Microsoft Internet Security and Acceleration Server Enterprise Edition

 Microsoft Internet Security and Acceleration Server 2000
Microsoft Internet Security and Acceleration Server provides an extensible, multilayer enterprise firewall and a scalable, high-performance Web cache server.
  • Concepts
  • Checklists
  • How to.
  • Troubleshooting and additional resources
  • Deployment scenarios

© 1995-2000 Microsoft Corporation.
All rights reserved.


Checklists

  • Checklist: Installing ISA Server
  • Checklist: Migrating from Microsoft Proxy Server 2.0
  • Checklist: Installing and configuring Firewall Client software
  • Checklist: Configuring SecureNAT clients
  • Checklist: Creating an access policy
  • Checklist: Publishing
  • Checklist: Configuring H.323 Gatekeeper


Checklist: Installing ISA Server

Step | Reference
Check system requirements. | System requirements
Review key concepts about ISA Server. | ISA Server overview; Understanding ISA Server
Determine if you will install ISA Server as a stand-alone server or as an array member. | Array considerations
Determine ISA Server mode: firewall, cache, or integrated. | ISA Server modes
If you are installing the ISA Server cache, verify that the computer has a Windows 2000 NTFS partition. | Configuring cache drives
If this is the first time you are installing ISA Server as an array member, initialize the enterprise. | Initialize the enterprise
Review the installation process. | Installation process
Start Setup and follow the instructions. | Install server software


Checklist: Migrating from Microsoft Proxy Server 2.0

Step | Reference
If Microsoft Proxy Server 2.0 is running on Windows NT 4.0, stop and disable all the Proxy Server services, and then upgrade to Windows 2000 Server. | Operating system considerations
If Proxy Server is installed on a computer running Windows 2000 Server, then determine if you will upgrade to an array or as a stand-alone server. | Microsoft Proxy Server 2.0 array considerations
Install Microsoft Internet Security and Acceleration (ISA) Server. | Install server software
Learn new ways to perform Proxy Server tasks. | New ways to do familiar tasks


Checklist: Installing and configuring Firewall client software

Step | Reference
Review key concepts about Firewall clients | Firewall clients
Install the Firewall Client software. | Install Firewall Client software
Configure how firewall clients connect to the ISA Server computer. | Configure firewall clients
When appropriate, modify default firewall client application settings. | Configuring firewall client application settings


Checklist: Configuring SecureNAT clients

Step | Reference
Review key concepts about secure network address translation (SecureNAT) clients. | SecureNAT clients
Configure the default gateway for the SecureNAT clients. | Setting up the default gateway for SecureNAT clients
Configure the DNS server so that names of internal or Internet computers from which SecureNAT clients request objects can be resolved. | Resolving names for SecureNAT clients


Checklist: Creating an access policy

Step | Reference
Verify that the local address table includes only addresses of computers in your network. | Configuring the local address table
Determine your corporate security policy by defining what type of communication is allowed with the Internet. |
Determine if you will use enterprise, array, or combined policies. | The enterprise, arrays, and stand-alone servers; Applying enterprise policy
Review key concepts about how Microsoft Internet Security and Acceleration (ISA) Server processes outgoing requests | Controlling outgoing requests
Create policy elements, including schedules, destination sets, and client address sets, which you will use to configure rules. | Configuring policy elements
Create protocol rules for protocols that can be used to communicate with the Internet. | Protocol rules
Create site and content rules, to determine which sites can be accessed by specific users. | Site and content rules


Checklist: Publishing

Step | Reference
Review key concepts about publishing servers to the Internet. | Publishing overview; Controlling incoming requests
Configure which Internet Protocol (IP) address and port will be used to service incoming Web requests (from external clients). | Configuring incoming Web request properties
Create policy elements, including schedules, destination sets, and client address sets, which you will use to configure rules. | Configuring policy elements
Create Web publishing rules that specify which Web servers and sites will be available to Internet users. | Web publishing rules
Determine if you will use IP packet filters or server publishing rules to publish (non-Web) servers. | Server publishing rules and IP packet filters
Create server publishing rules that specify which servers will be available to Internet users. | Server publishing rules


Checklist: Configuring H.323 Gatekeeper

Step | Reference
Enable H.323 protocol access. | Enable the H.323 protocol rule
Specify when the H.323 protocol can be accessed. | Control access to the H.323 protocol
Create a DNS Service location (SRV) resource record on your external DNS server so that proxies outside of your organization can locate your ISA Server computer. | Create a DNS service location resource record
Add a resource record to a zone. | Add a resource record to a zone
Add H.323 Gatekeeper to your ISA Server computer. | Add H.323 Gatekeeper to ISA Server
Enable fast kernel mode. | Enable fast kernel mode data pumping


How to...

  • Install, reinstall, and uninstall ISA Server
  • Install, reinstall, or uninstall Firewall Client software
  • Administer ISA Server
  • Administer clients
  • Set network configuration
  • Create and modify policy elements
  • Configure packet filtering
  • Configure access policy
  • Configure bandwidth rules
  • Configure publishing
  • Configure the cache
  • Configure application filters
  • Set up and configure H.323 Gatekeeper
  • Configure monitoring and reporting


Install, reinstall, and uninstall ISA Server

  • Initialize the enterprise
  • Install server software
  • Run unattended setup
  • Reinstall or uninstall server software
  • Change the installed ISA Server mode
  • Change ISA Server installation options
  • Install H.323 Gatekeeper
  • Perform a custom installation of H.323 Gatekeeper


Initialize the enterprise

To initialize the enterprise

  1. At a command prompt, type

    Path\ISA\i386\Msisaent.exe

    where Path is the path to the Microsoft Internet Security and Acceleration (ISA) Server installation files. The path may be the root folder of the ISA Server CD or a shared folder on your network that contains the ISA Server files.
  2. Follow the on-screen instructions.

Notes

  • If you downloaded the ISA Server installation files from the Web, or if you copied the contents of the ISA Server CD, run the ISAautorun.exe file at a command prompt to begin the ISA Server enterprise initialization.
  • In order to install the ISA Server schema to Active Directory, you must be an administrator on the local computer. In addition, you must be a member of the Enterprise Admins and Schema Admins groups. See Active Directory in Windows 2000 Help for specific instructions on user and group permissions.
  • The ISA Server schema only has to be installed once to Active Directory for the entire enterprise.

Caution

  • The enterprise initialization process copies the ISA Server schema information to Active Directory. Because Active Directory does not support deletion of schema objects, the enterprise initialization process is irreversible.

Related Topics

The enterprise and arrays

Initializing the enterprise


Install server software

To install server software

  1. At a command prompt, type

    Path\Isa\Setup

    where Path is the path to the Microsoft Internet Security and Acceleration (ISA) Server installation files. The path may be the root folder of the ISA Server CD or a shared folder on your network that contains the ISA Server files.
  2. Follow the on-screen instructions.

Notes

  • If you downloaded the ISA Server installation files from the Web, or if you copied the contents of the ISA Server CD, run the ISAautorun.exe file at a command prompt to begin the ISA Server installation. Then, click Install ISA Server.
  • If the computer on which you are installing ISA Server is not part of a Windows 2000 domain, then ISA Server will be installed as a stand-alone server. You can subsequently add the server to a Windows 2000 domain, and then join it to an array.
  • Confirm that you have installed Windows 2000 Service Pack 1 before you install ISA Server.
  • As part of the installation process, ISA Server modifies the TCP/IP driver dynamic port range, setting it to 65,535. This modification will take effect after the computer is rebooted.
  • Do not install more than one server at a time to the same array.
  • Do not uninstall more than one server at a time from the same array.

Related Topics

Installation process

Default settings


Run unattended setup

To run unattended setup

  1. Create a file called MsISAund.ini in the root directory of the first fixed drive computer on which you run unattended setup.
  2. At a command prompt, type

    3. Path\Isa\Setup /qt /k"CD Key" [/Q [0|1|T] [/R] [/U]

Parameters

Path
The path to the Microsoft Internet Security and Acceleration (ISA) Server installation files. The path may be the root folder of the ISA Server CD-ROM or a shared folder on your network that contains the ISA Server files.
CD Key
The CD key, as it appears on the back cover of the ISA Server CD-ROM.
/Q [0|1|T]
Performs unattended setup. If you specify 0, the exit dialog box displays when Setup completes. If you specify 1, the exit dialog box is not displayed. If you specify T, no dialog boxes are displayed.
/R
Performs unattended reinstallation.
/U
Performs unattended uninstallation.

Notes

  • The local address table (LAT) section of Msisaund.ini must specify the Internet Protocol (IP) address of at least one of the internal address cards. Otherwise, Setup fails.
  • The Msisaund.ini file must be created in the root directory of the first fixed drive of the computer on which you run unattended setup.
  • If Setup does not find the Msiasund.ini file in the root directory of the first fixed drive, then it looks for the file in the path in which setup is running. The path can be a directory on the local computer or a shared network folder.

Related Topics

Running unattended setup


Reinstall or uninstall server software

To reinstall or uninstall server software

  1. Click Start, point to Settings, click Control Panel, and then double-click Add/Remove Programs.
  2. In Currently installed programs, click Microsoft ISA Server.
  3. Then do one of the following:
    • To reinstall ISA Server, click Change
    • To uninstall ISA Server, click Remove
  4. In ISA Server Setup, click Reinstall to reinstall the software or Remove All to remove the software.

Notes

  • When you uninstall ISA Server software, all the cache contents are removed.


Change the installed ISA Server mode

To change the installed ISA Server mode

  1. Click Start, point to Settings, click Control Panel, and then double-click Add/Remove Programs.
  2. In Currently installed programs, click Microsoft ISA Server, and then click Change.
  3. In Microsoft ISA Server Setup, click Reinstall.
  4. In Microsoft ISA Server Setup, select one of the following installation modes:
    • Firewall
    • Cache
    • Integrated

Important

  • When you restore an ISA Server configuration, ISA Server restores the installation mode specified in the backup file. For example, if you backed up a configuration of a server in firewall mode, then ISA Server configuration will be restored firewall mode.
    It is recommended that you back up the configuration whenever you change ISA Server installation mode.

Related Topics

ISA Server modes


Change ISA Server installation options

To change ISA Server installation options

  1. Click Start, point to Settings, click Control Panel, and then double-click Add/Remove Programs.
  2. In Add/Remove Programs, click Microsoft Internet Security and Acceleration Server, and then click Change or Remove.
  3. In Microsoft Internet Security and Acceleration Server Setup, click Add/Remove.
  4. In Options, choose one or more of the following:
    • ISA Services. If you select this option, all the ISA Server services will be installed.
    • Add-in services. If you select this option, H.323 Gatekeeper, Message Screener, and other add-ins will be installed. You can select to install one or more of the add-in services.
    • Administration tools. If you select this option, click Select and then select one or more of the following: Administration Tools or H.323 Gatekeeper Administration Tool.

Notes

  • If you install only Administration Tools, then you can remotely administer another stand-alone ISA Server. ISA Server will not run on the local computer.

Related Topics

ISA Server modes

Remote administration


Install H.323 Gatekeeper

To Install H.323 Gatekeeper

  1. Click Start, point to Settings, click Control Panel, and then double-click Add/Remove Programs.
  2. In Currently installed programs, click Microsoft Internet Security and Acceleration Server, and then click Change.
  3. In ISA Server Setup, click Add/Remove.

Notes

  • H.323 Gatekeeper installation is performed automatically when the Full Installation option is selected during ISA Server installation.


Perform a custom installation of H.323 Gatekeeper

To perform a custom installation of H.323 Gatekeeper

  1. Click Start, point to Settings, click Control Panel, and then double-click Add/Remove Programs.
  2. In Currently installed programs, click Microsoft Internet Security and Acceleration Server, and then click Change.
  3. In ISA Server Setup, click Add/Remove, and follow the on-screen instructions.
  4. Select the Add-in services check box, and click Change Option.
  5. Select the Install H.323 Gatekeeper Service check box.
  6. Select the Administration tools check box, click Change Option, and click Select All.


Install, reinstall, or uninstall Firewall Client software

  • Install Firewall Client software
  • Reinstall or uninstall Firewall Client software
  • Run unattended client installation


Install Firewall Client software

To install Firewall Client software

  1. At a command prompt, type:

    Path\Setup

    where Path is the path to the shared Microsoft Internet Security and Acceleration (ISA) Server client installation files.
  2. Follow the on-screen instructions.

Notes

  • The ISA Server client installation files are usually located in a folder on the ISA Server computer with the share name ISA_Server_name/MSPClnt.
  • Do not install Firewall Client software on the ISA Server computer.
  • Upon installation, the Firewall Client application is enabled.
  • You can install Firewall Client software on client computers that run Windows ME, Windows 95, Windows 98, Windows NT 4.0, or Windows 2000. 16-bit Winsock applications are supported only on Windows 2000 and Windows NT 4.0.

Related Topics

Firewall clients

Deploying groups of Firewall clients


Reinstall or uninstall Firewall Client software

To reinstall or uninstall Firewall Client software

  1. On the client computer, click Start, point to Settings, click Control Panel, and then double-click Add/Remove Programs.
  2. In Currently installed programs, click Microsoft Firewall Client, and then click Change or Remove.


Run unattended client installation

To run unattended client installation

  1. At a command prompt, type

    Path\Setup /v " /qn "

    where Path is the path to the shared Microsoft Internet Security and Acceleration (ISA) Server client installation files. These files are usually located in a folder on the ISA Server computer with the share name ISA\MSPclnt.

Notes

  • To run unattended uninstall, type the following at a command prompt:

    MsiExec.exe /X {8C7A59A8-9ABE-459A-9A93-08C281A4A264} /qn

Related Topics

Firewall clients


Administer ISA Server

  • View taskpad
  • Administer the enterprise
  • Administer arrays
  • Manage a remote stand-alone server
  • Disconnect from a stand-alone server or enterprise
  • Manage a remote enterprise
  • Configure permissions


View taskpad

To view taskpad

  • On the View menu of ISA Management, select Taskpad.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Getting Started Wizard and taskpads


Administer the enterprise

  • Create an enterprise policy
  • Configure default enterprise policy settings
  • Allow array-level publishing rules
  • Force array-level packet filtering
  • Apply an enterprise policy to an array
  • Back up an enterprise configuration
  • Restore an enterprise configuration


Create an enterprise policy

To create an enterprise policy

  1. In the console tree of ISA Management, right-click Policies, point to New, and then click Policy.

    2. Where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policies
  2. In the New Enterprise Policy Wizard, follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • To create an enterprise policy, you must be logged on as a user in the Enterprise Admins group.
  • You can create a new enterprise policy only if you installed ISA Server as an array member or if you are managing an enterprise.

Related Topics

Administering stand-alone servers, arrays, and the enterprise


Configure default enterprise policy settings

To configure default enterprise policy settings

  1. In the console tree of ISA Management, right-click Policies.

    2. Where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policies
  2. Click Set defaults.
  3. In Set default policy, click one of the following:
    • If only the array policy should be applied, click Use array policy only.
    • If the enterprise policy should be applied to the array, click Use this enterprise policy.
  4. If you selected Use this enterprise policy:
    • In Policy, click the enterprise policy to apply to the array.
    • (Optional) To apply array-level policy rules, click Also allow array-level access rules that restrict enterprise policy.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You can only apply enterprise policies when administering ISA Server on a computer that belongs to an array.
  • If you set enterprise settings to Array policy only, you cannot subsequently modify the settings to Enterprise policy only.

Caution

  • When an enterprise policy is applied to an array, all previously-defined array-level site and content rules and protocol rules are deleted.

Related Topics

Applying enterprise policy

Arrays and stand-alone servers


Allow array-level publishing rules

To allow array-level publishing rules

  1. In the console tree of ISA Management, right-click the applicable array and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. On the Policies tab, verify that the Use custom enterprise policy settings check box is selected.
  3. Select the Allow publishing rules check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • Only enterprise administrators can allow array-level publishing rules.

Related Topics

Applying enterprise policy

Configuring publishing


Force array-level packet filtering

To force array-level packet filtering

  1. In the console tree of ISA Management, right-click the applicable array and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. On the Policies tab, verify that Use custom enterprise policy settings is selected.
  3. Select the Force packet filtering on the array check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • Only enterprise administrators can force array-level packet filtering.
  • If the Force packet filtering on the array check box is not available, click Use custom enterprise policy settings to make it available.

Related Topics

Applying enterprise policy

Filtering and routing


Apply an enterprise policy to an array

To apply an enterprise policy to an array

  1. In the console tree of ISA Management, right-click the applicable array and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. On the Policies tab, click one of the following:
    • Use default enterprise policy settings
    • Use custom enterprise policy settings
  3. If you use custom settings, click one of the following:
    • Use array policy only.
    • Use this enterprise policy, and click the enterprise policy to use.
    • (Optional) Select the Allow array-level access rules that restrict enterprise policy check box to allow policy configuration at the array level.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • Enterprise policies can be applied only to arrays.

Related Topics

Applying enterprise policy

The enterprise and arrays


Back up an enterprise configuration

To back up an enterprise configuration

  1. In the console tree of ISA Management, right-click Enterprise and then click Back up.

    2. Where?

    • Internet Security and Acceleration Server
    • Enterprise
  2. In Select location of configuration backup, type the filename and path in which the backup should be stored.
  3. (Optional) In Comment, type any information which you find helpful.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Backing up and restoring an enterprise configuration


Restore an enterprise configuration

To restore an enterprise configuration

  1. In the console tree of ISA Management, right-click Enterprise and then click Restore.

    2. Where?

    • Internet Security and Acceleration Server
    • Enterprise
  2. If you are sure you want to overwrite the existing enterprise configuration with the backed up configuration, click Yes.
  3. In Restore configuration from the following backup (.bef) file, type the path to the backup folder and the name of the backup file.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Backing up and restoring an enterprise configuration


Administer arrays

  • Create an array
  • Configure the enterprise policy for an array
  • Promote a stand-alone server
  • Set system security
  • Back up an array configuration
  • Restore an array configuration
  • Delete an array configuration


Create an array

To create an array

  1. In the console tree of ISA Management, right-click Servers and Arrays, point to New, and then click Array.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
  2. Follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You can only create a new array when administering Microsoft Internet Security and Acceleration (ISA) Server on a computer that belongs to an array.

Related Topics

Controlling array membership


Configure the enterprise policy of an array

To configure the enterprise policy of an array

  1. In the console tree of ISA Management, right-click the applicable array, and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. On the Policies tab, click Use custom enterprise policy settings.
  3. Click Use this enterprise policy and then click an enterprise policy to apply to the array.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Applying enterprise policy


Promote a stand-alone server

To promote a stand-alone server

  1. In the console tree of ISA Management, right-click the applicable array and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. Click Promote, then click Yes.
  3. In Set Global Policy, click one of the following:
    • Use default enterprise policy settings
    • Use custom enterprise policy settings
  4. If you selected Use custom enterprise policy settings, then click one of the following:
    • Use array policy only
    • Use enterprise policy only
  5. If you clicked Use enterprise policy only, then:
    • Click the enterprise policy to apply to the array.
    • (Optional) Click Also allow array policy.
  6. (Optional) If you select Use custom enterprise policy settings, select one or both of the following:
    • Allow publishing rules to be created on the array
    • Force packet filtering on the array

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You can only promote stand-alone servers that belong to a Windows 2000 domain.
  • You must initialize the enterprise before you can promote an ISA Server computer.

Related Topics

Administering stand-alone servers, arrays, and the enterprise

Promoting stand-alone servers

Applying enterprise policy

Initialize the enterprise


Set system security

To set system security

  1. In the console tree of ISA Management, click Computers.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Computers
  2. In the details pane, right-click the applicable computer and then click Secure.
  3. In the ISA Server Security Configuration Wizard, follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You can set system security to one of the following: Secure, Limited Services, or Dedicated.

Related Topics

ISA Server system security


Back up an array configuration

To back up an array configuration

  1. In the console tree of ISA Management, right-click the applicable array and then click Back Up.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. In Store backup configuration in this location, type the path in which the backup should be stored and the name of the backup file.
  3. (Optional) In Comment, type a comment for the backup file.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • The backup file can be saved to any drive on the local computer. It cannot be saved to another computer.

Related Topics

Backing up and restoring an array configuration


Restore an array configuration

To restore an array configuration

  1. In the console tree of ISA Management, right-click the appropriate array and then click Restore.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. If you are sure that you want to replace the existing configuration with the configuration in the backup file, click Yes.
  3. In Restore array configuration from the following backup (.bif) file, type the name of the path of the configuration backup file.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Backing up and restoring an array configuration


Delete an array configuration

To delete an array configuration

  1. In the console tree of ISA Management, right-click the appropriate array.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. Click Delete.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You can only delete arrays. Stand-alone servers cannot be deleted.


Manage a remote stand-alone server

To manage a remote stand-alone server

  1. In the console tree of ISA Management, right-click Internet Security and Acceleration Server and then click Connect to....
  2. In Connect to, select Connect to this stand-alone server and then type the name of the computer to administer.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You can specify computer name using any of the following formats:
    • computer_name
    • http://computer_name
    • IP address

Related Topics

Remote administration


Disconnect from a stand-alone server or enterprise

To disconnect from a stand-alone server or enterprise

  1. In the console tree of ISA Management, right-click the applicable array.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. Click Disconnect.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

The enterprise and arrays


Manage a remote enterprise and arrays

To manage a remote enterprise and arrays

  1. In the console tree of ISA Management, right-click Internet Security and Acceleration Server and then click Connect to....
  2. In Connect to, select Connect to enterprise and arrays and then type the name of te computer to administer.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Remote administration


Configure permissions

  • Configure array permissions
  • Configure enterprise policy permissions
  • Configure enterprise policy setting permissions
  • Configure alert permissions
  • Configure session permissions
  • Configure H.323 Gatekeeper permissions


Configure array permissions

To configure array permissions

  1. In the console tree of ISA Management, right-click the applicable array and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. On the Security tab, do one of the following:
    • To give additional users or groups permission to modify the array configuration, select the user you want to change and then, in Permissions, select the appropriate check boxes: Read or Full Control.
    • To deny a user or group permission to modify the array configuration, click a user or group and then click Remove.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring permissions


Configure enterprise policy permissions

To configure enterprise policy permissions

  1. In the console tree of ISA Management, right-click Enterprise Policy and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policies
    • Enterprise Policy
  2. In Enterprise Policy Properties, on the Security tab, do one of the following:
    • To allow additional users or groups permissions to modify the configuration, in Name, click the appropriate user or group, then in Permissions, select the appropriate check boxes.
    • To deny a user or group permission to modify the configuration, in Name, click a user or group and then click Remove.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring permissions


Configure enterprise permissions

To configure enterprise permissions

  1. In the console tree of ISA Management, right-click Enterprise and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Enterprise
  2. On the Security tab, do one of the following:
    • To allow additional users or groups permissions to modify the configuration:
      • Click Add, click the users or groups to add and click OK.
      • In Name, click a user or group and, in Permissions, select the appropriate check boxes.
    • To deny a user or group permission to modify the configuration, in Name, click a user or group and then click Remove.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring permissions


Configure alert permissions

To configure alert permissions

  1. In the console tree of ISA Management, right-click Alerts and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring
    • Alerts
  2. On the Security tab, do one of the following:
    • To allow additional users or groups permissions to modify the configuration, click Add, then select the appropriate permissions: Read Alerts Information or Reset Alerts.
    • To deny a user or group permission to modify the configuration, click a user or group and then click Remove.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring permissions


Configure session permissions

To configure session permissions

  1. In the console tree of ISA Management, right-click Sessions and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring
    • Sessions
  2. On the Security tab, do one of the following:
    • To allow additional users or groups permissions to modify the configuration:
      • Click Add, and then click the users or groups to add.
      • In Name, click a user or group and, in Permissions, select the appropriate check boxes: Read Sessions Information or Stop Sessions.
    • To deny a user or group permission to modify the configuration, in Name, click a user or group and then click Remove.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring permissions


Configure H.323 Gatekeeper permissions

To configure H.323 Gatekeeper permissions

  1. In the console tree of ISA Management, right-click the H.323 Gatekeeper server and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • H.323 Gatekeepers
    • H.323 Gatekeeper server
  2. On the Security tab, do one of the following:
    • To allow additional users or groups permissions to modify the configuration:
      • Click Add, click the users or groups to add, and click OK.
      • In Name, click a user or group and, in Permissions, select the appropriate check boxes: Read, Modify, or Full control.
    • To deny a user or group permission to modify the configuration, in Name, click a user or group and then click Remove.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring permissions


Administer clients

  • Configure firewall clients
  • Configure Web browser clients


Configure firewall clients

  • Configure Firewall Client settings
  • Configure the application settings of Firewall Client
  • Enable Firewall Client
  • Set automatic discovery for Firewall clients


Configure Firewall Client settings

To configure Firewall Client settings

  1. In the console tree of ISA Management, click Client Configuration.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Client Configuration
  2. In the details pane, right-click Firewall Client and then click Properties.
  3. On the General tab, do one of the following:
    • Click Array DNS name and type the name of the ISA Server or array in the box.
    • Click IP address and type the Internet protocol (IP) address of the ISA Server.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Firewall clients


Configure the application settings of Firewall Client

To configure the application settings of Firewall Client

  1. In the console tree of ISA Management, click Client Configuration.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Client Configuration
  2. In the details pane, right-click Firewall Client and then click Properties.
  3. On the Application Settings tab, click New.
  4. In Application, select an application or type a new application name.
  5. In Key, type the name of a key.
  6. In Value, type the value to set for the key.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • To remove an existing application setting, select it from Settings and click Delete.
  • To modify an existing application setting, select it from Settings and click Edit.

Related Topics

Configuring Firewall client application settings


Enable Firewall Client

To enable Firewall Client

  1. On the client computer, open Control Panel.
  2. Double-click Firewall Client and select the Enable Firewall Client check box.
  3. In Use this ISA Server, type the name of the ISA Server computer to use.

Notes

  • To open Control Panel, click Start, point to Settings, and click Control Panel.
  • By default, the Firewall Client application is enabled when it is installed.

Related Topics

Firewall clients


Set automatic discovery for firewall clients

To set automatic discovery for firewall clients

  1. On the client computer, open Control Panel.
  2. Double-click Firewall Client and select the Automatically detect ISA Server check box.

Notes

  • To open Control Panel, click Start, point to Settings, and click Control Panel.

Related Topics

Automatic discovery

Firewall clients

Publish automatic discovery


Configure Web browser clients

  • Configure Microsoft Internet Explorer 5 to use the Web Proxy service
  • Set Microsoft Internet Explorer 5 to use a client configuration script
  • Enable Web browser configuration during client setup
  • Set automatic discovery for Web browser clients
  • Configure a server for direct access
  • Configure a backup route for Web requests


Configure Microsoft Internet Explorer 5 to use the Web Proxy service

To configure Microsoft Internet Explorer 5 to use the Web Proxy service

  1. Open Microsoft Internet Explorer.
  2. On the Tools menu, click Internet Options.
  3. On the Connections tab, click LAN Settings.
  4. Select the Use a proxy server check box.
  5. In Address, type the name of an ISA Server computer or array, then in Port, type a valid port number (usually 8080).

Related Topics

Web Proxy clients


Set Microsoft Internet Explorer 5 to use a client configuration script

To set Microsoft Internet Explorer 5 to use a client configuration script

  1. Open Microsoft Internet Explorer.
  2. On the Tools menu, click Internet Options.
  3. On the Connections tab, click LAN Settings.
  4. Select the Use automatic configuration script check box.
  5. In Address, type:

    http://Servername/Array.dll?Get.Routing.Script

    where Servername is the name of a Microsoft Internet Security and Acceleration (ISA) Server array member or array that stores the script.

  6. Click Refresh.

Related Topics

Web Proxy clients

Configuring Web Proxy clients


Enable Web browser configuration during client setup

To enable Web browser configuration during client setup

  1. In the console tree of ISA Management, click Client Configuration.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Client Configuration
  2. In the details pane, right-click Web Browser and then click Properties.
  3. On the General tab, if clients should be automatically configured when they are set up, select the Configure Web browser during Firewall Client setup check box.
  4. If client Web browsers must use the automatic configuration script, select the Set Web browsers to use automatic configuration script check box, and then select one of the following:
    • To use the default automatic configuration script that is specified in the gray text box, select Use default URL.
    • To specify a custom configuration script, select Use custom URL and then, in the text box, enter the desired URL.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Web Proxy clients

Configuring Web Proxy clients


Set automatic discovery for Web browser clients during client setup

To set automatic discovery for Web browser clients during client setup

  1. In the console tree of ISA Management, click Client Configuration.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Client Configuration
  2. In the details pane, right-click Web browser and then click Properties.
  3. On the General tab, select the Configure Web browser during Firewall client setup check box.
  4. Under Automatic configuration, select the Automatically discover settings check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Web Proxy clients

Automatic discovery


Configure a server for direct access

To configure a server for direct access

  1. In the console tree of ISA Management, click Client Configuration.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Client Configuration
  2. In the details pane, right-click Web Browser and then click Properties.
  3. If clients should not request objects from the ISA Server computer if they are on computers that are in the local domain table (LDT), on the Direct Access tab, select the Directly access computers specified in the Local Domain Table (LDT) check box.
  4. If clients should not request objects from the ISA Server computer if they are on computers whose DNS names do not contain dots, on the Direct Access tab, select Bypass proxy for local servers check box.
  5. To add Internet protocol (IP) addresses of computers which clients should access directly and not via the ISA Server, click Add, and then do one of the following:
    • Click With IP Addresses within this range, type the lowest IP address of the range in From, then type the highest IP address of the range in To.
    • Click In domains ending with, and then enter the desired suffix in the adjacent box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Web Proxy clients

Automatic discovery

Configuring the local domain table


Configure a backup route for Web requests

To configure a backup route for Web requests

  1. In the console tree of ISA Management, click Client Configuration.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Client Configuration
  2. In the details pane, right-click Web Browser and then click Properties.
  3. On the Backup Route tab, select the If ISA Server is unavailable, use this backup route to connect to the Internet check box.
  4. Do one of the following:
    • To specify that the request must be serviced directly from the Internet, click Direct access.
    • To specify that another server should service the request, click Alternative ISA Server, then type the name of the ISA Server that should service the request.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Web Proxy clients

Configuring Web Proxy clients


Set network configuration

  • Configure the local address table
  • Configure the local domain table
  • Configure firewall chaining
  • Configure virtual private networks
  • Configure routing
  • Configure outgoing and incoming Web requests
  • Configure automatic discovery


Configure the local address table

  • Construct a local address table
  • Add an entry to the local address table
  • Modify an entry in the local address table
  • Delete an entry from the local address table


Construct a local address table

To construct a local address table

  1. In the console tree of ISA Management, right-click Local Address Table (LAT) and then click Construct LAT.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Local Address Table (LAT)
  2. To add the three private Internet protocol (IP) address ranges to the LAT, select the Add the following private ranges check box.
  3. To add address ranges using the selected computers routing table, select the Add address ranges based on the selected computer's Windows 2000 routing table check box and do the following.
    • In Select computer, click the computer whose routing table should be used when determining the LAT.
    • Select the appropriate check boxes for the internal network adapters whose address ranges you want to use.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring the local address table


Add an entry to the local address table

To add an entry to the local address table

  1. In the console tree of ISA Management, right-click Local Address Table (LAT), point to New, and then click LAT Entry.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Local Address Table (LAT)
  2. In From, type the first Internet protocol (IP) address in the range of addresses to add to the LAT.
  3. In To, type the last IP address in the range of addresses to add to the LAT. (To add just one address, type the same IP address in From and To.)
  4. (Optional) In Description, type a description of the LAT entry.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring the local address table


Modify an entry in the local address table

To modify an entry in the local address table

  1. In the console tree of ISA Management, click Local Address Table (LAT).

    2. Where?

    • ISA
    • Servers and Arrays
    • Name
    • Network Configuration
    • Local Address Table (LAT)
  2. In the details pane, right-click the applicable LAT entry and then click Properties.
  3. Change the appropriate entries in From, To, or Description.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring the local address table

Add an entry to the local address table


Delete an entry from the local address table

To delete an entry from the local address table

  1. In the console tree of ISA Management, click Local Address Table (LAT).

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Local Address Table (LAT)
  2. In the details pane, right-click the applicable LAT entry and then click Delete.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring the local address table


Configure the local domain table

  • Add an entry to the local domain table
  • Modify an entry in the local domain table
  • Delete an entry from the local domain table


Add an entry to the local domain table

To add an entry to the local domain table

  1. In the console tree of ISA Management, right-click Local Domain Table (LDT), point to New, and then click LDT entry.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Local Domain Table (LDT)
  2. In Name, type the name of the local domain.
  3. (Optional) In Description, type a description for the LDT entry.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring the local domain table


Modify an entry in the local domain table

To modify an entry in the local domain table

  1. In the console tree of ISA Management, click Local Domain Table (LDT).

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Local Domain Table (LDT)
  2. In the details pane, right-click the entry you want to change, and then click Properties.
  3. Change the entries in Local Domain and Description, as necessary.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring the local domain table


Delete an entry from the local domain table

To delete an entry from the local domain table

  1. In the console tree of ISA Management, click Local Domain Table (LDT).

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Local Domain Table (LDT)
  2. In the details pane, right-click the applicable LDT entry, and then click Delete.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring the local domain table


Configure firewall chaining

To configure firewall chaining

  1. In the console tree of ISA Management, right-click Network Configuration and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
  2. On the Firewall Chaining tab:
    • To use ISA Server's primary connection method to access the Internet, click Use primary connection.
    • To forward the request to an upstream ISA Server computer, click Chain to this computer and type the computer name in the text box below.
  3. (Optional) If you selected Use primary connection, click Use dial-up entry.
  4. If you selected Chain to this computer, then do the following:
    • If the requested application requires authentication, select the Use this account checkbox and click Set Account.
    • Type a domain name and user name in User, in this format:
      DomainName\UserName.
    • Type the password in Password and Confirm password.
    • (Optional) Select the Use dial-up entry check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You can only use a dial-up entry if you previously configured at least one dial-up entry and set it as the active entry.

Related Topics

Routing requests from Firewall and SecureNAT clients

Chained authentication

Configruring dial-up entries

Configuring dial-on-demand

Set an active dial-up entry


Configure virtual private networks

  • Set up a local ISA Server virtual private network
  • Set up a remote ISA Server virtual private network
  • Set up ISA Server to accept client-side virtual private network requests


Set up a local ISA Server virtual private network

To set up a local ISA Server virtual private network

  1. In the console tree of ISA Management, right-click Network configuration.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network configuration
  2. Click Set up Local ISA VPN Server.
  3. Follow the directions in the ISA Server VPN Configuration Wizard.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • As part of the Local ISA VPN Setup Wizard, you will be prompted to type the domain or computer name of the remote server, on which the user account for the VPN connection will be created. If the computer is a domain controller, type its domain controller name. Otherwise, type the computer's NetBIOS name.
  • You cannot set up a virtual private network if you installed ISA Server in cache mode.

Related Topics

Using an ISA Server virtual private network

Set up a remote ISA Server virtual private network

ISA Server modes


Set up a remote ISA Server virtual private network

To set up a remote ISA Server virtual private network

  1. In the console tree of ISA Management, right-click Network configuration.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network configuration
  2. Click Set up Remote ISA VPN Server.
  3. In the ISA VPN wizard, follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • The wizard creates the dial-on-demand interfaces that are required to initiate connections to a specific local VPN server, using the .vpc file generated by the Local ISA VPN Wizard.
  • The wizard creates the dial-on-demand interfaces and configures the IP packet filters required to protect the connection and sets the static routes to forward traffic from the local network to hosts on the remote network via the tunnel.
  • You cannot set up a virtual private network if you installed ISA Server in cache mode.

Related Topics

Virtual private networks

Using an ISA Server virtual private network

Set up a local virtual private network

ISA Server modes


Set up ISA Server to accept client-side virtual private network requests

To set up ISA Server to accept client-side virtual private network requests

  1. In the console tree of ISA Management, right-click Network configuration.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network configuration
  2. Click Set up Clients to ISA Server VPN.
  3. In the ISA VPN Server wizard, follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot set up a virtual private network if you installed ISA Server in cache mode.

Related Topics

Virtual private networks

Using an ISA Server virtual private network

ISA Server modes


Configure routing

  • Create a routing rule
  • Specify the destination set for a routing rule
  • Configure how routing rules retrieve requests
  • Configure a primary route for Web requests
  • Configure a backup route for Web requests
  • Configure how Web objects are cached
  • Configure how to redirect HTTP requests
  • Configure how to redirect SSL requests
  • Use client-side certificate to authenticate to upstream server
  • Change the order of a routing rule
  • Disable a routing rule
  • Delete a routing rule


Create a routing rule

To create a routing rule

  1. In the console tree of ISA Management, right-click Routing, point to New, and then click Rule.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Routing
  2. When the New Routing Rule Wizard starts, follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Routing Web requests

Specify the destination set for a routing rule

Configure how routing rules retrieve requests

Configure how Web objects are cached


Specify the destination set for a routing rule

To specify the destination set for a routing rule

  1. In the console tree of ISA Management, click Routing.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Routing
  2. In the details pane, right-click the applicable routing rule and then click Properties.
  3. On the Destinations tab, click the destination set to which the routing rule applies.
    • All destinations
    • All external destinations
    • All internal destinations
    • Selected destination set
    • All destinations except selected set
  4. If you chose Selected destination set or All destinations except selected set, then in Name, select a destination set.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If the destination set that you want to specify does not exist, you can click New to create it, and then select it in the list.

