. Type the name of the SQL Server computer, and then click Next.
    6. There are two options for database authentication. These options correspond to the account that you set up in step two:
      • Click With Windows NT authentication using the network login ID, to use the ISA Server computer account for authentication. This option can only be used in a Windows Server 2003 or Windows 2000 domain.
      • Click With SQL Server authentication using a login ID and password entered by the user to use an SQL account for authentication.
    7. Follow the on-screen instructions.


Configure log storage limits

To configure log storage limits

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, select the appropriate task:
    • Configure Firewall Logging. Used to configure the firewall log limits.
    • Configure Web Proxy Logging. Used to configure the Web proxy log limits.
  4. On the Log tab, select File or MSDE Database.
  5. Click the Options button.
  6. To limit the size of the logs, select Limit total log files size. Then, type the maximum log size.
  7. To maintain a specified amount of free disk space on the disk that the logs are stored, select Maintain free disk space. Then, type how much free disk space to maintain.
  8. If you selected either Limit total log files size or Maintain free disk space, select one of the following:
    • Deleting older log files as necessary. Used to delete the oldest log files when you exceed the limits specified previously.
    • Discarding new log entries. Used to stop ISA Server from adding any new log entries (while keeping all the old log information).
  9. To delete old log information, select Delete files older than (days). Then, type how long to keep log information.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • You cannot set log limits for SQL database logs.
  • ISA Server checks that logs do not exceed the specified limits every ten minutes. This means that for up to a period of ten minutes, logs might exceed the limits.


Configure logging to a file

To configure logging to a file

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, select the appropriate task:
    • Configure Firewall Logging. To configure the location of the Firewall log.
    • Configure Web Proxy Logging. To configure the location of the Web Proxy log.
    • Configure SMTP Message Screener Logging. To configure the location of the SMTP Message Screener log.
  4. On the Log tab, click File.
  5. (Optional) Click Options to confirm or modify the following parameters:
    • ISALogs folder or This folder. To select the location of the log file.
    • Compress log files. To compress the log file.
    • Delete log files older than. Specify the number of days to keep log files before they are automatically deleted.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • Compressing the log file decreases its size and reduces the amount of space it uses.
  • You may notice a decrease in performance when working with NTFS-compressed files. When you read from (access) a compressed file, Windows automatically decompresses it for you, and when you write to the file, Windows compresses it. This process may decrease your computer's performance.

If you are not running the Simple Mail Transfer Protocol (SMTP) Message Screener component on the ISA Server computer, and in ISA Server Management (on the ISA Server computer) you specify a folder location for the Message Screener log that does not exist on the computer running the Message Screener component, the folder will only be created on that computer after it is restarted.

Related Topics


Filter the log viewer data

To filter the log viewer data

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, click Edit Filter Properties.
  4. In Filter by, select one of the log fields.
  5. In Condition and Value, specify the appropriate condition, and then click Add to List.
  6. Repeat steps 4 and 5 to add more conditions to the filter. Then, click Start Query.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The log viewer displays log data only if it matches all the expressions included in the filter. In other words, the filter expressions are combined using the logical AND operator.
  • To edit an expression in the filter list, click Edit Filter Properties. Then, select the condition and click Update.
  • To delete an expression from the filter list, select the applicable expression in Query according to this list of expressions, and then click Remove.
  • When you create the filter, you must specify exactly one Log Time and one Log Record Type.
  • The log viewer updates data only when the Microsoft Firewall service is running. When the Firewall service is not running, ISA Server enforces lockdown mode. For more information, see Lockdown mode.
  • The log viewer can display information only about the Firewall and Web Proxy logs. SMTP Message Screener log information cannot be displayed in the log viewer.

Related Topics


Save a log filter definition

To save a log filter definition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, click Save Filter Definitions.
  4. In File Name, specify the file name of the .xml file with the filter definition. Then, click Save.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Load a log filter definition

To load a log filter definition

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, click Load Filter Definitions.
  4. In File Name, specify the file name of the .xml file with the filter definition. Then, click Load.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Save log viewer data

To save log viewer data

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Logging tab.
  3. On the Tasks tab, select one of the following:
    • Copy All Results to Clipboard. To copy all the data displayed in the log viewer.
    • Copy Selected Results to Clipboard. To copy selected data from the log viewer.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To select adjacent log entries, click the first alert, and then hold down SHIFT and click the last item.
  • To select nonadjacent log entries, click the first alert, and then hold down CTRL and click additional items.
  • After you copy the data to the Clipboard, you can paste the text into an appropriate application for analysis.

Related Topics


Configure reports

This section provides specific instructions for configuring reports in Internet Security and Acceleration (ISA) Server 2004.

  • Create a report
  • Create a recurring report job
  • Configure the report summary database
  • Disable report summary database generation
  • Configure Recurring Reports
  • View and Publish Reports


Create a report

To create a report

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Generate a New Report.
  4. Follow the on-screen instructions.
  5. On the General tab, in Name, type the name of the report job.
  6. (Optional) In Description, type a description of the report job.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The Microsoft ISA Server Job Scheduler service must be running to create a report.
  • If you publish the report to a shared folder, be sure to supply credentials that will be used by the reporting engine for publishing. These credentials should have write permissions in the specified folder. To allow others to view the published report, give them read permissions to that folder.
  • To create a recurring report job, click Configure Recurring Reports on the Tasks tab.

Related Topics


Create a recurring report job

To create a recurring report job

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Click Add to create a new recurring report job.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The Microsoft ISA Server Job Scheduler service must be running to create a report.
  • If you publish the report to a shared folder, be sure to supply credentials that will be used by the reporting engine for publishing. These credentials should have write permissions in the specified folder. To allow others to view the published report, give them read permissions to that folder.

Related Topics


Configure the report summary database

To configure the report summary database

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Configure Log Summary.
  4. On the Log Summaries tab, select the Enable Daily and monthly summaries check box.
  5. In Specify the generation time, type the time of day that the report data should be generated.
  6. Do one of the following:
    • To save the reports in the ISASummaries subfolder on this computer, click ISASummaries folder.
    • To save the reports in another folder, click Other folder, then click Browse and click the folder in which to save the reports.
  7. To configure the number of saved summaries:
    • In Number of summaries saved, in Daily summaries, type the number of daily summaries to save.
    • In Monthly summaries, type the number of monthly summaries to save.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • At least 35 daily summaries must be saved. At least 13 monthly summaries must be saved.

Related Topics


Disable report summary database generation

To disable report summary database generation

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Configure Log Summary.
  4. On the Log Summaries tab, clear the Enable daily and monthly summaries check box.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you create a report when the log summary database generation is disabled, ISA Server will create the missing log summaries to generate the report. If the summaries had previously been created, but subsequently deleted, they will not be re-created.

Related Topics


Configure recurring reports

This section provides specific instructions for configuring recurring reports in Internet Security and Acceleration (ISA) Server 2004.

  • Configure report contents for a report job
  • Configure a report job schedule
  • Configure period on which to base the report
  • Specify when to run a report job
  • Run a scheduled report job now
  • Notify upon report generation
  • Delete a report job


Configure report contents for a report job

To configure report contents for a report job

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Select the applicable report job, and then click Edit.
  5. On the Content tab, select which of the following reports should be generated:
    • Summary
    • Web Usage
    • Application Usage
    • Traffic and Utilization
    • Security

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you use the New Report Wizard to create a report, you can specify the types of reports to generate on the Report Types page of the wizard.
  • Summary reports include a set of reports with common information about protocol usage, websites accessed, cache information, and general traffic activity. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity.
  • Web usage reports include a set of reports that display top Web users, common responses, and browsers. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity. It shows how the Web is being used in a company.
  • Application usage reports illustrate Internet application usage in a company, including incoming and outgoing traffic, top users, client applications, and destinations. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity, because they can help you plan network capacity and determine bandwidth policies.
  • Traffic and utilization reports illustrate total Internet usage by application, protocol, and direction. These reports also show average traffic and peak simultaneous connections, cache hit ratio, errors, and other statistics. These reports can help plan and monitor network capacity and determine bandwidth policies.
  • Security reports list attempts to breach network security. Security reports can help identify attacks or security violations after they have occurred.

Related Topics


Configure a report job schedule

To configure a report job schedule

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Select the applicable report job, and then click Edit.
  5. On the Schedule tab:
    • To generate reports every day, click Every day.
    • To generate reports on a specific day every week, click On the following days, and then select the appropriate days.
    • To generate reports every month, click Every month, on this date. Specify the day of the month to generate the report.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The content displayed in the report will reflect the period specified when you configure the report period.

Related Topics


Configure period on which to base the report

To configure period on which to base the report

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Select the applicable report job, and then click Edit.
  5. On the Content tab, in Select a period to base the report on:
    • To generate reports that show activity in the past day, select Daily.
    • To generate reports that show activity over the past week, select Weekly.
    • To generate reports that show activity over the past month, select Monthly.
    • To generate reports that show activity over the past year, select Yearly.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • When you create a recurring report job, the period is assumed to be the same as the report job schedule. For example, if you create a recurring report job to run weekly, then the report will show activity for the previous week.

Related Topics


Specify when to run a report job

To specify when to run a report job

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Select the applicable report job, and then click Edit.
  5. On the Schedule tab, in Generation Hour, specify the time of day at which to run the report job.
  6. In Start Date, specify the date on which to start running the report.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • If you specify a date that does not exist in some months (for example, 31), the report will not run in those months.


Run a scheduled report job now

To run a scheduled report job now

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Select the applicable report job, and then click Run Now.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.


Notify upon report generation

To notify upon report generation

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Select the applicable report job, and then click Edit.
  5. On the Notifications tab, select Send e-mail.
  6. In SMTP server, type the name of the mail server to use when sending the e-mail notification.
  7. In From, To, and Cc, type the e-mail address of the sender and the recipients.
  8. In Message, type a message to send to the e-mail recipients.
  9. To verify that a message will be sent successfully, click Test.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.


Delete a report job

To delete a report job

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click Create and Configure Report Jobs.
  4. Select the applicable report job, and then click Remove.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.


View and publish reports

This section provides specific instructions for viewing and publishing reports in Internet Security and Acceleration (ISA) Server 2004.

  • View a report
  • Customize report data
  • Sort report data
  • Publish a report
  • Delete a report


View a report

To view a report

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab, and then select the applicable report.
  3. On the Tasks tab, click View Selected Report.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The graph displays only the top ten items included in a report.

Related Topics


Customize report data

To customize report data

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, to configure the applicable report type, click one of the following:
    • Customize Summary Content
    • Customize Web Usage Content
    • Customize Application Usage Content
    • Customize Traffic and Utilization Content
    • Customize Security Content
  4. Click a tab, and then in Include this number of, type the maximum amount of data that should be included in the report.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Sort report data

To sort report data

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab.
  3. On the Tasks tab, click to configure the applicable report type:
    • Customize Summary Content
    • Customize Web Usage Content
    • Customize Application Usage Content
    • Customize Traffic and Utilization Content
    • Customize Security Content
  4. In Sort Order, click the option that should be used to sort the data in the report.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The report will be sorted the next time you view the report.
  • The data in the tables are sorted. However, the graphs in the reports are not regenerated.

Related Topics


Publish a report

To publish a report

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab, and then select the applicable report.
  3. On the Tasks tab, click Publish Selected Report.
  4. In Browse for folder, select the folder in which the published reports folder should be created.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The published reports are stored in a folder named Report_Job_Name_(Start date—End date).
    For example, if you publish the report job named DailyReports, scheduled to run from December 1, 2004 through December 15, 2004, the published reports folder will be named DailyReports_(12.1.2004—12.15.2004).
  • To view the report, double-click the file named report.htm located in the published folder. This has links to all the report types generated.
  • You can configure report publishing when you generate a report or configure a recurring report job. In the Report Publishing page of the wizard, type the name of the folder in which the published reports folder should be created.