Related Topics

Routing Web requests

Configuring destination sets


Configure how routing rules retrieve requests

To configure how routing rules retrieve requests

  1. In the console tree of ISA Management, click Routing.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Routing
  2. In the details pane, right-click the applicable routing rule and then click Properties.
  3. On the Action tab, select one of the following options:
    • To retrieve the requested object directly from the Internet, click Retrieving them directly from the specified destination.
    • If an upstream server should service the request, click Routing them to a specified upstream server and configure the primary and backup route.
    • If the request should be redirected to a different computer, click Redirecting them to a hosted site and configure the site, port, and Secure Sockets Layer (SSL) port.
  4. (Optional) If you route the request directly to the specified destination or to an upstream server, select the Use dial-up entry for primary route check box.
  5. (Optional) If you route the request directly to an upstream server and you specify a backup route, select the Use dial-up entry for backup route check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You can only select to use a dial-up entry if you have configured at least one dial-up entry and you have set it as the active entry.

Related Topics

Routing Web requests

Configuring dial-up entries

Configure a primary route for Web requests

Configure a backup route for Web requests

Configuring dial-on-demand

Set an active dial-up entry


Configure a primary route for Web requests

To configure a primary route for Web requests

  1. In the console tree of ISA Management, click Routing.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Routing
  2. In the details pane, right-click the applicable routing rule and then click Properties.
  3. On the Action tab, click Routing them to a specified upstream proxy server and then click Settings.
  4. In Server or array, type the name or Internet Protocol (IP) address of the ISA server or array.
  5. In Port, type the port number on which the upstream server listens for Hypertext Transfer Protocol (HTTP) requests. This is typically port 8080.
  6. In SSL Port, type the port number on which the upstream server listens for Secure Sockets Layer (SSL) requests. This is typically port 8443.
  7. (Optional) If the upstream server should supply array information, click Automatically poll upstream server for array configuration and type the Uniform Resource Locator (URL) for the array.
  8. (Optional) If the upstream server is accessible only when the server supplies credentials, click Use this account, click Set Account, and type the user name, password, and authentication type.
  9. (Optional) If Microsoft Internet Security and Acceleration (ISA) Server should dial out for primary connections, on the Action tab under Automatic dial-out, select Use dial-up entry for primary route.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • When you select Automatically poll upstream server for array configuration, the upstream server informs the local ISA Server computer if it is an array member. If it is, then it also indicates the other member servers in the array. The local ISA Server computer uses this information to retrieve objects most optimally from the upstream array.
  • Because ISA Server supports pass-through authentication, the authentication information of the client requesting the object is passed to the upstream server. However, if the upstream server might not be able to identify the client, you can specify Use this account and supply which credentials to pass instead.
  • ISA Server uses the active dial-up entry to dial out to the Internet. For configuration instructions, see Set an active dial-up entry.

Related Topics

Routing Web requests

Chained authentication


Configure a backup route for Web requests

To configure a backup route for Web requests

  1. In the console tree of ISA Management, click Routing.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Routing
  2. In the details pane, right-click the applicable routing rule and then click Properties.
  3. On the Action tab, click Routing them to specified upstream server.
  4. In Backup route, select Upstream proxy server.
  5. (Optional) Select Use dial-up entry for backup route if ISA Server dials out for backup connections.
  6. Click Settings.
  7. In Server or array, type the server or array name.
  8. In Port, type the port number of the upstream server. Typically, this is port 8080.
  9. In SSL Port, type the SSL port number of the upstream server. Typically, this is port 8443.
  10. (Optional) If the upstream server should supply array information, click Automatically poll upstream server for array configuration and type the URL of the array.
  11. (Optional) If the upstream server is accessible only when the server supplies credentials, click Use this account. Then, type the User name, Passwordand select the authentication method in Authentication.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • ISA Server uses the active dial-up entry to dial out to the Internet. For configuration instructions, see Set an active dial-up entry.

Related Topics

Routing Web requests

Configuring dial-on-demand

Configure how routing rules retrieve requests


Configure how Web objects are cached

To configure how Web objects are cached

  1. In the console tree of ISA Management, right-click Routing.

    2. Where?

    • Internet Security and Acceleration Server
    • Array
    • Name
    • Network Configuration
    • Routing
  2. In the details pane, right-click the applicable routing rule and then click Properties.
  3. On the Cache tab, select one of the following options:
    • If the objects should only be retrieved from the cache if it has not expired, click A valid version of the object; if none exists, retrieve the request using the route defined on the Action tab.
    • If the object should be retrieved from the cache when available and otherwise using the specified route, click Any version of the object; if none exists, retrieve the request using the route defined on the Action tab.
    • If the object should only be retrieved if it is in the cache, click Any version of the requested object in the cache. Never route the request.
  4. In Cache content, select one of the following options:
    • If all content should always be cached, even if the headers in the request or response indicate that the object should not be cached, click All content, including dynamic content, will be cached.
    • If the headers in the request or response indicate that the object should be cached, click If source and request headers indicate to cache, then the content will be cached.
    • If retrieved objects should not be cached, click No content will ever be cached.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • In Cache content, If source and request headers indicate to cache, then the content will be cached is the default option.

Related Topics

Routing Web requests


Configure how to redirect HTTP requests

To configure how to redirect HTTP requests

  1. In the console tree of ISA Management, click Routing.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Routing
  2. In the details pane, right-click the applicable routing rule and then click Properties.
  3. On the Bridging tab, in Redirect HTTP requests as, select one of the following options:
    • If Hypertext Transfer Protocol (HTTP) requests should be routed to the upstream server using the HTTP protocol, click HTTP requests.
    • If HTTP requests should be routed to the upstream server using the Secure Hypertext Transfer Protocol (HTTPS) protocol, click SSL requests.
  4. (Optional) If you select SSL requests, then select the Use a certificate to authenticate to the SSL Web server check box and click Select to select the certificate to use.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If you select HTTP requests, then the ISA Server terminates the secure control channel.
  • If you select SSL requests, then the ISA Server opens a new secure control channel to the upstream server.
  • You only need to use a certificate if the Web server requires client certificate authentication.

Related Topics

Routing Web requests

SSL bridging


Configure how to redirect SSL requests

To configure how to redirect SSL requests

  1. In the console tree of ISA Management, click Routing.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Routing
  2. In the details pane, right-click the applicable routing rule and then click Properties.
  3. On the Bridging tab, in Redirect SSL requests as, select one of the following options:
    • If Secure Sockets Layer (SSL) requests should be routed to the upstream server using the Hypertext Transfer Protocol (HTTP) protocol, click HTTP requests.
    • If SSL requests should be routed to the upstream server using the Secure Hypertext Transfer Protocol (HTTPS) protocol, click SSL requests.
  4. (Optional) If you select SSL requests, then select the Use a certificate to authenticate to the SSL Web server and click Select to select the certificate to use.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If you select HTTP requests, then ISA Server terminates the secure control channel.
  • If you select SSL requests, then ISA Server opens a new secure control channel to the upstream server.
  • You only need to use a certificate if the Web server requires client certificate authentication.

Related Topics

Routing Web requests

SSL bridging


Use client-side certificate to authenticate to upstream server

To use client-side certificate to authenticate to upstream server

  1. In the console tree of ISA Management, click Routing.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Routing
  2. On the View menu, select Advanced.
  3. In the details pane, right-click the applicable routing rule and then click Properties.
  4. On the Bridging tab, select the Use a certificate to authenticate to the SSL Web server check box and click Select.
  5. In Select Certificate, select the client-side certificate that ISA Server should use to authenticate to the upstream server.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • ISA Server must have an appropriately-configured client-side certificate if you select this option. For more information on configuring client-side certificates, see the Windows 2000 Help.

Related Topics

Web publishing rules


Change the order of a routing rule

To change the order of a routing rule

  1. In the console tree of ISA Management, click Routing.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Routing
  2. In the details pane, right-click the rule whose order you want to change and then click Move Up or Move Down.
  3. Repeat as necessary to arrange the rules in the desired order.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot change the position of the default rule.

Related Topics

Routing Web requests


Disable a routing rule

To disable a routing rule

  1. In the console tree of ISA Management, click Routing.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Routing
  2. In the details pane, right-click the applicable routing rule and then click Disable.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot enable or disable the default rule.

Related Topics

Routing Web requests


Delete a routing rule

To delete a routing rule

  1. In the console tree of ISA Management, click Routing.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Network Configuration
    • Routing
  2. In the details pane, right-click the rule you want to delete and then click Delete.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot delete the default rule.

Related Topics

Routing Web requests


Configure outgoing and incoming Web requests

  • Configure listeners for incoming Web requests
  • Configure listeners for outgoing Web requests
  • Configure the TCP port
  • Enable SSL listeners
  • Configure server certificates for Web requests
  • Configure authentication methods for Web requests
  • Require authentication for all Web requests
  • Configure connection settings for Web requests
  • Enable Cache Array Routing Protocol


Configure listeners for incoming Web requests

To configure listeners for incoming Web requests

  1. In the console tree of ISA Management, right-click the applicable array and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. On the Incoming Web Requests tab, select one of the following:
    • Use the same listener configuration for all IP addresses
    • Configure listeners individually per IP address
  3. If you selected Configure listers individually per IP address, click Add and then:
    • In Server, click the server that should listen for incoming Web requests.
    • In IP address, click the Internet Protocol (IP) address on the server that should listen for incoming Web requests.
    • (Optional) In Display Name, type a name to use for this listener.
    • (Optional) Configure the authentication method and server certificate for the listener.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft Internet Security and Acceleration Server, and then click ISA Management.
  • By default, when you install ISA Server, incoming Web request properties are configured so that no IP address listens for requests. When you configure incoming Web request properties and specify the IP address, you set Microsoft Internet Security and Acceleration (ISA) Server to allow Web publishing.
  • When you select Use the same listener configuration for all internal IP addresses, ISA Server configures publishing for all addresses associated with all internal and external network adapters.
  • Typically, the IP address you specify should be the IP address of the network adapter that is connected to the external network.

Related Topics

Configuring incoming Web request properties

Configure server certificates for Web requests

Configure authentication methods for Web requests


Configure listeners for outgoing Web requests

To configure listeners for outgoing Web requests

  1. In the console tree of ISA Management, right-click the applicable array and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. On the Outgoing Web requests tab, select one of the following:
    • Use the same listener configuration for all internal IP addresses
    • Configure listers individually per IP address
  3. If you selected Configure listers individually per IP address, click Add and do the following:
    • In Server, select the server that should listen for outgoing Web requests.
    • In IP address, select the Internet Protocol (IP) address on the server that should listen for outgoing Web requests.
    • (Optional) Configure authentication method and server certificate for the listener.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • When you select All internal IP addresses, Microsoft Internet Security and Acceleration (ISA) Server configures the ISA Server computers to listen for outgoing Web requests on all addresses associated with all internal network adapters.

Related Topics

Configuring outgoing Web request properties

Configure server certificates for Web requests

Configure authentication methods for Web requests


Configure the TCP port

To configure the TCP port

  1. In the console tree of ISA Management, right-click the applicable array and click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. Select the Incoming Web request tab or the Outgoing Web request tab.
  3. In TCP port, type the port number on which the ISA Server should listen for Web requests.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • By default, Microsoft Internet Security and Acceleration (ISA) Server listens for outgoing Transmission Control Protocol (TCP) requests on port 8080.
  • By default, ISA Server does not listen for incoming TCP requests. If you configure the TCP port for incoming Web requests, it is recommended that you set it to port 80.

Related Topics

Configuring outgoing Web request properties

Configuring incoming Web request properties


Enable SSL listeners

To enable SSL listeners

  1. In the console tree of ISA Management, right-click the applicable array and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. On the Outgoing Web Requests tab or on the Incoming Web Requests tab, select the Enable SSL listeners check box.
  3. In SSL port, type the port on which the Microsoft Internet Security and Acceleration (ISA) Server computer should listen for incoming or outgoing Secure Sockets Layer (SSL) requests.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If you enable SSL listeners, then you must configure a server-side certificate with which to authenticate to clients.

Related Topics

SSL bridging

Configure server certificates for Web requests


Configure server certificates for Web requests

To configure server certificates for Web requests

  1. In the console tree of ISA Management, right-click the applicable array and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. On the Outgoing Web Requests tab or on the Incoming Web Requests tab, do one of the following:
    • If you selected Use the same listener configuration for all internal IP addresses, then click Edit to edit the selected IP address properties.
    • If you selected Configure listeners individually per IP address, then click Add to add an IP address and configure its properties. Or, click Edit to edit the properties of the selected Internet protocol (IP) address.
  3. Select the Use a server certificate to authenticate to Web clients check box and then click Select.
  4. Select a certificate from the certificate list.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You must have certificates installed on the ISA Server computer in order to configure this option.

Related Topics

Client certificates and server certificates

SSL bridging

Configuring outgoing Web request properties

Configuring incoming Web request properties


Configure authentication methods for Web requests

To configure authentication methods for Web requests

  1. In the console tree of ISA Management, right-click the applicable array and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. On the Incoming Web Requests tab or on the Outgoing Web Requests tab, do one of the following:
    • To add an Internet protocol (IP) address and configure its properties, click Add.
    • To edit the properties of an IP address properties, click the IP address, then click Edit.
  3. Under Authentication, do one or more of the following:
    • Click the Basic with this domain check box. Then, to select a domain other than the local domain, click Select domain and type the name of the desired domain.
    • Click the Digest with this domain check box. Then, to select a domain other than the local domain, click Select domain and type the name of the desired domain.
    • Click the Integrated check box.
    • Click the Client certificate (secure channel only) check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If more than one authentication method is selected, then the client can authenticate using any of the specified authentication methods.

Important

  • Internet Explorer 5 supports all the authentication methods. Other Web browsers may support only the Basic authentication method. Be sure that the clients' Web browsers can use at least one of the authentication methods that you specify in an array's incoming Web request and outgoing Web request properties. Otherwise, the client will not be able to access the requested object.

Related Topics

Authentication methods

Configuring outgoing Web request properties

Configuring incoming Web request properties


Require authentication for all Web requests

To require authentication for all Web requests

  1. In the console tree of ISA Management, right-click the applicable array and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. On the Incoming Web Requests tab or on the Outgoing Web Requests tab, click the Ask unauthenticated users for identification check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Rules and authentication

Configuring outgoing Web request properties

Configuring incoming Web request properties


Configure connection settings for Web requests

To configure connection settings for Web requests

  1. In the console tree of ISA Management, right-click the applicable array and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. On the Incoming Web Requests tab, or on the Outgoing Web Requests tab, under Connections, click Configure.
  3. Choose one of the following:
    • If any number of Web Proxy clients should be able to connect simultaneously, click Unlimited.
    • If you want a certain number of Web Proxy clients to be able to connect simultaneously, click Maximum per server and type the number of Web Proxy clients that can connect at one time.
  4. In Connection timeout, type how long the connection should be maintained with no response, measured in seconds.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring outgoing Web request properties

Configuring incoming Web request properties


Enable Cache Array Routing Protocol

  1. In the console tree of ISA Management, right-click the applicable array and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. On the Incoming Web requests tab or on the Outgoing Web requests tab, select the Resolve requests within array before routing check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • When ISA Server is installed, CARP is enabled for outgoing Web requests, and disabled for incoming Web requests.

Related Topics

Configuring outgoing Web request properties

Configuring incoming Web request properties

Configuring Cache Array Routing Protocol


Configure automatic discovery

  • Publish automatic discovery
  • Configure DNS for automatic discovery of ISA Server
  • Configure DHCP for automatic discovery of ISA Server


Publish automatic discovery

To publish automatic discovery

  1. In the console tree of ISA Management, right-click the applicable array, and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. On the Auto Discovery tab, select the Publish automatic discovery information check box.
  3. In Use this port for automatic discovery requests, type the appropriate port number.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Automatic discovery

Set automatic discovery for firewall clients


Configure DNS for automatic discovery of ISA Server

To configure DNS for automatic discovery of ISA Server

  1. Click Start, point to Programs, point to Administrative Tools, and then click DNS.
  2. In the console tree, right-click the applicable forward lookup zone and click New Alias.

    3. Where?

    • DNS
    • DNS server
    • Forward Lookup Zones
    • Applicable zone
  3. In Alias name, type WPAD.
  4. In Fully qualified name for target host, type the fully-qualified domain name of the ISA Server computer or array.

Notes

  • If DNS does not appear in Administrative Tools, it is not installed. See Windows 2000 Server Help for the installation procedure.
  • If the ISA Server computer or array already has a host (A) record defined, you can click Browse to search the DNS namespace for the ISA Server or array name.
  • When using DNS to publish WPAD, automatic discovery must be configured to use Port 80. Alternatively, the outgoing Web requests must be configured to listen on Port 80.

Related Topics

Automatic discovery

Set automatic discovery for firewall clients

Publish automatic discovery


Configure DHCP for automatic discovery of ISA Server

To configure DHCP for automatic discovery of ISA Server

  1. Click Start, point to Programs, point to Administrative Tools, and then click DHCP.
  2. In the console tree, right-click the applicable DHCP server, click Set Predefined Options, then click Add.
  3. In Name, type WPAD.
  4. In Code, type 252.
  5. In Data type, select String and then click OK.
  6. In String, type:

    7. http://Computer_Name:AutoDiscoveryPortNumber/Wpad.dat

    where Computer_Name is the fully qualified domain name of the ISA Server computer or array and AutoDiscoveryPortNumber is the port number on which auto-discovery information is published. This port is either the outgoing Web request port number or an additional port used for automatic discovery publishing.

  7. Right-click Server options and then click Configure options.
  8. Confirm that the Option 252 check box is selected.

Related Topics

Automatic discovery

Set automatic discovery for firewall clients

Publish automatic discovery


Create and modify policy elements

  • Create policy elements
  • Modify policy elements


Create policy elements

  • Create a schedule
  • Create a bandwidth priority
  • Create a destination set
  • Create a client address set
  • Create a protocol definition
  • Create a content group
  • Create a dial-up entry


Create a schedule

To create a schedule

  1. In the console tree of ISA Management, right-click Schedules, point to New, and then click Schedule.

    2. For array policy schedules, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Schedules

    For enterprise policy schedules, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policy Elements
    • Schedules
  2. In Name, type the name of the schedule.
  3. (Optional) In Description, type a description for the schedule.
  4. Use the schedule table to set the schedule.
    • Click a cell to select the specific hour on a specific day.
    • Click a day in the left column to select the entire day.
    • Click an hour in the top row to select the same hour on all days.
  5. Click Active, to enable the rule during the selected times or click Inactive to disable the selected times.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • In the table, a dark cell means the rule is in effect during that hour on that day; a white cell means the rule is not in effect.

Related Topics

Configuring schedules


Create a bandwidth priority

To create a bandwidth priority

  1. In the console tree of ISA Management, right-click Bandwidth Priorities, click New and then click Bandwidth priority.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Bandwidth Priorities
  2. In Name, type the name of the bandwidth priority.
  3. (Optional) In Description, type a description for the bandwidth priority.
  4. In Outbound bandwidth, type a number between 1 and 200.
  5. In Inbound bandwidth, type a number between 1 and 200.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring bandwidth priorities


Create a destination set

To create a destination set

  1. In the console tree of ISA Management, right-click Destination Sets, point to New, and then click Set.

    2. For array policy destination sets, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Destination Sets

    For enterprise policy destination sets, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policy Elements
    • Destination Sets
  2. In Name, type a name for the destination set.
  3. (Optional) In Description, type a description for the destination set.
  4. Click Add and do one of the following:
    • Click Destination and type a computer name.
    • Click IP address. Then, in From and To, type the appropriate Internet Protocol (IP) addresses.
    • (Optional) In Path, type the specific path on the specified computers.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • All the computers in that range of IP addresses are in the destination set.
  • Specify the fully qualified domain name (FQDN) for the computer name. For example, type computer_name.microsoft.com, and not //computer_name.
  • If you specify destination by typing the computer name, you can include all the computers in a domain by using wildcards. For example, to include all the computers in the microsoft.com domain, type *.microsoft.com.
  • The computer name, path, and file name are not case sensitive.
  • If you do not type an IP address in To, only one computer is added to the destination set.
  • To edit an address, in Include these computers, click the address and click Edit.
  • To delete an address, in Include these computers. click the address and click Remove.
  • To include a specific file, in Add/Edit Computer, in Path, type:

    /path_name/file_name

  • To include all the files in a directory path, type:

    /path_name/*

Related Topics

Configuring destination sets


Create a client address set

To create a client address set

  1. In the console tree of ISA Management, right-click Client Address Sets, point to New, and then click Set.

    2. For array policy client address sets, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Client Address Sets

    For enterprise policy client address sets, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policy Elements
    • Client Address Sets
  2. In Name, type a name for the set.
  3. (Optional) In Description, type a description for the set.
  4. Click Add.
  5. In From, type an Internet protocol (IP) address for the lowest IP address in the set.
  6. In To, type an IP address for the highest IP address in the set.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • To edit an address, in Members, click the address, then click Edit.
  • To delete an address, in Members, click the address, then click Remove.
  • If you want to include only one IP address in the set, type the same address in From and To.

Related Topics

Configuring client address sets


Create a protocol definition

To create a protocol definition

  1. In the console tree of ISA Management, right-click Protocol Definitions, click New and then click Definition.

    2. For array policy protocol definitions, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Protocol Definitions

    For enterprise policy protocol definitions, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policy Elements
    • Protocol Definitions
  2. In the New Protocol Definition wizard, type the name of the protocol definition and then click Next.
  3. On the Primary Connection Information page, specify the port, protocol type, and direction for the primary connection. Then click Next.
  4. On the Secondary Connections page, specify if the protocol definition includes a secondary connection. Then, specify the port range, protocol type, and direction for the secondary connection.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring protocol definitions

Modify a protocol definition


Create a content group

To create a content group

  1. In the console tree of ISA Management, right-click Content Groups, click New, and click Content Group.

    2. For array policy content groups, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Content Groups

    For enterprise policy content groups, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policy Elements
    • Content Groups
  2. In Name, type the name of the content group.
  3. (Optional) In Description, type a description for the content group.
  4. In Available Types, do one of the following:
    • To select an existing content type, click a file extension or Multipurpose Internet Mail Extensions (MIME) type.
    • To add a new content type, type a new file extension or a MIME type.
  5. Click Add.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • When you create content groups, it is recommended that you specify the content's MIME type and file extension.
  • When you configure a content group, specifying the MIME type, you can use asterisks as wildcards. For example, to include all application types, enter application/*. The asterisk wildcards can be used only with MIME types (and not with file extensions). The asterisk can appear only once and can be specified only at the end of the MIME type after /.
  • To remove a file type or MIME type from the content group, in Selected types, click the file type or MIME type, then click Remove.

Related Topics

Configuring content groups


Create a dial-up entry

To create a dial-up entry

  1. In the console tree of ISA Management, right-click Dial-up entries.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Dial-up Entries
  2. Click New, then click Dial-up Entry
  3. In Name, type the name of the dial-up entry.
  4. (Optional) In Description, type a description for the dial-up entry.
  5. In Use the following network dial-up connection, type the name of an existing Windows 2000 network dial-up connection, then click Set Account.
  6. In User, type the user name, supplied by your Internet Service Provider (ISP).
  7. In Password and Confirm password, type the user's password.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • The network dial-up connection must already be configured for the remote access server on each of the array's member servers.
  • The dial-up entry that is created becomes the active dial-up entry. This dial-up entry will be used for routing rules and for firewall chaining.
  • The user name and password you specify should be the same user name and password that you would type to manually establish a network dial-up connection.

Related Topics

Configuring dial-up entries

Set an active dial-up entry


Modify policy elements

  • Modify a schedule
  • Modify a bandwidth priority
  • Modify a destination set
  • Modify a client address set
  • Modify a protocol definition
  • Modify a content group
  • Modify a dial-up entry
  • Set an active dial-up entry
  • Set effective bandwidth for a modem


Modify a schedule

To modify a schedule

  1. In the console tree of ISA Management, click Schedules.

    2. For array policy schedules, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Schedules

    For enterprise policy schedules, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policy Elements
    • Schedules
  2. In the details pane, right-click the schedule you want to modify, then click Properties.
  3. (Optional) On the General tab, change the entries in Name and Description.
  4. On the Schedule tab, use the schedule table to modify the schedule.
    • Click a cell to select the specific hour on a specific day.
    • Click a day in the left column to select the entire day.
    • Click an hour in the top row to select the same hour on all days.
  5. Click Active, to enable the rule during the selected times or click Inactive to disable the selected times.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • Use the schedule table to modify the schedule. A dark cell means the rule is in effect during that hour on that day; a white cell means the rule is not in effect.

Related Topics

Configuring schedules


Modify a bandwidth priority

To modify a bandwidth priority

  1. In the console tree of ISA Management, click Bandwidth Priorities.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Bandwidth Priorities
  2. In the details pane, right-click the bandwidth priority you want to modify and then click Properties.
  3. (Optional) On the General tab, change the entries in Name and Description.
  4. On the Bandwidth tab, in Outbound bandwidth, type a number between 1 and 200.
  5. In Inbound bandwidth, type a number between 1 and 200.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring bandwidth priorities


Modify a destination set

To modify a destination set

  1. In the console tree of ISA Management, click Destination Sets.

    2. For array policy elements, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Destination Sets

    For enterprise policy elements, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policy Elements
    • Destination Sets
  2. On the View menu, click Advanced.
  3. In the details pane, right-click the destination set you want to modify and then click Properties.
  4. (Optional) On the General tab, change the entries in Name and Description.
  5. To add a destination, on the Destinations tab, click Add and do one of the following:
    • Click Destination, then type a computer name.
    • Click IP address, and then, in From and To, type Internet protocol (IP) addresses to indicate the range of IP addresses to include in the destination set.
    • (Optional) In Path, type the desired path to be included.
      • To include the default file, in Path, type /Path_name/
      • To include a specific file, in Path, type /Path_name/File_name
      • To include all the files in a directory path, type /Path_name/*

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • To modify an address, on the Destinations tab, in Computers in this set, click the address and click Edit.
  • To delete an address, on the Destinations tab, in Computers in this set, click the address and click Remove.

Related Topics

Configuring destination sets


Modify a client address set

To modify a client address set

  1. In the console tree of ISA Management, click Client Address Sets.

    2. For array policy client address sets, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Client Address Sets

    For enterprise policy client address sets, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policy Elements
    • Client Address Sets
  2. On the View menu, click Detail.
  3. In the details pane, right-click the client address set you want to modify, then click Properties.
  4. (Optional) On the General tab, change the entries in Name and Description.
  5. (Optional) On the Addresses tab:
    • To add a client address, click Add, and then, in From and To, type the lowest and highest Internet protocol (IP) addresses in the set.
    • To modify an address, click the address in the list, and then click Edit.
    • To delete an address, click the address in the list, and then click Remove.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • To include only one IP address in the set, type the same address in From and To.

Related Topics

Configuring client address sets


Modify a protocol definition

To modify a protocol definition

  1. In the console tree of ISA Management, click Protocol Definitions.

    2. For array policy protocol definitions, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Protocol Definitions

    For enterprise policy protocol definitions, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policy Elements
    • Protocol Definitions
  2. On the View menu, click Detail.
  3. In the details pane, right-click the protocol definition you want to modify and then click Properties.
  4. (Optional) If necessary, on the General tab, change the entries in Name and Description.
  5. To add port ranges for secondary connections, on the Parameters tab, click Add.
  6. In From and To, specify the lowest and highest ports in the range of ports to use for secondary connections.
  7. In Protocol type, select the low-level protocol to use for secondary connections.
  8. In Direction, specify Outbound or Inbound.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • To edit a secondary connection, in Members, click the connection and click Edit.
  • To delete a secondary connection, in Members, click the connection and click Remove.
  • You cannot modify protocol definitions installed with Microsoft Internet Security and Acceleration (ISA) Server or with application filters.

Related Topics

Configuring protocol definitions


Modify a content group

To modify a content group

  1. In the console tree of ISA Management, click Content groups.

    2. For array policy content groups, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Content Groups

    For enterprise policy content groups, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policy Elements
    • Content Groups
  2. In the details pane, right-click the content group you want to modify and then click Properties.
  3. (Optional) If necessary, on the General tab, change the entries in Name and Description.
  4. On the Content Types tab, in Available Types, do one of the following:
    • click a file extension or Multipurpose Internet Mail Extensions (MIME) type, to select an existing content type.
    • type a new file extension or a MIME type, to specify a new content type.
  5. Click Add.
  6. To remove a file extension or MIME type from the content group, select it from Selected Types and then click Remove.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • When you modify content groups, it is recommended that you specify the content's MIME type and file extension.

Related Topics

Configuring content groups


Modify a dial-up entry

To modify a dial-up entry

  1. In the console tree of ISA Management, click Dial-up entries.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Dial-up entries
  2. On the View menu, click Detail.
  3. In the details pane, right-click the dial-up entry you want to modify and then click Properties.
  4. On the General tab, in Name, type the name of the dial-up entry.
  5. (Optional) In Description, type a description for the dial-up entry.
  6. On the Dial-up Entry tab, in Use the following network dial-up connection, do one of the following:
    • Type the name of an existing Windows 2000 network dial-up connection.
    • Click Select and select a network dial-up connection from the list.
    • In User name, type the name of a user authorized to use the network dial-up connection. In Password, type the password.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • The first dial-up entry created is set as the active dial-up entry. This dial-up entry will be used for routing rules and for Firewall chaining.
  • When you set a new active dial-up entry, all existing dial-up connections are disconnected, if it was dialed using ISA Server.

Related Topics

Configuring dial-up entries

Set an active dial-up entry


Set an active dial-up entry

To set an active dial-up entry

  1. In the console tree of ISA Management, click Dial-up entries.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Dial-up Entries
  2. In the details pane, right-click the applicable dial-up entry and then click Set as active entry.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot delete the active dial-up entry.

Important

  • When you set an active dial-up entry, all existing dial-up connections are disconnected if ISA was used to dial it.

Related Topics

Configuring dial-up entries


Set effective bandwidth for a modem

To set effective bandwidth for a modem

  1. In the console tree of ISA Management, click Dial-up Entries.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Policy Elements
    • Dial-up Entries
  2. In the details pane, right-click the applicable dial-up entry and then click Properties.
  3. On the Bandwidth tab, click Enable bandwidth control.
  4. In Effective bandwidth, type the effective bandwidth for all the devices in the array.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Determining effective bandwidth


Configure packet filtering

  • Configure IP packet filters
  • Enable IP routing
  • Enable packet filtering
  • Enable IP options filtering
  • Enable IP fragment filtering
  • Enable intrusion detection
  • Configure intrusion detection
  • Allow outgoing PPTP access


Configure IP packet filters

  • Create an IP packet filter
  • Apply an IP packet filter to a server
  • Configure a protocol for an IP packet filter
  • Configure an IP packet filter for a local computer
  • Configure an IP packet filter for a remote computer


Create an IP packet filter

To create an IP packet filter

  1. In the console tree of ISA Management, right-click IP Packet Filters, point to New and then click Filter.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • IP Packet Filters
  2. Follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot create IP packet filters if you installed ISA Server in cache mode.

Related Topics

IP packet filters

ISA Server modes


Apply an IP packet filter to a server

To apply an IP packet filter to a server

  1. In the console tree of ISA Management, click IP Packet Filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • IP Packet Filters
  2. On the View menu, confirm that Advanced has a check mark next to it.
  3. In the details pane, right-click the IP packet filter you want to modify and then click Properties.
  4. On the General tab, verify that the Enable this filter check box is selected.
  5. On the General tab, in Servers that use this filter, do one of the following:
    • Click All servers in the array.
    • Click Only this server, and then click the server to which the filter applies.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

IP packet filters

Create an IP packet filter


Configure a protocol for an IP packet filter

To configure a protocol for an IP packet filter

  1. In the console tree of ISA Management, click IP Packet Filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • IP Packet Filters
  2. On the View menu, confirm that Advanced has a check mark next to it.
  3. In the details pane, right-click the Internet protocol (IP) packet filter you want to modify and then click Properties.
  4. On the Filter Type tab, do one of the following:
    • Click Predefined, and then click a filter from the list.
    • Click Custom, and then in the IP Protocol list, click one of the following: Any, ICMP, TCP, UDP, or Custom protocol.
  5. If you chose the ICMP protocol, then do the following:
    • In Direction, click Inbound, Outbound, or Both.
    • In Type, click All types or Fixed type. If you click Fixed type, then in Number, type the number.
    • In Code, click All Codes or Fixed Code. If you click Fixed Code, then in Number, type the code number.
  6. If you chose Any, then specify the direction: Inbound, Outbound, or Both.
  7. If you chose the UDP protocol, then do the following:
    • In Direction, click Receive only, Send only, Both, Receive Send, or Send Receive.
    • In Local Port, click All ports, Fixed port, or Dynamic (1025-5000). If you click Fixed Port, then in Local Port Number, type the port number.
    • In Remote Port, click All ports or Fixed port. If you click Fixed Port, then in Remote Port Number, type the port number.
  8. If you selected the TCP protocol, then do the following:
    • In Direction, click Inbound, Outbound, or Both.
    • In Local Port, click All ports, Fixed port, or Dynamic (1025-5000). If you click Fixed Port, then in Local Port Number, type the port number.
    • In Remote Port, click All ports or Fixed port. If you click Fixed Port, then in Remote Port Number, type the port number.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

IP packet filters

Create an IP packet filter


Configure an IP packet filter for a local computer

To configure an IP packet filter for a local computer

  1. In the console tree of ISA Management, click IP Packet Filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • IP Packet Filters
  2. On the View menu, select Advanced.
  3. In the details pane, right-click the Internet Protocol (IP) packet filter you want to modify and then click Properties.
  4. On the Local Computer tab:
    • To specify the default IP address for each external interface of the ISA Server computer, click Default IP address(es) on the external interface(s).
    • To select a specific IP address for an external interface of the ISA Server computer, click This ISA Server's external IP address and type the IP address of the ISA Server computer.
    • To select a specific computer on a perimeter network (also known as a DMZ, demilitarized zone, and screened subnet), click This computer (on the perimeter network) and type an IP address that is not on the ISA Server computer.
    • To specify a range of IP addresses on the perimeter network, click These computers (on the perimeter network), then type the appropriate information in Subnet and Mask.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Create an IP packet filter

IP packet filters

Server publishing rules and IP packet filters


Configure an IP packet filter for a remote computer

To configure an IP packet filter for a remote computer

  1. In the console tree of ISA Management, click IP Packet Filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • IP Packet Filters
  2. On the View menu, select Advanced.
  3. In the details pane, right-click the Internet Protocol (IP) packet filter you want to modify and then click Properties.
  4. On the Remote Computer tab, click the IP address to which the filter applies:
    • If the filter applies to all external computers, click All remote computers.
    • If the filter applies to one computer, click This remote computer, and then type atheIP address of the external computer to which the filter applies.
    • If the filter applies to a range of computers, click This range of computers, and then type the appropriate information in the Subnet and Mask.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Create an IP packet filter

IP packet filters

Server publishing rules and IP packet filters


Enable IP routing

To enable IP routing

  1. In the console tree of ISA Management, right-click IP Packet Filters and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • IP Packet Filters
  2. On the General tab, click Enable packet filtering.
  3. Click Enable IP routing.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot configure IP packet filter properties if you installed ISA Server in cache mode.

Important

  • If you use Windows 2000 Routing and Remote Access to enable IP routing, then IP routing will also be enabled for ISA Server, although the IP routing check box may remain unchecked.

Related Topics

Filtering and routing

ISA Server modes


Enable packet filtering

To enable packet filtering

  1. In the console tree of ISA Management, right-click IP Packet Filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • IP Packet Filters
  2. Click Properties.
  3. On the General tab, select the Enable packet filtering check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If the enterprise policy that is applied to the array forces packet filtering, then you cannot disable packet filtering.
  • You cannot configure IP packet filter properties if you installed ISA Server in cache mode.

Related Topics

Filtering and routing

ISA Server modes


Enable IP options filtering

To enable IP options filtering

  1. In the console tree of ISA Management, right-click IP Packet Filters and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • IP Packet Filters
  2. On the General tab, click Enable packet filtering.
  3. On the Packet Filters tab, click Enable filtering IP options.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot configure IP packet filter properties if you installed ISA Server in cache mode.

Related Topics

Filtering and routing

Packet filter options

ISA Server modes


Enable IP fragment filtering

To enable IP fragment filtering

  1. In the console tree of ISA Management, right-click IP Packet Filters and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • IP Packet Filters
  2. On the General tab, select the Enable packet filtering check box.
  3. On the Packet Filters tab, select the Enable filtering of IP fragments check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • It is recommended that you not enable Internet protocol (IP) fragment filtering if you want to allow video streams or quality audio streams to pass through ISA Server.
  • You cannot configure IP packet filter properties if you installed ISA Server in cache mode.

Related Topics

Filtering and routing

Packet filter options

ISA Server modes


Enable intrusion detection

To enable intrusion detection

  1. In the console tree of ISA Management, right-click IP Packet Filters and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • IP Packet Filters
  2. On the General tab, select Enable packet filtering.
  3. Select the Enable intrusion detection check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot configure IP packet filter properties if you installed ISA Server in cache mode.

Related Topics

Configuring intrusion detection

Configure intrusion detection

ISA Server modes


Configure intrusion detection

To configure intrusion detection

  1. In the console tree of ISA Management, right-click IP Packet Filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • IP Packet Filters
  2. Click Properties.
  3. On the General tab, select the Enable packet filtering and Enable intrusion detection check boxes.
  4. On the Intrusion detection tab, select the checkboxes for the types of attacks that should generate events:
    • Windows out-of-band (WinNuke)
    • Land
    • Ping of death
    • IP half scan
    • UDP bomb
    • Port scan
  5. If you select the Port scan check box, then do the following:
    • In Detect after attacks on number well-known ports, type the maximum number of well-known ports that can be scanned before generating an event.
    • In Detect after attacks on number ports, type the total number of ports that can be scanned before generating an alert.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • Although an event will be generated whenever a selected intrusion attack occurs, an alert will be generated only if you specifically configure it.
  • A well-known port is any port in the range of 1–2048.
  • You cannot configure IP packet filter properties if you installed ISA Server in cache mode.
  • Intrusion detection functionality is based on technology from Internet Security Systems, Inc., Atlanta, GA, USA, www.iss.net. Portions Copyright © 2000 Internet Security Systems, Inc.

Related Topics

Configuring intrusion detection

Create an alert

ISA Server modes


Allow outgoing PPTP access

To allow outgoing PPTP access

  1. In the console tree of ISA Management, right-click IP Packet Filters and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • IP Packet Filters
  2. On the PPTP tab, click PPTP through ISA firewall.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot configure IP packet filter properties if you installed ISA Server in cache mode.

Related Topics

Outgoing PPTP access

ISA Server modes


Configure access policy

  • Create a site and content rule
  • Create a protocol rule
  • Configure a destination set for a site and content rule
  • Configure a schedule for an access policy rule
  • Configure users for an access policy rule
  • Configure content for a site and content rule
  • Configure an action for a site and content rule
  • Configure protocols for a protocol rule
  • Turn off an access policy rule
  • Delete an access policy rule


Create a site and content rule

To create a site and content rule

  1. In the console tree of ISA Management, right-click Site and Content Rules, point to New, and then click Rule.

    2. For array policy, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • Site and Content Rules

    For enterprise policy, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policies
    • Enterprise Policy
    • Site and Content Rules
  2. Follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If an enterprise policy is applied to this array, then only deny rules can be created.
  • Before you use the New Site and Content Rule Wizard to create a rule, be sure to create the new policy elements that may required by the new rule. Depending on how you configure the rule, you may require the following policy elements: destination set, schedule, client address set, and content group.

Related Topics

Site and content rules

Configure a destination set for a site and content rule

Configure a schedule for an access policy rule

Configure users for an access policy rule

Configure content for a site and content rule

Configure action for a site and content rule


Create a protocol rule

To create a protocol rule

  1. In the console tree of ISA Management, right-click Protocol Rules, point to New, and then click Rule.

    2. For array policy, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • Protocol Rules

    For enterprise policy, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policies
    • Enterprise Policy
    • Protocol Rules
  2. Follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If an enterprise policy is applied to this array, then only deny rules can be created.
  • Before you use the New Protocol Rule Wizard to create a rule, be sure to create the new policy elements that may required by the new rule. Depending on how you configure the rule, you may require the following policy elements: protocol definition, schedule, and client address set.

Related Topics

Protocol rules

Configure a schedule for an access policy rule

Configure users for an access policy rule

Configure protocols for a protocol rule


Configure a destination set for a site and content rule

To configure a destination set for a site and content rule

  1. In the console tree of ISA Management, click Site and Content Rules.

    2. For array policy, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • Site and Content Rules

    For enterprise policy, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policies
    • Enterprise Policy
    • Site and Content Rules
  2. On the View menu, select Advanced.
  3. In the details pane, right-click the applicable rule and then click Properties.
  4. On the Destination tab, select one of the following:
    • All destinations
    • All external destinations
    • All internal destinations
    • Selected destination set
    • All destinations except selected set
  5. If you chose Selected destination set or All destinations except selected set, then in Name, select a destination set.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If the destination set that you want to specify does not exist, you can click New to create it, and then select it in the list.

Related Topics

Site and content rules

Create a destination set


Configure a schedule for an access policy rule

To configure a schedule for an access policy rule

  1. In the console tree of ISA Management, click one of the following:
    • For array policy, Access Policy.

      • Where?

      • Internet Security and Acceleration Server
      • Servers and Arrays
      • Name
      • Access Policy
    • For enterprise policy, the applicable enterprise policy.

      • Where?

      • Internet Security and Acceleration Server
      • Enterprise
      • Policies
      • Enterprise Policy
  2. On the View menu, select Advanced.
  3. In the details pane, right-click the applicable rule and then click Properties.
  4. On the Schedule tab, in Schedule, click the schedule for the time during which the rule is available.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • A dark cell means the rule is in effect during that hour on that day; a white cell means the rule is not in effect.
  • You can configure schedules for site and content rules and for protocol rules.
  • If the schedule that you want to specify does not exist, you can click New to create it, and then select it in the list.

Related Topics

Site and content rules

Protocol rules

Create a schedule


Configure users for an access policy rule

To configure users for an access policy rule

  1. In the console tree of ISA Management, click one of the following:
    • For array policy, Access Policy.

      • Where?

      • Internet Security and Acceleration Server
      • Servers and Arrays
      • Name
      • Access Policy
    • For enterprise policy, click the applicable enterprise policy.

      • Where?

      • Internet Security and Acceleration Server
      • Enterprise
      • Policies
      • Enterprise Policy
  2. On the View menu, select Advanced.
  3. In the details pane, right-click the applicable rule and then click Properties.
  4. To specify clients for the rule, on the Applies To tab, do one of the following:
    • Click Any request.
    • Click Client address sets specified below.
    • Click Users or groups specified below.
  5. If you selected Requests from specified users or groups or Requests from specified client address sets, then do the following:
    • To add users or clients to Applies to requests coming from, click Add.
    • To add users or clients to Exceptions, click Add.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You can configure users for site and content rules and for protocol rules.
  • Users will be authenticated differently, depending on how you configure ISA Server.

Related Topics

Site and content rules

Protocol rules

Create a client address set

Rules and authentication


Configure content for a site and content rule

To configure content for a site and content rule

  1. In the console tree of ISA Management, click Site and Content Rules.

    2. For array policy, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • Site and Content Rules

    For enterprise policy, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policies
    • Enterprise Policy
    • Site and Content Rules
  2. On the View menu, select Advanced.
  3. In the details pane, right-click the applicable site and content rule and then click Properties.
  4. On the HTTP Content tab, do one of the following:
    • To specify that the rule applies to all content, click All content groups.
    • To specify that the rule only applies to certain content, click Selected content groups and click one or more content groups.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If the content group that you want to specify does not exist, you can click New to create it, and then select it in the list.

Related Topics

Site and content rules

Create a content group


Configure an action for a site and content rule

To configure an action for a site and content rule

  1. In the console tree of ISA Management, click Site and Content Rules.

    2. For array policy, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • Site and Content Rules

    For enterprise policy, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policies
    • Enterprise Policy
    • Site and Content Rules
  2. On the View menu, select Advanced.
  3. In the details pane, right-click the applicable rule and then click Properties.
  4. On the Action tab, do one of the following:
    • To allow client access to the specified sites, click Allowed.
    • To deny client access to the specified sites, click Denied.
  5. (Optional) If you selected to deny access to sites, select the If HTTP request, redirect request to this URL check box, and then specify an alternate URL to which client requests should be redirected.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • The URL specified here must be accessible to the clients or users. In other words, either the URL must be on an internal computer or a rule must explicitly allow access to the URL.
  • When you specify the destination to which to redirect the request, you can specify a whole different location, by typing http:// and then the URL of the location to which to redirect the request.

Related Topics

Site and content rules


Configure protocols for a protocol rule

To configure protocols for a protocol rule

  1. In the console tree of ISA Management, click Protocol Rules.

    2. For array policy, where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • Protocol Rules

    For enterprise policy, where?

    • Internet Security and Acceleration Server
    • Enterprise
    • Policies
    • Enterprise Policy
    • Protocol Rules
  2. On the View menu, select Advanced.
  3. In the details pane, right-click the applicable protocol rule and then click Properties.
  4. On the Protocols tab, do one of the following:
    • If the rule applies to all protocols, even those not explicitly defined by ISA Server, click All IP traffic.
    • If the rule applies only to protocols that you select in Protocol, click Selected protocols.
    • If the rule applies to all IP traffic except those selected, click All IP traffic except selected.
  5. If you chose Selected protocols or All IP traffic excepted selected, then in Protocols, select one or more protocol definitions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If the protocol definition that you want to specify does not exist, you can click New to create it, and then select it in the list.

Related Topics

Protocol rules

Create a protocol definition


Turn off an access policy rule

To turn off an access policy rule

  1. In the console tree of ISA Management, click one of the following:
    • For array policy, Access Policy.

      • Where?

      • Internet Security and Acceleration Server
      • Servers and Arrays
      • Name
      • Access Policy
    • For enterprise policy, the applicable enterprise policy.

      • Where?

      • Internet Security and Acceleration Server
      • Enterprise
      • Policies
      • Enterprise Policy
  2. On the View menu, select Advanced.
  3. In the details pane, right-click the applicable rule and then click Disable.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • When you turn off a rule, existing client sessions are not disconnected. To disconnect client sessions, see Disconnect a client session.

Related Topics

Site and content rules

Protocol rules

IP packet filters


Delete an access policy rule

To delete an access policy rule

  1. In the console tree of ISA Management, click one of the following:
    • For array policy, Access Policy.

      Where?

      • Internet Security and Acceleration Server
      • Servers and Arrays
      • Name
      • Access Policy
    • For enterprise policy, the applicable enterprise policy.

      Where?

      • Internet Security and Acceleration Server
      • Enterprise
      • Policies
      • Enterprise Policy
  2. On the View menu, click Advanced.
  3. In the details pane, right-click the rule you want to delete and then click Delete.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Site and content rules

Protocol rules

IP packet filters


Configure bandwidth rules

  • Set effective bandwidth for a modem
  • Create a bandwidth rule
  • Configure bandwidth priority for a bandwidth rule
  • Configure protocols for a bandwidth rule
  • Configure a destination set for a bandwidth rule
  • Configure a schedule for a bandwidth rule
  • Configure users for a bandwidth rule
  • Configure content for a bandwidth rule
  • Change the order of a bandwidth rule
  • Disable a bandwidth rule
  • Delete a bandwidth rule


Set effective bandwidth for a network card

To set effective bandwidth for a network card

  1. In the console tree of ISA Management, right-click Bandwidth Rules and click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Bandwidth Rules
  2. On the General tab, click Enable bandwidth control.
  3. In Effective bandwidth, type the effective bandwidth for the network connection.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring the local address table


Create a bandwidth rule

To create a bandwidth rule

  1. In the console tree of ISA Management, right-click Bandwidth Rules, point to New, and then click Rule.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Bandwidth Rules
  2. In the New Bandwidth Rule Wizard, follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • Before you use the New Bandwidth Rule Wizard to create a rule, be sure to create the new policy elements that may required by the new rule. Depending on how you configure the rule, you may require the following policy elements: protocol definitions, schedule, client address set, destination set, content group, and bandwidth priority

Related Topics

Configuring bandwidth rules


Configure bandwidth priority for a bandwidth rule

To configure bandwidth priority for a bandwidth rule

  1. In the console tree of ISA Management, click Bandwidth Rules.

    2. Where?

    • ISA
    • Servers and Arrays
    • Name
    • Bandwidth Rules
  2. In the details pane, right-click the applicable bandwidth rule and then click Properties.
  3. On the Bandwidth tab, select one of the following:
    • To use the Windows 2000 default scheduling, click Default scheduling priority.
    • To specify a priority, click Specified priority and then in Name, select a bandwidth priority to apply to the rule and type an outbound bandwidth and inbound bandwidth.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • Bandwidth priorities can have a value between 1 and 200.

Related Topics

Configuring bandwidth rules

Configuring bandwidth priorities


Configure protocols for a bandwidth rule

To configure protocols for a bandwidth rule

  1. In the console tree of ISA Management, click Bandwidth Rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Bandwidth Rules
  2. In the details pane, right-click the applicable bandwidth rule and then click Properties.
  3. On the Protocol tab, in This rule applies to, select one of the following:
    • All IP traffic
    • Selected protocols
    • All IP traffic except selected
  4. If you choose Selected protocols or All protocols except selected, then in Protocols, select one or more protocols.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If the protocol definition that you want to specify does not exist, you can click New to create it, and then select it in the list.

Related Topics

Configuring bandwidth rules

Create a protocol definition


Configure a destination set for a bandwidth rule

To configure a destination set for a bandwidth rule

  1. In the console tree of ISA Management, click Bandwidth Rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Bandwidth Rules
  2. In the details pane, right-click the applicable rule and then click Properties.
  3. On the Destinations tab, in This rule applies to, click one of the following:
    • All destinations
    • All external destinations
    • All internal destinations
    • Selected destination set
    • All destinations except selected set
  4. If you clicked Selected destinations or All destinations except selected set, then in Name, click a destination set.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If the destination set that you want to specify does not exist, you can click New to create it and then select it in the list.

Related Topics

Configuring bandwidth rules

Create a destination set


Configure a schedule for a bandwidth rule

To configure a schedule for a bandwidth rule

  1. In the console tree of ISA Management, click Bandwidth Rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Bandwidth Rules
  2. In the details pane, right-click the applicable rule and then click Properties.
  3. On the Schedule tab, in Schedule, click the schedule for the time during which the rule is available.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • A dark cell means the rule is in effect during that hour on that day; a white cell means the rule is not in effect.
  • If the schedule that you want to specify does not exist, you can click New to create it and then select it in the list.

Related Topics

Configuring bandwidth rules

Create a schedule


Configure users for a bandwidth rule

To configure users for a bandwidth rule

  1. In the console tree of ISA Management, click Bandwidth Rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Bandwidth Rules
  2. In the details pane, right-click the applicable rule and then click Properties.
  3. To specify clients for the rule, on the Applies To tab, do one of the following:
    • Click Any request.
    • Click Client address sets specified below.
    • Click Users and groups specified below.
  4. If you clicked Client address sets specified below or Users and groups specified below, then do the following:
    • Click Add to add users or clients to Applies to requests coming from.
    • Click Add to add users or clients to Exceptions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If you choose Any request and if you configured Microsoft Internet Security and Acceleration (ISA) Server to always authenticate users, then the rule applies only to authenticated users.
  • Users will be authenticated differently, depending on how you configure ISA Server.

Related Topics

Configuring bandwidth rules

Create a client address set

Rules and authentication


Configure content for a bandwidth rule

To configure content for a bandwidth rule

  1. In the console tree of ISA Management, click Bandwidth Rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Bandwidth Rules
  2. In the details pane, right-click the applicable bandwidth rule and then click Properties.
  3. On the HTTP Content tab, do one of the following:
    • To specify that the rule applies to all content, click All content groups.
    • To specify that the rule only applies to certain content, click Selected content groups and select the check box for one or more content groups.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If the content group that you want to specify does not exist, you can click New to create it and then click it in the list.

Related Topics

Configuring bandwidth rules

Create a content group


Change the order of a bandwidth rule

To change the order of a bandwidth rule

  1. In the console tree of ISA Management, click Bandwidth rule.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Bandwidth rules
  2. In the details pane, right-click the rule whose order you want to change and then click Move Up or Move Down.
  3. Repeat as necessary to arrange the rules in the desired order.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot change the position of the default rule.

Related Topics

Configuring bandwidth rules


Turn off a bandwidth rule

To turn off a bandwidth rule

  1. In the console tree of ISA Management, click Bandwidth Rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Bandwidth Rules
  2. In the details pane, right-click the applicable rule and then click Disable.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot disable the default bandwidth rule.

Related Topics

Configuring bandwidth rules


Delete a bandwidth rule

To delete a bandwidth rule

  1. In the console tree of ISA Management, click Bandwidth Rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Bandwidth Rules
  2. In the details pane, right-click the rule you want to delete and then click Delete.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot delete the default bandwidth rule.

Related Topics

Configuring bandwidth rules


Configure publishing

This section provides general background information about configuring publishing rules.

  • Configure Web publishing rules
  • Configure server publishing rules
  • Run the Mail Server Security Wizard
  • Turn off a publishing rule
  • Delete a publishing rule


Configure Web publishing rules

  • Create a Web publishing rule
  • Configure a destination set for a Web publishing rule
  • Configure users for a Web publishing rule
  • Configure an action for a Web publishing rule
  • Configure how to redirect HTTP requests for Web publishing rules
  • Configure how to redirect SSL requests for Web publishing rules
  • Require a secure channel for published sites
  • Use client-side certificate to authenticate to Web server
  • Change the order of a Web publishing rule


Create a Web publishing rule

To create a Web publishing rule

  1. In the console tree of ISA Management, right-click Web Publishing Rules, point to New, and then click Rule.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Publishing
    • Web Publishing Rules
  2. In the New Web Publishing Rule Wizard, follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • For array members, if enterprise policy settings are configured so that publishing is not allowed, then you will not be able to create a Web publishing rule.
  • Before you use the New Web Publishing Rule Wizard to create a rule, be sure to create the policy elements that may required by the rule. Depending on how you configure the rule, you may require destination sets.

Related Topics

Web publishing rules


Configure a destination set for a Web publishing rule

To configure a destination set for a Web publishing rule

  1. In the console tree of ISA Management, click Web Publishing Rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Publishing
    • Web Publishing Rules
  2. On the View menu, confirm that Advanced has a check mark next to it.
  3. In the details pane, right-click the applicable rule and then click Properties.
  4. On the Destinations tab, in This rule applies to, select one of the following:
    • All destinations
    • All external destinations
    • All internal destinations
    • Selected destination set
    • All destinations except selected set
  5. If you select Selected destination set or All destinations except selected set, then in Name, select a destination set.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If the destination set that you want to specify does not exist, you can click New to create it, and then select it in the list.

Related Topics

Web publishing rules

Create a destination set


Configure users for a Web publishing rule

To configure users for a Web publishing rule

  1. In the console tree of ISA Management, click Web publishing rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Publishing
    • Web Publishing Rules
  2. On the View menu, confirm that Advanced has a check mark next to it.
  3. In the details pane, right-click the applicable rule and then click Properties.
  4. To specify clients or users for the rule, on the Applies To tab, do one of the following:
    • Click Any request.
    • Click Client address sets specified below.
    • Click Users and groups specified below.
  5. If you clicked Users or groups specified below or Client address sets specified below, then do the following:
    • To add users or clients to Applies to requests coming from, click Add.
    • To add users or clients to Exceptions, click Add.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • For Web publishing rules, client address sets typically include addresses of computers on the Internet.
  • Users will be authenticated differently, depending on how you configure ISA Server.

Related Topics

Web publishing rules

Create a client address set

Rules and authentication


Configure an action for a Web publishing rule

To configure an action for a Web publishing rule

  1. In the console tree of ISA Management, click Web Publishing Rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Publishing
    • Web Publishing Rules
  2. On the View menu, confirm that Advanced has a check mark next to it.
  3. In the details pane, right-click the applicable Web publishing rule and then click Properties.
  4. On the Action tab, do one of the following:
    • To refuse requests, click Discard the request.
    • To forward requests to the server or servers used for Internet publishing, click Redirect the request to this internal Web server.
  5. If you clicked Redirect the request to this internal Web server, do the following:
    • In Destination site, type an Internet protocol (IP) address or a domain name to which requests should be redirected.
    • In Use this port for redirecting HTTP requests, type the port to use for Hypertext Transfer Protocol (HTTP) requests. By default, the HTTP port is configured to 80.
    • In Use this port for redirecting SSL requests, type the port to use for Secure Hypertext Transfer Protocol (HTTPS) requests. By default, the HTTPS port is configured to 443.
    • In Use this port for redirecting FTP requests, type the port to use for Transmission Control Protocol (TCP) requests. By default, the FTP port is configured to 21.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • The port that you configure here is used only if, on the Bridging tab, you select to bridge using the specific protocol.

Related Topics

Web publishing rules


Configure how to redirect HTTP requests for Web publishing rules

To configure how to redirect HTTP requests for Web publishing rules

  1. In the console tree of ISA Management, click Web publishing rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Publishing
    • Web publishing rules
  2. On the View menu, confirm that Advanced has a check mark next to it.
  3. In the details pane, right-click the applicable rule and then click Properties.
  4. On the Bridging tab, in Redirect HTTP requests as, select one of the following options:
    • If Hypertext Transfer Protocol (HTTP) requests should be passed to the Web server using the HTTP protocol, click HTTP requests.
    • If HTTP requests should be passed to the Web server using Secure Hypertext Transfer Protocol (HTTPS), click SSL requests.
    • If HTTP requests should be passed to the Web server using File Transfer Protocol (FTP), click FTP requests.
  5. (Optional) If you clicked SSL requests, then click Use a certificate to authenticate to the Secure Sockets Layer (SSL) Web server and click Select to select the certificate to use.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If you selected SSL requests, then the ISA Server computer will open a new secure control channel to the published Web server.

Related Topics

Web publishing rules

SSL bridging


Configure how to redirect SSL requests for Web publishing rules

To configure how to redirect SSL requests for Web publishing rules

  1. In the console tree of ISA Management, click Web Publishing Rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Publishing
    • Web Publishing Rules
  2. On the View menu, confirm that Advanced has a check mark next to it.
  3. In the details pane, right-click the applicable Web publishing rule and then click Properties.
  4. On the Bridging tab, in Redirect SSL Requests as, select an option:
    • If Secure Sockets Layer (SSL) requests should be routed to the Web server using Hypertext Transfer Protocol (HTTP) protocol, click HTTP requests.
    • If SSL requests should be routed to the Web server using Secure HTTP (HTTPS) protocol, click SSL requests.
    • If SSL requests should be routed to the Web server using File Transfer Protocol (FTP), click FTP requests.
  5. (Optional) If you selected SSL requests, click Use a certificate to authenticate to the SSL Web server and click Select to select the certificate to use.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If you select HTTP requests, then Microsoft Internet Security and Acceleration (ISA) Server terminates the secure control channel.
  • If you select SSL requests, then ISA Server opens a new secure control channel to the published Web server.

Related Topics

Web publishing rules

SSL bridging


Require a secure channel for published sites

To require a secure channel for published sites

  1. In the console tree of ISA Management, click Web publishing rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Publishing
    • Web Publishing Rules
  2. On the View menu, confirm that Advanced has a check mark next to it.
  3. In the details pane, right-click the applicable Web publishing rule and then click Properties.
  4. On the Bridging tab, select the Require secure channel (SSL) for published site check box.
  5. (Optional) If you require 128-bit encryption, select the Require 128-bit encryption check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Web publishing rules


Use client-side certificate to authenticate to Web server

To use client-side certificate to authenticate to Web server

  1. In the console tree of ISA Management, click Web publishing rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Publishing
    • Web Publishing Rules
  2. On the View menu, select Advanced.
  3. In the details pane, right-click the applicable Web publishing rule and then click Properties.
  4. On the Bridging tab, select the Use a certificate to authenticate to the SSL Web server check box, then click Select.
  5. In Select Certificate, select the client-side certificate that ISA Server should use to authenticate to the Web server.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • ISA Server must have an appropriately-configured client-side certificate if you select this option. Refer to the Windows 2000 Help for more information on configuring client-side certificates.

Related Topics

Web publishing rules


Change the order of a Web publishing rule

To change the order of a Web publishing rule

  1. In the console tree of ISA Management, click Web Publishing Rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Publishing
    • Web publishing rules
  2. On the View menu, select Advanced.
  3. In the details pane, right-click the rule whose order you want to change and then click Move Up or Move Down.
  4. Repeat as necessary to arrange the rules in the desired order.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot change the position of the default rule.

Related Topics

Web publishing rules


Configure server publishing rules

  • Create a server publishing rule
  • Configure a server publishing rule action
  • Configure clients for a server publishing rule


Create a server publishing rule

To create a server publishing rule

  1. In the console tree of ISA Management, right-click Server publishing rules, point to New, and then click Rule.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Publishing
    • Server publishing rules
  2. Follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • For array members, if enterprise policy settings are configured so that publishing is not allowed, then you will not be able to create a server publishing rule.
  • Before you use the New Server Publishing Rule Wizard to create a rule, be sure to create the policy elements that may required by the rule. Depending on how you configure the rule, you may require client address sets.
  • You cannot create server publishing rules if you installed ISA Server in cache mode.

Related Topics

Server publishing rules

Configure a server publishing rule action

Configure clients for a server publishing rule

ISA Server modes


Configure a server publishing rule action

To configure a server publishing rule action

  1. In the console tree of ISA Management, click Server publishing rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Publishing
    • Server publishing rules
  2. On the View menu, select Advanced.
  3. In the details pane, right-click the appropriate server publishing rule and then click Properties.
  4. On the Action tab, in IP address of internal server, type the address of the internal server that you want to make available to external users.
  5. In External IP address on ISA Server, type an Internet protocol (IP) address on one of the Microsoft Internet Security and Acceleration (ISA) Server computer's external interface cards that will be accessed by external clients.
  6. In Mapped Server protocol, click a protocol definition that can be used by external clients to access the computer.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • Mapped Server protocol only lists protocol definitions with an inbound direction.

Related Topics

Server publishing rules

Configuring protocol definitions


Configure clients for a server publishing rule

To configure clients for a server publishing rule

  1. In the console tree of ISA Management, click Server publishing rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Publishing
    • Server Publishing Rules
  2. On the View menu, select Advanced.
  3. In the details pane, right-click the applicable rule and then click Properties.
  4. To specify clients for the rule, on the Applies To tab, do one of the following:
    • Click Any request.
    • Click Client address sets specified below.
  5. If you clicked Client address sets specified below, then do the following:
    • To add clients to Applies to requests coming from, click Add.
    • To add clients to Exceptions, click Add.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • For server publishing rules, client address sets typically include addresses of computers on the Internet.
  • The server publishing rule is applied to client address sets only if IP packet filtering is enabled. If IP packet filtering is not enabled, then the server publishing rule applies to all clients.

Related Topics

Server publishing rules

Create a client address set


Run the Mail Server Security Wizard

To run the Mail Server Security Wizard

  1. In the console tree of ISA Management, right-click Server publishing rules and then click Secure Mail Server.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Publishing
    • Server publishing rules
  2. Follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • For array members, if enterprise policy settings are configured so that publishing is not allowed, then you will not be able to create a server publishing rule.

Related Topics

Mail Server Security Wizard


Turn off a publishing rule

To turn off a publishing rule

  1. In the console tree of ISA Management, click Web Publishing Rules or Server Publishing Rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Publishing
    • Web Publishing Rules or Server Publishing Rules
  2. On the View menu, confirm that Advanced has a check mark next to it.
  3. In the details pane, right-click the applicable rule and then click Disable.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot disable the default Web publishing rule.

Related Topics

Web publishing rules

Server publishing rules


Delete a publishing rule

To delete a publishing rule

  1. In the console tree of ISA Management, click Web Publishing Rules or Server Publishing Rules.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Publishing
    • Web Publishing Rules or Server Publishing Rules
  2. On the View menu, confirm that Advanced has a check mark next to it.
  3. In the details pane, right-click the rule you want to delete and then click Delete.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You cannot delete the default Web publishing rule.

Related Topics

Web publishing rules

Server publishing rules


Configure the cache

  • Configure cache size on a server
  • Configure how ISA Server caches objects
  • Configure the load factor
  • Configure intra-array communication
  • Configure Scheduled Cache Content Download


Configure cache size on a server

To configure cache size on a server

  1. In the console tree of ISA Management, click Drives.

    Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Cache Configuration
    • Drives
  2. In the details pane, right-click the applicable server and then click Properties.
  3. Click the desired drive.
  4. In Maximum cache size (MB), type the size of the cache and click Set.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You must use an NTFS partition for caching and the drive must be a local drive.

Related Topics

Configuring cache drives


Configure how ISA Server caches objects

  • Configure HTTP caching
  • Configure FTP caching
  • Configure active caching
  • Configure which content to cache
  • Configure negative caching
  • Configure whether to return expired objects from the cache
  • Configure percentage of available memory to use for caching


Configure HTTP caching

To configure HTTP caching

  1. In the console tree of ISA Management, right-click Cache Configuration and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Cache Configuration
  2. On the HTTP tab, select the Enable HTTP caching check box.
  3. Click one of the following options:
    • If it is more important to make current information available, click Frequently (expire immediately).
    • To balance between current information and system load, click Normally.
    • If it is more important to less the system load, click Less frequently (Reduced network traffic is more important). This option also sets the time-to-live (TTL) period to a longer duration.
    • To customize the Hypertext Transfer Protocol (HTTP) cache expiration policy, click Set Time To Live (TTL) of object in cache to.
  4. If you chose Set Time To Live (TTL) of object in cache to, then click one of the following options:
    • If objects should expire immediately, click Immediately (time-to-live is zero) if objects should expire immediately.
    • To specify how long the HTTP objects should remain in the cache:
      • Click This percentage of content age (Time since creation or modification), and then type a number in the text box.
      • In No less than and No more than, type the minimum and maximum time that the objects should remain in the cache.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • To reset HTTP expiration policy to equal importance, click Restore defaults.

Related Topics

Configuring expiration policy


Configure FTP caching

To configure FTP caching

  1. In the console tree of ISA Management, right-click Cache Configuration and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Cache Configuration
  2. On the FTP tab, select the Enable FTP caching check box.
  3. In Time to Live for all objects, type the time-to-live (TTL) for all File Transfer Protocol (FTP) objects.
  4. In the list box, select a unit of time: Seconds, Minutes, Hours, Days, or Weeks.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • To reset FTP caching policy to the default settings, click Restore defaults.

Related Topics

Configuring expiration policy


Configure active caching

To configure active caching

  1. In the console tree of ISA Management, right-click Cache Configuration and then click Properties.

    Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Cache Configuration
  2. On the Active Caching tab, select the Enable active caching check box.
  3. Do one of the following:
    • If ISA Server should refresh and revalidate previously-cached objects before they expire, click Frequently.
    • If ISA Server should balance between fast response and network load, click Normally.
    • If you do not want to add to the network load, click Less frequently.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • When active caching is enabled, Microsoft Internet Security and Acceleration (ISA) Server retrieves fresh content from the Internet, according to specified settings. If you are using a dial-up connection to the Internet, then the computer will dial out to the Internet service provider when retrieving this content.

Related Topics

Configuring active caching


Configure which content to cache

To configure which content to cache

  1. In the console tree of ISA Management, right-click Cache Configuration and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Cache Configuration
  2. On the Advanced tab, do one or more of the following:
    • To limit size of cached objects, select the Do not cache objects larger than check box and type the size and select the unit.
    • To cache objects for which a last modification time is not specified, select the Cache objects that have an unspecified last modification time check box.
    • To cache dynamic content, select the Cache dynamic content (objects with question marks in the URL) check box.
    • To limit maximum size of URLs cached in memory, in Maximum size (bytes) or URL cached in memory, type the maximum number of bytes in the text box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • In an Secure Sockets Layer (SSL) bridging scenario, Microsoft Internet Security and Acceleration (ISA) Server caches cachable Web objects. You can use the FPCWebRequestConfiguration COM object to configure whether SSL objects should be cached. For more information, see the Microsoft Internet Security and Acceleration Server Software Development Kit.

Related Topics

Configuring which content to cache


Configure negative caching

To configure negative caching

  1. In the console tree of ISA Management, right-click Cache Configuration and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Cache Configuration
  2. On the Advanced tab, select the Cache objects even if they do not have an HTTP status code of 200 check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring negative caching


Configure whether to return expired objects from the cache

To configure whether to return expired objects from the cache

  1. In the console tree of ISA Management, right-click Cache Configuration and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Cache Configuration
  2. On the Advanced tab, select one of the following:
    • Do not return the expired object. If you select this option, an error page will be returned.
    • To return an expired version of the object from the ISA Server cache, select Return the expired object only if expiration was.
  3. If you selected to return the expired object, specify the time-to-live (TTL) limits for the object.
    • In At less than this percentage of original Time to Live, specify the maximum percentage of the TTL. If the expiration time exceeds this, then the object is not returned.
    • In But no more than, specify the maximum number of minutes that passed since the object expired. If the expiration time exceeds this, then the object is not returned.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring expiration policy


Configure percentage of available memory to use for caching

To configure percentage of available memory to use for caching

  1. In the console tree of ISA Management, right-click Cache Configuration and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Cache Configuration
  2. On the Advanced tab, in Percentage of available memory to use for caching, type a number between 1 and 100 that specifies the maximum percentage of memory that should be allocated for caching.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring cache drives


Configure the load factor

  1. In the console tree of ISA Management, click Computers.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Computers
  2. In the details pane, right-click the applicable computer and then click Properties.
  3. On the Array Membership tab, in Load Factor, type the load factor.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • The load factor determines how to divide the load among members of an array. Changing this value increases or decreases the load on a Microsoft Internet Security and Acceleration (ISA) Server computer.

Related Topics

Configuring Cache Array Routing Protocol


Configure intra-array communication

  1. In the console tree of ISA Management, click Server.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Computers
  2. In the details pane, right-click the applicable server and then click Properties.
  3. On the Array Membership tab, type the intra-array Internet protocol (IP) address in the text box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • In order for CARP to function for incoming Web requests, be sure that the IP address that is used for intra-array communication—by default, an internal IP address—listens for requests on the same port as the IP address configured to listen for incoming Web requests. (The default port is 80.) To do this, configure the array’s incoming Web request properties to use the same listener configuration for all IP addresses. You can also add the IP address used for intra-array communication to the list of incoming Web request listeners.
  • On the Array Membership tab, you can also click Find and select any one of the internal IP addresses that is listed.
  • The intra-array IP address must be an internal address, included in the local address table.

Related Topics

Configuring Cache Array Routing Protocol

Configuring the local address table

Configure intra-array communication

Configure listeners for incoming Web requests


Configure scheduled cache content download

  • Create a scheduled cache content download job
  • Configure a cache content download job schedule
  • Configure a location from which to download cache content
  • Configure time-to-live for downloaded cache content
  • Cache dynamic content for scheduled cache content download jobs


Create a scheduled cache content download job

To create a scheduled cache content download job

  1. In the console tree of ISA Management, right-click Scheduled Content Download Jobs.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Cache configuration
    • Scheduled Content Download Jobs
  2. Point to New and then click Job.
  3. Follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Updating cache content automatically


Configure a cache content download job schedule

To configure a cache content download job schedule

  1. In the console tree of ISA Management, click Scheduled Content Download Jobs.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Cache Configuration
    • Scheduled Content Download Jobs
  2. In the details pane, right-click the applicable scheduled cache content download job and then click Properties.
  3. On the Frequency tab, in Date and Time, select the date and time when the content should be downloaded from the Internet.
  4. In Frequency, do one of the following:
    • To download the content only once at the specified time, click Once.
    • To download the content every day at the specified time, click Daily.
    • To download the content on a specified day at a specified time, click Weekly on and select the check boxes for the days on which to download content.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Updating cache content automatically


Configure a location from which to download cache content

To configure a location from which to download cache content

  1. In the console tree of ISA Management, click Scheduled Content Download Jobs.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Cache Configuration
    • Scheduled Content Download Jobs
  2. In the details pane, right-click the applicable scheduled content download job and then click Properties.
  3. On the Parameters tab, in Begin downloading from URL, type the Uniform Resource Locator (URL) from which to download the content.
  4. To download only content from the domain specified in Begin downloading from URL, click the Keep download process inside URL domain only check box.
  5. To limit the number of links to follow from a single page when downloading content, click the Traverse maximum links depth of check box and type the number of links.
  6. To limit the total number of objects to cache, in Maximum number of cache objects, type the number of objects.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Updating cache content automatically


Configure time-to-live for downloaded cache content

To configure time-to-live for downloaded cache content

  1. In the console tree of ISA Management, click Scheduled Content Download Jobs.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Cache Configuration
    • Scheduled Content Download Jobs
  2. In the details pane, right-click the applicable scheduled content download job, click Properties and click the Parameters tab.
  3. To override the time-to-live (TTL) for an object, click the Always override object's TTL check box.
  4. To override the TTL for an object, if the TTL is not defined, click the Override TTL if not defined check box.
  5. To configure a specific time-to-live (TTL) for the downloaded objects, type a TTL in Mark downloaded objects with a new TTL of Number minutes.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • If you click Always override object's TTL, then the TTL will be determined either by the TTL specified here or by the TTL specified in the cache configuration properties.