Related Topics


Delete a report

To delete a report

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Reports tab, and then select the applicable report.
  3. On the Tasks tab, click Delete Selected Report. Then, click Yes.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure connectivity verifiers

This section contains information about creating and configuring connectivity verifiers in Internet Security and Acceleration (ISA) Server 2004.

  • Create a connectivity verifier
  • Configure connection verification method
  • Configure connection verification time-out
  • Configure a connectivity verifier group
  • Disable a connectivity verifier


Create a connectivity verifier

To create a connectivity verifier

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Connectivity tab.
  3. On the Tasks tab, click Create New Connectivity Verifier.
  4. Follow the on-screen instructions.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The Dashboard view lists the connectivity status by group. If all servers in a group are responsive (and within the specified response time threshold), the group status reflects that the servers in the group are responsive. If any server in the group is not responsive in a timely fashion, the group status displayed reflects the worst-case status for that group; for example, Slow connectivity or No connection.

Related Topics


Configure connection verification method

To configure connection verification method

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Connectivity tab and select the applicable verifier.
  3. On the Tasks tab, click Edit Selected Verifier.
  4. On the Properties tab, select one of the following methods:
    • Send an HTTP "GET" request
    • Send a Ping request
    • Establish a TCP connection
  5. If you select Establish a TCP connection, in Connect to Port, specify a protocol to select its default port, or select Custom, and then specify the port number.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure connection verification time-out

To configure connection verification time-out

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Connectivity tab and select the applicable verifier.
  3. On the Tasks tab, click Edit Selected Verifier.
  4. On the Properties tab, in Specify the timeout response threshold, type the number of milliseconds to wait to determine that the server is not responding.
  5. Select Trigger an alert if the server response is not within the specified timeout, if ISA Server should trigger an alert indicating that the server is not responding.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure a connectivity verifier group

To configure a connectivity verifier group

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Connectivity tab and select the applicable verifier.
  3. On the Tasks tab, click Edit Selected Verifier.
  4. On the Properties tab, in Group Type, select one of the following:
    • Active Directory
    • DHCP
    • DNS
    • Others
    • Published Servers
    • Web (Internet)

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • The Dashboard view lists the connectivity status by group. If all servers in a group are responsive (and within the specified response time threshold), the group status reflects that the servers in the group are responsive. If any server in the group is not responsive in a timely fashion, the group status displayed reflects the worst-case status for that group; for example, Slow connectivity or No connection.

Related Topics


Disable a connectivity verifier

To disable a connectivity verifier

  1. In the console tree of ISA Server Management, click Monitoring.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Monitoring
  2. In the details pane, click the Connectivity tab and select the applicable verifier.
  3. On the Tasks tab, click Disable Selected Verifier.

Note

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Troubleshooting monitoring

Troubleshooting logging

What problem are you having?

Anonymous access is blocked, but the logs show requests from anonymous users.

Cause: When a user is required to authenticate, the actual communication works as follows:

  1. A user sends an anonymous request. ISA Server responds with a 407 error and terminates the connection. An anonymous request is logged.
  2. The user sends the same request with Keep-Alive and NTLM authentication user information. ISA Server responds again with a 407 error—and with an authentication challenge. The connection is not terminated. Another anonymous request is logged.
  3. The user sends the same request with the authentication response. Now the request is authenticated and served.

Solution: Validate that the anonymous requests are followed by a request from an actual, authenticated user. Otherwise, there may be a configuration problem.

The logs show requests from Unknown users.

Cause: All data retrieved due to active caching configuration are logged as if they were requested by an Unknown user.

Cannot find client authentication (user names) information in the log file.

Cause: ISA Server does not always require that clients authenticate themselves. If clients are not authenticated, they are granted anonymous access and their authentication information is not logged.

Solution: You can configure ISA Server to always require that Web Proxy clients authenticate themselves by configuring the incoming and outgoing Web request properties. For more information, see Require authentication for all Web requests and Rules and authentication.

Too much information is filling the log.

Cause: When you create a rule, by default, any requests that match the rule are logged. Since the Default Rule denies all traffic, any requests that are not specifically allowed by rules that you create will be logged. This could potentially quickly fill your log.

Solution: If you notice a lot of log data from a specific protocol or source, you can create a new rule, which applies to that type of traffic, for which requests are not logged. For example, suppose your policy does not allow DHCP requests, and you see many DHCP requests that are being denied. You can create a new access rule that denies DHCP requests, but does not log the requests.

Troubleshooting sessions

What problem are you having?

There seems to be more current users (in the Microsoft Firewall service performance counters) than sessions (in the Sessions view).

Cause: ISA Server considers a session a unique combination of IP address and user name. A connection is considered a new session from a given IP address only if a unique user logs on. System Monitor, in contrast to ISA Server, counts all connections.

Troubleshooting reports

What problem are you having?

Report contains empty data.

Cause: Reports can be saved from Internet Explorer only on the computer running ISA Server Management. On any other computer, the report shows either empty data or empty frames with a message that the "Page cannot be displayed."

Solution: To view reports on another computer, publish the report. For instructions, see Publish a report.

Troubleshooting alerts

What problem are you having?

ISA Server does not perform the action configured for the alert definition.

Cause: When you configure an action for an alert definition, you can specify which account runs the action. If the specified account does not have Logon as batch job permission, the action will not be performed.

Solution: Give the user running the action permission to perform the action. For information on assigning Logon as batch job permission, see the Windows Help.

Alert definition that is configured to send e-mail message notification when the event occurs is not functioning properly.

Cause: Check which SMTP server is configured to send the e-mail message notification. If it is an external SMTP server, you must create an access rule that allows the Local Host access to the external SMTP server.

Solution: Create an access rule, allowing the Local Host to access the External network, using the SMTP protocol. For instructions, see Create an access rule.


Add-ins

Add-ins are application filters and Web filters developed by Microsoft or by third-party vendors. These add-ins provide additional filtering functionality to Internet Security and Acceleration (ISA) Server 2004. This section describes the add-ins and provides step-by-step instructions on how to configure them.

  • Add-ins: Concepts
  • Add-ins: How To
  • Deployment scenario: SMTP filter


Add-ins: Concepts

This section describes add-ins: application filters and Web filters, developed by Microsoft or by third-party vendors. These add-ins provide additional filtering functionality to Internet Security and Acceleration (ISA) Server 2004.

  • Extensibility overview
  • Application Filters
  • Web Filters


Extensibility overview

Security policies and implementation vary from organization to organization. Traffic volume and content formats also pose unique concerns. Because one product or vendor cannot meet all of the security and performance needs of a large organization, ISA Server is highly extensible. ISA Server includes a comprehensive software development kit for custom development. Also, a large number of independent vendors offer compatible and complementary solutions that extend and integrate with ISA Server. These third-party offerings include content security tools, such as virus scanning and lexical analysis, and management tools, such as real-time monitoring, remote administration, site blocking, Uniform Resource Locator (URL) categorization, reporting, and more. The ISA Server Software Development Kit includes full API documentation, step-by-step directions, and examples of source code for developing extensions and add-in components.

ISA Server uses these extensibility mechanisms:

  • Extensible administration. You can write scripts or management tools using the administration Component Object Model (COM) object, with programmatic read/write access to all management options.
  • Application filters. You can develop application filters that intercept, analyze, or modify any data stream.
  • Web filters. You can create Web filters, based on Internet Server API (ISAPI), for viewing, analyzing, blocking, redirecting, or modifying Hypertext Transfer Protocol (HTTP) and File Transfer Protocol (FTP) traffic.
  • Extensible user interface. You can extend the ISA Server interface with Microsoft Management Console (MMC) snap-ins.
  • Extensible alerts. You can define new events and scripts that are automatically launched in response to events.
  • Extensible storage. You can register additional information for storage with ISA Server configuration, which centralizes management of add-in filters and tools.


Application Filters

Internet Security and Acceleration (ISA) Server 2004 application filters provide an extra layer of security at the Microsoft Firewall service. Application filters can access the data stream or datagrams associated with a session within the Firewall service. Application filters are registered with the Firewall service and work with some or all of the application level protocol streams or datagrams. An application filter can perform protocol-specific or system-specific tasks, such as authentication and virus checking. This section describes the application filters provided with ISA Server.

  • FTP access filter
  • H.323 filter
  • Intrusion detection filters
  • RPC filter
  • SMTP Filtering
  • SOCKS filter
  • Streaming media application filters
  • Web Proxy filter


FTP access filter

The FTP access filter that is provided with ISA Server forwards File Transfer Protocol (FTP) requests from SecureNAT clients to the Microsoft Firewall service. The filter dynamically opens secondary ports, which are required by FTP, and performs necessary address translation for SecureNAT clients.

Although you could create a protocol for FTP, the protocol would not offer the full range of capabilities afforded by the FTP access filter. The following list describes the differences between a user-defined FTP protocol and the FTP access filter:

  • The FTP access filter dynamically opens specific ports for the secondary connection, but the protocol definition opens a range of secondary ports.
  • The FTP access filter can protect clients by performing the address translation required for the secondary connection.
  • Because the FTP access filter includes a read-only FTP protocol definition, it can distinguish between read and write permissions, enabling you to fine-tune access permissions.

The FTP access filter uses the following protocol definitions, which are installed with the filter during the ISA Server installation:

  • FTP client read-only
  • FTP client
  • FTP server

For instructions about applying FTP access filtering to a specific rule, see Configure FTP filtering.

By default, the FTP access filter is applied to FTP and FTP server protocols. For more information on protocols, see Protocols.


H.323 filter

ISA Server includes an H.323 filter that allows H.323 compliant applications, such as NetMeeting 3.0 or later, to pass through ISA Server. This enables rich multimedia and real-time collaboration capabilities between enterprises using the Internet. Organizations that deploy interdepartmental firewalls can also use this technology to enhance communications between their employees over their intranets.

Additionally, the H.323 filter protects communication between internal clients and the Internet, hiding client IP addresses and restricting access, as needed.

For instructions on configuring the H.323 filter, see Configure H.323 filter.

H.323 protocol

The H.323 protocol is a set of standards enabling real-time multimedia conferencing and communications over packet-based networks that do not guarantee Quality of Service (QoS). The standard was developed to accommodate varying usages. Due to the inadequate quality of voice over the Internet, it was proposed that improvements could be made if communications were carried partly on the Internet and partly on the public switched telephone network (PSTN). The H.323 standards would also provide for communications between a standard PSTN phone and a computer-based client.

H.323 defines how compliant components (terminals, gateways, gatekeepers, and Multipoint Control Units (MCUs)) engage in audio, video, and multipoint conference communications. The H.323 standards define the mandatory and optional services supplied by a gatekeeper. The H.323 protocol standard contends with call control and management for both point-to-point and multipoint conferences. The standard also defines the gateway operability that allows calls to be connected between H.32x terminals as well as between LAN and PSTN devices.

By default, the H.323 filter is applied to the H.323 protocol. For more information on protocols, see Protocols.

Limiting access to H.323

You can create access rules that limit access to the H.323 protocol. For example, you might want to deny a client's H.323 access to video, T120 data-sharing, and outbound calls. You can create an access rule that allows the H.323 client access only to the inbound calls protocol. Because ISA Server allows access only when explicitly specified, only this protocol will be allowed.


Intrusion detection filters

ISA Server 2004 includes intrusion detection filters:

  • The DNS intrusion detection filter works with DNS server publishing rules. The filter intercepts and analyzes all inbound DNS traffic destined for the Internal network.
  • The POP3 application filter checks for Post Office Protocol version 3 (POP3) buffer overflow attacks.

DNS filter

The DNS application filter, installed with ISA Server, intercepts and analyzes DNS traffic destined for the Internal network. The DNS filter is the backbone of the ISA Server intrusion detection mechanism. Intrusion detection identifies when an attack is attempted against your network and performs a set of configured actions, or alerts, in case of an attack. To detect unwanted intruders, ISA Server compares network traffic and log entries to well-known attack methods. Suspicious activities trigger alerts. Actions include connection termination, service termination, e-mail alerts, logging, and others.