Related Topics

Updating cache content automatically


Cache dynamic content for scheduled cache content download jobs

To cache dynamic content for scheduled cache content download jobs

  1. In the console tree of ISA Management, click Scheduled Content Download Jobs.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Cache Configuration
    • Scheduled Content Download Jobs
  2. In the details pane, right-click the applicable scheduled content download job and then click Properties.
  3. On the Parameters tab, select the Cache dynamic content check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Updating cache content automatically


Configure application filters

  • Enable an application filter
  • Configure live stream splitting for a media streaming application filter
  • Configure how the HTTP filter redirects requests
  • Configure a DNS intrusion detection filter
  • Change the SOCKS port
  • Configure an SMTP filter


Enable an application filter

To enable an application filter

  1. In the console tree of ISA Management, click Application filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Extensions
    • Application filters
  2. In the details pane, right-click the applicable application filter and then click Properties.
  3. On the General tab, click the Enable this filter check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Application filters

Configuring protocol definitions


Configure live stream splitting for a media streaming application filter

To configure live stream splitting for a media streaming application filter

  1. In the console tree of ISA Management, click Application filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Extensions
    • Application filters
  2. In the details pane, right-click Streaming media filter and then click Properties.
  3. On the Live Stream Splitting tab, click one of the following options:
    • If the media stream should not be accessible from a local Windows Media Technologies (WMT) server, click Disable WMT live stream splitting.
    • If the media stream should be accessible from a single local WMT server, click Split live streams using a local WMT server.
    • If the media stream can be accessed from one or more local WMT servers, click Split live streams using the following WMT server pool.
  4. If you selected Split live streams using the following WMT Server pool, then click Add and type the Internet protocol (IP) address of the WMT server.
  5. In User Account, type the server administrator user name, then type the account password in Password and Confirm password. The user must be a member of the Netshow Administrators group on each WMT server.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You should only select Split live streams using a local WMT server if a single ISA Server computer allows clients access to WMT servers.

Related Topics

Streaming media filter


Configure how the HTTP filter redirects requests

To configure how the HTTP filter redirects requests

  1. In the console tree of ISA Management, click Application Filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Extensions
    • Application Filters
  2. In the details pane, right-click HTTP redirector filter.
  3. On the Options tab, click one of the following:
    • If the Web Proxy service on this Microsoft Internet Security and Acceleration (ISA) Server computer should handle the request, click Redirect to local Web Proxy service.
    • (Optional) If you chose Redirect to local Web Proxy service, click the If the local service is unavailable, redirect requests to requested Web server check box. In this case, the object will be returned from the requested server.
    • If the request should be forwarded to the Web server specified by the client, click Send to requested Web server.
    • If Hypertext Transfer Protocol (HTTP) requests from Firewall and secure network address translation (SecureNAT) clients should be rejected, click the Reject HTTP requests from Firewall and SecureNAT clients check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • When you click Reject HTTP requests from Firewall and SecureNAT clients, requests from Web Proxy clients are rejected only if a specific ISA Server rule does not allow the request.
  • If you click Send to requested Web server, the requested object is not cached.

Related Topics

HTTP redirector filter


Configure a DNS intrusion detection filter

To configure a DNS intrusion detection filter

  1. In the console tree of ISA Management, click Application filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Extensions
    • Application filters
  2. In the details pane, right-click DNS intrusion detection filter and then click Properties.
  3. On the Attacks tab, select one or more of the following check boxes:
    • DNS hostname overflow
    • DNS length overflow
    • DNS zone transfer from privileged ports (1-1024)
    • DNS zone transfer from high ports (above 1024)

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • Intrusion detection functionality based on technology from Internet Security Systems, Inc., Atlanta, GA, USA, www.iss.net. Portions Copyright © 2000 Internet Security Systems, Inc.

Related Topics

Intrusion detection filters


Change the SOCKS port

To change the SOCKS port

  1. In the console tree of ISA Management, click Application filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Extensions
    • Application filters
  2. In the details pane, right-click SOCKS V4 filter and then click Properties.
  3. On the Options tab, in Port, type the port number on which Microsoft Internet Security and Acceleration (ISA) Server should listen for requests from SOCKS clients. By default, this port is set to 1080.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

SOCKS filter


Configure an SMTP filter

  • Configure SMTP filter buffer overflow thresholds
  • Stop users from gaining access to the SMTP server
  • Stop domains from gaining access to the SMTP server
  • Configure attachments for the SMTP filter
  • Configure keywords for the SMTP filter


Configure SMTP filter buffer overflow thresholds

To configure SMTP filter buffer overflow thresholds

  1. In the console tree of ISA Management, click Application filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Extensions
    • Application filters
  2. In the details pane, right-click SMTP Filter and then click Properties.
  3. On the SMTP Commands tab, double-click the applicable command.
  4. In SMTP Command Rule, select Enable an SMTP command.
  5. In Maximum Length, type the maximum length of the command line for the commands.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • To add a new command, click Add and type the command name in SMTP Command Rule.

Related Topics

SMTP filter


Stop users from gaining access to the SMTP server

To stop users from gaining access to the SMTP server

  1. In the console tree of ISA Management, click Application filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Extensions
    • Application filters
  2. In the details pane, right-click SMTP Filter and then click Properties.
  3. On the Users/Domains tab, in Sender's name, type the name of a user who should be denied access to the Simple Mail Transport Protocol (SMTP) server and then click Add.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

SMTP filter


Stop domains from gaining access to the SMTP server

To stop domains from gaining access to the SMTP server

  1. In the console tree of ISA Management, click Application filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Extensions
    • Application filters
  2. In the details pane, right-click SMTP Filter and then click Properties.
  3. On the Users/Domains tab, in Domain Name, type the name of a domain whose users are denied access to the Simple Mail Transport Protocol (SMTP) server and then click Add.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

SMTP filter


Configure attachments for the SMTP filter

To configure attachments for the SMTP filter

  1. In the console tree of ISA Management, click Application filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Extensions
    • Application filters
  2. In the details pane, right-click SMTP Filter and then click Properties.
  3. On the Attachments tab, click Add.
  4. In Mail Attachment Rule, select the Enable attachment rule check box.
  5. Select one of the following and type the appropriate information:
    • Attachment name, and type the name of the attachment
    • Attachment extension, and type the extension of the attachment
    • Attachment size limit, and type the maximum size of the attachment
  6. In Action, select one of the following:
    • Delete message
    • Hold message
    • Forward messages to
  7. If you selected Forward messages to, type the address to which the message should be forwarded.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • To change the order in which actions should be applied to the condition, click the up or down arrows.
  • You cannot filter for attachments if you did not install the message screener. For more information on installation options, see Installation options.

Related Topics

SMTP filter


Configure keywords for the SMTP filter

To configure keywords for the SMTP filter

  1. In the console tree of ISA Management, click Application filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Extensions
    • Application filters
  2. In the details pane, right-click SMTP Filter and then click Properties.
  3. On the Keywords tab, click Add.
  4. Click Enable keyword rule.
  5. In Keyword, type a string to which the rule applies.
  6. In Apply action if keyword is found in, select one of the following:
    • Message header or body
    • Message header
    • Message body
  7. In Action, select one of the following:
    • Delete message
    • Hold message
    • Forward messages to. Then, type the address to which the message should be forwarded.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • To change the order in which actions should be applied to the condition, click the up or down arrows.
  • You cannot filter for keywords if you did not install the message screener. For more information on installation options, see Installation options.

Related Topics

SMTP filter


Set up and configure H.323 Gatekeeper

This section describes the steps needed to prepare your server for H.323 Gatekeeper.

  • Create a DNS service location resource record
  • Add H.323 Gatekeeper to ISA Server
  • Enable the H.323 protocol rule
  • Control access to the H.323 protocol
  • Create a call routing rule
  • Create a destination
  • Enable fast kernel-mode data pumping


Create a DNS service location resource record

To create a DNS service location resource record

  1. Click Start, point to Programs, point to Administrative Tools, and then click DNS.
  2. In the console tree, double-click the applicable DNS server, and then double-click Forward Lookup Zones.
  3. Right-click the applicable forward lookup zone, and then click Other new records.
  4. In Resource Record Type, click Service Location, and then click Create Record.
  5. In Service, type Q931.
  6. In Protocol, select _tcp.
  7. In Port number, type 1720.
  8. In Host offering this service, type the external fully-qualified domain name of the Microsoft Internet Security and Acceleration (ISA) Server computer and the H.323 Gatekeeper computer.

Notes

  • Port 1720 is the recommended default port setting.
  • Use the default priority and weight settings, unless you require specific load balancing.
  • For more information, see "Managing Records" in the DNS section of Windows 2000 Help.


To add H.323 Gatekeeper to ISA Server

  1. In the console tree of ISA Management, right-click H323 Gatekeepers, and click Add gatekeeper.

    2. Where?

    • Internet Security and Acceleration Server
    • H323 Gatekeepers
  2. In Choose Target Machine, do one of the following:
    • To specify that H.323 Gatekeeper run on the local computer, click This Computer.
    • To specify that H.323 Gatekeeper run on a remote computer, click Another Computer, and then type the fully-qualified domain name (FQDN) of the remote computer.

Note

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Install H.323 Gatekeeper

Configure H.323 Gatekeeper


Enable the H.323 protocol rule

To enable the H.323 protocol rule

  1. In the console tree of ISA Management, click Application Filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Extensions
    • Application Filters
  2. In the details pane, right-click H.323 Filter, then click Properties.
  3. On the General tab, select the Enable this filter check box.
  4. On the Call Control tab, do one or more of the following:
    • To specify an H.323 Gatekeeper, select the Use this Gatekeeper check box and enter the fully-qualified domain name (FQDN) of the H.323 Gatekeeper server.
    • To permit people in other organizations to call people within your organization, select the Allow incoming calls check box.
    • To permit people within your organization to call people in other organizations over the Internet, select the Allow outgoing calls check box.
    • To enable DNS gatekeeper lookup, select the Use DNS gatekeeper lookup and LRQs for alias resolution check box.
    • To permit audio calls, select the Allow audio check box.
    • To permit video calls, select the Allow video check box.
    • To permit T.120 data and application sharing, select the Allow T120 and application sharing check box.

Note

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.


Control access to the H.323 protocol

To control access to the H.323 protocol

  1. In the console tree of ISA Management, right-click Protocol Rules, point to New, then click Rule.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • Protocol Rules
  2. Follow the on-screen instructions until the New Protocol Rule Wizard asks you to select the protocol to which the new rule applies.
  3. In Protocols, in Apply this rule to, click Selected protocols.
  4. In Protocols, select the H.323 Protocol check box.
  5. Complete the rest of the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Protocol Rules


Create a call routing rule

To create a call routing rule

  1. In the console tree of ISA Management, click Call routing.

    2. Where?

    • Internet Security and Acceleration Server
    • H.323 Gatekeepers
    • Gatekeeper
    • Call routing
  2. Do one of the following:
    • To create a phone number rule, right-click Phone number rules, and then click Add routing rule and follow the on-screen instructions.
    • To create an e-mail address rule, right-click Email address rules, and then click Add routing rule and follow the on-screen instructions.
    • To create an Internet protocol (IP) address rule, right-click IP address rules, and then click Add routing rule and follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Call routing rules


Create a destination

To create a destination

  1. In the console tree of ISA Management, right-click Destinations and then click Add destination.

    2. Where?

    • Internet Security and Acceleration Server
    • H.323 Gatekeepers
    • Gatekeeper
    • Call routing
    • Destinations
  2. Follow the on-screen instructions.

Note

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

To add H.323 Gatekeeper to ISA Server


Enable fast kernel-mode data pumping

  1. In the console tree of ISA Management, right-click IP Packet Filters and click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • IP Packet Filters
  2. On the General tab, select the Enable packet filtering and Enable IP routing check boxes.


Configure monitoring and reporting

  • Configure alerting
  • Configure logging
  • Schedule and create reports
  • Monitor ISA Server activity
  • Tune performance


Configure alerting

  • Create an alert
  • Modify an alert condition
  • Configure an alert threshold
  • Modify an alert action
  • Enable an alert


Create an alert

To create an alert

  1. In the console tree of ISA Management, right-click Alerts, point to New and then click Alert.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Alerts
  2. At the New Alert Wizard, follow the on-screen instructions.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring alerts

Modify an alert condition

Configure an alert threshold

Modify an alert action


Modify an alert condition

To modify an alert condition

  1. In the console tree of ISA Management, click Alerts.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Alerts
  2. In the details pane, right-click the applicable alert and then click Properties.
  3. On the Events tab, do the following:
    • In Event, click the event that triggers the alert.
    • If the event needs an additional key, in Additional condition, click the condition.
    • In By server, click the server in the array for which the alert should be triggered.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring alerts


Configure an alert threshold

To configure an alert threshold

  1. In the console tree of ISA Management, click Alerts.

    2. Where?

    • ISA
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Alerts
  2. In the details pane, right-click the applicable alert and then click Properties.
  3. On the Events tab, select the Number of occurrences before the alert is issued check box, and type how many events should occur before the alert is issued.
  4. Select the Number of events per second before the alert is issued check box, and type how many events should occur per second before the alert is issued.
  5. Select one of the following options:
    • If the alert should be reissued immediately if the event recurs, click Immediately.
    • If the alert should be reissued only after the alert is reset, click After manual reset of alert.
    • If the alert should be reissued after a specified amount of time, click If time since last execution is more than Number minutes, and then type the number of minutes that should elapse before the action should be performed.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring alerts


Modify an alert action

To modify an alert action

  1. In the console tree of ISA Management, click Alerts.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Alerts
  2. In the details pane, right-click the applicable alert and then click Properties.
  3. On the Actions tab, modify one or more of the following actions:
    • To send an e-mail when the alert condition occurs, select the Send e-mail check box, and then type the Simple Mail Transport Protocol (SMTP) server, recipient, and sender.
    • To run an application when the alert condition occurs, select the Program check box, and then type the command to run at a command prompt and the account from which to run the program.
    • To log the event, select the Report to Windows 2000 Event Log check box.
    • To stop Microsoft Internet Security and Acceleration (ISA) Server, select the Stop selected services check box, then click Select to select which ISA Server services to stop when the alert condition occurs.
    • To start ISA Server, select the Start selected services check box, then click Select to select which services to start when the alert condition occurs.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You can specify multiple recipients of e-mail messages by typing addresses in the To and Cc fields, separated by semicolons (;).
  • If you configure an e-mail action to use an external SMTP server, you must create a static packet filter that allows the SMTP protocol.
  • If ISA Server runs a program, you can specify which user account should be used. The specified user must have Logon as batch job permissions.
  • In Use this account, you can click Set account to specify a user account to run the program.

Related Topics

Configuring alerts

IP packet filters


Enable an alert

To enable an alert

  1. In the console tree of ISA Management, click Alerts.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Alerts
  2. In the details pane, right-click the appropriate alert and then click Properties.
  3. On the General tab, select the Enable check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring alerts


Configure logging

  • Configure logging to a database
  • Configure logging to a file
  • Compress log files
  • Set maximum number of log files
  • Enable logging for a specific service
  • Specify fields to log
  • Log allowed packets
  • Log blocked packets


Configure logging to a database

To configure logging to a database

  1. In the console tree of ISA Management, click Logs.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Logs
  2. In the details pane, right-click the applicable service and then click Properties.
  3. On the Log tab, click Database.
  4. Confirm or modify the following parameters:
    • ODBC data source (DSN)
    • Table name
    • User account
  5. (Optional) If you need to change the user account, click Set Account, type the user name in User, and type the password in Password and Confirm password.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Logging to a database


Configure logging to a file

To configure logging to a file

  1. In the console tree of ISA Management, click Logs.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Logs
  2. In the details pane, right-click the applicable service and then click Properties.
  3. On the Log tab, click File.
  4. In Format, click the log format.
  5. In Create new file, click a time period that specifies how often a new log file will be created.
  6. (Optional) To modify the location of the log file:
    • Click Options.
    • Do one of the following:
      • To save the file to the default folder, click ISALogs folder.
      • To save the file to another folder, click Other folder and then type a folder name.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Logging to a file


Compress log files

To compress log files

  1. In the console tree of ISA Management, click Logs.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Logs
  2. In the details pane, right-click the applicable service and then click Properties.
  3. On the Log tab, click File.
  4. Click Options.
  5. Select the Compress log files check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring logging


Set maximum number of log files

To set maximum number of log files

  1. In the console tree of ISA Management, click Logs.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Logs
  2. In the details pane, right-click the applicable service and then click Properties.
  3. On the Log tab, click File.
  4. Click Options.
  5. Select the Limit number of log files check box and type the maximum number of log files to keep for the array.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring logging


Enable logging for a specific service

To enable logging for a specific service

  1. In the console tree of ISA Management, click Logs.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Logs
  2. In the details pane, right-click the applicable service and then click Properties.
  3. On the Log tab, select the Enable logging for this service check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.


Specify fields to log

To specify fields to log

  1. In the console tree of ISA Management, click Logs.

    2. Where?

    • Internet Security and Acceleration Server
    • Name
    • Monitoring Configuration
    • Logs
  2. In the details pane, right-click the applicable service and then click Properties.
  3. On the Fields tab, do one of the following:
    • To select specific fields, select the appropriate check box.
    • To clear all the check boxes in the field list, click Clear All.
    • To select all the check boxes in the field list, click Select All.
    • To select a default set of fields in the ISA Server log file, click Restore Defaults.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.


Log allowed packets

To log allowed packets

  1. In the console tree of ISA Management, right-click IP Packet Filters and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • IP Packet Filters
  2. On the Packet Filters tab, select the Log packets from 'Allow' filters check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • You can only log allowed packets if packet filtering is enabled.
  • Logging allowed packets causes additional load on the server.

Related Topics

IP packet filters

Logging packets

Create an IP packet filter

Enable packet filtering


Log blocked packets

To log blocked packets

  1. In the console tree of ISA Management, click IP Packet Filters.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Access Policy
    • IP Packet Filters
  2. On the View menu, confirm that Advanced has a check mark next to it.
  3. In the details pane, right-click the block-mode Internet protocol (IP) packet filter you want to modify and then click Properties.
  4. On the General tab, select the Log any packets matching this filter check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • To disable logging for all packets, disable the packet filter log.

Related Topics

IP packet filters

Logging packets

Create an IP packet filter

Enable logging for a specific service


Schedule and create reports

  • Enable reports
  • Configure location of reports
  • Configure the location of the daily report database
  • Create a report job
  • Enable a report job
  • Configure a report job period
  • Configure a report job schedule
  • Delete a report job schedule
  • Specify user credentials for a report job
  • Enable and configure the log summary
  • View a report
  • Sort report data
  • Save a report
  • Delete a report


Enable reports

To enable reports

  1. In the console tree of ISA Management, right-click Report Jobs and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Report Jobs
  2. On the General tab, select the Enable Reports check box.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring reports


Configure location of reports

To configure location of reports

  1. In the console tree of ISA Management, right-click Report Jobs and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Report Jobs
  2. On the General tab, confirm that the Enable Reports check box is selected.
  3. Do one of the following:
    • To save the reports in the ISAReports subfolder of the ISA Server installation folder, click ISAReports folder.
    • To save the reports in another folder, click Directory, then click Browse and click the folder in which to save the reports.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring reports


Configure the location of the daily summary database

To configure the location of the daily summary database

  1. In the console tree of ISA Management, right-click Report Jobs and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Report Jobs
  2. On the Log Summaries tab, select the Enable Daily and monthly summaries check box.
  3. Do one of the following:
    • To save the reports in the ISA Summaries subfolder on this computer, click ISASummaries folder.
    • To save the reports in another folder, click Directory, then click Browse and click the folder in which to save the reports.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • The ISA Reports directory is located on each server in the array.

Related Topics

Configuring reports


Create a report job

To create a report job

  1. In the console tree of ISA Management, right-click Report Jobs, point to New, and then click Report Job.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Report Jobs
  2. On the General tab, in Name, type the name of the report job.
  3. (Optional) In Description, type a description of the report job.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Scheduling reports

Configure a report job period

Configure a report job schedule

Specify user credentials for a report job


Enable a report job

To enable a report job

  1. In the console tree of ISA Management, click Report Jobs.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Report Jobs
  2. In the details pane, right-click the applicable schedule, then click Enable.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Scheduling reports


Configure a report job period

To configure a report job period

  1. In the console tree of ISA Management, click Report Jobs.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Report Jobs
  2. In the details pane, right-click the applicable report job, then click Properties.
  3. On the Period tab:
    • To generate reports that show the previous day's activity, click Daily.
    • To generate reports that show the previous week's activity, click Weekly.
    • To generate reports that show the previous month's activity, click Monthly.
    • To generate reports that show the previous year's activity, click Yearly.
    • To generate reports that show activity for a specified period, click Custom and then type the desired dates in From and To.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Scheduling reports


Configure a report job schedule

To configure a report job schedule

  1. In the console tree of ISA Management, click Report Jobs.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Report Jobs
  2. In the details pane, right-click the applicable report job, then click Properties.
  3. On the Schedule tab, click one of the following:
    • To generate the report immediately, click Immediately.
    • To generate the report at the specified time, click At, and type a date and time.
  4. In Recurrence pattern, select one of the following:
    • To generate a report once, click Generate once.
    • To generate reports every day, click Generate every day.
    • To generate reports on specific days, click Generate on the following days and select the appropriate check boxes.
    • To generate reports once a month, click Generate once a month and type the day of the month on which to generate the reports.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Scheduling reports


Delete a report job schedule

To delete a report job schedule

  1. In the console tree of ISA Management, click Report Jobs.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Report Jobs
  2. In the details pane, right-click the applicable report job and then click Delete.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Configuring reports


Specify user credentials for a report job

To specify user credentials for a report job

  1. In the console tree of ISA Management, click Report Jobs.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Report Jobs
  2. In the details pane, right-click the applicable report job, then click Properties.
  3. On the Credentials tab, in Username, type the name of a user with permissions to generate the report.
  4. In Domain, type the user's domain.
  5. In Password, type the user's password.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • The user generating the reports must have appropriate permissions to access and use the reporting mechanism on the servers in the array.

Related Topics

Scheduling reports


Enable and configure the log summary

To enable and configure the log summary

  1. In the console tree of ISA Management, right-click Report Jobs and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring Configuration
    • Report Jobs
  2. On the Log Summaries tab, select the Enable daily and monthly summaries check box.
  3. In Number of summaries saved, in Daily summaries, type the number of daily summaries to save.
  4. In Monthly summaries, type the number of monthly summaries to save.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • At least 35 daily summaries must be saved. At least 13 monthly summaries must be saved.

Related Topics

Configuring report log summaries


View a report

To view a report

  1. In the console tree of ISA Management, click the applicable report type: Summary, Web Usage, Application Usage, Traffic & Utilization, or Security.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring
    • Reports
    • Report_Type
  2. In the details pane, right-click the applicable report and then click Open.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • To view the sorted data, close the report and then re-open it.

Related Topics

Viewing predefined reports

Sort report data

Save a report


Sort report data

To sort report data

  1. In the console tree of ISA Management, right-click a report type and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring
    • Reports
    • Report_Type
  2. Click a tab and then, in Sort Order, click the option that should be used to sort the data in the report.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • The report will be sorted the next time you view the report.

Related Topics

Viewing predefined reports


Save a report

To save a report

  1. In the console tree of ISA Management, click the applicable report type.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring
    • Reports
    • Report_Type
  2. In the details pane, right-click the applicable report and then click Save as.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • The report will be saved as a set of HTML files.
  • You can also save the report set as an Excel spreadsheet. To do so, click Servers and Arrays, click the applicable array, click Monitoring, and then click Reports. In the detail pane, right-click the applicable report in the details pane and then click Save as....

Related Topics

Viewing predefined reports


Delete a report

To delete a report

  1. In the console tree of ISA Management, click Reports.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring
    • Reports
  2. In the details pane, right-click the applicable report and then click Delete.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.


Monitor ISA Server activity

  • View performance counters
  • View alerts
  • Reset an alert
  • View sessions
  • Disconnect a client session
  • Start a service


View performance counters

To view performance counters

  • Click Start, point to Programs, point to Microsoft ISA Server, then click ISA Server Performance Monitor.

Notes

  • ISA Server loads the default counters. More counters can be added.


View alerts

To view alerts

  1. In the console tree of ISA Management, click Alerts.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring
    • Alerts

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • The alerts are listed in the details pane.

Related Topics

ISA Server events


Reset an alert

To reset an alert

  1. In the console tree of ISA Management, click Alerts.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring
    • Alerts
  2. If you are in Taskpad view, on the View menu, click Taskpad to turn it off.
  3. In the details pane, right-click the applicable alert and then click Reset.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

ISA Server events


View sessions

To view sessions

  1. In the console tree of ISA Management, click Sessions.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring
    • Sessions

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • The sessions are listed in the details pane.


Disconnect a client session

To disconnect a client session

  1. In the console tree of ISA Management, click Services.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring
    • Sessions
  2. On the View menu, confirm that Advanced has a check mark next to it.
  3. In the details pane, right-click the applicable session and then click Stop.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Real-time monitoring


Start a service

To start a service

  1. In the console tree of ISA Management, click Services.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
    • Monitoring
    • Services
  2. On the View menu, confirm that Advanced has a check mark next to it.
  3. In the details pane, right-click the applicable service and then click Start.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.
  • To start all services, in the console tree, right-click Services and then click Start all services.

Related Topics

ISA Server services


Tune performance

To tune performance

  1. In the console tree of ISA Management, right-click the appropriate array and then click Properties.

    2. Where?

    • Internet Security and Acceleration Server
    • Servers and Arrays
    • Name
  2. On the Performance tab, do one of the following:
    • If you expect fewer than 100 users per day, move the slider to Fewer than 100.
    • If you expect fewer than 1,000 users per day, move the slider to Fewer than 1000.
    • if you expect more than 1,000 users per day, move the slider to More than 1000.

Notes

  • To open ISA Management, click Start, point to Programs, point to Microsoft ISA Server, and then click ISA Management.

Related Topics

Tuning performance


Concepts

This section provides general background information for Microsoft Internet Security and Acceleration (ISA) Server.

  • ISA Server overview
  • Understanding ISA Server
  • Using ISA Server


ISA Server overview

There is an explosion of business activities taking place on the Internet. Vast numbers of corporate networks are now connected to the Internet and the need is greater than ever for a powerful and easy-to-administer Internet gateway that provides a secure connection while also enhancing and improving network performance. Microsoft Internet Security and Acceleration (ISA) Server meets these demands by offering a complete Internet connectivity solution that contains both an enterprise firewall and a complete Web cache solution. These services are complementary—you can use either or both of these functions when you install ISA Server in your network.

ISA Server secures your network, allowing you to implement your business security policy by configuring a broad set of rules that specify which sites, protocols, and content can be passed through the ISA Server computer. ISA Server monitors requests and responses between the Internet and internal client computers, controlling who can access which computers on the corporate network. ISA Server also controls which computers on the Internet can be accessed by internal clients.

This section introduces ISA Server. For information about specific topics, see:

  • Firewall and security overview
  • Publishing overview
  • Cache overview
  • Enterprise management overview
  • Extensibility overview
  • Architecture overview
  • H.323 Gatekeeper overview


Firewall and security overview

Microsoft Internet Security and Acceleration (ISA) Server can be deployed as a dedicated firewall that acts as the secure gateway to the Internet for internal clients. ISA Server protects all communication between internal computers and the Internet. In a simple firewall scenario, the ISA Server computer has two network interface cards, one connected to the local network and one connected to the Internet. The figure illustrates this scenario.

Firewall scenario introduction

You can use Microsoft Internet and Security (ISA) Server to configure the firewall, configuring policies and creating rules to implement your business guidelines. By setting the security access policies, you prevent unauthorized access and malicious content from entering the network. You can also restrict what traffic is allowed for each user and group, application, destination, content type, and schedule. For more information, see Internet security.

ISA Server includes the following firewall and security features:

  • Outgoing access policy. You can use ISA Server to configure site and content rules and protocol rules that control how your internal clients access the Internet. Site and content rules specify which sites and content can be accessed. Protocol rules indicate whether a particular protocol is accessible for inbound and outbound communication. For more information, see Controlling outgoing requests and Access policy rules.
  • Intrusion detection. Integrated intrusion detection mechanisms can alert you when a specific attack is launched against your network. For example, you can configure the ISA Server to alert you if a port scanning attempt is detected. For more information, see Intrusion detection.
  • Security Wizard. The ISA Server Security Wizard enables you to set the appropriate level of system security, depending on how ISA Server functions in your network. For more information, see ISA Server system security.
  • Application filters. ISA Server controls application-specific traffic with data-aware filters. ISA Server uses the filters to determine if packets should be accepted, rejected, redirected, or modified. For more information, see Application filters.
  • Authentication. ISA Server supports the following user authentication methods: Integrated Windows authentication, client certificates, digest, and basic. For more information, see Authentication.


Publishing overview

Microsoft Internet Security and Acceleration (ISA) Server allows you to publish internal servers to the Internet without compromising the security of your internal network. You can configure Web publishing and server publishing rules that determine which requests should be sent to a server on your local network, providing an increased layer of security for your internal servers.

For example, you can place your Microsoft Exchange server behind the ISA Server computer and create server publishing rules that allow the e-mail server to be published to the Internet. Incoming e-mail to the Exchange server is intercepted by the ISA Server computer, which gives the appearance of an e-mail server to clients. ISA Server can filter the traffic and forward it on to the Exchange server. Your Exchange server is never exposed directly to external users and sits in its secure environment, maintaining access to other internal network services.

The figure illustrates how you can use ISA Server in a similar way to securely publish Web servers.

When a client on the Internet requests an object from a Web server, the request is actually sent to an Internet protocol (IP) address on the ISA Server computer. Web publishing rules that are configured on the ISA Server computer forward the request, as applicable, to the internal Web server.

In both these scenarios, the publishing servers require no special configuration. This is because the servers benefit from the ISA Server extensible network address translation (NAT) architecture. For more information, see SecureNAT clients, Controlling incoming requests and Publishing policy rules.


Cache overview

Microsoft Internet Security and Acceleration (ISA) Server implements a cache of frequently-requested objects to improve network performance. You can configure the cache to ensure that it contains the data that is most frequently used by the organization or accessed by your Internet clients. For more information, see Internet acceleration.

ISA Server can be used to allow communication between your local network and the Internet. Communication may be internal clients accessing servers on the Internet—in this case, ISA Server implements forward caching. Communication might be external clients accessing internal, publishing servers—for this case, ISA Server features reverse caching. Both scenarios can benefit from ISA Server's ability to cache information, making it more quickly available to users.

ISA Server caching features include:

  • Distributed caching. When you set up an array of ISA Server computers, you benefit from distributed content caching. ISA Server uses the Cache Array Routing Protocol (CARP) to enable multiple ISA Server computers to be arrayed as a single logical cache. For more information, see Cache Array Routing Protocol.
  • Hierarchical caching. ISA Server further extends distributed caching by allowing you to set up a hierarchy of caches, chaining together arrays of ISA Server computers, so that clients can access objects from the cache geographically nearest them. For more information, see Chaining and routing.
  • Scheduled caching. Use the scheduled cache content download service to configure when the ISA Server should fetch commonly-requested content from the Internet to its cache. For more information, see Scheduled cache content download.
  • Reverse caching. ISA Server can cache content of publishing Web servers, thereby improving their performance and accessibility. All ISA Server caching features are applicable for the content on published servers.

Forward caching

ISA Server can be deployed as a forward caching server that provides internal clients with access to the Internet. ISA Server maintains a centralized cache of frequently requested Internet objects that can be accessed by any web browser client. Objects served from the disk cache require significantly less processing than objects served from the Internet. This improves client browser performance, decreases user response time, and reduces bandwidth consumption on your Internet connection.

The figure illustrates how ISA Server responds when a user requests an object.

How caching works

The figure illustrates how users benefit when ISA Server caches objects. Although the figure focuses on a forward caching scenario (internal clients accessing the Internet), the process is identical for reverse caching, when Internet users access a corporate Web server. The figure illustrates these steps:

  1. The first user (Client 1) requests a Web object.
  2. ISA Server checks if the object is in the cache. Since the object is not in the ISA Server cache, ISA Server requests the object from the server on the Internet.
  3. The server on the Internet returns the object to the ISA Server.
  4. The ISA Server retains a copy of the object in its cache, and returns the object to Client 1.
  5. Client 2 requests the same object.
  6. The ISA Server returns the object from its cache, rather than obtaining it from the Internet.

Reverse caching

ISA Server can be deployed in front of an organization's Web server that is hosting a commercial Web business or providing access to business partners. With incoming Web requests, ISA Server can impersonate a Web server to the outside world, fulfilling client requests for Web content from its cache. ISA Server forwards requests to the Web server only when the requests cannot be served from its cache.


Enterprise management overview

You can set up Microsoft Internet Security and Acceleration (ISA) Server computers as stand-alone servers or group them into arrays. Arrays include one or more ISA Server computers, all of which share the same configuration. ISA Server extends centralized management for arrays to the enterprise level.

The ISA Server enterprise includes all the arrays in your organization. When you set up the enterprise, you specify the enterprise policy management. You can select a centralized enterprise policy that applies to all arrays in the enterprise or a more flexible policy where each array administrator can define a local policy.

You can create array-level access policies and enterprise-level policies. The enterprise policy can be applied to any array and can be augmented by the array's own policy. This enables administrators at branch and departmental levels to adopt governing enterprise policies.

For more information, see The enterprise, arrays, and stand-alone servers.


Extensibility overview

Security policies and implementation vary from organization to organization. Traffic volume and content formats also pose unique concerns. No one product or vendor can meet all of the security and performance needs of a large organization, so Microsoft Internet Security and Acceleration (ISA) Server is highly extensible. ISA Server includes a comprehensive software development kit for custom development, and a large number of independent vendors offer compatible and complementary solutions that extend and integrate with ISA Server. These third-party offerings include content security tools such as virus scanning and lexical analysis, management tools including real-time monitoring and remote administration, site blocking and Uniform Resource Locator (URL) categorization, reporting, and more. The ISA Server Software Developers Kit includes full API documentation, step-by-step directions, and examples of source code for developing extensions and add-in components.

ISA Server uses these extensibility mechanisms:

  • Extensible administration. You can write scripts or management tools using the administration COM object, with programmatic read/write access to all management options.
  • Application filters. You can develop application filters that intercept, analyze, or modify any data stream.
  • Web filters. You can create Web filters, based on Internet Server API (ISAPI), for viewing, analyzing, blocking, redirecting, or modifying Hypertext Transfer Protocol (HTTP) and File Transfer Protocol (FTP) traffic.
  • Extensible user interface. You can extend the ISA Server interface with MMC snap-ins.
  • Extensible alerts. You can define new events and scripts that are automatically launched in response to events.
  • Extensible storage. You can register additional information for storage with ISA Server configuration, which centralizes management of add-in filters and tools.


Architecture overview

Microsoft Internet Security and Acceleration (ISA) Server works at various communication layers to protect the corporate network. At the packet layer, ISA Server implements packet filtering. When packet filtering is enabled, ISA Server can statically control data on the external interface, evaluating inbound traffic before it has the chance to reach any resource. If the data is allowed to pass the packet filtering layer, it is passed to the Firewall and Web Proxy services, where ISA Server rules are processed to determine if the request should be serviced. For more information, see Controlling outgoing requests and Controlling incoming requests.

ISA Server Architecture

As illustrated in the figure, ISA Server protects three types of clients: Firewall clients, SecureNAT clients, and Web Proxy clients. For more information, see Understanding ISA Server clients.

Firewall clients are computers that have Firewall Client software installed and enabled. Requests from firewall clients are directed to the Firewall service on the ISA Server computer to determine if access is allowed. Subsequently, they may be filtered by application filters and other add-ins. If the Firewall client requests an Hypertext Transfer Protocol (HTTP) object, then the HTTP redirector redirects the request to the Web Proxy service. The Web Proxy service may also cache the requested object or serve the object from the ISA Server cache.

Secure network address translation (SecureNAT) clients are computers that do not have Firewall Client installed. Requests from SecureNAT clients are directed first to the network address translation (NAT) driver, which substitutes a global Internet Protocol (IP) address that is valid on the Internet for the internal IP address of the SecureNAT client. The client request is then directed to the Firewall service to determine if access is allowed. Finally, the request may be filtered by application filters and other extensions. If the SecureNAT client requests an HTTP object, then the HTTP redirector redirects the request to the Web Proxy service. The Web Proxy service may also cache the requested object or deliver the object from the ISA Server cache.

Web Proxy clients are any CERN-compatible Web application. Requests from Web Proxy clients are directed to the Web Proxy service on the ISA Server computer to determine if access is allowed. The Web Proxy service may also cache the requested object or serve the object from the ISA Server cache.

Both Firewall client computers and SecureNAT client computers might also be Web Proxy clients. If the Web application on the computer is configured explicitly to use the ISA Server, then all Web requests are sent directly to the Web Proxy service, including HTTP, File Transfer Protocol (FTP), Secure HTTP (HTTPS), and Gopher. All other requests are handled first by the Firewall service.


H.323 Gatekeeper overview

H.323 Gatekeeper works together with the H.323 protocol filter to provide full communications capabilities to H.323-registered clients using applications that are compliant with H.323 Gatekeeper, such as NetMeeting 3.0 or later. You can register the well-known aliases of someone who uses NetMeeting 3.0 or later into the H.323 Gatekeeper registration database to provide registered clients with call routing and directory services. Client registration is typically accomplished using the H.323 Registration, Admission, and Status (H.323 RAS) protocol. You can also use the H.323 protocol filter to create PBX-style dial plans to route calls intelligently, based on the called party's address.

Registered clients can also use H.323 Gatekeeper so that they can be reached by way of their well-known alias to engage in video, audio, and data conferences when using applications that are compliant with H.323 Gatekeeper. H.323 Gatekeeper clients can communicate in local and wide area networks, across multiple firewalls, and over the Internet.

H.323 Gatekeeper service is required for all inbound calls through the ISA Server computer to a well-known alias. Any client who wants to be reachable using a well-known alias—someone@microsoft.com, for example—must register with H.323 Gatekeeper. Clients must register with the H.323 Gatekeeper if translation services are to be used when placing outbound calls. Outbound calls that do not require translation services may be placed without H.323 Gatekeeper.

For example, suppose you are in your company office and want to contact a person over the Internet. He is named Someone, and works at Microsoft. The person is registered at Microsoft with H.323 Gatekeeper as someone@microsoft.com. Because that person is registered with H.323 Gatekeeper, you can contact him using his well-known alias–someone@microsoft.com–even though there is no DNS listing for him on the Internet. If you placed a call to someone@microsoft.com using NetMeeting 3.0, the following steps would take place.

From within your company:

  • You place a call from your office to someone@microsoft.com using NetMeeting 3.0.
  • NetMeeting 3.0 connects with your in-house H.323 Gatekeeper.
  • The H.323 Gatekeeper does not recognize microsoft.com as an internal address and forwards the call to the ISA Server computer within your company.
  • ISA Server looks up the address for microsoft.com and makes the query over the Internet to microsoft.com.

At the destination:

  • When the ISA Server computer at microsoft.com receives the query for someone@microsoft.com, it contacts the internal H.323 Gatekeeper at microsoft.com to obtain the correct in-house address.
  • The H.323 Gatekeeper at microsoft.com translates the alias into a network address for ISA Server.
  • The ISA Server sends a confirmation back to ISA Server at your company and establishes the connection.
  • From this point through the end of the communication, the ISA Server holds open the link established by H.323 Gatekeeper.
  • Someone is not required to have a valid, externally routable IP address, and the address will remain hidden from other endpoints by the ISA Server.

You can set restrictions within the ISA Server H.323 Gatekeeper filter to permit or deny video, audio, T120 data, and application sharing. You can also set time restrictions to limit the hours available for H.323-compliant communications.

For more information, see H.323 Gatekeeper.


Understanding ISA Server

Microsoft Internet Security and Acceleration (ISA) Server integrates firewall and cache features to secure your network and to improve its performance.

As a firewall, ISA Server routes requests and responses between the Internet and client computers after determining if the communication is allowed. As a cache, ISA Server stores frequently-requested Internet sites so that the objects can be quickly accessed by clients directly from the ISA Server computer, rather than from the Internet.

This section introduces ISA Server and describes ISA Server architecture and features. For information about specific topics, see:

  • Internet security
  • Internet acceleration
  • Routing, chaining, and dialing out to the Internet
  • ISA Server rules
  • ISA Server services
  • ISA Server clients
  • Authentication
  • The enterprise, arrays, and stand-alone servers
  • Interoperation with other services
  • Planning considerations


Internet security

In its firewall capacity, Microsoft Internet Security and Acceleration (ISA) Server allows you to prevent unauthorized Internet users from accessing your local network by examining all incoming data and blocking packets that do not meet your specified security criteria.

ISA Server combines several security mechanisms to help you enforce your security policies at all network layers: a flexible rule base for incoming and outgoing requests, intrusions and alerts, application filters, and system security configuration options.

For more information on specific topics, see:

  • Controlling outgoing requests
  • Controlling incoming requests
  • Application filters
  • Intrusion detection
  • ISA Server system security
  • Virtual private networks


Controlling outgoing requests

One of the primary functions of Microsoft Internet Security and Acceleration (ISA) Server is its ability to connect your local network to the Internet while protecting your local network from malicious content. To facilitate this connectivity, you use ISA Server to create an access policy that permits internal clients access to specific Internet hosts. The access policy, together with the routing rules, determines how clients access the Internet.

When ISA Server processes an outgoing request, it checks routing rules, site and content rules, and protocol rules to determine if access is allowed. A request is allowed only if both a protocol rule and a site and content rule each allow the request and if there is no rule that explicitly denies the request.

Some rules can be configured to apply to specific clients. In this case, the clients can be specified either by Internet protocol (IP) address or by user name. ISA Server processes the requests differently, depending on which type of client requests the object and on how you configure ISA Server. For more information, see Rules and authentication.

For an outgoing request, rules are processed in the following order:

  1. Protocol rules
  2. Site and content rules
  3. IP packet filters
  4. Routing rules or Firewall chaining configuration

The figure illustrates the processing flow for an outgoing Web request.

Processing outgoing requests

First, ISA Server checks the protocol rules. ISA Server allows the request only if a protocol rule specifically allows the request and if no protocol rule specifically denies it.

Next, ISA Server checks the site and content rules. ISA Server allows the request only if a site and content rule specifically allows the request and if no site and content rule specifically denies it.

ISA Server then checks if an IP packet filter has been configured to specifically block the request, to determine if the request should be denied.

Finally, ISA Server checks the routing rules (if a Web Proxy client requested the object) or the firewall chaining configuration (if a SecureNAT or firewall client requested the object) to determine how the request should be serviced.

For example, assume that you installed ISA Server in integrated or firewall mode on a computer with two network cards: one connected to the Internet and the other connected to your local network. You have permissive corporate guidelines which allow all users access to all sites. In this case, your policy would consist simply of the following access policy rules:

  • A protocol rule, which allows all internal clients to use any protocol at all times.
  • A site and content rule, which allows everyone access to content on all sites at all times. Note that this rule will allow internal clients access to the Internet, without allowing external clients access to your network.

For more information, see Configuring access policy and Routing Web requests.


Controlling incoming requests

Microsoft Internet Security and Acceleration (ISA) Server can also make internal servers securely accessible to external clients. You use ISA Server to create a publishing policy to securely publish your internal servers. The publishing policy, which consists of Internet protocol (IP) packet filters, Web publishing rules, or server publishing rules, together with the routing rules, determine how internal servers are published.

You can use one of the following ISA Server rules to publish servers:

  • Web publishing rules to publish Web server content.
  • Server publishing rules to publish content on all other servers located on the internal network.
  • IP packet filters to publish content on servers on a perimeter network (also known as a DMZ, demilitarized zone, and screened subnet).

For more information, see Web publishing rules, Server publishing rules, and IP packet filters.

When ISA Server processes a request from an external client, it checks IP packet filters, publishing rules, and routing rules to determine if the request is allowed and which internal server should service the request.

For an incoming Web request, rules are processed in the following order:

  1. IP packet filters
  2. Web publishing rules
  3. Routing rules

The figure illustrates the processing flow for an incoming Web request.

Processing outgoing requests

The scenario assumes that you have installed ISA Server in integrated or firewall mode on a computer with two network cards: one connected to the Internet and the other connected to your local network.

  1. If packet filtering is enabled, then if an IP packet filter specifically denies the request, the request is denied.
  2. If a Web publishing rules specifically denies the request, then the request is denied.
  3. If a routing rule specifies that the requests be routed to a specific upstream server or an alternate hosted site, then the specified server handles the request.
  4. If a routing rule specifies that the requests be routed to the specified server, then the internal Web server returns the object.

For example, consider the following rules:

  • A Web publishing rule redirects requests from all clients for a destination set to a hosted site (Web server) named Msweb. The destination set includes widgets.microsoft.com.
  • A routing rule routes requests for a destination set that includes msweb by servicing them directly. The rule's cache properties specify that responses to requests are never cached.

When an external user from the Internet requests an object from widgets.microsoft.com, ISA Server intercepts the request. First, it processes the Web publishing rule, determining that the request should be redirected to Msweb. Next, it processes the routing rule and determines that the request should be serviced directly by the specified Web server (Msweb).


Application filters

Microsoft Internet Security and Acceleration (ISA) Server application filters provide an extra layer of security at the Firewall service. Application filters can access the datastream or datagrams associated with a session within the Firewall service. Application filters are registered with the Firewall service and work with some or all application-level protocol streams or datagrams. An application filter can perform protocol-specific or system-specific tasks, such as authentication and virus checking.

For information on the following application filters which are installed with ISA Server, see Using extensions.


Intrusion detection

Microsoft Internet Security and Acceleration (ISA) Server features intrusion detection, which identifies when an attack is attempted against your network and performs a set of configured actions, or alerts, in case of an attack. The following ISA Server events are considered intrusions:

  • All ports scan attack
  • IP half scan attack
  • Land attack
  • Ping of death attack
  • UDP bomb attack
  • Windows out of band attack

Intrusion detection functionality based on technology from Internet Security Systems, Inc., Atlanta, GA, USA, www.iss.net. Portions Copyright © 2000 Internet Security Systems, Inc.

For more information, see Configuring intrusion detection.

All ports scan attack

This alert notifies you that an attempt was made to access more than the preconfigured number of ports. You can specify a threshold, indicating the number of ports that can be accessed.

Enumerated port scan attack

This alert notifies you that an attempt was made to count the services running on a computer by probing each port for a response.

If this alert occurs, you should identify the source of the port scan. Compare this with the services that are running on the target computer. Also, identify the source and intent of the scan. Check the access logs for indications of unauthorized access. If you do detect indications of unauthorized access, you should consider the system compromised and take appropriate action.

IP half scan attack

This alert notifies that repeated attempts to a destination computer were made, and no corresponding ACK packets were communicated.

A standard transmission control protocol (TCP) connection is established by sending a SYN packet to the destination computer. If the destination is waiting for a connection on the specified port, it responds with a SYN/ACK packet. The initial sender replies with an ACK packet, and the connection is established. If the destination computer is not waiting for a connection on the specified port, it responds with an RST packet.

Most system logs do not log completed connections until the final ACK packet is received from the source. Sending an RST packet instead of the final ACK results in the connection never actually being established and, therefore, the connection is not logged. Because the source can identify whether the destination sent a SYN/ACK or RST packet, an attacker can determine exactly which ports are open for connections, without the destination being aware of the probing.

If this alert occurs, log the address from which the scan occurs. If appropriate, configure the ISA Server policy rules or Internet Protocol (IP) packet filters to block traffic from the source of the scans.

Land attack

This alert notifies you that a TCP SYN packet was sent with a spoofed source IP address and port number that matches that of the destination IP address and port. If the attack is successfully mounted, it can cause some TCP implementation to go into a loop that crashes the computer.

If this alert occurs, configure the ISA Server policy rules or IP packet filters to inhibit traffic from the source of the scans.

Ping of death attack

This alert notifies you that a large amount of information was appended to an Internet Control Message Protocol (ICMP) echo request (ping) packet. If the attack is successfully mounted, a kernel buffer overflows when the computer attempts to respond, which crashes the computer.

If this alert occurs, create a protocol rule that specifically denies incoming ICMP echo request packets from the Internet.

UDP bomb attack

This alert notifies you that there is an attempt to send an illegal User Datagram Protocol (UDP) packet. A UDP packet that is constructed with illegal values in certain fields will cause some older operating systems to crash when the packet is received. If the target machine does crash, it is often difficult to determine the cause.

Windows out-of-band attack

This alert notifies you that there was an out-of-band denial-of-service attack attempted against a computer protected by ISA Server. If mounted successfully, this attack causes the computer to crash or causes a loss of network connectivity on vulnerable computers.

Intrusion detection functionality is based on technology from Internet Security Systems, Inc., Atlanta, Georgia, United States of America.


ISA Server system security

Microsoft Internet Security and Acceleration (ISA) Server includes the ISA Server Security Configuration Wizard, which you can use to apply the full range of system security settings to all the servers in an array. You can select from one of the following security levels:

  • Secure. This setting is appropriate when the ISA Server computer has other servers installed on it, such as an Internet Information Services (IIS) server, database servers or Simple Mail Transfer Protocol (SMTP) servers.
  • Limited Services. This setting is appropriate when ISA Server is functioning as a combined firewall and cache server. It may be protected by an additional firewall.
  • Dedicated. This setting is appropriate when ISA Server is functioning as a fully-dedicated firewall, with no other interactive applications.

For configuration instructions, see Set system security.

For more information on the security templates, see the technical documentation on the ISA Server Web site.


Virtual private networks

Microsoft Internet Security and Acceleration (ISA) Server helps you set up and secure a virtual private network (VPN). A VPN is an extension of a private network that is made up of links across shared or public networks like the Internet. A VPN enables you to send data between two computers in a manner that emulates the properties of a point-to-point private link.

VPN connections allow users who work at home or on the road to obtain a remote access connection to an organization server using the infrastructure provided by a public internetwork such as the Internet. From the user's perspective, the VPN is a point-to-point connection between the computer, the VPN client, and an organization server (the VPN server). The exact infrastructure of the shared or public network is irrelevant, because it appears as if the data is sent over a dedicated private link.

VPN connections also allow organizations to have routed connections with other organizations over a public internetwork such as the Internet while maintaining secure communications, such as offices that are geographically separate. A routed VPN connection across the Internet logically operates as a dedicated wide area network (WAN) link.

The figure shows a virtual private network.

The Local VPN Wizard runs on ISA Server on the local network. The local ISA VPN computer connects to its Internet Service Provider (ISP). The Remote VPN Wizard runs on the ISA Server on the remote network. The remote ISA VPN computer connects to its ISP. When a computer on the local network communicates with a computer on the remote network, data is encapsulated and sent through the VPN tunnel. The computer uses either Point-to-Point Tunneling Protocol (PPTP) or Layer 2 Tunneling Protocol (L2TP) to manage tunnels and encapsulate private data. Data that is tunneled must also be encrypted to use a VPN connection.

For more information on setting up a VPN, see Using an ISA Server virtual private network. For a scenario that illustrates how a VPN might be used, see Enterprise scenario with VPN and routing.


Internet acceleration

In its function as a cache server, Microsoft Internet Security and Acceleration (ISA) Server improves network performance by maintaining a cache of frequently-requested Web objects.

ISA Server combines sophisticated caching techniques to help you ensure optimal connectivity: distributed caching, chained caching, scheduled content download, and flexible cache configuration.

For more information on specific topics, see:

  • How caching works
  • Cache content files
  • Cache Array Routing Protocol
  • Cache policy and cache filtering
  • Scheduled cache content download
  • Tuning performance


How caching works

The Web Proxy service of Microsoft Internet Security and Acceleration (ISA) Server maintains a cache of Web objects and attempts to fulfill Web requests from the cache. If the request cannot be fulfilled from the cache, the ISA Server computer initiates a new request on behalf of the client. Once the remote Web server responds to the ISA Server computer, the ISA Server computer caches the response to the original client request and sends a response to the client.

ISA Server supports forward caching, used for outgoing requests, and reverse caching, used for incoming requests. Clients in both forward caching and reverse caching benefit from the full gamut of ISA Server caching features. For more information, see Cache overview.

ISA Server includes an Hypertext Transfer Protocol (HTTP) redirector filter, which allows Firewall and secure network address translation (SecureNAT) clients to also benefit from the caching features. When the HTTP redirector is enabled, Web requests from Firewall and SecureNAT clients can also be cached. For more information, see HTTP redirector filter.

If you installed ISA Server in Firewall mode, ISA Server does not maintain a cache. For more information, see ISA Server modes.

ISA Server determines whether to retrieve the object from its cache or from another server by examining cache properties and routing rules that you have configured. The figure illustrates the processing flow for caching objects.

Cache processing flow

ISA Server analyzes routing rules, cache configuration, and existing cache content to determine if an object should be retrieved from the cache.

First, if the user request is allowed, ISA Server checks if the object exists in its cache. If the request is made to an array of ISA Server computers, then the Cache Array Routing Protocol (CARP) algorithm is used to determine which server's cache should be checked. If the object is not in the cache, then ISA Server checks the routing rule's action, to determine how to route the request. If the object is in the cache, then ISA Server performs the following steps:

  1. ISA Server checks if the object is valid. The object is considered invalid if one of the following conditions is true:
    • The time-to-live (TTL) that is specified in the source has expired.
    • The TTL that you configured in a scheduled cache content download job has expired.
    • The TTL that you configured for the object has expired.
    If the object is valid, ISA Server retrieves the object from the cache and returns it to the user.
  2. If the object is invalid, then ISA Server checks the applicable routing rule. If you configured the routing rule cache properties to return any version of the object, then ISA Server retrieves the invalid object from the cache.
  3. If the routing rule is configured to route the request, then ISA Server determines whether to route the request to the upstream server or to the requested Web server.
  4. If the routing rule is configured to route the request to the Web server, then ISA Server checks if the Web server is accessible.
  5. If the Web server is not accessible, then ISA Server checks if you configured the server to return expired objects from the cache. If you instructed the server to return the expired object as long as the specific expiration time did not pass, then the object is returned from the cache to the user.
  6. If the Web server is available, ISA Server determines if the object is cachable and if you configured the routing rule's cache properties to cache the response. If so, then ISA Server caches the object and returns the object to the user.

For more information, see Cache Array Routing Protocol, Updating cache content automatically, Configuring expiration policy, Configure how Web objects are cached, Configure whether to return expired objects from the cache, and Cache policy and cache filtering.


Cache content files

When you configure a drive for caching, Microsoft Internet Security and Acceleration (ISA) Server creates a cache content file on that drive with the .cdat extension.

There is a cache content file for each 10 GB of space on a disk, to the maximum that you dedicated for the cache. For example, if you allocate 12 GBs of disk space on a particular drive, ISA Server creates two cache content files. The first file will be 10 GBs and the second file will be 2 GB.

As objects are cached, ISA Server appends them to the cache content file. If the cache content file is too full to hold a new object, ISA Server removes older objects from the cache, by using a formula that evaluates age, how often the object is accessed, and size.

Warning

  • Do not modify or delete the cache content files.

For more information, see Web Proxy service, How caching works, and Configuring cache drives.


Cache Array Routing Protocol

Microsoft Internet Security and Acceleration (ISA) Server uses the Cache Array Routing Protocol (CARP) to provide seamless scaling and efficiency when using multiple ISA Server computers that are arrayed as a single logical cache. CARP uses hash-based routing to determine the best path through an array to resolve a request. The request resolution path, which is based upon a hash of array member identities and Uniform Resource Locators (URLs), means that, for any given URL request, the browser or downstream proxy server will know exactly where in the array the information will be stored, whether it is already cached from a previous request or finding it on the Internet for delivery and caching for the first time.

CARP provides powerful benefits:

  • Because CARP determines the best request resolution path, there is no query messaging between proxy servers, as is found with conventional Internet Cache Protocol (ICP) networks. By doing this, CARP avoids the heavier query congestion that normally occurs with a greater number of servers.
  • CARP eliminates the duplication of contents that otherwise occurs on an array of proxy servers. With an ICP network, an array of five proxy servers can rapidly evolve into duplicate caches of the most frequently-requested URLs. The hash-based routing of CARP keeps this from happening by allowing all five ISA Server computers to exist as a single logical cache. The result is a faster response to queries and a far more efficient use of server resources.
  • CARP has positive scalability. Due to its hash-based routing and—as a result—its independence from peer-to-peer pinging, CARP becomes faster and more efficient as more proxy servers are added. ICP arrays, which must conduct queries to determine the location of cached information, an inefficient process that generates extraneous network traffic. ICP arrays have negative scalability: the more servers added to the array, the more querying required between servers to determine location.
  • CARP automatically adjusts to additions or deletions of servers in the array. The hash-based routing means that, when a server is either taken offline or added, only minimal reassignment of URL caches is required.
  • CARP ensures that the cache objects are either distributed evenly between all servers in the array or by the load factor that you configure for each server.

How CARP works

The CARP process provides efficient routing for requests.

  1. All servers are tracked through an array membership list, which is maintained in Active Directory. Array members are notified when servers are added or removed from the array.
  2. Periodically, the Web Proxy client or a downstream server polls and, if necessary, updates the array membership list.
    • Web Proxy clients send a array.dll?get.routing.script request to the member server.
    • Downstream servers send a array.dll?get.info.v1 request to the member server.
  3. When requesting an object, the client or downstream server uses the membership list, together with a hash function it computes for the name of each requested URL, to determine which server should service the request.
  4. The hash value of the URL is combined with the hash value for each ISA Server. The URL+ISA Server hash that comes up with the highest value becomes "owner" of the information cache.
  5. The server checks if it should handle the request. If not, then it sends the request to another member server, specifying its intra-array IP address.

The result is a location for all cached information, meaning that the Web browser or downstream server can know exactly where a requested URL is either already stored locally or will be located after caching. Because the hash functions used to assign values are so numerous, the load is statistically distributed and balanced across the array.

The request resolution path that CARP provides means that there is no need to maintain massive location tables for cached information. The browser simply runs the same math function across an object to determine where it is.

Because ISA Server computers in an array may have different hardware and may be more powerful than others, you may want to divide the cache load differently. For this reason, you can configure the CARP functions, specifying the load factor for any given server in the array.

Furthermore, you can configure CARP differently for incoming and outgoing Web requests. For example, CARP can be enabled for all outgoing Web requests, and disabled for all incoming Web requests.

For more information on enabling CARP, and configuring a server's intra-array IP address and load factor, see Configuring Cache Array Routing Protocol.


Cache policy and cache filtering

In addition to the expiration policy and cache size, additional access policy and publishing rules determine the cache behavior.

When you install Microsoft Internet Security and Acceleration (ISA) Server in cache mode, site and content rules add an access policy mechanism and security features to a cache-only scenario. The site and content rules limit which sites and MIME content can be accessed and by whom.

Routing rules determine how requests are routed to the Internet and whether the objects should be returned from the ISA Server cache or from the Internet.

Web publishing rules map requests from Internet clients to the appropriate Web server on the corporate network.

For more information, see ISA Server modes, Site and content rules, Routing Web requests, and Web publishing rules.

Cache filtering

You can use Microsoft Internet Security and Acceleration (ISA) Server to filter which content should be cached. You can use routing rules to configure which content should not be cached. For more information, see Routing Web requests.

For example, you might not want to cache objects from a particular Internet server, called example.microsoft.com. You can configure a routing rule with the following properties:

  • Set the destination sets to a specific destination set that includes example.microsoft.com.
  • Set the request action to the applicable routing method.
  • Configure the cache so that it never caches responses to the request.


Scheduled cache content download

The scheduled cache content download service of Microsoft Internet Security and Acceleration (ISA) Server enables you to schedule content download from the Internet directly to the ISA Server cache. A background process actually downloads the content according to a predefined schedule.

Scheduled cache content download allows you to update the ISA Server cache with Hypertext Transfer Protocol (HTTP) contents that may soon be requested by Web Proxy clients. When used wisely, scheduled cache content download saves valuable network bandwidth and improves the overall cache performance without affecting throughput.

For more information, see Updating cache content automatically.


Tuning performance

You can tune Microsoft Internet Security and Acceleration (ISA) Server performance settings to meet your specific needs. You can adjust the array's performance settings to the number of daily connections you anticipate for your site. ISA Server tunes performance for all of the servers in the array, depending on your settings. For configuration instructions, see Tune performance.

You can also use the performance counters provided with ISA Server to monitor performance. For more information, see Performance counters.


Routing, chaining, and dialing out to the Internet

You can configure Microsoft Internet Security and Acceleration (ISA) Server to route outgoing client requests to the Internet. If the request is routed to a destination on the Internet, you can also configure ISA Server to establish a dial-up connection. You can configure this to take place on all occurences or only when the primary connection is unavailable.

For information on specific topics, see:

  • Chaining and routing
  • Dial-on-demand


Chaining and routing

With the Microsoft Internet Security and Acceleration (ISA) Server cache, content caching is distributed among an array of ISA Server computers. By distributing the load of cached objects, ISA Server enhances caching performance and provides fault tolerance in case an ISA Server computer becomes unavailable.

ISA Server also supports chained (or hierarchical) caching. The term chaining refers to a hierarchical connection between individual ISA Server computers or arrays of ISA Server computers. Requests from clients are sent upstream through the chain until the requested object is found. ISA Server computers can be chained as either individual computers or as arrays. Chaining is also an effective means of distributing server load and fault tolerance.

You can arrange ISA Server computers in a hierarchy for branch office or departmental use. Requests from clients are sent upstream through the hierarchy until the requested object is found. When the object is located on an upstream server, it is cached at every server's cache, until it is returned to the client. The figure illustrates how chaining works.

The figure illustrates a client at a branch office who requests an Internet object. The request is sent to the branch office ISA Server computer, then on to the regional or corporate headquarters before sending the request to the Internet. After retrieving the object from the Internet, the ISA Server at the main office caches the requested object and returns it to the ISA Server at the branch office. At the branch office, the ISA Server caches the object and then returns it to the client.

Hierarchical caching is useful in this scenario, because objects are initially routed through the main office to the Internet, while subsequent requests for the same object are serviced directly from the branch office ISA Server arrays.

Chained caching is significant because it enables caching to take place closer to users. For example, within an enterprise, caching can move beyond a single, central location at the edge of an organization's network and toward the branch office and workgroup levels. With an Internet Service Provider (ISP), caching can move toward a regional ISP point of presence as opposed to one central ISP point of presence. Because of this, requests can be fulfilled more quickly.

Web Proxy routing

Web Proxy routing rules take the concept of chaining one step further, by allowing you to conditionally route requests, depending on the destination. For example, an organization with a branch office in the United Kingdom might set up an ISA Server computer at the branch office. The branch office array might be connected to an ISP in the United Kingdom. A routing rule on the ISA Server computer at the branch office could direct requests for Internet hosts in the United Kingdom to the local ISP, with all other requests directed to the ISA Server array at the headquarters.

In this way, the downstream ISA Server computer at the branch office in the United Kingdom benefits from the ISA Server cache at headquarters. That benefit is augmented by additional caching of more local objects—retrieved from the local ISP—on the ISA Server in the branch office.

The figure illustrates how Web Proxy requests can be routed to different servers, depending on the requested destination.

Here, the ISA Server computer in the branch office routes client requests for all domestic sites to the Internet. Client requests for all other sites are routed to the upstream ISA Server computer at headquarters.

For more information, see Routing Web requests and Chained authentication.


Dialing out to the Internet

Depending on how you configure routing and chaining, Microsoft Internet Security and Acceleration (ISA) Server uses a dial-up entry to dial out to the Internet.

ISA Server can be configured to dial out for the following:

  • Firewall chaining. If you configure Firewall chaining to use a primary route then, if the access policy allows the client request, ISA Server dials out to the Internet, using the active dial-up entry. For more information on routing rules, see Routing requests from Firewall and secure network address translation (SecureNAT) clients.
  • Routing rules. If the client requests an object, and the route for the client request requires establishing a dial-up connection, then if access policy allows the client request, ISA Server dials out to the Internet, using the active dial-up entry. For more information on routing rules, see Routing Web requests.
  • Active caching. If active caching is enabled, ISA Server dials out to the Internet, to retrieve the frequently-accessed files. For more information, see Configuring active caching.

In addition, ISA Server dials out to the Internet if a client requests an object and ISA Server cannot definitively determine whether the access policy allows the request, such as if some routing rule that applies to the request indicates that a dial-up connection should be established. For example, this happens when the access policy rules specify a destination by name, while the client specifies the computer by Internet Protocol (IP) address.

In this case, ISA Server checks if a routing rule which applies to the client request, requires establishing a dial-up connection. If such a routing rule exists, then ISA Server dials out to the Internet, either to resolve the name of the computer requested by the client or to do a reverse lookup. Then, ISA Server again checks the access policy rules to determine if the request is allowed. For more information on how rules are processed, see Controlling outgoing requests.

Limiting when ISA Server dials out

You can limit when ISA Server dials out to the Internet by performing one or more of the following:

  • Configure the local domain table (LDT) so that it includes the names of all internal computers. In this way, ISA Server will not have to dial out to an external DNS server, only to determine that the requested computer is actually internal. Note that the LDT is checked only for requests from Firewall clients. For more information on the LDT, see Configuring the local domain table.
  • To limit dial-out access for Web requests, create a site and content rule that denies all access to the Internet, in a given time frame. For more information, see Site and content rules.
  • To limit dial-out access for all requests, create a protocol rule that denies all protocols, in a given time frame. For more information, see Protocol rules.

Closing dial-up connections

After ISA Server dials out to the Internet, the connection is maintained until one of the following occurs:

  • The dial-up connection is the backup route and the primary route becomes available. Then, the connection is closed.
  • Another dial-up entry is made active.
  • The active dial-up entry is modified so that it specifies a different network dial-up connection.
  • The dial-up entry for Firewall chaining is disabled.


ISA Server rules

You can configure Microsoft Internet Security and Acceleration (ISA) Server to meet your specific security and performance needs by defining and configuring rules that determine whether users, computers, or applications are granted access to computers in your network and on the Internet. ISA Server allows you to define several types of rules: access policy rules, bandwidth rules, publishing policy rules, and routing and chaining.

When an internal client requests an Internet object, ISA Server processes the rules to determine if the request is allowed.

Similarly, when an external (Internet) client requests an object from an internal server, ISA Server processes the rules to determine if the request is allowed.

For information on specific topics, see:

  • Packet filtering
  • Access policy rules
  • Bandwidth rules
  • Publishing policy rules
For more general information, see Controlling outgoing requests and Controlling incoming requests.


Packet filtering

The packet filtering feature of Microsoft Internet Security and Acceleration (ISA) Server allows you to control the flow of Internet protocol (IP) packets to and from ISA Server. When you enable packet filtering, all packets on the external interface are dropped unless they are explicitly allowed, either statically by IP packet filters or dynamically by access policy or publishing rules.

Even if you do not enable packet filtering, communication between your local network and the Internet is allowed only when you explicitly configure rules that permit access.

In most cases, it is preferable to open ports dynamically. Therefore, it is usually recommended that you create access policy rules to allow internal clients access to the Internet or publishing rules to allow external clients access to internal servers. This is because IP packet filters open the ports statically, but the access policy and publishing rules open the ports dynamically (as a request arrives). For example, suppose you want to grant all internal users access to Hypertext Transfer Protocol (HTTP) sites. You should not create an IP packet filter that opens port 80. Rather, you should create the necessary site and content rule and protocol rule that allow this access. For more information on access policy, see Configuring access policy and IP packet filters.

In some scenarios, you must use IP packet filters. Configure IP packet filters if:

  • You publish servers that are located on a perimeter network (also known as a DMZ, demilitarized zone, and screened subnet).
  • You run applications or other services on the ISA Server computer that need to listen to the Internet.
  • You want to allow access to protocols that are not based on User Datagram Protocol (UDP) or Transmission Control Protocol (TCP), which are IP protocols.

You can only configure IP packet filters if you install ISA Server in firewall mode or integrated mode.

For more information on packet filtering, see Using packet filtering.


Access policy rules

You can use Microsoft Internet Security and Acceleration (ISA) Server to configure an access policy, which consists of protocol rules and site and content rules.

Protocol rules define which protocols can be used for communication between the local network and the Internet. Protocol rules are processed at the application level. For example, a protocol rule might allow clients to use the HTTP protocol. For more information, see Protocol rules.

Site and content rules define what content on which Internet sites can be accessed by clients behind the ISA Server computer. Site and content rules are processed at the application level. For example, a site and content rule might allow clients to access any destination on the Internet. For more information, see Site and content rules.

When you install ISA Server, you specify the installation mode: firewall, cache, or integrated. The following table lists which access policy rule types are available for each mode.

Rule type | Firewall | Cache | Integrated
Site and content rules | Yes | Yes | Yes
Protocol rules | Yes | Yes, for HTTP, File Transfer Protocol (FTP), and Secure HTTP (HTTPS) | Yes


Bandwidth rules

Bandwidth rules determine what connection gets priority over another. Microsoft Internet Security and Acceleration (ISA) Server bandwidth control does not limit how much bandwidth can be used. Rather, it informs the Windows 2000 quality of service (QoS) packet scheduling service how to prioritize network connections. Any connection that does not have an associated bandwidth rule will get a default scheduling priority. On the other hand, any connection with an associated bandwidth rule will be scheduled ahead of default scheduled connections.

When you install ISA Server, you specify the installation mode: firewall, cache, or integrated. Bandwidth rules are available in all installation modes.

For more information, see Configuring bandwidth rules.


Publishing policy rules

You can use Microsoft Internet Security and Acceleration (ISA) Server to configure a publishing policy, which consists of server publishing rules and Web publishing rules.

Server publishing rules filter all incoming requests. Server publishing rules map incoming requests to the appropriate servers behind the ISA Server computer.

Web publishing rules map incoming requests to the appropriate Web servers behind the ISA Server computer.

When you install ISA Server, you specify the installation mode: firewall, cache, or integrated. The following table lists which publishing policy rule types are available for each mode.

Rule type | Firewall | Cache | Integrated
Web publishing rules | No | Yes | Yes
Server publishing rules | Yes | No | Yes

For more information, see Web publishing rules and Server publishing rules.


ISA Server services

ISA Server includes the following services, which are detailed in the following topics:

  • ISA Server control service
  • Firewall service
  • Web Proxy service
  • Scheduled cache content download service
  • H.323 Gatekeeper service
  • Service permissions
  • Restarting services after configuration changes


ISA Server control service

The Microsoft Internet Security and Acceleration (ISA) Server control service (mspadmin) is a Windows 2000 service that is responsible for:

  • Restarting other ISA Server services, as necessary.
  • Generating alerts and running actions.
  • Synchronizing each member server's configuration with the array.
  • Updating the client configuration files (msplat.txt and mspclnt.ini).
  • Deleting unused log files.

You cannot use ISA Management to stop or start the ISA Server control service. To stop the service, type the following at a command prompt:

net stop mspadmin

If you stop the ISA Server control service, all the other ISA Server services will also be stopped.


Firewall service

Microsoft Internet Security and Acceleration (ISA) Firewall service (fwsrv) is a Windows 2000 service that supports requests from firewall and Secure network address translation (SecureNAT) clients.

You can use ISA Management to monitor Firewall service status. Similarly, you can use ISA Management to stop or start the Firewall service. The Firewall service is installed and enabled when you install ISA Server in firewall or integrated mode.

For more information, see SecureNAT clients, Firewall clients, Real-time monitoring, Start a service, and ISA Server modes.

How the Firewall service works

The Firewall service works with Telnet, mail, news, Microsoft Windows Media, RealAudio, Internet Relay Chat (IRC), or other client applications that are compatible with Windows Sockets (Winsock). The Firewall service makes these applications perform as if they were directly connected to the Internet. The client application makes Winsock API calls to communicate with an application running on an Internet-based host. The Firewall service redirects the necessary functions to the ISA Server computer, thus establishing a communication path from the internal application to the Internet application through the ISA Server computer. This eliminates the need for a specific gateway for each protocol, such as in Network News Transfer Protocol (NNTP), Simple Mail Transfer Protocol (SMTP), Telnet, or File Transfer Protocol (FTP).

The Firewall service allows applications with no built-in support for a proxy to benefit from the service without using the protocols. The Firewall service offers client and server support for most standard and custom Internet applications that communicate using Winsock. Almost all Winsock 1.1 TCP/IP applications can be redirected.

Winsock

Sockets are a common set of APIs that provide an abstraction model and a framework for network application writers. The basic sockets API allows a program to open an outbound communication channel for a client, then accept an inbound response from a server. Essentially, sockets allow data to be sent and received and then close the channels upon completion.

Winsock is the Microsoft implementation of sockets.

Applications and ports

Winsock establishes communications by using an address and a port. The address is a typical Transmission Control Protocol/Internet Protocol (TCP/IP) 32-bit number that uniquely identifies a host system to a client on the network.

The port number is a secondary address specifier that is used internally for TCP/IP to route application traffic. For example, port 21 is a well-known port of the File Transfer Protocol (FTP) service. Therefore, packets sent to port 21 on a host computer are typically sent to the FTP service.

Control channel

When Firewall Client software is installed on the computer, it installs two .dll files. They intercept Winsock API calls from applications on the client and forward them to the ISA Server computer, using a control channel.

The control channel manages remote Winsock messages and is designed to do the following:

  • Deliver the local address table (LAT) to the client. The LAT determines whether a destination is on the local network. For more information, see Configuring the local address table.
  • Establish TCP connections from the client to the ISA Server computer. This channel is used to build the virtual connection while attempting to connect with a remote application.
  • Furnish User Datagram Protocol (UDP) communications to and from the Firewall client and with the ISA Server computer.

The Firewall Client .dll is initialized when the first Winsock connection is attempted. Then, a control channel with the Firewall service is established and then designated as active through the channel. Finally, the local address table is copied from the server to determine which networks are on the Internet and which are local.


Web Proxy service

The Web Proxy service (w3proxy) is a Windows 2000 service that supports requests from any Web browser. This allows Web access to nearly every desktop operating system, including Windows NT, Microsoft Windows 95, Windows 98, Windows 2000, Macintosh, and UNIX. The Web Proxy service works at the application level on behalf of a client requesting an Internet object that can be retrieved using one of the protocols supported by the Web Proxy protocols: File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), and Gopher. The Web Proxy service also supports the Secure HTTP (HTTPS) protocol for secure sessions using Secure Sockets Layer (SSL) connections.

Web Proxy clients—typically, browsers—must be specifically configured to use the Microsoft Internet Security and Acceleration (ISA) Server computer. When a user requests a Web site, the browser parses the URL. If a dot address is used, as in a fully-qualified domain name or Internet protocol (IP) address, the browser considers the destination to be remote and sends the HTTP request to the ISA Server computer for processing. For more information, see Configuring Web Proxy clients.