For instructions, see Enable intrusion detection of common attacks and Enable intrusion detection of DNS attacks.

If intrusion detection is enabled, you can configure which of the following intrusions triggers alerts:

  • All ports scan attack
  • Enumerated port scan attack
  • IP half scan attack
  • Land attack
  • Ping of Death attack
  • UDP bomb attack
  • Windows out-of-band attack

In addition, you can configure which of the following DNS attacks triggers alerts:

  • DNS host name overflow. A DNS host name overflow occurs when a DNS response for a host name exceeds a certain fixed length (255 bytes). Applications that do not check the length of the host names may return overflow internal buffers when copying this host name, allowing a remote attacker to execute arbitrary commands on a targeted computer.
  • DNS length overflow. DNS responses for Internet Protocol (IP) addresses contain a length field, which should be 4 bytes. By formatting a DNS response with a larger value, some applications executing DNS lookups will overflow internal buffers, allowing a remote attacker to execute arbitrary commands on a targeted computer.
    ISA Server also checks that the value of RDLength does not exceed the size of the rest of the DNS response.
  • DNS zone transfer. A DNS zone transfer occurs when a client system uses a DNS client application to transfer zones from an internal DNS server, from any source port.

All ports scan attack

This alert notifies you that an attempt was made to access more than the preconfigured number of ports. You can specify a threshold, indicating the number of ports that can be accessed.

Enumerated port scan attack

This alert notifies you that an attempt was made to count the services running on a computer by probing each port for a response.

If this alert occurs, you should identify the source of the port scan. Compare this with the services that are running on the target computer. Also, identify the source and intent of the scan. Check the access logs for indications of unauthorized access. If you do detect indications of unauthorized access, you should consider the system compromised and take appropriate action.

IP half scan attack

This alert notifies that repeated attempts to send TCP packets with invalid flags were made.

During a normal TCP connection, the source initiates the connection by sending a SYN packet to a port on the destination system. If a service is listening on that port, the service responds with a SYN/ACK packet. The client initiating the connection then responds with an ACK packet, and the connection is established. If the destination host is not waiting for a connection on the specified port, it responds with an RST packet. Most system logs do not log completed connections until the final ACK packet is received from the source. Sending other types of packets that do not follow this sequence can elicit useful responses from the target host, without causing a connection to be logged. This is known as a TCP half scan, or a stealth scan, because it does not generate a log entry on the scanned host.

If this alert occurs, log the address from which the scan occurs. If appropriate, configure the ISA Server rules to block traffic from the source of the scans.

Land attack

This alert notifies you that a TCP SYN packet was sent with a spoofed source IP address and port number that matches that of the destination IP address and port. If the attack is successfully mounted, it can cause some TCP implementations to go into a loop that causes the computer to fail.

Ping of Death attack

This alert notifies you that an IP fragment was received with more data than the maximum IP packet size. If the attack is successfully mounted, a kernel buffer overflows, which causes the computer to fail.

UDP bomb attack

This alert notifies you that there is an attempt to send an illegal User Datagram Protocol (UDP) packet. A UDP packet that is constructed with illegal values in certain fields will cause some older operating systems to fail, when the packet is received. If the target machine does fail, it is often difficult to determine the cause.

Windows out-of-band attack

This alert notifies you that there was an out-of-band denial of service attack attempted against a computer protected by ISA Server. If mounted successfully, this attack causes the computer to fail or causes a loss of network connectivity on vulnerable computers.

POP filter

The Post Office Protocol (POP) filter intercepts and analyzes POP traffic destined for the Internal network. Specifically, the application filter checks for POP buffer overflow attacks.

A POP buffer overflow attack occurs when a remote attacker attempts to gain root access of a POP server by overflowing an internal buffer on the server.


RPC filter

ISA Server handles traffic for all remote procedure calls (RPCs) between clients outside your network and RPC servers located inside your network. Using the ISA Server RPC filter, you can define one or more UUID interfaces as an RPC protocol definition. This protocol definition is used in ISA Server publishing rules for the server, so that external clients can access UUID interfaces on the internal RPC server.

By default, the RPC filter is applied to the RPC and RPC server protocols. For more information on protocols, see Protocols.

Exchange server publishing and the RPC filter

A popular method of accessing Exchange servers from remote sites is by using the full Outlook® MAPI client. Users prefer using the same full Outlook MAPI client for e-mail that they use when directly connected to the corporate network. The challenge for the firewall and security administrator is how to make the full Outlook MAPI client remote access connections secure. Remote access to Microsoft Exchange RPC services (which is required for Outlook MAPI client access) can require a large number of statically open ports on the Internet edge firewall. The number of statically opened ports required to allow remote access to Exchange RPC services has been a barrier to enabling an improved Outlook mail experience from remote locations.

On a conventional firewall, to enable this type of access, a large number of statically opened ports on the traditional firewall made security and firewall administrators hesitant about allowing remote access for the full Outlook MAPI client. An important concern is the potential for viruses and worms designed to attack RPC and DCOM services. If you use a conventional firewall that is not RPC application layer aware, RPC worms can attack the network through this port number. Such an attack could infect the Exchange server and subsequently infect other machines on the corporate network.

The ISA Server RPC filter enables you to force secure Outlook MAPI connections with the corporate Exchange server. The RPC filter blocks outbound RPC worm connections from the corporate network. The filter can help you prevent RPC worm connections from leaving the corporate network and prevent hosts on your network from infecting computers on the Internet.

The RPC filter can also be used to enforce secure RPC connections from Outlook MAPI clients. When this feature is enabled, connection requests from remote Outlook MAPI clients must be done through a secure encrypted channel. If the connection is not secured, ISA Server drops the client request. This allows ISA Server, instead of users, to control the level of security.

For instructions, see Configure RPC filtering.

RPC filtering for Outlook clients

The following describes when the initial RPC endpoint mapper connection is established between the Outlook MAPI client and ISA Server:

  1. The Outlook MAPI client establishes a connection to TCP port 135 on the external interface of ISA Server.
  2. The RPC filter statefully inspects packets in the connection. If invalid RPC communications are detected, the connection is dropped.
  3. Valid RPC connections from Outlook MAPI clients are forwarded to the Exchange server. The Exchange server responds to the request with a port number that the client uses for subsequent data connections.
  4. ISA Server intercepts the response and changes the port number to a valid port that the Outlook MAPI client can use on the external interface of ISA Server.
  5. ISA Server forwards to the Outlook MAPI client the port number it will use for subsequent communications with the Exchange server.

The following is the communications sequence between the Outlook MAPI client and the Exchange server after the endpoint mapper connection is established:

  1. The Outlook MAPI client establishes a connection to the MAPI port that ISA Server instructed it to use. ISA Server screens the RPC commands to ensure that no exploits are contained within the channel.
  2. Information sent by the Outlook MAPI client is forwarded by ISA Server to the Exchange server RPC services.
  3. The Exchange server responds to the Outlook MAPI client and ISA Server intercepts the responses. The RPC filter screens these responses and changes the source port number.
  4. ISA Server forwards the responses to the Outlook MAPI client.

Strict RPC compliance

Outbound RPC protocols can be configured on a per-rule basis, to enforce strict RPC compliance. By default, strict compliance is enforced for RPC protocols. By enforcing strict compliance, RPC-type protocols, such as DCOM, will not be allowed through ISA Server.

For instructions, see Configure RPC filtering.


SMTP Filtering

ISA Server 2004 is a sophisticated, application layer aware firewall that can be configured to stop unwanted e-mail messages, including dangerous viruses and worms. ISA Server performs inspection of SMTP messages, and blocks dangerous code and unwanted e-mail messages from entering the corporate network.

ISA Server use two components to protect the corporate network:

  • SMTP filter. For more information, see SMTP filter.
  • SMTP Message Screener. For more information, see Message Screener.


SMTP filter

ISA Server intercepts all Simple Mail Transfer Protocol (SMTP) traffic that arrives on port 25 of the ISA Server computer. The SMTP filter accepts the traffic, inspects it, and passes it on, only if the rules allow it.

The SMTP filter can work in conjunction with Message Screener to provide deeper content inspection. For more information on Message Screener, see Message Screener.

By default, the SMTP filter is applied to the SMTP and SMTP Server protocols. For more information on protocols, see Protocols.

ISA Server supports inter-forest communication between Exchange server computers only when the communication is over a secure channel (using TLS).

Logging blocked e-mail

If an SMTP command is blocked because it violates one of the SMTP filter's conditions, the blocked message will only be logged when you enable the SMTP Filter event alert. This alert is disabled by default. For instructions, see Enable an alert definition.

Handling commands

The SMTP filter examines SMTP commands sent by Internet SMTP servers and clients. The filter can intercept SMTP commands and check whether they are larger than they should be. SMTP commands that are larger than configured limits are assumed to be attacks against the SMTP server and can be stopped by the SMTP filter. For instructions on configuring which commands to filter, see Configure SMTP filter buffer overflow thresholds.

Each SMTP command has a maximum length associated with it. This length represents the number of bytes allowed for each command. If an attacker sends a command that exceeds the number of bytes allowed for the command, ISA Server drops the connection and prevents the attacker from communicating with the corporate mail server.

When a client uses a command that is defined but disabled, the filter closes that connection. When a client uses a command that is unrecognized by the SMTP filter, no filtering is performed on that message. If a client uses the TURN command, all e-mail messages will be dropped by the filter.

The RFC considers the AUTH command as part of the MAIL FROM command. For this reason, the SMTP filter blocks MAIL FROM commands only when they exceed the length of the MAIL FROM and AUTH commands issued (when AUTH is enabled). For example, if you specify maximum length of MAIL FROM as 266 bytes and AUTH as 1024 bytes, the message will be blocked only if the MAIL FROM command exceeds 1290 bytes.


Message Screener

ISA Server includes two components to help prevent mail relaying, the entry of viruses, and unwanted attachments on the network: the Simple Mail Transfer Protocol (SMTP) filter and Message Screener. Message Screener is an ISA Server optional component, which you can install separately from ISA Server and ISA Server Management.

SMTP Message Screener works together with the SMTP filter, to intercept all SMTP traffic arriving on TCP port 25 of the ISA Server computer. Message Screener is designed for filtering spam. Its primary purpose is to filter keywords, attachments, and e-mail messages sent from unwanted senders and domains, according to your specifications. It must be installed on an SMTP server running Internet Information Services (IIS) 6.0 or IIS 5.0. This server does not have to be the ISA Server computer. For example, Message Screener could be installed on the ISA Server computer, on the Exchange Server computer, or on any other internal SMTP server running IIS 6.0 or IIS 5.0.

Note

  • If you do not install Message Screener on the ISA Server computer, you must create an access rule allowing Message Screener access to the Local Host network, using the MS Firewall Control protocol.

SMTP Message Screener can filter incoming mail based on:

  • Value sent in the MAIL FROM SMTP command. This is used for Sender and Domain name filtering.
  • Content-Disposition header field for each attachment. This field commonly contains the attachment file name and extension. Message Screener can filter attachments by extension, by name, or by size.
  • Keyword filtering. This is used for filtering the message subject and the body, either text/plain or text/html content type.

SMTP Message Screener can be configured to delete e-mail messages, hold e-mail messages for later inspection, or forward e-mail messages to a security administrator's account for further examination and analysis.

Consider, for example, a common virus that sends unwanted e-mail messages containing a specific keyword. You can configure Message Screener to take one of three actions when e-mail messages with this keyword are received:

  • Delete message
  • Hold message
  • Forward message to

Important

  • If you install but do not enable and configure Message Screener, Message Screener will drop all messages.

Configuring message screening

Follow these steps to install and enable message screening with ISA Server:

  1. Install Message Screener. Typically, this will not be on the ISA Server computer. For instructions, see Install Message Screener.
  2. Configure the SMTPCredTool. For instructions, see Configure SMTPCred Tool.

Per-rule filtering

Message Screener is configured on a per-rule basis. Message Screener will be applied to rules only if you specifically enable message screening for that rule. Otherwise, the Message Screener will drop all e-mail messages. This is different from the filtering performed by the SMTP filter, which is configured for all rules that apply to SMTP traffic.

Logging blocked messages

Messages that are allowed or blocked by SMTP Message Screener are logged locally to a file on the machine running Message Screener. The file is located by default in %ProgramFiles%\Microsoft ISA Server\ISALogs. For more information about the SMTP log, see SMTP Message Screener log fields.

Note

  • If you are not running Message Screener on the ISA Server computer, and you specify a folder location for the Message Screener log that does not exist on the Message Screener computer, the folder will only be created on that computer after it is restarted.


SOCKS filter

The SOCKS filter provided with ISA Server forwards requests from SOCKS applications to the Microsoft Firewall service. ISA Server checks the access policy rules to determine if the SOCKS client application can communicate with the Internet.

When you install ISA Server, the SOCKS filter is disabled for all networks. You can configure ISA Server to listen for SOCKS requests on any port. (SOCKS applications typically send requests to port 1080.) You can modify the default port.

For instructions, see Configure SOCKS filtering.


Streaming media application filters

Streaming media application filters allow Firewall clients and SecureNAT clients to use the following streaming media protocols to access media streaming servers such as Microsoft Windows Media® Technologies (WMT) Server.

ISA Server includes three application filters, which enable client access to common streaming media protocols:

  • RTSP filter. Applies to Real Time Streaming Protocol (RTSP), which is used for access rules, and RTSP Server, which is used for server publishing rules. When enabled, this application filter can be used to allow Windows Media Player 9 and greater, RealPlayer G2 and greater, and QuickTime 4 and other client access and server publishing.
  • MMS filter. Applies to the Microsoft Windows Media (MMS), which is used for access rules, and to the MMS Server protocol, which is used for server publishing rules. When enabled, this application filter can be used to allow Windows Media Player 8 (default client in Windows XP) client access and server publishing.
  • PNM filter. Applies to Progressive Networks protocol (PNM), which is used for access rules, and PNM Server, which is used for server publishing rules. When enabled, this application filter can be used to allow RealPlayer client access and server publishing.

You can create protocol rules that limit access to the protocol definitions. For example, you might want to limit a client's access to Windows Media only. You can create a protocol rule that allows the Client MMS: Windows Media protocol and another protocol rule that denies use of the Client PNM: RealNetworks protocol.

If you disable the streaming media filter, all its protocol definitions are also disabled. That is, traffic that uses Windows Media Technologies, RealNetworks, and RTSP protocol definitions is blocked.

By default, the streaming media filters apply to the following protocols: RTSP, RTSP Server, MMS, MMS Server, PNM, and PNM Server. For more information on protocols, see Protocols.


Web Proxy filter

The Web Proxy filter works at the application level on behalf of a client requesting Web-based traffic. Although you cannot disable this filter, you can configure whether the filter applies to specific protocols. By default, it is applied to the Hypertext Transfer Protocol (HTTP), which is configured as follows:

  • Direction is Outbound.
  • Protocol Type is TCP.
  • Port is 80.

For more information about protocols, see Protocols.

When Web Proxy filter is enabled for a protocol, that protocol can use the following features, if applicable:

  • Authentication. For more information, see Authentication.
  • HTTP filtering. For more information, see HTTP filter.

When the Web Proxy filter is disabled for a protocol, ISA Server does not intercept requests from clients connecting to Web servers. This disables all caching and other proxying services for the client request. For instructions on disabling (or applying) a filter for a protocol, see Apply an application filter to a protocol.

You can create a custom protocol, which listens on a port other than 80, and apply the Web Proxy application filter to that protocol. In this way, you extend the Web Proxy filter functionality to the custom protocol.


Web Filters

ISA Server features can be extended by installing Web filters developed by other vendors. Web filters can monitor, evaluate, and intercept Hypertext Transfer Protocol (HTTP) communication between an Internal network and the Internet.

Web filters are loaded when the Microsoft Firewall service is started. Web filters can be configured to receive a number of special filter event notifications that occur with each HTTP request and response.

ISA Server includes the following Web filters:

  • Authentication filters
  • HTTP filter
  • Link Translation

Installing and upgrading additional application filters

Additional application filters developed by other vendors can work with ISA Server to extend its security model.

When you install a new application filter, you must restart the Firewall service.

When you upgrade a Web filter, we recommend that you create an access rule that denies use of the HTTP protocol. In this way, you block all HTTP traffic, until the filter again becomes functional. After the upgrade process completes, you can delete or disable the rule. For instructions, see Create an access rule.


Authentication filters

ISA Server includes a variety of authentication schemes. Support for the new authentication mechanisms is enabled by the following Web filters:

  • OWA forms-based authentication Web filter. This enables forms-based (cookie) authentication for publishing Outlook Web Access servers.
  • RSA SecurID Web filter. This enables authentication of Web requests using RSA SecurID authentication.
  • RADIUS authentication Web filter. This enables authentication of Web requests using RADIUS authentication.

ISA Server allows you to authenticate users in Active Directory and other authentication databases by using RADIUS to query Active Directory. Web publishing rules can also use RADIUS to authenticate remote access connections.

ISA Server can authenticate remote connections using SecurID two-factor authentication. This provides a high level of authentication security because a user must know something and have something to gain access to the published Web server.

ISA Server can generate the forms used by Outlook Web Access sites for forms-based authentication. This enhances security for remote access to Outlook Web Access sites by preventing unauthenticated users from contacting the Outlook Web Access server.

For more information about authentication, see Authentication Methods for Web Requests.


HTTP filter

ISA Server 2004 can perform stateful inspection, in addition to stateful filtering. Stateful inspection enables ISA Server to examine application layer commands and data. ISA Server can block the attack code passing through the stateful filtering mechanism because the packets are subsequently passed to the stateful inspection mechanism. The ISA Server stateful application layer filter examines Hypertext Transfer Protocol (HTTP) commands and data, and blocks packets from being passed to the Web server on the corporate network. This stops the attacks at the perimeter.

The HTTP filter is a Web filter that allows you to block HTTP requests based on the following:

  • Length of request payload. For instructions, see Limit request payload length.
  • Length of URL. For instructions, see Limit URLs that can be specified in a request.
  • HTTP request method. For example, the request method POST, GET, or HEAD may be used. For instructions, see Block specified HTTP methods.
  • HTTP request file name extension. For example, the file name extension may be .exe, .asp, or .dll. For instructions, see Block specified HTTP extensions.
  • HTTP request or response header. For example, the request or response header may be Location, Server, or Via. For instructions, see Block specified HTTP methods.
  • Signature or pattern in the request or response headers or body. For instructions, see Block specified HTTP signatures.

The HTTP filter is initially configured with defaults that help ensure secure HTTP access. However, depending on your specific deployment scenario, you should customize these defaults. For example, for Web publishing scenarios, allow these methods: OPTIONS, TRACE, GET, HEAD, and POST.

Notes

  • When you block specific signatures, you are blocking applications that tunnel traffic over HTTP and can be characterized by specific patterns in request headers, response headers, and body (for example, Windows Messenger). HTTP signature blocking will not block applications that use different types of content encoding or range requests.
  • It is assumed that all HTTP requests and responses are UTF-8 encoded. If a different encoding scheme is used, signature blocking cannot be performed.

Configuring extensions

When the HTTP filter is configured to allow or deny specific file name extensions, it first determines the extension. ISA Server considers an extension any character starting with a last period (.) and ending with a slash (/) or question mark (?), or to the end of the URL, if there is no / or ?. In addition, if ISA Server identifies characters after a . that seem like an extension (for example, .exe, .dll, or .com), the HTTP filter uses those as the extension.

The following table lists some examples of client requests and the file name extension that ISA Server uses for HTTP filtering.

Client request | Extension
http://server/path/file.ext | .ext
http://server/path/file.htm/additional/path/info.asp | .asp
http://MyServer/Path.exe/file.ext | .exe

In the last example listed in the table, if the HTTP filter allows .exe extensions, the request will be allowed (even if the filter does not allow .ext extensions). To work around this issue, deny the .ext signature in the URL. For instructions, see Block specified HTTP signatures.

Per-rule filtering

The HTTP filter can be configured on a per-rule basis, for Web publishing and access rules. For a given rule, you can configure which methods, extensions, and signatures are blocked.

The maximum length of headers is the only HTTP filter property that is configured for all rules that apply to HTTP. By default, it is set to 32,768 bytes. For instructions, see Limit the maximum size of a header in HTTP requests.

When the HTTP filter denies a request, the reason for denial is stored in the the Filter Information field of the Web Proxy log.

Important

  • When you configure the HTTP filter, you can select to block high bit characters. When this option is selected, URLs that contains DBCS or Latin 1 characters will be blocked. This can impact scenarios such as Outlook® Web Access publishing, SharePoint™ Portal Server publishing, and any scenario in which a GET request passes a parameter that includes a character from a double-byte character set. For instructions, see Limit URLs that can be specified in a request.


Link Translation

Some published websites may include references to internal names of computers. Because only ISA Server—and not the whole network—is made available to external clients, these references will appear as broken links. ISA Server includes a link translation Web filter, which you can use to create a dictionary of definitions for internal computer names that map to publicly known names.

For more information, see:

  • How link translation works
  • Link translation dictionaries


How link translation works

Due to the ISA Server link translation Web filter's built-in functionality and its default dictionary, enabling link translation for a Web publishing rule will solve problems in simple publishing scenarios. For example, when pages on the internal Web server contain absolute Uniform Record Locators (URLs) that point to its own server name (NetBIOS name), the link translation filter returns the appropriate links that are accessible for External network users. In addition, even when those URLs contain http:// and the external user connects to the website using https://, ISA Server link translation changes the link to use https:// instead of http://. For instructions, see Replace absolute links in Web pages.

The default link translation dictionary also translates requests made to nonstandard ports. For example, if users connect to a website published on a nonstandard port on the ISA Server firewall, such as http://www.external.net:8181, link translation includes the port number in the URLs sent back to the external client.

For more complex publishing scenarios or when complex Active Server Pages (ASP) code is involved, it is necessary to configure dictionary definitions that map to the names returned by the internal website. The dictionary name mappings are configured on a per-Web publishing rule basis on ISA Server.

When link translation is enabled, ISA Server also checks the Content-type header of the response to determine whether link translation should be applied to the body of the message. (By default, link translation operates only on the HTML documents content group, although other content groups can be specified.)

Notes:

  • The link translation filter works by first looking for a Content-type header to determine whether it needs to perform translation. If no Content-type header is present, the filter will look for a Content-location header to perform translation. If neither header is present, the filter will look at the file name extension of the requested URL.
  • ISA Server only performs link translation on HTML document strings, such as internal computer names, that are specified in UTF-8 format.
  • If the website contains many links that must be translated, this may adversely impact ISA Server performance.

    When link translation dictionaries are used in Web publishing rules, the link translation filter maps text strings according to the following rules:

    1. The filter searches for the strings in the order they were added to the dictionary.
    2. If the filter finds a match to a text string, it will look at the next character to the right to determine if it is a terminating character. The following are considered terminating characters.
    Terminating characters
    \t \r \n ; ~ < ! " & '
    ( $ ) * + , / > =
    ? [ \ ] ^ ` { | }
  • If the filter finds a terminating character immediately to the right of the string, it will perform translation.

For example, consider the search string http://IntSalesA. Although the string is in both http://IntSalesA/Sales/ and http://IntSalesAfrica/, the link translation Web filter only replaces http://IntSalesA/Sales/ because f is not a terminating character.

Note that FTP:// links are not automatically added to the default link translation dictionary. You can add them to the dictionary explicitly.

Caution

  • Internal links that are not mapped in the link translation dictionary are passed as is to the user. In this way, names of internal computers are exposed and are put at risk, allowing a potential hacker to become aware of these internal names. This can be particularly dangerous for computers with meaningful names (for example, a computer named \\Firewall).