You can use ISA Management to monitor Web Proxy service status. Similarly, you can use ISA Management to stop or start the Web Proxy service. For more information, see Real-time monitoring and Start a service.

When you stop the Web Proxy service, the information in the cache is not deleted. However, when you restart the Web Proxy service, several seconds may pass before the cache is fully enabled and functional. If the Web Proxy service crashed, then ISA Server will restore the information in the cache. This will take some time, and performance may not be optimal until the cache is eventually restored.


Scheduled cache content download service

The scheduled cache content download service (w3prefch) is a Windows 2000 service that downloads cache content from Web servers, according to the jobs you configure using ISA Management. For more information, see Updating cache content automatically.

The scheduled cache content download service is installed and enabled when you install Microsoft Internet Security and Acceleration (ISA) Server in cache or integrated mode. For more information on modes, see ISA Server modes.

You can use ISA Management to monitor scheduled cache content download service status. For more information, see Real-time monitoring. Similarly, you can use ISA Management to stop or start the scheduled cache content download service. For more information, see Start a service.


H.323 Gatekeeper service

H.323 Gatekeeper works together with the H.323 protocol filter to support full communications capabilities when using applications that are compliant with H.323 Gatekeeper such as NetMeeting 3.0 or higher. H.323 Gatekeeper provides directory and call-routing services to registered H.323 clients. You can use H.323 Gatekeeper to register clients in a registration database, allowing clients to use well-known aliases while using connections compliant with the H.323 standard, including NetMeeting 3.0 or higher. All inbound calls to a registered H.323 client's well-known alias require the H.323 Gatekeeper service. Outbound calls that need translation services require H.323 Gatekeeper.

People can reach H.323 clients in a local area network using their well-known alias with H.323 Gatekeeper, even from across multiple firewalls and routers.

You can use the H.323 protocol filter to regulate how H.323 Gatekeeper calls are made. Using the H.323 protocol filter, you can create PBX-style dial plans to intelligently route calls based on the called party's address

Installing H.323 Gatekeeper

If you choose Full Installation when installing Microsoft Internet Security and Acceleration (ISA) Server, H.323 Gatekeeper is automatically installed. If you choose Custom Installation, you must select the Proxy Service Add-in Services check box and the Administration Tools check box to be able to administer H.323 Gatekeeper. You will need to highlight Administration Tools and select the Change Option. Be certain to select the Administration Tools check box and the H.323 Gatekeeper Administration Tool check box.

For information regarding installing H.323 Gatekeeper after ISA Server is installed, see Install H.323 Gatekeeper.

Monitoring H.323 Gatekeeper

You can use ISA Management to monitor H.323 Gatekeeper service status. Similarly, you can use ISA Management to stop or start the H.323 Gatekeeper service. For more information, see Real-time monitoring and Start a service.


Service permissions

Microsoft Internet Security and Acceleration (ISA) Server is designed to run its services only in the context of the Local System user account. If a service is compromised, this limits the threat to the computer running the service.

The table below lists the privileges and user rights required by each of the ISA Server services.

Service | Resource or user right | Minimum resource permission required by service | Used for
All Services | HKLM\Software\Microsoft\Fpc | Read (this key, and all descendants) | Reading product settings
 | CN=Fpc,CN=Services,CN=Configuration,DC=... | Read (this key, and all descendant objects) | Reading product enterprise settings
 | CN=Fpc,CN=System,DC=... | Read (this key, and all descendant objects) | Reading product domain settings
 | %programdir%\ISALogs | Write (this directory, subdirectories and files) | Writing log files
 | Log on as a batch job privilege | N/A | Executing as a service
 | Manage auditing and security log privilege | N/A | Creating and using cryptography objects
Control | %programdir% | Write (this directory, subdirectories and files) | Writing settings, log summaries
 | Restore files and directories privilege | N/A | Backup and restore
 | Generate security audits privilege | N/A | Writing events to the security logs
 | X:\urlcache, where X is any drive that hosts the ISA Server cache | Read, List files, Delete (this directory, subdirectories and files) | Resetting the cache storage
Firewall | Generate security audits privilege | N/A | Writing events to the security logs
Web Proxy | X:\urlcache, where X is any drive that hosts the ISA Server cache | Full Control (this directory, subdirectories and files) | Reading and writing the cache storage
 | Generate security audits privilege | N/A | Writing events to the security logs
Scheduled cache content download | HKLM\CurrentControlSet\Services\W3Proxy\Parameters | Read | Reading settings
Gatekeeper |  |  |


Restarting services after configuration changes

Some changes to the Microsoft Internet Security and Acceleration (ISA) Server configuration require that it restart one or more of the ISA Server services on all the servers in the array. In the case of such a configuration change, ISA Management displays a message that informs you that the service will be restarted.

The table below lists the configuration changes for which services are restarted.

Configuration change | Service restarted
Enabling or disabling an application filter | Firewall service
Reducing or increasing cache size, and adding or removing a disk from the cache | Web Proxy service
Changes to the local address table that affect a network adapter's internal or external state | Firewall service, Web Proxy service
Enabling or disabling packet filtering | Firewall service, Web Proxy service
Changing Internet Protocol (IP) address of a network adapter | Firewall service, Web Proxy service
Routing table changes | Firewall service
Enabling, disabling, or changing order of Web filter | Web Proxy service
Changing any incoming Web request or outgoing Web request property (including changes to listener properties, connection properties, enabling CARP, changing port numbers) | Web Proxy service
Changing port number and enabling or disabling CARP | Web Proxy service, Scheduled content download service
Updating Secure Socket Layer (SSL) certificate | Web Proxy service
Adding or removing a server to or from the array | Web Proxy service
Changing H.323 Gatekeeper network interface | H.323 Gatekeeper service


ISA Server clients

This section introduces key concepts and terminology about ISA Server clients. For information about specific topics, see:

  • About ISA Server clients
  • SecureNAT clients
  • Firewall clients
  • Web Proxy clients


About ISA Server clients

Microsoft Internet Security and Acceleration (ISA) Server supports three types of clients:

  • Firewall clients are client computers that have Firewall Client installed and enabled.
  • Secure network address translation (SecureNAT) clients are client computers that do not have Firewall Client installed.
  • Web Proxy clients are any client Web application configured to use ISA Server.

For more information, see Firewall clients, Secure network address translation clients, and Web Proxy clients.

The table below compares the ISA Server clients.

Feature | SecureNAT client | Firewall client | Web Proxy client
Installation required | Some network configuration changes are required | Yes | No, requires Web browser configuration
Operating system support | Any operating system that supports Transmission Control Protocol/Internet Protocol (TCP/IP) | Only Windows platforms | All platforms, but by way of Web application
Protocol support | Requires application filters for multi-connection protocols | All Winsock applications | Hypertext Transfer Protocol (HTTP), Secure HTTP (HTTPS), File Transfer Protocol (FTP), and Gopher
User-level authentication | Some network configuration changes are required | Yes | Yes
Server applications | No configuration or installation required | Requires configuration file | N/A

Both Firewall client computers and SecureNAT client computers may also be Web Proxy clients. If the Web application on the computer is configured explicitly to use the ISA Server, then all Web requests (HTTP, FTP, HTTPS, and Gopher) are sent directly to the Web Proxy service. All other requests are handled first by the Firewall service.


SecureNAT clients

Client computers that do not have Firewall client software are secure network address translation (SecureNAT) clients. SecureNAT clients can benefit from many of the features of Microsoft Internet Security and Acceleration (ISA) Server. This includes most access control features, with the exception of high-level protocol support and user-level authentication.

Although SecureNAT clients do not require special software, you should configure the default gateway so that all traffic destined to the Internet is sent by way of ISA Server, either directly or indirectly, through a router. You can configure clients either by using the DHCP service or manually.

Since requests from SecureNAT clients are essentially handled by the Firewall service, SecureNAT clients benefit from the following security features:

  • Application filters can modify the protocol stream to allow handling of complex protocols. In Windows 2000 NAT, this mechanism is accomplished through the use of NAT editors which are written as kernel-mode NAT editor drivers in Windows 2000.
  • The Firewall service can pass all Hypertext Transfer Protocol (HTTP) requests to the Web Proxy service, which handles caching and ensures that site and content rules are applied appropriately.

SecureNAT and Windows 2000 NAT

ISA Server extends the Windows 2000 network address translation (NAT) functionality by enforcing ISA Server policy for SecureNAT clients. In other words, all ISA Server rules can be applied to SecureNAT clients, despite the fact that Windows 2000 NAT does not have an inherent authentication mechanism. (Policies regarding protocol usage, destination, and content type are also applied to SecureNAT clients.)

SecureNAT clients and server publishing

As with Firewall clients, SecureNAT clients can also actually be servers, such as mail servers, which publish information to the Internet. You configure server publishing rules in order to publish servers as SecureNAT clients. For more information, see Server publishing rules.

SecureNAT clients are not supported in cache mode. For more information, see ISA Server modes.


Firewall clients

A Firewall client is a computer with Firewall Client software installed and enabled. The Firewall client runs Winsock applications that use the Firewall service of Microsoft Internet Security and Acceleration (ISA) Server. When a Firewall client uses a Winsock application to request an object from a computer, the client checks its copy of the local address table (LAT) to see if the specified computer is in the LAT. If the computer is not in the LAT, then the request is sent to the ISA Server Firewall service. The Firewall service handles the request, forwarding it to the appropriate destination, as permitted. The Firewall Client software can send Windows user information, which is required for authentication purposes, to the ISA Server. For more information, see Firewall client components.

Setting up a Firewall client does not configure individual Winsock applications. Instead, it uses the same Winsock dynamic link library (.dll) that the other applications use. The Firewall client then intercepts the application calls and decides whether to route the request to the ISA Server computer. For more information, see Install Firewall Client software.

You can install Firewall Client software on client computers that run Windows ME, Windows 95, Windows 98, Windows NT 4.0, or Windows 2000. 16-bit Winsock applications are supported, but only on Windows 2000 and Windows NT 4.0.

Firewall clients are not supported in cache mode. For more information, see ISA Server modes.


Web Proxy clients

A Web Proxy client is a client computer that has a Web browser application, which complies with Hypertext Transfer Protocol (HTTP) 1.1 and which is configured to use the Web Proxy service of Microsoft Internet Security and Acceleration (ISA) Server. Each Web browser is configured through its own user interface.

When you install Firewall Client software, the Web browser settings on the Firewall Client desktop can be configured automatically. Subsequently, you can reconfigure the Web browser clients. You can use ISA Management to configure the following Web browser properties:

  • The ISA Server and port to which the client should connect.
  • Automatic discovery settings.
  • The computers that the Firewall client's Web browser should access directly.
  • Backup route, if the ISA Server is unavailable.

When the Firewall client software is installed, the Web browser on the client computer is configured with those settings.

If Firewall client is not installed, then the Web browser can be configured manually.

For more information, see Enable Web browser configuration during client setup, Automatic discovery, Configure a server for direct access, Configure a backup route for Web requests, and Configure Microsoft Internet Explorer 5 to use the Web Proxy service.


Authentication

This section introduces the key concepts about authentication and how Microsoft Internet Security and Acceleration (ISA) Server authenticates user requests. For information about specific topics, see:

  • Authentication methods
  • Rules and authentication
  • Pass-through authentication
  • Chained authentication
  • SSL tunneling
  • SSL bridging


Authentication methods

The access policy and publishing rules of Microsoft Internet Security and Acceleration (ISA) Server can be configured to allow or deny a set of computers (client address sets) or a group of users from accessing specific servers. If the rule applies specifically to users, then the ISA Server checks the Web request properties for listeners on the array to determine how the user should be authenticated.

You can configure incoming and outgoing Web request settings so that users must always be authenticated by ISA Server before processing rules. This ensures that requests are allowed only if the user making the request is authenticated. For more information, see Require authentication for all Web requests.

You can also configure which authentication method to use. You can configure different authentication methods for incoming Web requests and for outgoing Web requests.

ISA Server supports the following authentication methods:

  • Basic authentication
  • Digest authentication
  • Integrated Windows authentication
  • Client certificates and server certificates

Caution

  • Microsoft Internet Explorer 5 supports all the authentication methods. Other Web browsers may support only the Basic authentication method. Be sure that the client Web browsers can use at least one of the authentication methods that you specify in an array's incoming Web request and outgoing Web request properties. Otherwise, the client will not be able to access the requested object.


Basic authentication

The standard Hypertext Transfer Protocol (HTTP) method of authentication is basic authentication. Basic authentication sends and receives user information as text characters that can be easily read. While passwords and user names are encoded, no encryption is used with basic authentication. The following describes the authentication procedure for basic authentication:

  1. The client prompts the user for user name and password credentials.
  2. The credentials are then encoded by the client and sent to the server.
  3. The user name is verified as being an account on the Microsoft Internet Security and Acceleration (ISA) Server computer or in a trusted domain of the ISA Server.

For configuration instructions, see Configure authentication methods for Web requests.


Digest authentication

Digest authentication offers the same features as basic authentication but involves a different way of transmitting the authentication credentials. The authentication credentials pass through a one-way process, often referred to as hashing. The result of this process is called a hash or message digest, and it is not feasible to decrypt it—the original text cannot be deciphered from the hash.

Additional information is added to the password before hashing so that no one can capture the password hash and use it to impersonate the true user. Values are added that help to identify the user, the user's computer, and the domain that the user belongs to. A time stamp is added to prevent a user from using a password after it has been revoked. This is a clear advantage over basic authentication because the password cannot be intercepted and used by an unauthorized person.

Digest authentication can be used only in Windows 2000 domains.

For configuration instructions, see Configure authentication methods for Web requests.


Integrated Windows authentication

Integrated Windows authentication is a secure form of authentication, because the user name and password are not sent across the network. Integrated Windows authentication can use either the Kerberos V5 authentication protocol or its own challenge/response authentication protocol.

Important

  • In a passthrough authentication scenario, ISA Server does not support Kerberos V5 authentication, because Kerberos V5 requires that the client be able to identify the authenticating server.

For more information, see Configure authentication methods for Web requests and Pass-through authentication.


Client certificates and server certificates

You can use Secure Sockets Layer (SSL) security features for authentication. Certification is used in two ways, when a client requests an object from a server:

  • The server authenticates itself by sending a server certificate to the client.
  • The server requests that the client authenticate itself. In this case, the client must present an appropriate client certificate to the server.

SSL authenticates by checking the contents of an encrypted digital identification submitted by the user's Web browser during the logon process. (Users obtain client certificates from a mutually-trusted external organization.) Server certificates contain identifying information about the server. Client certificates usually contain identifying information about the user and the organization that issued the certificate.

For more information on SSL scenarios, see SSL tunneling and SSL bridging. In Windows 2000 Server Help, see Configure client certificate and Server certificate.

Client certificate

If client certificate is the chosen authentication method, then Microsoft Internet Security and Acceleration (ISA) Server requests a client certificate from the client, before allowing the request.

The ISA Server computer receives the request and sends a certificate to the client. The ISA Server computer identifies itself as the SSL Web server. The client receives the certificate, and verifies that the certificate indeed belongs to the ISA server computer.

The client sends its request to the ISA Server computer. However, the ISA Server computer requires a certificate from the client which must have been previously issued. The ISA Server computer verifies that the certificate indeed belongs to a client that is allowed access.

The client certificate should be installed in the Microsoft Web Proxy Service certificate store on the ISA Server computer. The certificate should be mapped to the appropriate user account.

ISA Server can present client certificates only in SSL bridging scenarios.

For configuration instructions, see Configure authentication methods for Web requests.

Server certificates

When a client requests SSL objects from a server, it requests that the server authenticate itself. If ISA Server terminates an SSL connection, then the ISA Server will have to authenticate itself to the client. You must configure and specify a server-side certificate, to use when authenticating ISA Server to the client.

The server certificate should be installed in the Local Computer certificate store on the ISA Server computer. The certificate name should be identical to the name of the ISA Server (for outgoing Web requests) or to the name of the published Web servers (for incoming Web requests)

For configuration instructions, see Configure server certificates for Web requests.


Rules and authentication

When a Firewall client requests content which is not Hypertext Transfer Protocol (HTTP), Microsoft Internet Security and Acceleration (ISA) Server determines if any rules have been configured to apply to specific users or groups. If so, then ISA Server will require that the client authenticate itself, so that ISA Server can determine if the rule applies to the client requesting the object.

When a Web Proxy or Firewall client requests HTTP content, ISA Server checks the rules to determine if a specific rule allows anonymous users access (either because it applies to all users, or it applies to a client address set that includes the IP address of the client). If so, then the request will be allowed. Otherwise, if no rule has been configured to allow anonymous users access, ISA Server will require that the client authenticate itself, to determine if a rule applies to the specific, authenticated user.

In other words, when a client requests HTTP content, authentication information is not passed to the ISA Server, unless ISA Server requires it. This happens when the Web Proxy service must identify the user in order to allow the request.

You can configure ISA Server to always require authentication for Web requests by enabling the array's outgoing Web request property. For more information, see Require authentication for all Web requests.

For Firewall clients, HTTP requests are passed to the HTTP redirector, if the filter is enabled and configured. In this case, the Firewall client's authentication information is not passed to the Web Proxy service and ISA Server treats the request as if it were from an unauthenticated user. If ISA server cannot pass the request from unauthenticated users, then the request will be denied, because ISA Server will not ask for authentication).

For more information, see Configuring access policy, Web publishing rules, and HTTP redirector filter.

Example

Suppose you configure ISA Server with the following rules:

  1. A protocol rule that allows everyone to use all protocols.
  2. A site and content rule that allows everyone access to all sites.
  3. A site and content rule that denies access to user John.

The first two rules allow access to all requests from anonymous users. The third rule will be enforced—that is, John's request will be denied—only if ISA Server requires that John authenticate himself. For example, consider the following scenarios:

  • John's computer has Firewall client installed. Jon requests non-HTTP content. John's request will be denied because the ISA Server Firewall service requires authentication; the third rule is therefore enforced.
  • John's computer is configured as a Web Proxy client. John requests HTTP content, John's requests will be allowed because ISA Server does not require authentication; the third rule is therefore not enforced.
  • John's computer has Firewall client installed. Jon requests HTTP content. John's request will be allowed because ISA Server does not require authentication; the third rule is therefore not enforced.

To enforce the third rule for all Web requests, configure the array option to ask unauthenticated users for identification. John's request will be denied in all the scenarios previously listed.


Pass-through authentication

Pass-through authentication refers to the ability of Microsoft Internet Security and Acceleration (ISA) Server to pass a client's authentication information to the destination server. ISA Server supports pass-through authentication for both outgoing and incoming Web requests.

The figure illustrates a pass-through authentication scenario.

The client sends a Get request for an object on a Web server to the ISA Server. ISA Server passes the request to the Web server. From there, the pass-through authentication works as follows:

  1. The Web server receives the Get request, and responds that authentication is required (401 error). The Web server also indicates the types of authentication that it supports.
  2. ISA Server passes the Authentication Required response to the client.
  3. The client returns authentication information to the ISA Server.
  4. The ISA Server passes the client authentication information to the Web server.
  5. From this point on, the client communicates directly with the Web server.

Important

  • In a pass-through authentication scenario, ISA Server does not support Kerberos V5 authentication. This is because Kerberos V5 requires that the client can identify the authenticating server.


Chained authentication

Chained authentication refers to the authentication that a Microsoft Internet Security and Acceleration (ISA) Server provides when it routes requests to an upstream server. Requests are chained to an upstream server when the ISA Server routing rules are configured to route to an upstream server.

Chained authentication is supported only when chaining to an upstream server running Microsoft Proxy Server 2.0 or ISA Server.

You can configure ISA Server so that client requests are routed to an upstream server by creating routing rules. For more information, see Routing Web requests.

Before the request is routed, the downstream ISA Server might require that the client authenticate itself. In addition, when the request is routed, the upstream server might also require authentication. In this case, the downstream ISA Server passes the client's authentication information to the upstream server.

Sometimes, the upstream server might not be able to identify the clients requesting the object.

In this case:

  • If the routing rule specifies to use an account when connecting to the upstream server, then the downstream ISA Server computer passes the authentication information for that account.
  • If the routing rule does not specifiy to use an account , then the downstream ISA Server computer passes the client's authentication information to the upstream server.
For more information, see Configure a primary route for Web requests.


SSL tunneling

With Secure Socket Layer (SSL) tunneling, a client can establish a tunnel through the Microsoft Internet Security and Acceleration (ISA) Server directly to the Web server with the requested Secure Hypertext Transfer Protocol (HTTPS) object. Whenever a client browser requests an HTTPS object through ISA Server, it uses SSL tunneling.

The figure illustrates the SSL tunneling process:

  1. When a client requests an SSL object from a Web server on the Internet, ISA Server sends the connect request

    2. https://URL_name

  2. The following request is sent to port 8080 on the ISA Server computer:

    CONNECT URL_name:443 HTTP/1.1

  3. ISA Server connects to the destination Web server on port 443.
  4. When the TCP connection is established, the ISA Server returns:

    HTTP/1.0 200 connection established

From that point on, the client communicates directly with the external Web server.

SSL tunneling works by default for outgoing client requests to ports 443 and 563. You can add SSL tunneling for additional ports by setting FPCProxyTunnelPortRange, an ISA Admin COM object. For more information, see the ISA Server Software Development Kit.


SSL bridging

Secure Socket Layer (SSL) bridging refers to the ability of Microsoft Internet Security and Acceleration (ISA) Server to encrypt or decrypt client requests and pass on the request to a destination Web server. For example, in a publishing (or reverse proxy) scenario, ISA Server can service a client SSL request by terminating the SSL connection from a client and reopening a new connection with a Web server.

SSL tunneling—and not SSL bridging—is used whenever a client browser (from the local, internal network) requests an object using HTTPS on port 8080 through the ISA Server computer. For more information, see SSL tunneling.

SSL bridging is used when ISA Server ends an SSL connection or when it initiates an SSL connection. Specifically, SSL bridging works in the following scenarios:

  • A client requests an Hypertext Transfer Protocol (HTTP) object. ISA Server encrypts the request and forwards it to the Web server. The Web server returns the encrypted object to ISA Server. Then, ISA Server decrypts the object and then sends it to the client. In other words, HTTP requests are forwarded as SSL requests.
  • A client requests an SSL object. ISA Server decrypts the request, then encrypts it again and forwards it to the Web server. The Web server returns the encrypted object to ISA Server. ISA Server decrypts the object and then sends it to the client. In other words, SSL requests are forwarded as SSL requests.
  • A client requests an SSL object. ISA Server decrypts the request and forwards it to the Web server. The Web server returns the HTTP object to ISA Server. ISA Server encrypts the object and sends it to the client. In other words, SSL requests are forwarded as HTTP requests.

SSL bridging can be configured for outgoing and incoming Web requests. However, for outgoing Web requests, the client browser must support secure communication with the Web Proxy service of ISA Server.

The figure illustrates an SSL bridging scenario.

The figure illustrates a reverse publishing scenario. In this scenario, the client requests objects from ISA Server, which forwards the request to the published Web server. In the figure, the Web Proxy client (browser) connects to ISA Server. ISA Server returns a server-side certificate, authenticating itself to the client. When the client and ISA Server complete the SSL negotiation, the client sends an encrypted HTTP request to the ISA Server. ISA Server decrypts the request and checks if the requested object is in its cache. If the object is in the cache, ISA Server returns the object to the client.

If the object is not in the cache, then ISA Server encrypts the request and sends the request to the Web server. The Web server returns a server-side certificate to the ISA Server. When the ISA Server and the Web server complete the SSL negotiation, the ISA Server sends the encrypted HTTP request to the Web server. The Web server decrypts the request and returns it to the ISA Server.

ISA Server receives the object, encrypts it, and passes it to the requesting client.

In an SSL bridging scenario, ISA Server caches cacheable Web objects returned. You can use the FPCWebRequestConfiguration COM object to configure whether SSL objects should be cached. For more information, see the ISA Server Software Development Kit documentation.

Incoming Web requests

For incoming Web requests, an external client uses HTTPS to request an object from a Web server located on your internal network. The client connects to the ISA Server on a port — by default, port 443. In this case, ISA Server responds with a server-side SSL certificate to the client.

For this scenario, ISA Server must be configured to listen for SSL requests on port 443 and a server certificate must be specified. For more information, see Enable SSL listeners and Configure server certificates for Web requests.

Having received the client's request, ISA Server decrypts it, terminating the SSL connection. The Web publishing rules determine how ISA Server communicates the request for the object to the publishing Web server: File Transfer Protocol (FTP), HTTP, or SSL. For more information, see Web publishing rules.

If the Web publishing rule is configured to forward the request using HTTPS, then the ISA Server initiates a new SSL connection with the publishing server, sending a request to port 443. That is, since the ISA Server is now an SSL client, it will require that the publishing Web server respond with a server-side certificate. If the Web server requires a client certificate, then ISA Server must respond with the appropriate certificate as well.

Outgoing Web requests

In most cases, when an internal client uses HTTPS to request an object from a server on the Internet, the ISA Server uses SSL tunneling to establish the connection.

For clients that support secure communication directly with ISA Server, you can configure routing rules to enable SSL bridging, instead. In this case, the client uses HTTP or HTTPS to request an object from an external Web server (on the Internet), connecting to the ISA Server on port 8080 or port 443, respectively (or whichever port is configured to listen for TCP and SSL requests). A routing rule, which applies to the specified destination server, specifies that the request should be redirected as an SSL request.

For more information, see SSL tunnelingand Routing Web requests.


The enterprise, arrays, and stand-alone servers

This section introduces key concepts regarding the Microsoft Internet Security and Acceleration (ISA) Server enterprise, arrays, and stand-alone servers. For information about specific topics, see:

  • The enterprise and arrays
  • Enterprise administrators
  • Arrays and stand-alone servers


The enterprise and arrays

Microsoft Internet Security and Acceleration (ISA) Server can be installed as a stand-alone server or as an array member. Array members share the same configuration, easing management and administration. When you modify the array configuration, all the ISA Server computers in the array are also modified, including all the access policies and cache policies.

The centralized administration can also mean greater security. All the administrative tasks can be performed from one computer and the configuration is applied to all, ensuring that all the servers have the same access policies configured. This is particularly useful in large organizations, where arrays can include many ISA Server computers.

You can create site and content rules, protocol rules, Internet Protocol (IP) packet filters, Web publishing rules, and server publishing rules at the array level. Together, these rules compose an array policy. The array policy determines how the ISA Server clients communicate with the Internet and what communication is permitted. As the name implies, the array policy applies only to the ISA Server computers in the array.

The enterprise takes this centralized management one step further, allowing you to implement one or more enterprise policies, which can be applied to the arrays in your corporate network. The enterprise policy includes site and content rules and protocol rules. The enterprise policy can be applied to any array, and can be augmented by the array's own policy. This enables administrators at branch and departmental levels to adopt governing enterprise policies, while allowing them to further restrict access, if necessary.

You can create one or more enterprise policies and a single set of policy elements. The enterprise-level policy elements can be used when configuring rules for any enterprise policy and when creating array-level rules.

For more information on administering arrays and the enterprise, see Administering stand-alone servers, arrays, and the enterprise.

Applying enterprise policy

You can determine how the enterprise policy should be used by the array administrators in the organization. The enterprise administrator might decide on a very restrictive policy. In this case, no array policies will be configurable. However, the enterprise administrator might decide on a very liberal policy, allowing the array administrators to define any rules. In this case, no enterprise policy will be applied to the array.

A mixed approach might be to allow array policies while still applying an enterprise policy. In this case, the array administrator can define array policy rules, which restrict the enterprise policy rules.

Consider the figure below, which assumes a hypothetical network topology, with the headquarters in the United States and branch offices in France and the United Kingdom.

Network with arrays

At the array level, all the ISA Server computers in the United States array have the same configuration, as do each of the computers in France and in the United Kingdom.

At the enterprise level, you can configure all the arrays in the enterprise to use the enterprise policy. As an alternative, you can allow some arrays to create a more restrictive access policy. At the enterprise level, you can also decide which arrays are allowed to publish servers.

By allowing both enterprise and array policies, you ensure that a corporate policy is implemented all through the organization. At the same time, you can allow for nuances at the department or branch level, creating extra rules as necessary. For more information, see Applying enterprise policy.

For example, an enterprise policy might only allow access to Hypertext Transfer Protocol (HTTP) addresses and deny communication using all other protocol definitions. An array that uses this enterprise policy can add a rule that limits who can use the HTTP protocol. But the array policy cannot allow communication using other protocols.


Enterprise administrators

Only enterprise administrators can change the enterprise policy settings and create or modify new enterprise policies. Enterprise administrators are users that belong to the Enterprise Admins group.By default, members of the Domain Admins group in the root domain of the organization also have enterprise administrator permissions. You can deny Domain Admins members permission to modify enterprise policies and settings by configuring the permissions. For configuration instructions, see Configure enterprise policy setting permissions and Configure enterprise policy permissions.


Arrays and stand-alone servers

Microsoft Internet Security and Acceleration (ISA) Server computers can be grouped together in arrays. An array is a group of ISA Server computers used to provide fault tolerance, load balancing, and distributed caching. Arrays allow a group of ISA Server computers to be treated and managed as a single, logical entity.

All the servers in the array share a common configuration. This saves on management overhead, since the array is configured once, and the configuration is applied to all the servers in the array. Furthermore, you can apply an enterprise policy to an array, allowing you to centralize management for all the arrays in your enterprise. For more information, see Understanding enterprise and arrays.

An array installation also means performance savings. Arrays allow client requests to be distributed among several ISA Server computers, which improves response time for clients. Because load is distributed across all the servers in the array, you can achieve good performance even with moderate hardware.

In order to install ISA Server as an array member, the computer must be a member of a Windows 2000 domain. Furthermore, the ISA Server enterprise must be initialized before you can install ISA Server as an array member. For more information, see Initializing the enterprise.

If you choose not to install ISA Server as an array member, you can install ISA Server as a stand-alone server. Stand-alone server installations do not require that the computer belong to a Windows 2000 domain.

The table below lists the differences between array members and stand-alone servers.

 | Array member | Stand-alone server
Scalability | Can have one or more member servers. | Limited to only one member.
Active Directory required? | Yes. Can be installed only in Windows 2000 domains with Active Directory installed. | No. Can be installed in Windows NT 4.0 domains. Configuration information is stored in the registry.
Enterprise policy | Yes. A single policy can be applied to all arrays in the enterprise. | No.

Array requirements

All array members must be in the same domain and in the same site. A site is a set of computers in a well-connected Transmission Control Protocol/Internet Protocol (TCP/IP) subnet. A domain is a collection of computers, defined by the administrator, that share a common directory database. For more information, see the Windows 2000 Help.

Mode

When you install an ISA Server computer as a member of an existing array, you should install it in the same mode as the other array members: cache, firewall, or integrated. For example, if all the servers in the array were installed in firewall mode, then this server should also be installed in firewall mode. For more information, see ISA Server modes.

Add-ins

ISA Server includes several application filters, Web filters, and other add-ins, which you can install when you install ISA Server. You should install the same set of add-ins on each server in an array, in order to ensure consistent functionality on all the servers.

When you install an add-in on one server in an array, it is not automatically installed on all the servers in the array. You must install the add-in on each server in the array.

Policy Configuration

The array policy of ISA Server—all access policy, publishing, and bandwidth rules—is defined once at the array level and applied to all the servers. Similarly, the cache is centrally configured at the array level; the policy and scheduled content download jobs are identical for all servers.

Alert configuration

Alerts can be configured for each server in the array or for all the servers in the array. For more information, see Alerts.

Reports

Reports display information about the activity on all the ISA Server computers in the array. The report data is stored in a database on a computer and in a directory that you specify—by default, the ISA Server computer on which you configure the report jobs. For more information, see Configuring reports.

Cache

Space for the ISA Server cache is allocated on each server according to the amount you specify when you install or reconfigure the cache.

All cache configuration properties are common for all the servers in an array. This includes Hypertext Transfer Protocol (HTTP) caching properties, File Transfer Protocol (FTP) caching properties, and Cache Array Routing Protocol (CARP) properties. For more information, see ISA Server cache.

Scheduled cache content download jobs are common for all servers in an array.


Interoperation with other services

When you install Microsoft Internet Security and Acceleration (ISA) Server, you are adding it to secure and connect an existing network of services, all of which may be centralized on a single server or dispersed across many servers. The following sections describe network issues to consider when deploying ISA Server.

For information about specific topics, see:

  • Windows NT 4.0 domains
  • Active Directory
  • Remote access server
  • ISA Server and IIS Server
  • Internet Connection Sharing
  • ISA Server and IPSec
  • Running other services on the ISA Server computer


Windows NT 4.0 domains

Microsoft Internet Security and Acceleration (ISA) Server can be installed as a stand-alone server in a Windows NT 4.0 domain. No special configuration is required.

Arrays can also be used to connect and secure Windows NT 4.0 domain users and clients to the Internet. However, the array of ISA Server computers must be set up on a separate Windows 2000 domain. You can then establish a trust relationship between the Windows NT 4.0 domain and the domain to which the ISA Server computer belongs.

For background information on arrays, see Arrays and stand-alone servers.


Active Directory

If you install Microsoft Internet Security and Acceleration (ISA) Server as a stand-alone server, all configuration information is saved to the registry.

If you install ISA Server in an array configuration, all of its configuration information is saved to Active Directory. In other words, ISA Server arrays require that Active Directory is installed on the ISA Server domain. For more information on arrays, see Arrays and stand-alone servers.

If you install ISA Server in an array configuration, the ISA Server does not have to be installed on the domain controller computer. Indeed, it is recommended that you place the domain controller behind the ISA Server, on the local network. In this way, ISA Server protects the domain controller from unwanted access.


Routing and Remote Access

In the absence of Microsoft Internet Security and Acceleration (ISA) Server, you may have used Routing and Remote Access to make network services and computers available to remote clients. ISA Server provides the remote connectivity and extends Routing and Remote Access features by offering more extensive and flexible security features.

  • ISA Server packet filtering replaces the Routing and Remote Access packet filtering.
  • ISA Server uses the dial-up entries configured for Routing and Remote Access.

Routing and Remote Access can run on the ISA Server computer.


ISA Server and IIS Server

The Web Proxy service (w3proxy) of Microsoft Internet Security and Acceleration (ISA) Server runs as a Windows 2000 service. The process is initialized by starting the Web Proxy service. Microsoft Internet Information Services (IIS) can be installed on an ISA Server computer, but it is not required.

You can configure ISA Server to listen for incoming Web requests and outgoing Web requests on different ports, by configuring the properties in Servers and Arrays. For example, by default, ISA Server listens for outgoing Web requests on TCP port 8080. In this way, ISA Server ensures that outgoing Web requests do not interfere with Web publishing on port 80. For configuration instructions, see Configure the TCP port.

If IIS is installed on the ISA Server computer, you can publish IIS by configuring Web publishing rules. In this case, IIS must be configured not to use the ports that ISA Server uses for outgoing Web requests (by default, port 8080) and for incoming Web requests (by default, port 80). For example, you can change IIS to listen on port 81. Then you can configure the ISA Server computer to listen for incoming Web requests on port 80 and create a Web publishing rule that directs the incoming Web requests to port 81 on the local IIS server. For more information, see Web publishing rules. For a scenario illustrating this, see Web server on the ISA Server computer.

Alternatively, IIS can continue to listen for incoming Web requests on port 80. In this case, configure an Internet Protocol (IP) packet filter, which maps incoming requests on TCP port 80 to IIS. For more information, see IP packet filters. For a scenario illustrating this, see Using packet filters to publish a Web server on the ISA Server computer

To avoid any potential conflict between ports used by ISA Server and those used by IIS, the setup program stops the World Wide Web Publishing service (w3svc). After ISA Server is installed, you can change IIS to listen on a different port and then restart the IIS publishing service.


Internet Connection Sharing

In the absence of Microsoft Internet Security and Acceleration (ISA) Server, you may have used the Internet connection sharing (ICS) or network address translation (NAT) features of Windows 2000 to access the Internet. ISA Server can be used instead of NAT or ICS, replacing and enhancing its function in the organization. ISA Server provides the connectivity enabled by NAT or ICS and adds sophisticated security and caching features.

Warning

  • Do not run ICS on the computer running ISA Server.


ISA Server and IPSec

The Internet Protocol security (IPSec) driver may be enabled on the ISA Server computer. For example, when ISA Server is configured as an IPSec/L2TP VPN server, then the IPSec driver is enabled.

When IPSec is enabled, Authentication Header (AH) and Encapsulating Security Payload (ESP), IP protocols 50 and 51, are controlled by the IPSec driver and not by the ISA Server's packet filter driver. In this case, the IPSec driver allows control over the tunneled traffic. The IPSec driver ensures that only valid AH and ESP protected traffic is admitted into the network.

When IPSec is not enabled on the ISA Server computer, then the ISA Server policy controls which packets are allowed and which are blocked, and also logs all traffic that passes through the ISA Server, including IPSec AH and ESP protocols.

If ISA is configured to block IP fragments, all IP fragments will be blocked, including AH and ESP fragments, even if IPSec is enabled. For more information on IP fragmenting, see Packet filter options.