Link translation dictionaries

When you enable link translation for a Web publishing rule, a link translation dictionary is automatically created. In most cases, you will not need to add more entries to the default dictionary. If necessary, you can add more entries to this dictionary.

The default dictionary includes the following entries:

  • Any occurrence on the website of the computer name that is specified on the To tab of the Web publishing rule properties is replaced with the website name (or IP address).
    For example, if a rule redirects all requests for http://www.microsoft.com to an internal computer called msinternal, all occurrences of http://msinternal in the response page returned to the client are replaced with http://www.microsoft.com.
  • If a port that is not the default is specified on the incoming Web request listener, it is used when replacing links on the response page. If a default port is specified, the port is removed when replacing links on the response page.
  • If the client specifies HTTPS in the request to the ISA Server computer, ISA Server, in the response from the IIS Server computer, replaces all occurrences of HTTP with HTTPS.

Example

For example, consider a scenario where ISA Server publishes a site located on a computer with the internal name IIS_A.Org, which is available on the default HTTP port 80 and SSL port 443. ISA Server publishes the site, using its public name www.fabrikam.com, on the same default ports. A client might make the following request:

GET /dirA HTTP/1.1
Host: www.fabrikam.com

Note that the directory name in the request is not terminated by a slash (/). When the server running Internet Information Services (IIS) receives this request, it automatically returns a 302 response with the location header set to http://IIS_A.Org/dirA/, which is the internal name of the server followed by the directory name and terminated by a slash.

ISA Server translates the response header value to http://www.fabrikam.com/dirA/.

In this example, the following entries are automatically added to the link translation dictionary:

  • http://IIS_A.Org is mapped to http://www.fabrikam.com
  • http://IIS_A.Org:80 is mapped to http://www.fabrikam.com
  • https://IIS_A.Org is mapped to https://www.fabrikam.com
  • https://IIS_A.Org:443 is mapped to https://www.fabrikam.com

If an initial client request was sent on a secure connection (using SSL), all the links to the same computer will be translated to use SSL for security reasons. The following entries are automatically included in the link translation dictionary:

  • http://IIS_A.Org is mapped to https://www.fabrikam.com
  • http://IIS_A.Org:80 is mapped to https://www.fabrikam.com
  • https://IIS_A.Org is mapped to https://www.fabrikam.com
  • https://IIS_A.Org:443 is mapped to https://www.fabrikam.com

If the site uses ports other than the default ports (for example, 81 for HTTP and 444 for SSL), links will contain that port number. The port number will also be translated, as follows:

  • http://IIS_A.Org:81 is mapped to http://www.fabrikam.com
  • https://IIS_A.Org:444 is mapped to https://www.fabrikam.com

Similarly, if ISA Server publishes the site on ports that are not the default ports (for example, 82 for HTTP and 445 for SSL), links will be translated to the published ports:

  • http://IIS_A.Org is mapped to http://www.fabrikam.com:82
  • http://IIS_A.Org:80 is mapped to http://www.fabrikam.com:82
  • https://IIS_A.Org is mapped to https://www.fabrikam.com:445
  • https://IIS_A.Org:443 is mapped to https://www.fabrikam.com:445

Tips and hints on adding entries

Follow these guidelines when creating entries for the link translation dictionary:

  • Do not end the search string with a terminating character. For example, use http://IIS_A.Org and not http://IIS_A.Org/.
  • When adding an entry for a site name, also add an entry with the site name and port. For example, when adding the search string http://IIS_A.Org, also add the search string http://IIS_A.Org:80.
  • Use both http:// and https://.
  • Use caution when changing directory structures.
  • Dictionaries with a large number of entries, which are applied to websites that include many links that require translation, could detrimentally impact ISA Server performance.


Add-ins: How To

This section describes how to use the filtering add-ins, developed by Microsoft or by third-party vendors. These add-ins provide additional filtering functionality to Internet Security and Acceleration (ISA) Server 2004.

  • Enable or disable a filter
  • Configure H.323 filter
  • Configure Intrusion Detection Filters
  • Configure Web Filter for RSA SecurID
  • Configure SOCKS filter
  • Configure SMTP Filter


Enable or disable a filter

To enable or disable a filter

  1. In the console tree of ISA Server Management, click Add-ins.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Add-ins
  2. In the details pane, click the applicable Web filter or the application filter.
  3. On the Tasks tab, do one of the following:
    • To enable the filter, click Enable Selected Filter.
    • To disable the filter, click Disable Selected Filter.

Notes

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • By disabling a filter, you disable application filtering for the applicable protocols. The recommended method of disabling application filtering is by not applying the filter to a specific protocol.

Related Topics


Configure H.323 filter

To configure H.323 filter

  1. In the console tree of ISA Server Management, click Add-ins.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Add-ins
  2. In the details pane, select the H.323 Filter.
  3. On the Tasks tab, click Configure Selected Filter.
  4. On the Call Control tab, do one or more of the following:
    • To specify an H.323 gatekeeper, select the Use this Gatekeeper check box and enter the fully qualified domain name (FQDN) of the H.323 gatekeeper server.
    • To permit people in other organizations to call people within your organization, select the Allow incoming calls check box.
    • To enable DNS gatekeeper lookup, select the Use DNS gatekeeper lookup and LRQs for alias resolution check box.
    • To permit audio calls, select the Allow audio check box.
    • To permit video calls, select the Allow video check box.
    • To permit T.120 data and application sharing, select the Allow T120 and application sharing check box.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure Intrusion Detection Filters

This section describes how to configure the intrusion detection filters included with Internet Security and Acceleration (ISA) Server 2004.

  • Enable intrusion detection of common attacks
  • Enable intrusion detection of DNS attacks
  • Log dropped packets


Enable intrusion detection of common attacks

To enable intrusion detection of common attacks

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. In the details pane, click Enable Intrusion Detection and DNS Attack Detection.
  3. On the Common Attacks tab, click Enable intrusion detection.
  4. Select one or more of the following:
    • Windows out-of-band (WinNuke). Select this option when ISA Server will generate an event if an out-of-band denial of service attack is attempted against a computer protected by ISA Server.
    • Land. Select this option when ISA Server will generate an event if a TCP SYN packet is sent with a spoofed source IP address and port number that matches that of the destination IP address and port number.
    • Ping of death. Select this option when ISA Server will generate an event if an IP fragment is received with more data than the maximum IP packet size.
    • IP half scan. Select this option when ISA Server will generate an event if repeated attempts to connect to a destination computer are made and no corresponding ACK packets are communicated.
    • UDP bomb. Select this option when ISA Server will generate an event if there is an attempt to send an illegal User Datagram Protocol (UDP) packet. Although an event will be generated when the attack occurs, you must specifically enable and configure an alert to trigger an action.
    • Port scan. Select this option when ISA Server will generate an event if an attempt is made to count the services running on a computer by probing each port for a response. If you select this option, also specify the following:
      • Detect after attacks on well-known ports. Type the maximum number of well-known ports that can be scanned before generating an event when a port scan attack is detected. A well-known port is any port in the range from 1 through 2048.
      • Detect after attacks on ports. Type the maximum number of ports that can be scanned before generating an event when a port scan attack is detected.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Enable intrusion detection of DNS attacks

To enable intrusion detection of DNS attacks

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. In the details pane, click Enable Intrusion Detection and DNS Attack Detection.
  3. On the DNS Attacks page, click Enable detection and filtering of DNS attacks.
  4. Select one or more of the following:
    • DNS host name overflow. If ISA Server should check for DNS host name overflow intrusion attempts. The DNS intrusion detection filter intercepts and analyzes DNS traffic destined for the Internal network. A DNS host name overflow intrusion occurs when a DNS response for a host name exceeds a certain fixed length.
    • DNS length overflow. If ISA Server should check for DNS length overflow intrusion attempts. A DNS length overflow intrusion occurs when a DNS response for IP addresses exceeds a specified length of 4 bytes.
    • DNS zone transfer. If ISA Server should check for DNS zone transfer intrusion attempts. A DNS zone transfer intrusion occurs when a client system uses a DNS client application to transfer zones from an internal DNS server.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Log dropped packets

To log dropped packets

  1. In the console tree of ISA Server Management, click General.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • General
  2. In the details pane, click Enable Intrusion Detection and DNS Attack Detection.
  3. On the Common Attacks page, click Log Dropped Packets.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • By default, when you install ISA Server, all dropped packets are logged.

Related Topics


Configure Web Filter for RSA SecurID

This section describes how to configure Internet Security and Acceleration (ISA) Server 2004 for RSA ACE/Agent and RSA ACE/Server.

  • Set up the ISA Server computer as an RSA ACE/Agent
  • Verify that ISA Server can authenticate against the RSA ACE/Server


Set up the ISA Server computer as an RSA ACE/Agent

To set up the ISA Server computer as an RSA ACE/Agent

  • Copy the Sdconf.rec file, located in the ACE\Data folder on the RSA ACE/Server computer, to the %windir%\system32 folder on the ISA Server computer.

Note

  • If you are using a version of RSA Ace/Server earlier than 5.0, perform the following steps:
    1. On the RSA ACE/Server computer, click Start, click Programs, click RSA ACE Server, and then click Database Administration - Host Mode.
    2. On the Agent Host menu, click Add Agent Host.
    3. In Name, type the name of the ISA Server computer.
    4. In Network address, type the IP address of the ISA Server computer, if it did not appear.
    5. In Agent Host, click Generate Configuration File, click One Agent Host, click OK, double-click the name of the ISA Server computer, and save the Sdconf.rec file in a folder on the computer.
    6. Copy the Sdconf.rec file to the %windir%\system32 folder on the ISA Server computer.

Related Topics


Verify that ISA Server can authenticate against the RSA ACE/Server

To verify that ISA Server can authenticate against the RSA ACE/Server

  1. From a command prompt, type ISA_installation_directory\sdtest.exe.
  2. In RSA SecurID Authentication Information, click RSA ACE/Server Test Directly.
  3. In RSA SecurID Authentication, type the user name in Enter User Name and the passcode in Enter PASSCODE.
  4. Click OK when the Authentication successful message displays.

Important

  • Because the Web filter for RSA SecurID authentication communicates and authenticates with the RSA ACE/Server, the ISA Server computer must be able to communicate and authenticate against the RSA ACE/Server.

Related Topics


Configure SOCKS filter

To configure SOCKS filter

  1. In the console tree of ISA Server Management, click Add-ins.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Add-ins
  2. In the details pane, select the SOCKS V4 Filter.
  3. On the Tasks tab, click Configure Selected Filter.
  4. On the General tab, select Enable this filter.
  5. On the Networks tab, in Port, type the port number on which ISA Server will listen for SOCKS requests.
  6. Select one or more networks on which ISA Server will listen for SOCKS requests.

Note

  • To open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Related Topics


Configure SMTP Filter

This section describes how to configure the SMTP filter included with Internet Security and Acceleration (ISA) Server 2004.

  • Install Message Screener
  • Configure SMTPCred tool
  • Configure SMTP filter buffer overflow thresholds
  • Stop users from gaining access to the SMTP server
  • Stop domains from gaining access to the SMTP server
  • Filter e-mail attachments
  • Filter e-mail messages by keyword


Install Message Screener

To install Message Screener

  1. At a command prompt, type:
    Path\ISA\Setup
    where Path is the path to the ISA Server 2004 installation files. The path may be the root folder of the ISA Server CD or a shared folder on your network that contains the ISA Server files.
  2. On the Welcome screen, click Next. Follow the on-screen instructions.
  3. On the License Agreement screen, click I accept the terms of the license agreement, and then click Next.
  4. On the Customer Information screen, fill in the information, and then click Next.
  5. On the Setup Type screen, select Custom, and then click Next.
  6. On the Custom Settings screen, select Message Screener, click This feature will be installed on local hard drive, and then click Next.
  7. Click Install.

Notes

  • To perform this procedure, you must be a member of the Administrators group.
  • Message Screener must be installed on a Simple Mail Transfer Protocol (SMTP) server, which is typically not your ISA Server computer.
  • The user account specified for configuring SMTP Message Screener must have read access to the ISA Server computer.
  • The SMTP server that runs Message Screener can pass these credentials by using the SMTPCred tool. For instructions, see Configure SMTPCred.
  • If you do not install Message Screener on the ISA Server computer, you must create an access rule allowing Message Screener access to the Local Host network, using the MS Firewall Control protocol.

Related Topics


Configure SMTPCred tool

To configure SMTPCred tool

  1. Run the SMTPCred tool by typing SMTPCred.exe at a command prompt.
  2. In the message box, type the name or IP address of the ISA Server computer.
  3. Type the domain name, administrator name, and password in the applicable text boxes.
  4. Click Test.

Notes

  • By default, the SMTPCred.exe tool is located in the ISA Server installation folder.
  • The user account specified for configuring SMTP Message Screener must have read access to the ISA Server computer.

Related Topics


Configure SMTP filter buffer overflow thresholds

To configure SMTP filter buffer overflow thresholds

  1. In the console tree of ISA Server Management, click Add-ins.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Add-ins
  2. In the details pane, on the Application Filters tab, click SMTP Filter.
  3. On the Tasks tab, click Configure Selected Filter.
  4. On the SMTP Commands tab, click the applicable command, and then click Edit.
  5. In SMTP Command Rule, select Enable SMTP command.
  6. In Maximum Length, type the maximum length of the command line for the commands.

Notes

  • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
  • To add a new command, click Add and type the command name in SMTP Command Rule.
  • When a client uses a command that is defined but disabled, the filter closes that connection.
  • When a client uses a command that is unrecognized by the SMTP filter, no filtering is performed on that message.
  • Only simple SMTP commands can be added.
  • If a client uses the TURN command, all e-mail messages will be dropped by the filter.
  • The RFC considers the AUTH command as part of the MAIL FROM command. For this reason, the SMTP filter blocks MAIL FROM commands only when they exceed the length of the MAIL FROM and AUTH commands issued (when AUTH is enabled). For example, if you specify a maximum length of MAIL FROM as 266 bytes and AUTH as 1024 bytes, the message will be blocked only if the MAIL FROM command exceeds 1290 bytes.

Related Topics


Stop users from gaining access to the SMTP server

To stop users from gaining access to the SMTP server

  • In the console tree of ISA Server Management, click Add-ins.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Add-ins
  • In the details pane, on the Application Filters tab, click SMTP Filter.
  • On the Tasks tab, click Configure Selected Filter.
  • On the Users/Domains tab, in Sender's email address, type the e-mail address of a sender who will be denied access to the SMTP server, and then click Add.

    • Notes

    • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
    • Message Screener must be installed and enabled to use this functionality.

    Related Topics


Stop domains from gaining access to the SMTP server

To stop domains from gaining access to the SMTP server

  • In the console tree of ISA Server Management, click Add-ins.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Add-ins
  • In the details pane, on the Application Filters tab, click SMTP Filter.
  • On the Tasks tab, click Configure Selected Filter.
  • On the Users/Domains tab, in Domain Name, type the name of a domain whose users are denied access to the SMTP server, and then click Add.

    • Notes

    • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
    • Message Screener must be installed and enabled to use this functionality.

    Related Topics


Filter e-mail attachments

To filter e-mail attachments

  • In the console tree of ISA Server Management, click Add-ins.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Add-ins
  • In the details pane, on the Application Filters tab, click SMTP Filter.
  • On the Tasks tab, click Configure Selected Filter.
  • On the Attachments tab, click Add.
  • In Mail Attachment Rule, select the Enable this rule check box.
  • Select one of the following and type the appropriate information:
    • Attachment name. Type the name of the attachment.
    • Attachment extension. Type the extension of the attachment.
    • Attachment size limit. Type the maximum size of the attachment.
  • In Action, select one of the following:
    • Delete message
    • Hold message
    • Forward messages to
  • If you selected Forward messages to, type one or more addresses, separated by semi-colons (;), to which the message should be forwarded.

    • Notes

    • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
    • Message Screener must be installed and enabled to use this functionality.
    • To change the order in which actions will be applied to the condition, click the up or down arrows.

    Related Topics


Filter e-mail messages by keyword

To filter e-mail messages by keyword

  • In the console tree of ISA Server Management, click Add-ins.

    Where?

    • Microsoft ISA Server 2004
    • Server_Name
    • Configuration
    • Add-ins
  • In the details pane, on the Application Filters tab, click SMTP Filter.
  • On the Tasks tab, click Configure Selected Filter.
  • On the Keywords tab, click Add.
  • Click Enable this rule.
  • In Keyword, type a string to which the rule applies.
  • In Apply action if keyword is found in, select one of the following:
    • Message header or body
    • Message header
    • Message body
  • In Action, select one of the following:
    • Delete message
    • Hold message
    • Forward messages to. Then, type one or more addresses, separated by semi-colons (;), to which the message should be forwarded.

    • Notes

    • To open ISA Server Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Server Management.
    • Message Screener must be installed and enabled to use this functionality.
    • To change the order in which actions will be applied to the condition, click the up or down arrows.

    Related Topics


Deployment scenario: SMTP filter

The SMTP filter always runs on the ISA Server computer. However, you can place the SMTP Message Screener on another computer located on the protected network behind the ISA Server computer. The SMTP Message Screener can be installed in the following locations:

  • On the ISA Server computer
  • On an independent SMTP relay located behind the ISA Server computer
  • On the Exchange server

Message filtering requires a significant amount of processing power. For this reason, most organizations prefer to put the SMTP Message Screener on the ISA Server computer or on an SMTP relay located somewhere on the corporate network, so as not to overload the Exchange server.

The SMTP Message Screener can be installed on an SMTP relay computer on the corporate network running the Internet Information Services (IIS) 6.0 or IIS 5.0 SMTP service. The ISA Server computer publishes the SMTP relay on the Internal network, and the Message Screener blocks dangerous e-mail messages at the SMTP relay computer. The SMTP Message Screener communicates with the SMTP filter to obtain information about which e-mail messages should be blocked.

For more background information, see SMTP filtering. For a detailed deployment scenario, see SMTP Message Screening (http://www.microsoft.com/) on the ISA Server website.


Additional Resources

  • Accessibility for ISA Server Management
  • Log Code Values
  • Performance Counters


Accessibility for ISA Server Management

In addition to Microsoft® Windows Server™ 2003 (or Windows® 2000 Server) and Microsoft Management Console (MMC) accessibility products and services, ISA Server provides keyboard shortcuts for selecting commands and for navigating in and between console panes.

Navigation

As with any MMC snap-in, you can browse ISA Server Management console tree by expanding and collapsing branches, by clicking the plus sign and minus sign or by double-clicking with the mouse. The following table lists the keystrokes you can use to move in and between console panes.

Keystroke action | Result
TAB | Moves forward between panes in the active window.
SHIFT+TAB | Moves backward between panes in the active window.
UP ARROW | Moves the selection up one item in a pane.
DOWN ARROW | Moves the selection down one item in a pane.
PAGE UP | Moves the selection to the top item visible in a pane.
PAGE DOWN | Moves the selection to the bottom item visible in a pane.
HOME | Moves the selection to the first item in a pane.
END | Moves the selection to the last displayed item in a pane.
RIGHT ARROW | Expands the selected item.
LEFT ARROW | Collapses the selected item. If the selected item does not contain hidden items, functions like the UP ARROW.

The following table lists the mouse actions you can use to move through the ISA Server Management console tree.

Mouse action | Result
Click | Selects an item.
Double-click | Displays or hides items contained by the selected item. Displays properties for or opens an item.
Right-click | Displays the Action shortcut menu for the selected item.

Navigation between tabs

You can move between tabs by using the Switch To command on the View menu. Press ALT+V to access the View menu, and then press W to access the Switch To command. Then, click the applicable keyboard shortcut to access the tab.

Keyboard shortcuts

The following table lists the keyboard shortcuts for the menu commands in ISA Server Management.

Action | Result
F1 | Opens the Help topic, if any, for the selected item.
F5 | Refreshes the content of all console panes.
ENTER | Displays the properties dialog box, if any, for the selected item.
ALT+SPACEBAR | Displays the ISA Server Management window menu.
ALT+F4 | Closes the snap-in.
ALT+A | Displays the Action menu.
ALT+V | Displays the View menu.
ALT+F | Displays the File menu.
ALT+H | Displays the Help menu.


Log Code Values

  • Action log values
  • Cache info log values
  • Error information log values
  • Operating system log values
  • Object source log values
  • Result code log values


Action log values

The Firewall log can include an action field. For more information, see Log viewer and Microsoft Firewall service log fields. The following table lists the possible action values.

MSDE value | String in text log
0 | -
1 | Bind
2 | Listen
3 | GHBN
4 | GHBA
5 | Redirect-bind
6 | Establish
7 | Terminate
8 | Denied
9 | Allowed
10 | Failed
11 | Intermediate
12 | Successful Connection
13 | Unsuccessful Connection
14 | Disconnection
15 | User cleared Quarantine
16 | Quarantine timeout


Cache info log values

The Web Proxy log can include a cache info field that specifies the cache status of the object, which indicates why the object was or was not cached. The following table lists the possible cache info values.

Value | Description
0x00000001 | Request should not be served from the cache.
0x00000002 | Request includes the IF-MODIFIED-SINCE header.
0x00000004 | Request includes one of these headers: CACHE-CONTROL:NO-CACHE or PRAGMA:NO-CACHE.
0x00000008 | Request includes the AUTHORIZATION header.
0x00000010 | Request includes the VIA header.
0x00000020 | Request includes the IF-MATCH header.
0x00000040 | Request includes the RANGE header.
0x00000080 | Request includes the CACHE-CONTROL: NO-STORE header.
0x00000100 | Request includes the CACHE-CONTROL: MAX-AGE, CACHE-CONTROL: MAX-STALE, or CACHE-CONTROL: MIN-FRESH header.
0x00000200 | Cache could not be updated.
0x00000400 | IF-MODIFIED-SINCE time specified in the request is newer than cached LASTMODIFIED time.
0x00000800 | Request includes the CACHE-CONTROL: ONLY-IF-CACHED header.
0x00001000 | Request includes the IF-NONE-MATCH header.
0x00002000 | Request includes the IF-UNMODIFIED-SINCE header.
0x00004000 | Request includes the IF-RANGE header.
0x00008000 | More than one VARY header.
0x00010000 | Response includes the CACHE-CONTROL: PUBLIC header.
0x00020000 | Response includes the CACHE-CONTROL: PRIVATE header.
0x00040000 | Response includes the CACHE-CONTROL: NO-CACHE or PRAGMA: NO-CACHE header.
0x00080000 | Response includes the CACHE-CONTROL: NO-STORE header.
0x00100000 | Response includes either the CACHE-CONTROL: MUST-REVALIDATE or CACHE-CONTROL: PROXY-REVALIDATE header.
0x00200000 | Response includes the CACHE-CONTROL: MAX-AGE or S-MAXAGE header.
0x00400000 | Response includes the VARY header.
0x00800000 | Response includes the LAST-MODIFIED header.
0x01000000 | Response includes the EXPIRES header.
0x02000000 | Response includes the SET-COOKIE header.
0x04000000 | Response includes the WWW-AUTHENTICATE header.
0x08000000 | Response includes the VIA header.
0x10000000 | Response includes the AGE header.
0x20000000 | Response includes the TRANSFER-ENCODING header.
0x40000000 | Response should not be cached.


Error information log values

The Web Proxy log can include an error information field. For more information, see Log viewer and Web Proxy log fields. The following table lists the possible values.

MSDE value | Description
0x00000001 | Error receiving packets from client
0x00000002 | Error sending packets to client
0x00000004 | Error sending packets to server
0x00000008 | Error receiving packets from server
0x00000040 | Error while connecting
0x00000080 | Connection with client is "Keep-Alive"
0x00000100 | Connection with upstream server is "Keep-Alive"
0x00000200 | Client's request includes a body (of non-zero content length)
0x00000400 | Server's response includes a body (of non-zero content length)
0x00000800 | Name resolution made using DNS cache


Operating system log values

The Web Proxy and Firewall logs can include a Client Agent field that specifies the operating system initiating the request. The following table lists the possible operating system values.