Running other services on the ISA Server computer

For all client requests, ISA Server processes the request by analyzing rules and determining if access is allowed. If the client request is allowed, then ISA Server dynamically opens the ports required for the communication.

For applications that run on the ISA Server computer, you must configure Internet Protocol (IP) packet filters, which statically open ports to allow the requested communication. For more information, see IP packet filters.

Running IIS on the ISA Server computer

For example, if you want to run Internet Information Services (IIS) on the same computer as ISA Server, you should create an IP packet filter with the following parameters:

  • Packet filter is only on the computer with IIS. (Select Only this server.)
  • Filter mode is Allow packet transmission
  • Filter type is Custom.
  • IP Protocol is TCP.
  • Direction is Inbound.
  • Local Port is Fixed Port, 80.
  • Remote Port is All ports.

For a detailed description of how to configure ISA Server in this scenario, see Using packet filters to publish a Web server on the ISA Server computer

Running Outlook on the ISA Server computer

In another scenario, you might want to run Outlook Express on the ISA Server computer to access Simple Mail Transport Protocol (SMTP), Post Office Protocol (POP) and Network News Transfer Protocol (NNTP) servers on the Internet. You should create the following IP packet filters:

  • An IP packet filter that allows the POP3 protocol, configured with the following custom properties:
    • IP protocol is set to TCP
    • Direction is set to Both
    • Local Port is set to Dynamic
    • Remote Port is set to Fixed Port
    • Number is set to 110
    • Local computer is set to Default external IP address of the ISA Server computer
    • Remote computers is set to All remote computers
  • An IP packet filter that allows the SMTP protocol, configured with the following custom properties:
    • IP protocol is set to TCP
    • Direction is set to Both
    • Local Port is set to Dynamic
    • Remote Port is set to Fixed Port
    • Number is set to 25
    • Local computer is set to the Default external IP address of the ISA Server computer
    • Remote computers is set to All remote computers
  • An IP packet filter that allows the NNTP protocol, configured with the following custom properties:
    • IP protocol is set to TCP
    • Direction is set to Both
    • Local Port is set to Dynamic
    • Remote Port is set to Fixed Port
    • Number is set to 119
    • Local computer is set to the Default external IP address of the ISA Server computer
    • Remote computers is set to All remote computers

If ISA Server is functioning as your firewall, then you should avoid statically opening ports (by creating IP packet filters) for other services and applications on the computer.

Configuring the browser on the ISA Server computer

If you use a Web browser on the ISA Server computer, you must configure the browser to use the IP address of the server network adapter that is connected to the internal network. Do not use the server computer name or DNS name.

If you configure the server browser to use the computer or DNS name, the name is resolved to the IP address of the external network interface connected to the Internet. When this occurs, requests from the browser are denied because the local address table (LAT) does not contain the external IP address and access is denied. Consequently, you must configure the browser on the server to connect through the Web Proxy service.


Planning considerations

As you plan your Microsoft Internet Security and Acceleration (ISA) Server deployment, consider these factors:

Network size. It is important to form a clear idea of the size of your network, or expected usage of publishing servers, so that you can determine how many ISA Server computers to deploy. For more information, see Capacity planning.

Array considerations. Determine the appropriate number of ISA Server computers and how to map these servers into arrays. Bear in mind security considerations, intended functions for the ISA Server computers, and how clients will access the ISA Server computers. Map out how the arrays will be organized hierarchically. For more information, see Array considerations.

ISA Server mode. Determine which ISA Server mode you will install for each array: firewall, cache, or integrated. For more information, see ISA Server modes.

ISA Server installation options. When you install ISA Server, you can select to install the whole package—including the administrative interface, extensions, and the services—or select specific options to install. Determine how you will use ISA Server on the computer and select the options accordingly. For more information, see ISA Server installation options.

User needs. Determine what applications and services your users require. This will help you decide what type of client software (if any) you should install on the client computers. For more information, see Assessing client requirements.

Internet connectivity requirements. Determine how you will physically connect your internal network to the Internet. For more information, see Connecting to the Internet.


Capacity planning

For improved performance, you should plan the Microsoft Internet Security and Acceleration (ISA) Server hardware and Internet connectivity to meet the expected load. For information about recommended system configurations for various usage scenarios, see:

  • Minimum system requirements
  • Forward caching requirements
  • Publishing requirements


Minimum system requirements

To use Microsoft Internet Security and Acceleration (ISA) Server, you need:

  • A computer with a 300 MHz or higher Pentium II-compatible processor that is running one of the following operating systems:
    • Microsoft Windows 2000 Server with Service Pack 1 or later
    • Windows 2000 Advanced Server with Service Pack 1 or later
    • Windows 2000 Datacenter Server

    Note

    • It is always recommended to use the latest Service Pack.
  • 256 MB of RAM
  • 20 MB of available hard-disk space
  • A Windows 2000-compatible network adapter for communicating with the internal network
  • One local hard disk partition formatted with the NTFS file system

To implement an array and advanced policies configuration, you also need Windows 2000 Active Directory available on your network.

For remote ISA Server administration, you only need to install ISA Management, which can run on Windows 2000 Professional or above. For more information, see Remote administration.


Forward caching requirements

Microsoft Internet Security and Acceleration (ISA) Server can be deployed as a forward caching server, maintaining a centralized cache of frequently-requested Internet objects that can be accessed by any Web browser client. In this case, consider how many Web browser clients will be accessing the Internet. The table below lists hardware configurations for expected number of internal clients accessing objects on the Internet.

Number of users | ISA Server computer | RAM | Disk space allocated for caching
Up to 500 | Pentium II, 300 MHz | 256 MB | 2-4 GB
500 - 1,000 | Pentium III, 550 MHz | 256 MB | 10 GB
More than 1,000 | Two ISA Server computers with Pentium III, 550 MHz | 256 for each server. | 10 Gigabytes for each server.

As your user base exceeds 1,000 users, you can consider either using better-performing hardware (stronger processors, more memory), or adding more ISA Server installations.

When you set up more than one ISA Server computer, consider grouping the computers in arrays. For more information, see Array considerations.

Actual performance depends on your particular configuration. You can use ISA Server reports to determine actual performance and calibrate the ISA Server computers accordingly. For more information, see Reporting.


Publishing requirements

Microsoft Internet Security and Acceleration (ISA) Server can be deployed in front of an organization's Web server that is hosting a commercial Web business or providing access to business partners. In this case, you need to consider how often external clients will request objects on the publishing servers.

The table below lists hardware configurations for expected number of requests from Internet (external) users, in a reverse caching scenario. These estimates are for a single ISA Server computer.

Hits/second | ISA Server computer
Less than 800 | Pentium II, 300 Megahertz (MHz)
Approximately 800 | Pentium III, 550 MHz
More than 800 | Pentium III, 550 MHz. For each 800 hits per second, add an ISA Server computer or add more processors to the ISA Server computer.

Random access memory (RAM) requirements depend on the size of the cacheable content that you are publishing—the working set of the content. Ideally, all cacheable content should be able to fit into memory. For example, if the Web site you are publishing takes up 250 MB of hard disk space, then 256 MB of RAM is sufficient.


Array considerations

Before you install Microsoft Internet Security and Acceleration (ISA) Server, decide how many servers you will install. If you are installing more than one server, consider setting up an array of ISA Server computers. Arrays allow a group of ISA Server computers to be treated and managed as a single, logical entity. For more information concerining guidelines, see Capacity planning.

Furthermore, because all the servers in the array have an identical configuration, arrays ensure fault tolerance. If one server becomes unavailable, the other servers in the array can perform on its behalf.

A unique array policy can be applied to each array in the enterprise. This can provide a method of departmentalizing your organization. For example, you might want to allow clients protected by one array unlimited access to the Internet, whereas more restrictions are placed on clients in another array.

Even if you are installing just one ISA Server computer, you should consider installing it as an array member. When ISA Server is installed as an array member, enterprise policy can be applied to the array. Furthermore, an array installation means that future expansion is easier—an additional server can easily be added to the array.

For more information, see Applying enterprise policy and Arrays and stand-alone servers.


ISA Server modes

As part of the setup process, you can select the Microsoft Internet Security and Acceleration (ISA) mode: firewall, cache, or integrated.

In firewall mode, you can secure network communication by configuring rules that control communication between your corporate network and the Internet. You can also publish internal servers, thereby sharing data on your internal servers with Internet users.

In cache mode, you can improve network performance and save bandwidth by storing commonly-accessed objects closer to the user. You can then route requests from Internet users to the appropriate Web server.

In integrated mode, all the features are available.

Depending on which mode you select, different features are available. The table below lists which features are available for the firewall and cache modes.

Feature | Firewall | Cache
Enterprise policy | Yes | Yes
Access policy | Yes | Yes, but only for Hypertext Transfer Protocol (HTTP)
Web publishing | Yes | Yes
Server publishing | Yes | No
Packet filtering | Yes | No
Cache configuration | No | Yes
Application filters | Yes | No
Web filters | Yes | Yes
Real-time monitoring | Yes | Yes
Alerts | Yes | Yes
Reports | Yes | Yes
Virtual private networking | Yes | No
SecureNAT client support | Yes | No
Firewall client support | Yes | No
Web Proxy client support | Yes | Yes


Installation options

As part of the installation process, you can choose which Microsoft Internet Security and Acceleration (ISA) Server components to install. You can select one or more of the following:

  • ISA Management only
  • ISA Server services
  • ISA Server extensions

If you install only ISA Management, you can use the server on which ISA Management is installed to remotely administer one or more arrays of ISA Server computers. For instructions on remote administration, see Remote administration.

You can install the message screener only if an SMTP or related service is installed on the ISA Server computer. Even if you choose not to install the message screener, then some message filtering is still available. For more information, see SMTP filter.


Assessing client requirements

Before you deploy or configure client software, assess your organizational needs. Determine which applications and services your internal clients require. Assess how you will be publishing servers. Then map these needs to the client types supported by Microsoft Internet Security and Acceleration (ISA) Server:

  • Secure network addressing translation (SecureNAT) clients
  • Firewall clients
  • Web Proxy clients

For more information, see ISA Server clients.

Ask yourself the following types of questions, to help you map user needs to the client types that you will deploy in your organization:

Do you want to avoid deploying client software or configuring client computers?

Recommended: SecureNAT clients.

SecureNAT clients do not require any software or specific configuration. On the other hand, Firewall clients require that you deploy Firewall Client software and Web Proxy clients require that you configure the Web applications on the client computers.

Are you using ISA Server only for forward caching of Web objects?

Recommended: SecureNAT clients.

If you use SecureNAT clients in this scenario, you will not have to deploy any special software or configure the client computers. Instead, client requests are transparently passed to the ISA Server Firewall service and then on to the Web Proxy service for caching.

Do you allow access only for authenticated clients?

Recommended: Firewall clients.

For Firewall clients, you can configure user-based access policy rules. You can also configure user-based rules for Web Proxy clients, but the rule will be effective only if the Web application can pass on the authentication information.

You can install Firewall client software on client computers that run Windows ME, Windows 95, Windows 98, Windows NT 4.0, or Windows 2000. 16-bit Winsock applications are supported, but only on Windows 2000 and Windows NT 4.0.

SecureNAT clients do not support user-based authentication.

Are you publishing servers that are located on your internal network?

Recommended: SecureNAT clients.

Internal servers can be published as SecureNAT clients. This eliminates the need for creating special configuration files on the publishing server. Instead, you simply create a server publishing rule on the ISA Server. For more information, see Server publishing rules.

Although you can set up publishing servers as Firewall clients, this is not recommended, as a complex configuration process is required.

You can install Firewall client software on client computers that run Windows ME, Windows 95, Windows 98, Windows NT 4.0, or Windows 2000. 16-bit Winsock applications are supported, but only on Windows 2000 and Windows NT 4.0.


Connecting to the Internet

The first step to providing Internet access is connecting to the Internet. Every connection with the Internet goes through the Internet service provider (ISP). The business of providing connectivity to the Internet is quite competitive, so you have the opportunity to shop around for an ISP. When you consider suitability, consider these three factors: price, services, and bandwidth.

You can connect Microsoft Internet Security and Acceleration (ISA) Server to the Internet with either a direct link or a dial-up link. If you connect using a direct link, xDSL, or cable modem, you must set up an external network adapter. If you connect using a dial-up link, you must use a modem or an Integrated Services Digital Network (ISDN) adapter with your server.

Typically, ISA Server will have only one Internet protocol (IP) default gateway. You should only configure the IP address of the default gateway on the external network adapter and not on the internal network adapter.

TCP/IP settings

When setting Transmission Control Protocol/Internet Protocol (TCP/IP) properties for any network adapter, you should enter a permanent, reserved IP address for the ISA Server computer and an appropriate subnet mask for your local network. DHCP should be disabled because it attempts to reset the default gateway you selected for the ISA Server computer.

Windows 2000 identifies each adapter added to the system with a leading number. Refer to these numbers when you are attempting to verify or change settings for a specific hardware adapter.

After setup, you can use the Ping tool which is provided with Windows 2000 Server or a similar utility on another internal IP client computer to verify that the network adapters are set correctly. You must use another computer located on the external segment when using Ping or other echo-reply types of testing.

Publishing and connectivity

If you are using ISA Server to publish Web servers and other servers, making them available to Internet clients, you must obtain one or more static IP addresses in addition to registering your domain names. Internet users will access your internal servers by accessing these IP addresses or names.

If you have registered an Internet domain name, you may decide to have your Internet service provider handle the details of how to administer the listing of your domain name in DNS for use by others on the Internet.

When you publish internal servers, you must obtain static IP addresses with which to associate the domain or server name. When external clients access your web site or domain, local server, the ISP's DNS name resolution server will find the IP address associated with the requested Web site name server—usually an IP address on your ISA Server or on a perimeter network (also known as a DMZ, demilitarized zone, and screened subnet).

Alternatively, you can use an internal DNS server to resolve requests from external clients. This DNS server should be published like any other published server. For more information, see Server publishing rules.


Using ISA Server

This section describes background concepts that are useful when administering Microsoft Internet Security and Acceleration (ISA) Server. For specific information, see:

  • Migrating from Microsoft Proxy Server 2.0
  • Installing ISA Server
  • Installing and configuring ISA Server clients
  • Administering ISA Server
  • Setting network configuration
  • Configuring policy elements
  • Using packet filtering
  • Configuring access policy
  • Configuring bandwidth
  • Configuring publishing
  • Configuring ISA Server cache
  • Using extensions
  • Using H.323 Gatekeeper
  • Monitoring and reporting
  • Deployment scenarios


Migrating from Microsoft Proxy Server 2.0

Microsoft Internet Security and Acceleration (ISA) Server supports a full migration path for Microsoft Proxy Server 2.0 users. Most Proxy Server rules, network settings, monitoring configuration, and cache configuration will be migrated to ISA Server. Furthermore, ISA Server will continue to support Winsock Proxy client software, together with its own Firewall client software, in a heterogeneous client base.

ISA Server introduces many new features and changes over Proxy Server 2.0. These changes affect the server configuration and upgrade scenarios. This document outlines the key items that an administrator should consider as part of the upgrade process to ISA Server.

Important

  • Perform a full backup of the current Proxy Server 2.0 settings before you upgrade your system.

For information about specific topics, see:

  • Migration process
  • Microsoft Proxy Server 2.0 array considerations
  • Migrating Microsoft Proxy Server 2.0 configuration
  • New ways to do familiar tasks


Migration process

Microsoft Internet Security and Acceleration (ISA) Server can only be installed on computers running Windows 2000 Server or later, with Service Pack 1 installed. For more information, see Minimum system requirements.

If your current version of Microsoft Proxy Server 2.0 is installed on Windows NT 4.0, follow these steps:

  1. Stop and disable all Proxy Server services by typing the following at a command prompt:

    net stop service_name

    The services are listed in the table below.
    Display name | Service name
    Microsoft Winsock Proxy service | wspsrv
    Microsoft Proxy Server Administration | mspadmin
    Proxy Alert Notification Service | mailalrt
    World Wide Web Publishing Service | w3svc
  2. Upgrade to Windows 2000. You may receive a message indicating that Proxy Server will not work on Windows 2000. This message can be safely ignored.
  3. You can now begin ISA Server setup. For more information, see Installing ISA Server.
    Since the core services required for firewall operation are inactive during setup, it is recommended that you disconnect the computer that is being upgraded from the Internet for the duration of the installation.

Direct upgrade from Proxy Server 1.0, BackOffice Server 4.0 or Small Business Server 4.0 is not supported. Also, ISA Server does not support the IPX protocol.

Caution

  • You cannot return to Proxy Server 2.0 once you start the upgrade to ISA Server.


Microsoft Proxy Server 2.0 array considerations

When you migrate Microsoft Proxy Server 2.0 to Microsoft Internet Security and Acceleration (ISA) Server, you can install the ISA Server computer as an array member or a stand-alone server. For more information, see Arrays and stand-alone servers.

If you migrate the proxy server to a stand-alone server, most of the rules and other configuration elements previously created for proxy server are also migrated. If you migrate to a new array, the enterprise policy default settings determine how the Proxy Server rules are migrated. For more information, see Migrating Proxy Server 2.0 configuration.

Before you can migrate an array of Proxy Server computers, it is recommended that you remove all the members. Each member will retain an identical set of rules which was replicated to all the servers in the array. Similarly, all the servers will retain identical network configuration (such as dial-on-demand settings), and monitoring configuration (such as alerts).

After you remove the servers from the array, you can migrate each Proxy Server computer to ISA Server. To retain a similar array configuration, perform the following steps:

  1. During setup, create a new array.
  2. Migrate all subsequent proxy servers to this array.

Migrating to an array

You can migrate a single Proxy Server computer to a new array of ISA Server computers. In this case, the configuration information is migrated to the ISA Server array differently, depending on the ISA Server array's default enterprise settings. For more information on ISA Server enterprise policy settings, see Applying enterprise policy.

ISA Server can be configured to use an enterprise policy only, an array policy only, or a combination of both. Depending on the enterprise policy settings, Proxy Server rules are migrated differently. The table below lists the possible enterprise settings and details how the Proxy Server policy is migrated for each setting.

Enterprise policy settings | Have enterprise administrator permissions? | Rules that ISA Server migrates
Use array policy only | Yes/No | All the existing Proxy Server rules to the array policy.
Use enterprise policy only | Yes | All the existing Proxy Server rules. Enterprise policy settings for the new array are configured to Use array policy only.
Use enterprise policy only | No | None of the Proxy Server rules. The new array uses only the enterprise policy.
Use enterprise and array policy | Yes | All the existing Proxy Server rules. Enterprise policy settings for the new array are configured to Use array policy only.
Use enterprise and array policy | No | Only the Proxy Server rules that can be migrated to deny rules (domain filters and not protocols). Enterprise policy settings for the new array are to configured to use the enterprise policy, together with the more restrictive array policy.

If the enterprise policy allows publishing rules, then the Proxy Server publishing settings are migrated to the array policy.

If the enterprise policy does not allow publishing rules then, if you have Enterprise Administrator permissions, the enterprise policy settings are changed so that publishing rules are allowed on this array. The Proxy Server publishing settings are then migrated to the array policy.


Migrating Microsoft Proxy Server 2.0 configuration

Most Microsoft Proxy Server 2.0 rules, network settings, monitoring configuration, and cache configuration are migrated to Microsoft Internet Security and Acceleration (ISA) Server during setup. This topic details how the configuration information is migrated.

Proxy chains

Mixed chains of Proxy Server 2.0 and ISA Server computers are supported.

Web Proxy client requests

Proxy Server 2.0 listens for client Hypertext Transfer Protocol (HTTP) requests on port 80, and ISA Server listens on port 8080 by default. Therefore, all downstream chain members (or browsers) connecting to ISA Server must connect to port 8080. You can also configure ISA Server to listen on port 80.

Publishing

Proxy Server 2.0 required that you configure publishing servers as Winsock Proxy clients. ISA Server allows you to publish internal servers without requiring any special configuration or software installation on the publishing server. Instead, the ISA Server treats the publishing servers as secure network address translation (SecureNAT) clients. Web publishing rules and server publishing rules, configured on the ISA Server computer, make the servers securely accessible to specific external clients. No additional configuration is required on the publishing server.

Cache

The Proxy Server cache configuration is migrated to the ISA Server computer, including cache drive specifications, size, and all other properties.

Proxy Server 2.0 cache content will not be migrated due to the vastly different cache storage engine in ISA Server. It will be deleted as part of ISA Server setup and the new storage engine will be instituted based on existing cache and drive settings.

Depending on the cache size, the deletion process may take some time.

SOCKS

ISA Server includes a SOCKS application filter, which allows client SOCKS applications to communicate with the network, using the applicable array or enterprise policy to determine if the client request is allowed. Migration of Proxy Server 2.0 SOCKS rules to ISA Server policy is not supported. For more information, see SOCKS filter.

Rules and policies

The table below lists how Proxy Server rules and other configuration information are migrated on the ISA Server computer:

Proxy Server 2.0 | ISA Server
Domain filters | Site and content rules
Winsock permission settings | Protocol rules
Publishing properties | Web publishing rules
Static packet filters | Allow or block IP packet filters
Web Proxy routing rules | Routing rules

Policy elements are created, as necessary, for the new rules. Additional configuration information is also migrated: local address tables, automatic dial settings, alerts, log settings, and client configurations.

Web Proxy Service permissions are not migrated to the ISA Server configuration.

Authentication

ISA Server supports the following authentication methods: basic, digest, integrated Windows authentication, and client certificate. By default, when you install ISA Server, the integrated Windows authentication method is configured for Web requests. In Microsoft Proxy Server 2.0, anonymous and integrated authentication are enabled by default. Internet Explorer 5 supports integrated Windows authentication. However, other Web browser may support only the basic authentication method. In this case, no requests will be allowed, since the user cannot be authenticated. In other words, ISA Server will reject Web requests that were previously allowed by Proxy Server. You can configure basic authentication for all Web requests. For more information, see Configure authentication methods for Web requests for configuration instructions.

With Proxy Server, intra-array authentication was required when array members communicated with each other. Since ISA Server uses Kerberos V5 and system account authentication, intra-array authentication is not required.


New ways to do familiar tasks

The following table lists common tasks you can perform using ISA Management and compares these tasks to how they were performed using Microsoft Proxy Server 2.0.

If you want to | In Microsoft Proxy Server 2.0 | In ISA Server
Restrict access to sites and domains | Use the Internet Service Manager to create domain filters | Create site and content rules. For more information, see Create a site and content rule.
Restrict use of specific protocols | Configure the permissions of the Web Proxy or Winsock Proxy service to make available access control from specific protocols | Create protocol rules. For more information, see Create a protocol rule.
Publish Hypertext Transfer Protocol (HTTP) sites. | Configure the Web Proxy service publishing properties | Create Web publishing rules. For more information, see Create a Web publishing rule.
Create packet filters | Use the Packet filters tab in Security. | Create an Internet protocol (IP) packet filter. For more information, see Create an IP packet filter.
Configure alerting | Use the Alerting tab in Security for any of the services. | Create an alert. For more information, see Create an alert.
Configure dial-on-demand | On the Services tab, click Auto Dial. | For Winsock requests, configure Winsock Proxy chaining to automatically dial out when requests arrive. For more information, see Configure firewall chaining. For Web browser requests, configure routing rules. For more information, see Configure routing.
Configure the cache | Configure Caching on Web Proxy Service properties | Configure HTTP and File Transfer Protocol (FTP) cache properties. For more information, see Configure HTTP caching and Configure FTP caching.
Configure the local address table (LAT) | Click Local Address Table on any service's properties. | Construct the local address table or add an LAT entry. You can also configure the local domain table. For more information, see Construct a local address table or Add an entry to the local address table.
Configure routing | Configure Routing on Web Proxy Service properties. | Configure routing rules. For more information, see Create a routing rule


Installing ISA Server

For more information on specific topics, see:

  • Initializing the enterprise
  • Installation process
  • Unattended setup
  • Default settings


Initializing the enterprise

Before you can set up Microsoft Internet Security and Acceleration (ISA) Server as an array member, the ISA Server schema must be installed to Active Directory. ISA Server includes an Enterprise Initialization utility that you can use to install the ISA Server schema in Active Directory. For details on how this impacts the Active Directory, see Active Directory.

After the ISA Server schema is imported, all subsequent ISA Server installations to computers in the domain can use the ISA Server schema. You do not have to install the schema again. For more information, see The enterprise and arrays and Initialize the enterprise.

In order to install the ISA Server schema to Active Directory, you must be an administrator on the local computer. In addition, you must be a member of the Enterprise Admins and Schema Admins groups. For more information on user and group permissions, see Active Directory in Windows 2000 Help.


Installation process

Before you set up Microsoft Internet Security and Acceleration (ISA) Server, review Minimum system requirements. If you are installing ISA Server in cache or integrated mode, be sure that you have at least one disk formatted with the NTFS file system. If you need to convert a disk to NTFS, refer to Configuring cache drives.

As part of the installation options, you will construct the local address table (LAT). For information on constructing the LAT, see Configuring the local address table.

When you install ISA Server, you will be requested to supply the following information.

  1. CD key. This is the 10-digit number located on back of the ISA Server CD-ROM case.
  2. Installation options. You can select a typical installation, full installation, or custom installation. For more information, see Installation options.
  3. Array selection. If you previously initialized the enterprise, you can select which array to join. If you did not initialize the enterprise, then ISA Server will be installed as a stand-alone server. For more information, see Arrays and stand-alone servers.
  4. Mode. You can select to install ISA Server in firewall mode, cache mode, or integrated mode. For more information, see ISA Server modes.
  5. Cache configuration. If you install ISA Server in integrated or cache mode, then you must configure which cache drives to use. For more information, see Configuring cache drives.
  6. Local address table (LAT) configuration. If you install ISA Server in integrated or firewall mode, then you must configure the address ranges to include in the local address table. See Configuring the local address table for more information.

Caution

  • Be sure to install Windows 2000 Service Pack 1 before you install ISA Server.

As part of the installation process, ISA Server modifies the TCP/IP driver's dynamic port range, setting it to 65,535. This modification will take effect after the computer is rebooted. Note that your computer is not automatically rebooted after ISA Server is installed.

If you are installing ISA Server as an array member and this is the first installation in the enterprise, you must initialize the enterprise before the first array installation of ISA Server.

For more information, see Initializing the enterprise and Install server software.


Unattended setup

You can install Microsoft Internet Security and Acceleration (ISA) Server by using the unattended server setup command. For instructions, see Run unattended setup.

Msisaund.ini contains the configuration information that is used by server setup in unattended mode. It has no effect on the standard ISA Server setup. If a value is not specified in this file, a default value is used. The following table describes the entries and values in the Msisaund.ini file of the server.

Section | Entry | Description
[ISA Setup Install] | Install Dir | Specifies the installation directory for ISA Server. If not specified, it defaults to the first disk drive with enough space. The syntax is: Drive:\Folder The default folder is Systemroot\Program Files\Microsoft ISA Server
[ISA Setup Install] | Override Existing Configuration | If set to 0, setup program retains existing configuration set by previous installation, ignoring data from the remaining sections of this file. Default is 0.
[Array Membership] | Join existing array | Specifies the name of the array to join. You must import the schema if you specify Join existing array or Create new array and join. For more information, see Initialize the enterprise. If you don't specify either Join existing array or Create new array and join, the server is set up as a stand-alone server. You cannot specify both Join existing array and Create new array and join.
[Array Membership] | Create new array and join | Specifies the name of a new array to create. The server is joined to the new array. If you don't specify either Join existing array or Create new array and join, the server is set up as a stand-alone server. You cannot specify both Join existing array and Create new array and join.
[Features] | Installation Option | This specifies the mode in which ISA Server will be installed. Possible values are Integrated, Firewall, and Cache. The default is Integrated. For more information, see ISA Server modes.
[Firewall LAT Config] | Include Ranges From All Cards | If set to 1, treats all network adapter Internet Protocol (IP) address ranges as being on the internal network. Assumes a dial-up modem connection to the Internet.
[Firewall LAT Config] | Include Private Ranges | If set to 1, treats all network adapter IP address ranges as being on the internal network. Assumes a dial-up modem connection to the Internet.
[Firewall LAT Config] | Range1,Range2... | Defines local address table (LAT) IP ranges specifically. Syntax is Range1=x.x.x.x. Range2=y.y.y.y. If you install ISA Server in cache mode, then you should omit the [Proxy Setup LAT Config] section. If you include this section, then at least one entry must be specified in the [Proxy Setup LAT Config] section, otherwise setup fails.
[Cache Config] | Drive=drive size_min size_max | Specifies the disk drives to be used for caching. You can specify one or more drives to use for caching. The default size for both min_size and max_size is 100. If not specified, it defaults to the first NTFS file system partition large enough for adequate caching. The drive specified must have at least one NTFS partition, otherwise setup fails. If the amount of available space is lower that min_size, setup fails. If the maximum size that is specified exceeds the available space, the cache size is set to the size of the available space. If you install ISA Server in firewall mode, then you should omit the [Proxy Setup Cache Config] section.
[Cache Config] | Enable Cache={1,0} | Specifies whether caching is enabled. If set to 1, caching is enabled. If set to 0, caching is disabled. Default is 1; that is, caching is enabled when this option is not set.


Default settings

After installation, Microsoft Internet Security and Acceleration (ISA) Server uses the default settings that are listed in the table below.

Feature | Default Setting | For configuration information, see
User permissions | For stand-alone servers, members of the Administrators group on the local computer can configure array policy. For arrays, members of the Domain Admins and Enterprise Admins group can configure policies. | Configuring permissions
Local address table | Contains entries specified during installation process. | Constructing the local address table
Enterprise policy settings | When creating a new array, the array adopts the default enterprise policy settings. | Configuring enterprise policy settings
Access control | Unless the enterprise policy settings are configured to prohibit array-level allow rules, a default site and content rule named Allow Rule allows all clients access to all content on all sites always. However, since no protocol rules are defined, no traffic will be allowed to pass. | Configuring access policy
Packet filtering | Enabled in firewall mode and in integrated mode Disabled in cache mode | Configuring filtering and routing
Publishing | No internal servers are accessible to external clients. A default Web publishing rule discards all requests. | Configuring publishing
Routing | All Web Proxy client requests are retrieved directly from the Internet. | Routing Web requests
Caching | The cache size is set to the size that was specified during setup. Hypertext Transfer Protocol (HTTP) and File Transfer Protocol (FTP) caching are enabled. Active caching is disabled. | Configuring cache drives; Configuring expiration policy; Configuring active caching
Alerts | All alerts except the following are active: All port scan attack, Dropped packets, Protocol violation, and User Datagram Protocol (UDP) bomb attack. | Using alerts
Client configuration | When installed or configured, Firewall and Web Proxy clients have automatic discovery enabled. Web browser applications on Firewall clients are configured when the Firewall client is installed. | Configuring automatic discovery; Configuring Web Proxy clients


Installing and configuring ISA Server clients

  • Configuring SecureNAT clients
  • Installing and configuring Firewall Client software
  • Configuring Web Proxy clients
  • Automatic discovery


Configuring SecureNAT clients

Although secure network address translation (SecureNAT) clients do not require specific software to be deployed on the client computers, you must configure the network appropriately. This section details network considerations for SecureNAT clients. For information about specific topics, see:

  • Setting up the default gateway for SecureNAT clients
  • Resolving names for SecureNAT clients


Setting up the default gateway for SecureNAT clients

Secure network address translation (SecureNAT) clients do not require specific software to be deployed on the client computers. However, you must configure your network topology for the Microsoft Internet Security and Acceleration (ISA) Server computer to protect the SecureNAT clients and ensure that their requests are serviced.

Specifically, the default gateway for the SecureNAT clients must be properly configured. When setting the default gateway property, identify which type of network topology you are configuring:

  • Simple network. A simple network topology does not have any routers configured between the SecureNAT client and the ISA Server computer.
  • Complex network. A complex network topology has one or more routers bridging multiple subnets that are configured between a SecureNAT client and the ISA Server computer.

Configuring SecureNAT clients on a simple network

To configure SecureNAT clients on a simple network, you should set the SecureNAT client's Internet Protocol (IP) default gateway settings to the IP address of the ISA Server computer's internal network address card. You can set this manually, using the TCP/IP settings on the client. (These settings can be by clicking the Network icon in Control Panel.) Alternatively, you can configure these settings automatically for the client using the DHCP service.

Configuring SecureNAT clients on a complex network

To configure SecureNAT clients on a complex network, you should set the default gateway settings to the last router in the chain between the SecureNAT client and the ISA Server computer. In this case, you do not have to change the default gateway settings for the SecureNAT clients.

Optimally, the router should use a default gateway that routes along the shortest path to the ISA Server computer. Also, the router should not be configured to discard packets destined for addresses outside the corporate network; ISA Server will determine how to route the packets.


Resolving names for SecureNAT clients

Secure network address translation (SecureNAT) clients will probably request objects both from computers in the local network and from the Internet. Thus, SecureNAT clients will require DNS servers that can resolve names both for external and internal computers.

Internet access only

For Internet access only, the SecureNAT clients should configure the Transmission Control Protocol/Internet Protocol (TCP/IP) settings to use the DNS servers on the Internet. You should create a protocol rule that allows the SecureNAT clients to use the DNS protocol and configure the DNS filter for the SecureNAT clients. For more information, see Create a protocol rule and Create an IP packet filter.

Internal network and Internet access

If the SecureNAT clients will request data both from the Internet and from the internal network servers, then the clients should use a DNS server located on the internal network. You should configure the DNS server to resolve both internal addresses and Internet addresses.


Installing and configuring Firewall Client software

You must install Microsoft Internet Security and Acceleration (ISA) Server before you can install the Firewall Client software. For information about specific topics, see:

  • Deploying groups of Firewall clients
  • Client setup log
  • Firewall client components
  • Advanced firewall client configuration
  • Configuring firewall client application settings


Deploying groups of Firewall clients

You can use the Windows 2000 Software Installation snap-in to centrally manage distribution of Firewall Client software. You distribute and configure the client software of Microsoft Internet Security and Acceleration (ISA) Server to groups of computers so that all users who require the applications automatically have the application on their desktops. The administrator or the technical personnel do not have to set up the application on each desktop.

When you assign an application to computers, the application is installed the next time the computer restarts.

For more information, see the Windows 2000 Help.


Client setup log

After you install Microsoft Internet Security and Acceleration (ISA) Server, you can install the Firewall Client software. For instructions, see Install Firewall Client software.

The Firewall Client setup creates a log file on the client computer each time client software is installed. The log file contains information about the setup, including information about which client applications were installed and which services started. You can use the log file to troubleshoot problems with setup. The log file name is Firewallc.log and is in the Firewall Client installation directory. ISA Server overwrites this log file each time you install the Firewall Client software.


Firewall Client components

Microsoft Internet Security and Acceleration (ISA) Server installs the following components on the client computer during client setup:

  • Mspclnt.ini, a shared client configuration file and the local domain table.
  • Msplat.txt, a shared client local address table.
  • The Firewall Client application.

You can change the default settings for all of these components after installation. The new configuration settings take effect only when the client configuration is refreshed.

Client local address table file

When the client setup program runs, it installs a file named Msplat.txt into the Microsoft Firewall Client folder on the client computer. The Msplat.txt file contains the local address table (LAT) which defines the Internet protocol (IP) addresses of your internal network. To keep the LAT files current, ISA Server regularly updates the Msplat.txt file from the server. Each time a Winsock application on that client attempts to establish a connection to an IP address, the LAT is used to determine whether the IP address is on the internal network or is external. If the address is internal, the connection is made directly. If the address is external, the connection is made through the Firewall service on ISA Server.

Because ISA Server overwrites the Msplat.txt file at regular intervals with a fresh version downloaded from the server, any changes you make at the client are lost each time the server updates the file. To avoid this, use a text editor to create a custom client LAT file named Locallat.txt and place it in the client Firewall Client folder. You can add additional IP address ranges that the client recognizes as part of the internal network. The client uses both the Msplat.txt and Locallat.txt files to determine which IP addresses are part of the internal network and which are on the Internet.

When you create the Locallat.txt file, enter IP address pairs in the file. Each address pair defines either a range of IP addresses or a single IP address. The following example shows a Locallat.txt file that has two entries. The first entry is an IP address range and the second entry is a single IP address. Note that the second entry is an IP address and not a subnet mask.

10.51.0.0      10.51.255.255
10.52.144.103  10.52.144.103

Client configuration file

When you install ISA Server, a master copy of the client configuration file, Mspclnt.ini, is created on the ISA Server. The file is stored in the folder on on which ISA Server is installed. Every firewall client receives a copy of the Mspclnt.ini file, which is stored in the Firewall Client installation folder on the client computer.

You can use ISA Management to reconfigure the master copy of the client configuration file. For more information, see Configuring firewall client application settings.

The following is a sample Mspclnt.ini file:

[Master Config]
Path1=\\EYLON\Mspclnt\
[Servers IP Addresses]
Name=EYLON
[Common]
Port=1745
Configuration Refresh Time (Hours)=6
Re-check Inaccessible Server Time (Minutes)=10
Refresh Give Up Time (Minutes)=15
Inaccessible Servers Give Up Time (Minutes)=2
Set Browsers To Use Proxy=1
WWW-Proxy=EYLON
WebProxyPort=8080


Firewall client application settings

When you set up Microsoft Internet Security and Acceleration (ISA) Server, you configure the array to which Firewall clients should connect when sending requests to the Internet. You can specify the array by DNS name or by Internet protocol (IP) address. For more information, see Configure the application settings of Firewall Client.