Value | Description
0:3.1 | Windows® 3.1
0:3.11 | Windows for Workgroups
0:3.95 | Windows 95 (16-bit)
1:3.11 | Win32s
2:4.0 | Windows 95 (32-bit)
2:4.10 | Windows 98
2:4.90 | Windows Millennium Edition
3:3.1 | Windows NT® 3.1
3:3.5 | Windows NT 3.5
3:3.51 | Windows NT 3.51
3:4.0 | Windows NT 4.0
3:5.0 | Windows 2000
3:5.1 | Windows XP
3:5.2 | Windows Server™ 2003

If ISA Server does not recognize the operating system, the log field value is set to Unknown.


Object source log values

The Web Proxy log can include an object source field that specifies the source that was used to retrieve the current object. For more information, see Log viewer and Web Proxy log fields. The following table lists the possible object source values.

Source values | String in text log | Description
0 | (None) | No source information is available.
1 | Cache | Source is the cache. Object returned from cache.
2 | Verified Cache | Source is the cache. Object was verified to source and had not been modified.
3 | Not Verified Cache | Source is the cache. Object could not be verified to source.
4 | Verify Failed Internet | Source is the Internet. The object in the cache was not valid, and was retrieved from the Internet.
5 | Internet | Source is the Internet. Object added to cache.
7 | Upstream | Object returned from an upstream proxy cache.
8 | Not Modified | Source is the cache. Client performed an If-Modified-Since request and object had not been modified.


Result code log values

The Web Proxy and Firewall logs can include a result code field that specifies the status of the request. In the Web proxy log, this field indicates the HTTP status code. In the Firewall log, this field indicates the result code.

In the Firewall log, the result code field represents an error. It can be one of the following:

  • A Windows-based HRESULT error code
  • An ISA Server service error code. These errors typically begin with 0xC00. Error text typically includes FWX_E_.

The HTTP Status Code column represents an http error (from the web proxy). It can get one of the following values:

  • An HTTP response code, as defined in the HTTP RFC. For a list of HTTP response codes, see the Platform SDK (http://www.microsoft.com/).
  • A Winsock error code. For a list of Winsock error codes, see MSDN (http://www.microsoft.com/).
  • An ISA Server Web Proxy error code. These errors also include a description.


Performance Counters

This section describes Internet Security and Acceleration (ISA) Server 2004 performance counters. For information about specific counters, see:

  • Firewall Engine performance counters
  • H.323 filter performance counters
  • Cache performance counters
  • Microsoft Firewall service performance counters
  • SOCKS filter performance counters
  • Web Proxy performance counters

Load monitoring

To monitor general performance, closely monitor the following counters.

Category | Counter name
ISA Server Firewall Engine | Active Connections
ISA Server Firewall Service | Active Sessions
ISA Server Web Proxy | Requests per second
ISA Server Firewall Engine | Bytes/sec

Security monitoring

To monitor general security threats, closely monitor the following counters.

Category | Counter name
ISA Server Firewall Engine | Dropped packets/sec
ISA Server Firewall Engine | Packets/sec
ISA Server Firewall Engine | Connections/sec
ISA Server Web Proxy | Current Average Milliseconds/request


Firewall Engine performance counters

The following table lists the performance counters for the Firewall Engine.

Performance counter | Description
Active Connections | The total number of active connections currently passing data.
Connections/sec | The number of new connections created per second.
TCP Established Connections/sec | The number of TCP connections newly established per second. A TCP connection is counted as established after the 3-way SYN handshake was completed successfully.
Bytes | The total number of bytes that passed through ISA Server.
Bytes/sec | The number of bytes passed through ISA Server per second.
Packets | The total number of packets inspected by ISA Server.
Packets/sec | The number of packets inspected by ISA Server per second.
Allowed Packets | The total number of packets that ISA Server allows to pass.
Allowed Packets/sec | The number of packets per second that ISA Server allows to pass.
Dropped Packets | The number of packets dropped by ISA Server.
Dropped Packets/sec | The number of packets dropped by ISA Server per second.
Backlogged Packets | The number of backlogged packets.


H.323 filter performance counters

The following table lists the H.323 filter performance counters.

Performance counter | Description
Total H.323 Calls | The total number of H.323 calls handled by the H.323 filter since the Firewall Service was started.
Active H.323 Calls | The number of H.323 calls that are currently active


Cache performance counters

The following table lists the performance counters for the ISA Server cache.

Counter | Description
Active Refresh Bytes Rate (KB/sec) | Measures the rate at which bytes of data are retrieved from the Internet to actively refresh popular Uniform Resource Locators (URLs) in the cache. This will relate to the configuration set for active caching.
Active URL Refresh Rate (URL/sec) | Measures the rate at which popular cached URLs are actively refreshed from the Internet. This will relate to the configuration set for active caching.
Disk Bytes Retrieve Rate (KB/sec) | Measures the rate at which bytes of data are retrieved from the disk cache. This counter is similar to the Disk URL Retrieve Rate counter, but monitors bytes, rather than URLs.
Disk Cache Allocated Space (KB) | Measures how much space is being used by the disk cache. It will be equal to or less than the amount configured for the disk cache.
Disk Content Write Rate (Writes/sec) | Measures the number of writes per second to the disk cache for the purpose of writing URL content to the cache disk.
Disk Failure Rate (Failures/sec) | Measures the number of input/output (I/O) failures per second. An I/O failure occurs when ISA Server fails to read from or write to the disk cache. This counter, with the Total Disk Failures counter, will clearly indicate disk cache problems.
Disk URL Retrieve Rate (URL/sec) | Measures how many URLs are sent to clients from the disk cache in one second. This is a useful counter to measure at peak and off-peak times to check how the disk cache is performing. It can be compared with the Memory URL Retrieve Rate counter to see how cache disk and memory are being utilized.
Max URLs Cached | Measures the maximum number of URLs that have been stored in the cache.
Memory Bytes Retrieved Rate (KB/sec) | Measures the rate at which bytes of data are retrieved from the memory cache. This counter is similar to the Memory URL Retrieve Rate counter, but monitors bytes, rather than URLs.
Memory Cache Allocated Space (KB) | Measures how much space is being used by the memory cache. It should be equal to or less than the amount configured for the memory cache.
Memory URL Retrieve Rate (URL/sec) | Measures how many URLs are sent to clients from the memory cache in one second. This is a useful counter to measure at peak and off-peak times, to check how the memory cache is performing and whether available memory allocated for caching purposes is being used efficiently.
Memory Usage Ratio Percent (%) | Shows the percentage of the total amount of cache fetches that are from the memory cache. A high percentage may indicate that it is worthwhile allocating more available memory resources to the cache. A low percentage may indicate that memory resources may be better used elsewhere.
Total Actively Refreshed URLs | Displays the cumulative number of popular URLs in the cache that have been actively refreshed from the Internet. This counter will give an indication of active caching performance.
Total Bytes Actively Refreshed (KB) | Displays the total number of bytes that have been retrieved from the Internet to actively refresh popular URLs in the cache. This counter will give an indication of active caching performance.
Total Disk Bytes Retrieved (KB) | Measures the cumulative number of disk bytes that have been retrieved from the disk cache. This counter, added to the Total Memory Bytes Retrieved counter, will indicate the total number of bytes retrieved from the cache.
Total Disk Failures | Measures the number of times that Web Proxy failed to read from or write to the disk cache due to an input/output (I/O) failure. A low counter will indicate that a disk is performing properly. A high counter will indicate that a cache disk is too small, too slow, or corrupted.
Total Disk URLs Retrieved | Measures the cumulative number of URLs that have been retrieved from the disk cache. This counter, added to the Total Memory URLs Retrieved counter, will indicate the total number of URLs retrieved from the cache.
Total Memory Bytes Retrieved (KB) | Measures the cumulative number of memory bytes that have been retrieved from the memory cache in response to client requests to the cache. A low number might indicate that memory resources dedicated to the cache are not being used efficiently. A high number might indicate that more memory resources should be allocated to the cache.
Total Memory URLs Retrieved | Measures the cumulative number of URLs that have been retrieved from the memory cache in response to client requests to the cache. A low number might indicate that memory resources dedicated to the cache are not being used efficiently. A high number might indicate that more memory resources should be allocated to the cache.
Total URLs Cached | Measures the cumulative number of URLs that have been stored in the cache. If this counter and the URLs in Cache counter is low, it may indicate a problem with the cache. The cache may not be configured for optimal use or the cache size may be too small.
URL Commit Rate (URL/sec) | Indicates the speed at which URLs are being written to the cache. If the rate of this counter is comparable to the rate of the Disk Failure Rate counter, it indicates that a high proportion of attempts to write to the cache are failing. This could indicate a problem with cache configuration, a cache disk that is too slow, or a cache size that is too small.
URLs in Cache | Measures the current number of URLs in the cache.


Microsoft Firewall service performance counters

The following table lists the performance counters for the Microsoft Firewall service.

Performance Counter | Description
Accepting TCP Connections | The number of connection objects that wait for a Transmission Control Protocol (TCP) connection from Firewall clients.
Active Sessions | The number of active sessions for the Firewall service.
Active TCP Connections | The number of active TCP connections currently passing data. Connections pending or not yet established are counted elsewhere.
Active UDP Connections | The number of active User Datagram Protocol (UDP) connections.
Available Worker Threads | The number of Firewall service worker threads that are available or waiting in the completion port queue.
Back-connecting TCP Connections | The number of TCP connections awaiting an inbound connect call to complete. These are connections placed by the Firewall service to a client after the Firewall service accepts a connection from the Internet on a listening socket.
Bytes Read/sec | The number of bytes read by the data pump per second.
Bytes Written/sec | The number of bytes written by the data pump per second.
Connecting TCP Connections | The number of TCP connections pending. These are connections awaiting completion between the Firewall service and remote computers.
DNS Cache Entries | The current number of DNS domain name entries cached as a result of Firewall service activity.
DNS Cache Flushes | The number of times that the DNS domain name cache has been flushed or cleared by the Firewall service.
DNS Cache Hits | The number of times a DNS domain name was found within the DNS cache by the Firewall service.
DNS Cache Hits % | The percentage of DNS domain names serviced by the DNS cache, from the total of all DNS entries that have been retrieved by the Firewall service.
DNS Retrievals | The number of DNS domain names that have been retrieved by the Firewall service.
Failed DNS Resolutions The number of
gethostbyname
and
gethostbyaddr
application programming interface (API) calls that have failed. These are calls used to resolve host DNS domain names and IP addresses for Firewall service connections.
Kernel Mode Data Pumps | The number of kernel mode data pumps created by the Firewall service.
Listening TCP Connections | The number of connection objects that wait for TCP connections from remote Internet computers.
Non-connected UDP mappings | The number of mappings available for UDP connections.
Pending DNS Resolutions The number of
gethostbyname
and
gethostbyaddr
application programming interface (API) calls pending resolution. These are calls used to resolve host DNS domain names and Internet Protocol (IP) addresses for Firewall service connections.
SecureNAT Mappings | The number of mappings created by SecureNAT.
Successful DNS Resolutions The number of
gethostbyname
and
gethostbyaddr
application programming interface (API) calls successfully returned. These are calls used to resolve host DNS domain names and IP addresses for Firewall service connections.
Worker Threads | The number of Firewall service worker threads that are currently active.


SOCKS filter performance counters

The following table lists the SOCKS filter performance counters.

Performance counter | Description
Active Sessions | A single SOCKS session includes the CONNECT and BIND commands for a single client.
Active Connections | The total number of active connections currently passing data. Connections pending or not yet established are not included. This counter is incremented when a SOCKS connection is established. A SOCKS connection is counted after a successful CONNECT command, when the SOCKS filter begins the data pump stage of the protocol. This counter is decremented when the connection is terminated (for any reason).
Connecting Connections | The number of SOCKS connections waiting for a remote computer to connect to. When a client sends a CONNECT command to the SOCKS filter, the SOCKS filter connects to the specified server on behalf of the client. This counter is incremented immediately before the SOCKS filter starts the connection process to the specified server, and is decremented when the connection (to the specified server) process is completed (successfully or unsuccessfully).
Listening Connections | The number of connection objects waiting for remote computers to connect. When a client sends a BIND command to the SOCKS filter, the SOCKS filter listens for an incoming connection on the specified port. This counter is incremented when the SOCKS filter starts waiting for the incoming connection, and is decremented when the incoming connection is received (or if the connection was terminated).
Bytes Read/sec | The number of bytes read on all SOCKS connections per second. The term "bytes read" refers to the amount of data from the client to the server during the data pump stage of the protocol.
Bytes Written/sec | The amount of data sent from the server to the client during the data pump stage of the protocol.
Pending DNS Resolutions | The number of pending name resolution requests. These requests resolve host DNS names and IP addresses for SOCKS connections.
Successful DNS Resolutions | The number of name resolution requests resolved each second. These requests resolve host DNS names and IP addresses for SOCKS connections.


Web Proxy performance counters

The following table lists the Web Proxy performance counters.

Performance counter | Description
Array Bytes Received/sec (Enterprise) | The rate at which data bytes are received from other ISA Server computers within the same array.
Array Bytes Sent/sec (Enterprise) | The rate at which data bytes are sent to other ISA Server computers within the same array.
Array Bytes Total/sec (Enterprise) | The sum of the Array Bytes Sent/sec and the Array Bytes Received/sec counters. This is the total rate for all data bytes transferred between the ISA Server computer and other members of the same array.
Cache Hit Ratio (%) | Determines how many Web Proxy client requests have been served using cached data (Total Cache Fetches), as a percentage of the total number of successful Web Proxy client requests to the ISA Server computer (Total Successful Requests). Its value gives a good indication of the effectiveness of the cache. A high counter value indicates that a high level of requests are being serviced from the cache, meaning faster response times. A zero counter value indicates that caching is not enabled. A low counter value may indicate a configuration problem. The cache size may be too small, or requests may not be cacheable.
Cache Running Hit Ratio (%) | The amount of requests served from the cache as a percentage of total successful requests serviced. This ratio is the same as that measured by the Cache Hit Ratio counter. The difference between these two counters is that the Cache Running Hit Ratio counter measures this ratio for the last 10,000 requests serviced, and the Cache Hit Ratio counter measures this ratio since the last time that Web Proxy was started. This means that the Cache Running Hit Ratio counter gives a more dynamic evaluation of cache effectiveness.
Client Bytes Received/sec | The rate at which data bytes are received from Web Proxy clients. The value will change according to the volume of Web Proxy client requests, but a consistently slow rate may indicate a delay in servicing requests.
Client Bytes Sent/sec | The rate at which data bytes are sent to Web Proxy clients. The value will change according to the volume of Web Proxy client requests, but a consistently slow rate may indicate a delay in servicing requests.
Client Bytes Total/sec | The sum of the Client Bytes Sent/sec and the Client Bytes Received/sec counters. This is the total rate for all bytes transferred between the ISA Server computer and Web Proxy clients.
Current Array Fetches Average (Milliseconds/request) | The mean number of milliseconds required to service a Web Proxy client request that is fetched through another array member. This does not include requests for services by the Secure Sockets Layer (SSL) tunnel.
Current Average (Milliseconds/request) | The mean number of milliseconds required to service a Web Proxy client request, not including requests serviced by the SSL tunnel. This counter can be monitored at peak and off-peak times to get a comprehensive picture of how fast client requests are being serviced. A counter with a value that is too high might indicate that the ISA Server computer is having difficulty in handling all requests and that requests are being delayed.
Current Cache Fetches Average(Milliseconds/request) | The mean number of milliseconds required to service a Web Proxy client request from the cache. This does not include requests for services by the SSL tunnel.
Current Direct Fetches Average (Milliseconds/request) | The mean number of milliseconds required to service a Web Proxy client request directly to the Web server or upstream proxy. This does not include requests for services by the SSL tunnel.
Current Users | Indicates how many clients are currently running Web Proxy. Monitoring this counter at both peak and off-peak times will give a good indication of server usage. The configuration setting for maximum Web request connections influences this value. This counter may also be useful if you need to temporarily stop ISA Server services.
DNS Cache Entries | The current number of DNS domain name entries cached by Web Proxy. A high counter value suggests a beneficial impact on performance, since a DNS cache entry eliminates the need for a DNS lookup, saving system resources.
DNS Cache Flushes | The total number of times that the DNS domain name cache has been flushed or cleared by Web Proxy. When there is no room left for more data in the DNS cache, the DNS cache is flushed to allow new entries to be made.
DNS Cache Hits | The total number of times a DNS domain name was found within the DNS cache by Web Proxy. This counter can be compared with the DNS Cache Entries and the DNS Cache Flushes counters to find out if DNS caching is working efficiently. A low number of DNS cache hits will impact performance, as every DNS lookup will slow performance, particularly if a problem arises in the lookup process.
DNS Cache Hits % | Determines how many DNS entries have been resolved using cached data (DNS Cache Hits), as a percentage of the total number of DNS domain names retrieved by Web Proxy (DNS Retrievals). A high counter value means better performance as the DNS data is served from the cache, rather than incurring the overhead of resolving DNS lookups.
DNS Retrievals | The total number of DNS domain names that have been retrieved by Web Proxy.
Failing Requests/sec | The rate of Web Proxy client requests that have been completed with some type of error. This counter can be compared with the Requests/sec counter to give an indication of how well ISA Server is servicing incoming Web requests. A high failure rate, as compared with the rate of incoming requests, will suggest that ISA Server is having difficulty in coping with all incoming requests. Connection settings for incoming Web requests may be incorrectly configured, or connection bandwidth may be insufficient.
FTP Requests | The number of File Transfer Protocol (FTP) requests that have been made to Web Proxy. A consistently low counter value may influence the caching policy for FTP objects.
HTTP Requests | The number of Hypertext Transfer Protocol (HTTP) requests that have been made to Web Proxy.
HTTPS Sessions | The total number of Secure Hypertext Transfer Protocol (HTTPS) secured sessions serviced by the SSL tunnel.
Maximum Users | The maximum number of users that have connected to Web Proxy simultaneously. This counter can be useful for determining load usage and license requirements.
Requests/sec | The rate of incoming requests that have been made to Web Proxy. A higher value means that more ISA Server resources will be required to service incoming requests.
Reverse Bytes Received/sec | The rate at which data bytes are received by Web Proxy from Web publishing servers in response to incoming requests. This rate can be monitored at peak and off-peak times as an indication of how ISA Server is performing in servicing incoming Web requests.
Reverse Bytes Sent/sec | The rate at which data bytes are sent by Web Proxy to Web publishing servers in response to incoming requests. This rate can be monitored at peak and off-peak times as an indication of how ISA Server is performing in servicing incoming Web requests.
Reverse Bytes Total/sec | The total sum of the Reverse Bytes Sent/sec and the Reverse Bytes Received/sec counters. This is the total rate for all bytes transferred between Web Proxy and Web publishing servers in response to incoming requests.
Site Access Denied | The total number of Internet sites to which Web Proxy has denied access. An excessively high number might indicate an access policy that is too restrictive.
Site Access Granted | The total number of Internet sites to which Web Proxy has granted access. This can be compared with the Site Access Denied counter to give a numeric summary of the results of access policy configuration.
SNEWS Sessions | The total number of SNEWS sessions serviced by the SSL tunnel.
SSL Client Bytes Received/sec | The rate at which SSL data bytes are received by Web Proxy from SSL clients. Similar to the Client Bytes Received/sec counter, but counts only SSL requests.
SSL Client Bytes Sent/sec | The rate at which SSL data bytes are sent by Web Proxy to SSL clients. Similar to the Client Bytes Sent/sec counter, but counts only SSL requests.
SSL Client Bytes Total/sec | The sum of the SSL Client Bytes Sent/sec and the SSL Client Bytes Received/sec counters. This is the total rate for all bytes transferred between Web Proxy and SSL clients.
Thread Pool Active Sessions | The number of sessions being actively serviced by thread pools.
Thread Pool Failures | The number of requests rejected because the thread pool was full.
Thread Pool Size | The number of threads in the thread pool. This thread pool represents the resources available to service client requests.
Total Array Fetches (Enterprise) | The total number of Web Proxy client requests that have been served by requesting the data from another ISA Server within this array. These requests are the result of the Cache Array Routing Protocol (CARP) algorithm, which randomly stores objects in any one of the member servers cache. This counter is influenced by the cache size for each ISA Server in the array, since a server with a larger cache will hold more cache items. The load factor for each server can also be configured, to determine how workload is divided among array members.
Total Cache Fetches | The total number of Web Proxy client requests that have been served by using cached data. A high number will indicate a cache being fully exploited.
Total Failed Requests | The total number of requests that have failed to be processed by Web Proxy due to errors. Errors can be the result of Web Proxy failing to locate a requested server URL on the Internet or because the client did not have authorized access to the requested URL. This counter should be lower than the Total Successful Requests counter. If not, it is an indication that ISA Server is failing to service requests effectively. This could be a configuration problem, or a connection that is too slow. It could also indicate an access policy that is too restrictive.
Total Pending Connects | The total number of pending connections to Web Proxy.
Total Requests | The total number of requests that have been made to Web Proxy. It is the sum of the Total Successful Requests and the Total Failed Requests counters.
Total Reverse Fetches | The total number of incoming requests that have been served by requesting the data from Web publishing servers.
Total SSL Sessions | The total number of SSL sessions serviced by the SSL tunnel.
Total Successful Requests | The total number of requests that have been successfully processed by Web Proxy. This counter can be compared with the Total Requests and the Total Failed Requests counters to indicate the effectiveness of ISA Server in servicing requests.
Total Upstream Fetches | The total number of requests that have been served by using data from the Internet or from a chained proxy computer. This counter can be compared to the Total Cache Fetches counter to determine what proportion of requests are being serviced from remote servers on the Internet or upstream proxies, compared with those being serviced from the cache.
Total Users | The total number of users that have connected to Web Proxy. It represents a history of past server usage.
Unknown SSL Sessions | The total number of unknown SSL sessions serviced by the SSL tunnel.
Upstream Bytes Received/sec | The rate at which data bytes are received by Web Proxy from remote servers on the Internet or from a chained proxy computer in response to requests from Web Proxy. The value of this counter will depend partially on the connection bandwidth. If the counter value is consistently low, it may indicate a bottleneck caused by a slow connection. Changing the bandwidth priority configuration may help in this situation, or a faster connection may be required.
Upstream Bytes Sent/sec | The rate at which data bytes are sent by Web Proxy to remote servers on the Internet or to a chained proxy computer. The value of this counter will depend partially on the connection bandwidth. If the counter value is consistently low, it may indicate a bottleneck caused by a slow connection. Changing the bandwidth priority configuration may help in this situation, or a faster connection may be required.
Upstream Bytes Total/sec | The sum of the Upstream Bytes Sent/sec and the Upstream Bytes Received/sec counters. It represents the total rate for all bytes transferred between Web Proxy and remote servers on the Internet or a chained proxy server.


Copyright

Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

The links in this area will let you leave Microsoft's product and/or Web site. The linked sites are not under the control of Microsoft and Microsoft is not responsible for the contents of any linked site or any link contained in a linked site, or any changes or updates to such sites. Microsoft is not responsible for webcasting or any other form of transmission received from any linked site. Microsoft is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Microsoft of the site.

© 2004 Microsoft Corporation. All rights reserved.

Active Directory, Microsoft, Microsoft Press, MSDN, Visual Basic, Visual C++, Windows, and Windows NT are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or other regions and/or countries.

The names of actual companies and products mentioned herein may be the trademarks of their respective owners.