After installing the client software, you can modify the server name to which the client connects by specifying a different name either on the ISA Server computer to which the client currently connects or by changing the name in the Firewall client software. The configuration changes take effect after the firewall configuration is refreshed. For more information, see the Firewall Client help.

Advanced client configuration

For most Winsock applications, the default Firewall Client configuration works with no need for further modification. However, in some cases, you will need to add client configuration information as described below. You can store the client configuration information in one of the following locations:

  • Mspclnt.ini, which is the global client configuration file, located in the Firewall Client installation folder. The Mspclnt.ini file is periodically downloaded by the client from the ISA Server computer and overwrites previous versions. Consequently, you can make configuration changes at the ISA Server computer and the setting will automatically be downloaded to the client computers.
  • Wspcfg.ini, located in a specific client application folder. The ISA Server computer does not overwrite this file. Consequently, if you can make configuration changes in this file, they will apply only to the specific client.

The Firewall Client application looks for a Wspcfg.ini file in the directory where the client Winsock application is installed. If this file is found, it looks for a [WSP_Client_App] section, where WSP_Client_App is the name of the Winsock application without the .exe extension. If this section does not exist, the Firewall Client application next looks for the [Common Configuration] section. If this section also does not exist, it looks for the same sections in the Mspclnt.ini file. The first section found by this search, and only that section, is used to apply the application-specific configuration settings.

Sample Wspcfg.ini file

A sample [WSP_Client_App] section in a client configuration file is listed below for the WSP Client App.exe section.

[WSP_Client_App]
Disable=0
NameResolution=R
LocalBindTcpPorts=7777
LocalBindUdpPorts=7000–7022, 7100–7170
RemoteBindTcpPorts=30
RemoteBindUdpPorts=3000–3050
ServerBindTcpPorts=100–300
ProxyBindIp=80:110.52.144.103, 82:110.51.0.0
KillOldSession=1
Persistent=1
ForceProxy=i:172.23.23.23
ForceCredentials=1
NameResolutionForLocalHost=L

The following table describes the possible entries that can be placed in a configuration file for a Winsock application.

Entry | Description
Disable | Possible values: 0 or 1. When the value is set to 1, the Firewall service is disabled for the specific client application.
NameResolution | Possible values: L or R. By default, dotted decimal notation or Internet domain names are redirected to the ISA Server computer for name resolution and all other names are resolved on the local computer. When the value is set to R, all names are redirected to the ISA Server computer for resolution. When the value is set to L, all names are resolved on the local computer.
LocalBindTcpPorts | Specifies a Transmission Control Protocol (TCP) port, list, or range that is bound locally.
LocalBindUdpPorts | Specifies a User Datagram Protocol (UDP) port, list, or range that is bound locally.
RemoteBindTcpPorts | Specifies a TCP port, list, or range that is bound remotely.
RemoteBindUdpPorts | Specifies a UDP port, list, or range that is bound remotely.
ServerBindTcpPorts | Specifies a TCP port, list, or range for all ports that should accept more than one connection.
ProxyBindIp

Specifies an IP address or list that is used when binding with a corresponding port. Use this entry when multiple servers that use the same port need to bind to the same port on different IP addresses on the ISA Server computer. The syntax of the entry is:

ProxyBindIp=[port]:[IP address], [port]:[IP address]

The port numbers apply to both TCP and UDP ports.
KillOldSession | Possible values: 0 or 1. When the value is set to 1, it specifies that, if the ISA Server computer holds a session from an old instance of an application, that session is terminated before the application is granted a new session. This option is useful, for example, if an application crashed or did not close the socket on which it was listening. By closing the old session, ISA Server immediately discovers that the application was terminated and can release the port used by the old session immediately.
Persistent | Possible values: 0 or 1. When the value is set to 1, a specific server state can be maintained on the ISA Server computer if a service is stopped and restarted and if the server is not responding. The client sends a keep-alive message to the server periodically during an active session. If the server is not responding, the client tries to restore the state of the bound and listening sockets upon server restart.
ForceProxy Used to force a specific ISA Server computer for a specific Winsock application. The syntax of the entry is:

ForceProxy=[Tag]:[Entry]

where Tag equals i for an IP address or n for a name. Entry equals the address of the name. If the n tag is used, the Firewall service only works over IP.
ForceCredentials | Used when running a Windows NT or Windows 2000 service or server application as a Firewall client application. When the value is set to 1, it forces the use of alternate user authentication credentials that are stored locally on the computer that is running the service. The user credentials are stored on the client computer using the Credtool.exe application that is provided with the Firewall Client software. User credentials must reference a user account that can be authenticated by ISA Server, either local to ISA Server or in a domain trusted by ISA Server. The user account is normally set not to expire; otherwise, user credentials need to be renewed each time the account expires.
NameResolutionForLocalHost

Possible values are L (default), P, or E. Used to specify how the local (client) computer name is resolved, when the gethostbyname API is called.
The LocalHost computer name is resolved by calling the Winsock API function gethostbyname() using the LocalHost string, an empty string, or a NULL string pointer. Winsock applications call gethostbyname(LocalHost) to find their local IP address and send it to an Internet server.

When this option is set to L, gethostbyname() returns the IP addresses of the local host computer. When this option is set to P, gethostbyname() returns the IP addresses of the ISA Server computer. When this option is set to E, gethostbyname() returns only the external IP addresses of the ISA Server computer—those IP addresses that are not in the local address table.
ControlChannel | Possible Values: Wsp.udp (default) or Wsp.tcp. Specifies the type of the control-channel used.


Configuring Firewall client settings

By default, after the Firewall Client application is installed, Microsoft Internet Security and Acceleration (ISA) Server updates and downloads the client configuration file to the client each time a client computer is restarted and every six hours after an initial refresh is made.

It is also possible to download the client configuration file from the server or change the server used for downloads at any time by using the Firewall Client application.

You can use ISA Management to modify firewall client configuration settings. For instructions, see Configure Firewall Client settings.

The table below lists the entries that you can include when configuring the Firewall Client application settings. The first column lists the sections in the Firewall Client configuration file. The second column lists the keys that can be included in each section. The third column describes the values to which the keys can be set.

Section | Key | Description (Value)
[Master Config] | Path1 | A universal naming convention (UNC) path to the installation share folder.
[Servers IP addresses] | Name | The computer or DNS name (if there is a DNS server available) for the ISA Server computer used by the client. If participating in an array, the DNS name for the array. (This entry does not appear if an Internet Protocol (IP) address is used.)
[Servers IP addresses] | Addr1 | The IP address of the ISA Server computer used by the client. If participating in an array, the IP address of each array member. (This entry does not appear if a computer or DNS name is used.) This entry can be used if there is not a DNS server available on your internal network.
[Common] | Port | The port that ISA Server uses for the control channel. This value is rarely changed. If it needs to be changed, edit the server master copy of the Mspclnt.ini file. It should be changed only if there is a conflict with another service on the server. This value should never be edited in the client copy of the Mspclnt.ini file.
[Common] | Configuration Refresh Time (Hours) | The interval, specified in hours, after which the client asks the server to download a fresh copy of the local address table (Msplat.txt).
[Common] | Re-check Inaccessible Server Time (Minutes) | The interval, specified in minutes, during which the Firewall client does not try to redirect a request by using the specific inaccessible server. The default value is 10 minutes.
[Common] | Refresh Give Up Time (Minutes) | The interval, specified in minutes, after which the Firewall client attempts to refresh the configuration if a previous refresh attempt has failed. The default value is 15 minutes.
[Common] | Inaccessible Servers Give Up Time (Minutes) | The interval, specified in minutes, during which the Firewall client does not try to redirect a request if all servers are marked as inaccessible. After this interval, the client tries one of the servers even if the Refresh Give Up Time has not expired. The default value is 2 minutes.
[Common] | Set Browsers To Use Proxy | If this value is set to 1, the Client setup program configures the browser of the client computer to use the ISA Server computer defined in the WWW Proxy field. If the value is set to 0, the client setup program does not configure clients to use an ISA Server computer.
[Common] | Configuration URL | If Set Browser to Use Proxy is set to 1, the location of the configuration script that is downloaded to a client browser to use for routing into a particular ISA Server computer in an array. The URL has the form http://Servername/Array.dll?Get.Routing.Script where Servername is the name of the ISA Server computer that stores the script.
[Common] | LocalDomains | A list of suffixes for names that are resolved locally, separated by commas. Domain names that end in the listed strings are resolved at the client.
[Common] | WWW-Proxy | If Set Browsers to Use Proxy is set to 1, the Client Setup program configures client browsers to use the ISA Server computer named here.
[Common] | WebProxyPort | The listen-on port used by the Web Proxy service. If Set Browsers to Use Proxy is set to 1, the Client Setup program configures client browsers to use the port named in that box. You should usually use port 8080.
[COMMON] | Set Browsers to use Auto Config | Possible values: 0 or 1. If this value is set to 1, the Client Setup program configures client browsers to use the specified configuration Uniform Resource Locator (URL).
[COMMON] | AutoDetect ISA Servers | Possible values: 0 or 1. If set to 1, the Client Setup program configures Firewall Client to automatically detect ISA Server using the WSPAD protocol.
[COMMON] | Set Browsers to use Auto Detect | Possible values: 0 or 1. If set to 1, the Firewall Client setup program enables Microsoft Internet Explorer WPAD auto-detection.


Configuring Web Proxy clients

You do not have to install any software to configure Web Proxy clients. However, you must configure the Web browser applications on the client computers to use the Microsoft Internet Security and Acceleration (ISA) Server computer as the proxy server.

The default configuration URL is

http://Computer_name/array.dll?Get.Routing.Script

where Computer_name is the name of the ISA Server computer. This is the URL where the configuration script is located. ISA Server automatically generates this configuration script based on the direct access and backup route options.

You can set an option by which ISA Server automatically downloads a client configuration script located on the ISA Server computer every time a Web browser is opened. The output of this script provides an ordered series of ISA Server computers that the browser uses to retrieve the object that is specified by the URL.

The script is stored at a specific URL on any ISA Server computer in an array. You can easily update all Web browser settings without having to reconfigure each individual Web browser. Microsoft Internet Explorer version 3.02 and later and Netscape 2.0 and later support this feature.

Automatic Web browser configuration for Firewall clients

You can configure ISA Server so that the Firewall client's Web browser is configured during setup. This way, the client's Web browser will use the specified automatic configuration script. The script is based on the options set in Advanced Client Configuration. For more information, see Enable Web browser configuration during client setup.

Configuring the browser on the ISA Server computer

If you use a Web browser on the ISA Server computer, you must configure the browser to use the Internet protocol (IP) address of the server network adapter that is connected to the internal network. Do not use the server computer name or DNS name.

If you configure the server browser to use the computer or DNS name, the name is resolved to the IP address of the external network interface connected to the Internet. When this occurs, requests from the browser are denied because the local address table (LAT) does not contain the external IP address and access is denied. Consequently, you must configure the browser on the server to connect through the Web Proxy service.

Web Proxy client considerations

If you use a RealPlayer application, do not configure it as a Web Proxy client.

Direct access

You can configure the computers on the local network that can be accessed directly by the client by creating a Web browser exception list. You can also specify that all computers included in the local domain table (LDT) can be accessed directly by the client. For more information, see Configure a server for direct access Configuring the local domain table.


Configuring automatic discovery

At first, it is a simple task to configure the Microsoft Internet Security and Acceleration (ISA) Server computer to which Firewall clients and Web Proxy clients connect. However, subsequent modifications can be time consuming, particularly for roaming clients, who may require constant adjustments. The automatic discovery feature of ISA Server allows you to configure clients so that they automatically discover the appropriate ISA Server computer. In this way, roaming clients can connect to the ISA Server computer, as appropriate and when necessary. By enabling automatic discovery, Web Proxy and Firewall clients all automatically discover the appropriate ISA Server computer. For more information, see Publish automatic discovery.

Configuring WPAD and WSPAD on the DNS or DHCP server

When automatic discovery is enabled, the Firewall client or the Web Proxy client requests an object from the ISA Server computer that is configured to fulfill requests. If the ISA Server does not respond and if automatic discovery is enabled for the client, it starts the automatic discovery process.

ISA Server uses the Web Proxy Autodiscovery Protocol (WPAD) entry to determine the appropriate Winsock Proxy Autodetect (WSPAD) entry. You do not have to configure the WSPAD entry explicitly on the DNS server.

Automatic discovery can be configured using DHCP for clients running Windows 2000, Windows 98, and Windows ME.

Automatic discovery can be configured using DNS for clients running Windows 2000, Windows NT 4.0, Windows 98, and Windows ME. Automatic discovery will work if DNS is statically configured for Windows 95 clients.

For more information, see Configure DNS for automatic discovery of ISA Server and Configure DHCP for automatic discovery of ISA Server.

Automatic discovery for Firewall clients

When you configure the Firewall client, you indicate a particular ISA Server computer to which the client should connect. You can also configure the automatic discovery feature so that the Firewall client will automatically discover which ISA Server computer it should use.

If automatic discovery is configured, here are the steps it takes.

  1. When the client makes a Winsock request, the client connects to the DNS or DHCP server.
  2. The DNS server or the DHCP server should have a WPAD entry which points to a WPAD server that indicates the ISA Server computer. For more information, see Configuring WPAD and WSPAD on the DNS or DHCP server.
  3. The requests of the client will be fulfilled by the ISA Server computer, as identified by the WSPAD entry in the DNS server or DHCP server.

For more information, see Set automatic discovery for firewall clients.

Automatic discovery for Web Proxy clients

ISA Server provides similar support for Web Proxy clients. You can configure the automatic discovery feature so that roaming Web Proxy clients will always connect to the appropriate ISA Server computer when they log on to the Internet.

Automatic discovery is supported for Internet Explorer 5 and later.

If automatic discovery is configured, ISA Server performs these steps:

  1. When the client makes a Web request, the client connects to the DNS or DHCP server.
  2. The DNS server or the DHCP server should have a WPAD entry, which points to a WPAD server that indicates the ISA Server computer.
  3. The requests of the client will be fulfilled by the ISA Server computer, as identified by the WPAD entry in the DNS server or DHCP server.


Administering ISA Server

This section describes background concepts on administering Microsoft Internet Security and Acceleration (ISA) Server. For specific information, see:

  • Getting Started Wizard and taskpads
  • Administering stand-alone servers, arrays, and the enterprise
  • Applying enterprise policy
  • Promoting stand-alone servers
  • Controlling array membership
  • Remote administration
  • Configuring permissions
  • Storing an array configuration
  • Backing up and restoring an array configuration
  • Backing up and restoring an enterprise configuration


Getting Started Wizard and taskpads

Microsoft Internet Security and Acceleration (ISA) Server includes graphical taskpads and wizards. These simplify navigation and configuration for common tasks. ISA Server also includes a Getting Started Wizard that you can use to help you with post-installation configuration.

Getting Started Wizard

As part of the installation process, you can run the Getting Started Wizard when you first start ISA Server. The Getting Started Wizard will walk you through the steps of defining and configuring initial enterprise and array policies. After you finish using the tool, you have configured ISA Server to secure your network's connection to the Internet.

The Getting Started Wizard helps you perform the following tasks:

  • Configure enterprise policy settings (for array installation only).
  • Create enterprise-level policy elements (for array installation only).
  • Create enterprise-level protocol rules (for array installation only).
  • Create enterprise-level site and content rules (for array installation only).
  • Create array-level policy elements.
  • Create array-level protocol rules.
  • Create array-level site and content rules.
  • Set system security level.
  • Configure packet filtering.
  • Configuring routing and chaining.
  • Create cache policy.

For more information, see Protocol rules, Site and content rules, ISA Server system security, Using packet filtering, ISA Server cache, Applying enterprise policy, Applying enterprise policy, Policy elements, Routing requests from Firewall and SecureNAT clients, and Routing Web requests.

Taskpads

You can run ISA Management in Taskpad view or in Advanced view. Taskpads contain shortcuts for performing the most common configuration tasks in the details pane of the console tree. Taskpad view is the default view in ISA Management and simplifies many common configuration steps. However, you can complete some less-commonly performed tasks only in Advanced view.

The Taskpad view is available for most objects in the console tree.

For more information, see View taskpad.


Administering stand-alone servers, arrays, and the enterprise

You install Microsoft Internet Security and Acceleration (ISA) Server as a stand-alone server or as an array member. In both cases, ISA Management shows the server as belonging to an array.

When you install an array member, you specify the array to which it belongs.

For stand-alone servers, as part of the installation process, an array with the same name as the ISA Server computer is created.

For more information, see The enterprise, arrays, and stand-alone servers.

Array policy for stand-alone servers

Stand-alone servers have an array policy. Depending on installation mode, the array policy consists of:

  • Policy elements. Includes schedules, bandwidth priorities, destination sets, client address sets, protocol definitions, content groups, and dial-up entries. For more information, see Policy elements.
  • Access policy rules. Includes site and content rules, protocol rules, and Internet Protocol (IP) packet filters. For more information, see Configuring access policy.
  • Publishing rules. Includes server publishing and Web publishing rules. For more information, see Configuring publishing.
  • Cache configuration. Includes cache size, expiration policy. For more information, see Configuring ISA Server cache.
  • Routing rules. Determine whether a Web Proxy client request is retrieved directly from the specified destination or redirected to an upstream server. For more information, see Routing Web requests.
  • Bandwidth rules. Set priorities for any request passing through ISA Server. For more information, see Configuring bandwidth rules.
  • Local address table and local domain table configuration. These tables include the IP addresses or names of all internal computers. For more information, see Configuring the local address table and Configuring the local domain table.

Array and enterprise policies for array members

If you install ISA Server as an array member, enterprise policy settings determine whether an array policy can be created and which types of rules can be included in the array policy. See Applying enterprise policy for more information.

The enterprise administrator is responsible not only for creating and configuring enterprise policy, but also for determining how and if that policy should be applied to all the arrays in the enterprise.

The enterprise policy includes site and content rules and protocol rules. The enterprise policy can be applied to any array and can be augmented by the array's own policy. This enables administrators at branch and departmental levels to adopt governing enterprise policies.

More than one enterprise policy can be created. Each enterprise policy can be applied to one or more arrays. You can configure permissions for the enterprise policies, limiting which administrators can configure the rules. For more information, see Configuring permissions.

You can also create policy elements at the enterprise level. These policy elements can be used by enterprise-level rules or by array-level rules.

If the array uses only an array policy (no enterprise policy), then you cannot modify the array's policy settings to use an enterprise policy. Likewise, if the array uses an enterprise policy, you cannot change the array's policy settings to use only an array policy (set to Array policy only.

For configuration instructions, see Create an enterprise policy.

Managing remote arrays

You can use ISA Server to manage more than one stand-alone server at a time. Each stand-alone server belongs to its own array. Each has its own array policy, which you can configure by creating rules and modifying properties. For more information, see Using remote administration.

For array members, all the arrays in the enterprise are displayed in ISA Management. You can only configure the arrays in the enterprise only if you have the appropriate permissions. For more information, see Configuring permissions.


Promoting stand-alone servers

You can promote stand-alone servers. When the stand-alone server is promoted, a new array is created. The ISA Server computer is a member of that array.

When you promote a stand-alone server, if you are not an enterprise administrator, then the new array adopts the default enterprise policy settings. In this case, all enterprise policy rules apply to the array. If the enterprise policy allows publishing, then any publishing rules defined for the array are retained.

Note that, depending on the default enterprise policy settings, some existing array policy rules may be deleted. If the default enterprise policy settings are only for enterprise policy, then all array policy rules will be deleted. If the default enterprise policy settings are enterprise policy and array policy, then all array policy rules that allow access will be deleted.

If you are an enterprise administrator, then you can configure the enterprise policy settings. You can choose to use the default enterprise policy settings or configure custom enterprise policy settings.

For instructions on promoting stand-alone servers, see Promote a stand-alone server.


Configuring enterprise policy settings

The enterprise administrator can select how the enterprise policy should be applied at the array level:

  • Enterprise policy only. In this case, the administrator at the enterprise level dictates that only the selected enterprise policy applies. No new rules can be added at the array level.
  • Combined enterprise and array policy. In this case, an array policy is added to the enterprise policy. The enterprise policy overrides the array policy. That is, the array policy can impose additional limitations, but cannot be more permissive than the enterprise policy.
  • Array policy only. In this case, no enterprise policy is applied to the array. The array administrator can create any rule to allow or deny access.

If the array uses only an array policy (without an enterprise policy), then you cannot modify the array's policy settings to use an enterprise policy. Likewise, if the array uses an enterprise policy, you cannot set the array's policy settings to use only an array policy (Array policy only).

For more information, see Configure default enterprise policy settings.

You can change the default enterprise policy settings, but only if no array in the enterprise is currently using these default settings. If an array is currently using the default settings, change the array's enterprise policy settings to Use custom enterprise policy settings, then change the default enterprise policy settings.

Publishing rules cannot be created at the enterprise level. However, the enterprise administrator can specify whether an array is allowed to publish servers by creating Web publishing rules or server publishing rules.

Similarly, packet filtering cannot be enabled at the enterprise level. However, the enterprise administrator determines whether packet filtering is forced at the array level. Alternatively, the enterprise administrator can allow the array administrator to decide if packet filtering should be made available.

For more information, see Allow array-level publishing rules and Force array-level packet filtering

Each enterprise policy can be configured to allow different administrators privileges to modify the policy. For more information, see Configuring permissions.


Controlling array membership

Before you can install Microsoft Internet Security and Acceleration (ISA) Server as an array member, you must initialize the enterprise and configure basic enterprise defaults. For more information, see Initialize the enterprise.

You create the first array when you install an ISA Server computer as an array member. You can subsequently create new arrays. ISA Server computers that belong to arrays can join, leave, or be removed from an array, thereby changing an array's membership list.

To move a computer to another array, uninstall ISA Server. Then, reinstall ISA Server, specifying the name of the new array which the server should join.

When you change an enterprise configuration by adding or removing an array, the information is stored in Active Directory of the network to which the enterprise is connected. Active Directory replicates the information to the other domain controllers. ISA Server configuration is updated when the relevant domain controller is replicated.

It is recommended that you back up the array configuration whenever you change array membership in any way. When you restore an array configuration, ISA Server uses the membership list specified in the backup file.

Although anyone can query the array members, only the system administrator can change the array membership.

ISA Server computers that were installed as a stand-alone server cannot join arrays. You can promote stand-alone servers to become array members. For more information, see Promoting stand-alone servers.

All array members must be in the same domain and the same site. If an array member changes domain or site, ISA Server services will not function properly.

For more information, see Create an array.


Remote administration

Microsoft Internet Security and Acceleration (ISA) Server supports remote management of ISA Server computers. You can remotely manage an ISA Server computer by doing one of the following:

  • Installing ISA Management and connecting to the ISA Server computer.
  • Running Terminal Server client and connecting to the ISA Server computer.

Remotely managing another computer

As part of the installation process, you can choose to only install ISA Management. After you install it, you can run ISA Management, and connect to a remote ISA Server computer to manage it. For more information, see Manage a remote stand-alone server.

To manage a remote ISA Server computer, you must be a member of the Administrators or Server Operators group on the remote computer. Also, both the user account and the server computer must be members of the same domain or within trusted domains.

Remotely managing an enterprise

To administer an array member remotely, choose to manage the enterprise. For instructions, see Manage a remote enterprise.

Terminal Server

You can also remotely manage a computer with Terminal Server. Perform the following steps:

  1. Install Terminal Server on the ISA Server computer.
  2. Install Terminal Client on the computer that will manage the ISA Server computer.


Configuring permissions

Microsoft Internet Security and Acceleration (ISA) Server uses access control, which enables you to configure permissions. Permissions define the type of access granted to a user or group for an object or object property. You can configure permissions for the following ISA Server objects:

  • Enterprise policy settings
  • Enterprise policies
  • Array
  • Alerts
  • Sessions
  • Gatekeeper

The permissions attached to an object depend on the object type. Enterprise policy settings, enterprise policies, array, and Gatekeeper objects have the Read and Full Control basic permissions.

The Alerts object has the Read Alerts Information and Reset Alerts basic permissions.

The Sessions object has the Read Sessions Information and Stop Sessions permissions.

Default Storage Permissions

You can use ISA Management to configure permissions for arrays, alerts, sessions, and Gatekeeper. The table below lists the default permissions assigned to each object upon installation.

Object | Permissions
Enterprise | Enterprise Admins, and local system have Full Control permission. All authenticated users have Read permission.
Enterprise policy | Enterprise Admins, and local system have Full Control permission. All authenticated users have Read permission.
Array | Enterprise Admins, Domain Admins, local Administrators, and local system have Full Control permission. All authenticated users have Read permission.
Alerts | Enterprise Admins, Domain Admins, local Administrators, and local system have Read Alerts Information and Reset Alerts permissions. All authenticated users have Read Alerts Information permission.
Sessions | Enterprise Admins, Domain Admins, local Administrators, and local system have Read Sessions Information and Stop Sessions permissions. All authenticated users have Read Sessions Information permission.
Gatekeeper | Enterprise Admins, Domain Admins, local Administrators, and local system have Full Control, Modify, and Read permissions. All authenticated users have Read permission.

Reconfiguring permissions

Perform the following steps to limit the permissions that allow any authenticated user to read the storage:

  1. Use Active Directory Users and Computers in Administrative Tools to create the following:
    • For each domain, a global group called ISA Domain Servers, which includes all the computers in all the arrays in that domain.
    • For each domain, a global group called ISA Array_Name Array Servers, which includes all the computers in the specific array.
    • At the root domain (the enterprise), a local group called ISA Enterprise Readers, which includes ISA Domain Servers and Domain Admins for each domain in the enterprise.
  2. For each object, remove permissions for authenticated users.
  3. For the specific array, configure Read permission for the ISA Array_Name Array Servers group.
  4. For the enterprise, configure Read permission for the ISA Enterprise Readers group.
  5. For the default enterprise policy, configure Read permission for the ISA Enterprise Readers group.
  6. For all other enterprise policies, configure Read permission for the ISA Array_Name Array Servers group that corresponds to each array that uses the policy.

For configuration instructions, see Configure array permissions, Configure enterprise policy setting permissions, and Configure enterprise policy permissions.

Permissions for stand-alone servers

Upon installation, default permissions are assigned to the following objects: array, alerts, sessions, and Gatekeeper. You can use ISA Management to configure permissions for arrays, alerts, sessions, and Gatekeeper. The table below lists the default permissions assigned to each object upon installation.

Object | Permissions
Array | Local administrators and local system have Full Control permission.
Alerts | Local administrators and local system have Read Alerts Information and Reset Alerts permissions. All authenticated users have Read Alerts Information permission.
Sessions | Local administrators and local system have Read Sessions Information and Stop Sessions permissions. All authenticated users have Read permission.
Gatekeeper | Local administrators have Full Control, Modify, and Read permissions. All authenticated users have Read permission.


Storing an array configuration

Configuration information for arrays is stored in Active Directory, but configuration information for stand-alone servers is stored in the registry.

When you promote a stand-alone server to an array, its configuration information is installed in Active Directory.

When you change any member server properties, the changes are applied to all the member servers. Each member has the same information as all the other members, thereby ensuring that the system is fault-tolerant.

Some configuration data is specific to the server. For example, static filters are applied at the server level. Cache content and activity logs are stored on the local computer. Reports are generated for all the servers in the array, but are stored on a specific server. Server-specific configuration information is not saved when you back up the array configuration.

Because every member of the array has current information about every other array member, a client only needs to query a single array member. This provides additional fault tolerance for the client.

Most array information can be saved when you back up the array.

For more information, see Promote a stand-alone server, Arrays and stand-alone servers, and Backing up and restoring an array configuration.


Backing up and restoring an array configuration

Microsoft Internet Security and Acceleration (ISA) Server includes a backup and restore feature that enables you to save and restore most array configuration information. The array configuration parameters can be backed up and stored locally in a file. You can save your configuration to any directory and file name on the local computer. It is recommended that you save the backup files to an NTFS disk partition for maximum security.

If ISA Server is set up as an array member, its configuration information is stored in Active Directory. If ISA Server is installed as a stand-alone server, the configuration settings are stored in the server's local registry.

Backing up the configuration

ISA Server backs up all of the array's general configuration information. This includes access policy rules, publishing rules, policy elements, alert configuration, cache configuration, and array properties.

Some server-specific configuration information is not backed up. This includes cache content, activity logs, reports, and effective enterprise policy.

It is recommended that you back up the array configuration after any major modification to the array, including:

  • Changing the enterprise policy settings
  • Changing the array's installation mode
  • Adding, removing, or renaming a member server
  • Changing cache size or location
  • Adding or removing Web filters

It is recommended that you also periodically back up the server-specific configuration. You can use Backup to back up ISA Server information, including passwords, local registry parameters, cache store configuration information, H.323 Gatekeeper configuration, reports, local settings for application filters, performance tuning parameters, cache contents, and log files. Although the Backup can be used to back up server-specific information, it cannot back up array configuration information because the array information is stored in Active Directory. It is therefore recommended that you back up the array configuration before using Backup. It is also recommended that you restore the array configuration immediately after using Restore.

If an array has no members, then the passwords in the backup file cannot be deciphered.

For configuration instructions, see Back up an array configuration.

Backing up a stand-alone server configuration

You can back up a stand-alone server configuration. The configuration can be restored to the same stand-alone server.

Restoring the configuration

The restore process reconstructs most configuration parameters that pertain to the array.

For configuration instructions, see Restore an array configuration.

You cannot backup an array configuration and subsequently restore the configuration to another array or stand-alone server.

You cannot restore an enterprise configuration (.bef file) to an array.

You cannot restore an array configuration if the array to which the configuration is being restored does not use the same enterprise policy settings. Enterprise policy settings determine:

  • If an enterprise policy is used.
  • If array policy is allowed.
  • If packet filtering is forced on an array.
  • If publishing rules can be created for the array.


Backing up and restoring an enterprise configuration

All enterprise configuration parameters can be backed up and stored locally in a file. You can save your configuration to any directory and file name you choose. The backup process saves all enterprise-specific information, including all enterprise policies and enterprise policy elements. The backup process also saves information about which arrays use which enterprise policies.

The enterprise backup process does not save array-specific configuration information. For more information, see Backing up and restoring an array configuration.

You can fully restore the enterprise configuration if that configuration has been backed up and saved to a file. The restore operation rolls back all configuration parameters that pertain to the enterprise.

Caution

  • Restoring an enterprise configuration may impact policies for arrays that use enterprise policies, so after you back up the enterprise configuration, back up all the arrays in the enterprise. After you restore the enterprise configuration, restore all the array configurations. For more information on enterprise and array policies, see Applying enterprise policy.

For instructions, see Back up an enterprise configuration and Restore an enterprise configuration.


Setting network configuration

This section introduces the key concepts and terminology of Microsoft Internet Security and Acceleration (ISA) Server network configuration. For information about specific topics, see:

  • Configuring the local address table
  • Configuring the local domain table
  • Routing requests from Firewall and SecureNAT clients
  • Routing Web requests
  • Configuring dial-on-demand
  • Configuring outgoing Web request properties
  • Configuring incoming Web request properties
  • Using an ISA Server virtual private network


Configuring the local address table

If you install Microsoft Internet Security and Acceleration (ISA) Server in firewall mode or in integrated mode, as part of the setup process, you must specify the local address table (LAT). The local address table is a table of all internal Internet protocol (IP) address ranges used by the internal network behind the ISA Server computer. ISA Server uses the LAT to control how machines on the internal network communicate with external networks.

Typically, the LAT contains all IP addresses associated with the internal network cards on the ISA Server computer, in addition to the private IP address ranges defined by the Internet Assigned Numbers Authority (IANA).

For configuration instructions, see Configure the local address table.

ISA Server can construct the LAT, based on your Windows 2000 routing table. You can also select the private IP address ranges, as defined by the Internet Assigned Numbers Authority (IANA) in RFC 1918. These three blocks of addresses are reserved for private intranets only and are never used on the public Internet.

The default LAT includes addresses known as private IP addresses. These addresses are listed in the local routing table. Because of the way ISA Server reads the routing table for Windows 2000 Server, the default LAT may not contain all of your organization's addresses. You can add these addresses manually. You can also add addresses that are not part of your network as local addresses.

The LAT is maintained centrally at the ISA Server computer. Firewall clients automatically download and receive LAT updates at preset intervals. When a Firewall client requests an object, the client checks the LAT. If an IP address request is in the LAT, then the Firewall client requests the object directly. If the IP address request is not in the LAT, the client asks the ISA Server computer to request the object on its behalf.

Secure network address translation (SecureNAT) clients do not have a local copy of the LAT. Therefore, when a SecureNAT client requests an object, the request is sent through ISA Server. If the request is to an external IP address, then ISA Server makes the request on behalf of the client.

For instructions on constructing the LAT, see Construct a local address table.

Windows 2000 routing table

When ISA Server constructs the LAT, it uses the Windows 2000 routing table to determine which address ranges in your internal network are internal. If you fail to set the routing table correctly, the ISA Server LAT may not be built correctly. This can result in a client request for an internal IP address being routed to the Internet or being redirected through the Firewall service. You can use the Windows 2000 routing utility to configure the routing table accordingly. Then, during installation, you can construct the LAT, based on your Windows 2000 routing table.


Configuring the local domain table

In the past, the naming scheme was an easy way to distinguish between local computers and computers that were external to the organization. External machines had name extensions (periods in their name) and local machines did not. Now, as networks grow, server names are also growing and often include extensions, even in their internal names.

For this reason, you can use Microsoft Internet Security and Acceleration (ISA) Server to define a local domain table (LDT), which lists all the domain names in the internal network that are served by the ISA Server computer. When a client requests an object from a computer and requires name resolution, the client checks the LDT. If the domain name does not appear in the LDT, then the client requests that ISA Server resolve the domain name on its behalf.

After the name resolution server returns the Internet protocol (IP) address of the destination server, the LAT is used to determine whether to go directly to that address or through ISA Server.

Clients use the LDT to determine if a name resolution request should be performed directly or via ISA Server. Firewall clients maintain a copy of the LDT, which is updated regularly, on their computer. When a Firewall client attempts to resolve a name, it checks the LDT. If the name is in the LDT, then the Firewall client resolves the name directly. Otherwise, it requests that ISA Server resolve the name by passing the request to a DNS server on the Internet.

For instructions on configuring the LDT, see Configure the local domain table.

Secure network address translation (SecureNAT) clients do not use the LDT, so they do not retain a local copy of the LDT. Therefore, SecureNAT clients require access to DNS servers so they can resolve both internal and external server names.


Routing requests from Firewall and SecureNAT clients

For Firewall clients, you can use Firewall chaining to configure how requests should be routed. For background information, see Chaining and routing.

You can select to route requests from Firewall clients to one of the following:

  • Directly to the Internet, with or without a dial-up connection
  • To an upstream proxy server, with or without a dial-up connection

For more information, see Configure firewall chaining.

Dial-up entries

You can select whether ISA Server should use a dial-up entry to service client requests. In this case, the active dial-up entry is used. For more information, see Configuring dial-up entries.

Upstream proxy server

You can route client requests to an upstream ISA Server or a Microsoft Proxy Server 2.0 computer. In this case, you can specify a primary route.

Authentication

When Firewall client requests are sent to an upstream proxy server, you can enable password authentication. This specifies the authentication parameters that are used between an ISA Server and an upstream server. For more information, see Chained authentication.


Routing Web requests

As part of the network configuration, you can create routing rules, which determine whether a Web Proxy client request is:

  • Retrieved directly from the specified destination
  • Sent to an upstream server
  • Redirected to an alternate site

The upstream proxy server can be a Microsoft Internet Security and Acceleration (ISA) Server computer or a Microsoft Proxy Server 2.0 server.

Destinations

Routing rules apply to both incoming Web requests and outgoing Web requests. For more information, see Configuring destination sets. For configuration instructions, see Specify the destination set for a routing rule.

Action

You can configure ISA Server to process client requests by:

  • Retrieving the object directly from the specified destination.
  • Routing the request to a specific upstream ISA Server or Proxy Server 2.0 computer. In this case, you can also specify a backup route if the primary route is unavailable.
  • Redirecting them to a hosted site. In this case, the request is routed to the specified Web site.

ISA Server uses the backup route when the primary route is unavailable. The ISA Server computer polls the upstream server that is specified as the primary route periodically to see if it is available. As soon as the primary route is available, requests are sent to that server, rather than the server on the backup route.

In certain cases, the upstream server may require that the downstream proxy pass authentication. For those cases, credentials must be passed. These credentials are used by the upstream server to authenticate the downstream server. For more information, see Chained authentication.

For configuration instructions, see Configure how routing rules retrieve requests.

Dial-up entry

If you route client requests by retrieving the object from the specified destination or by routing the request to an upstream server, you can specify whether ISA Server should use a dial-up entry to service the request. In this case, the active dial-up entry is used. For more information, see Configuring dial-up entries

You can configure ISA Server to dial out when using the primary route. You can also configure ISA Server to dial out when using the backup route. For more information, see Configure how routing rules retrieve requests and Configuring dial-on-demand.

Caching

Before ISA Server determines how the request should be routed, ISA Server checks if a valid copy of the object exists in the cache. An object is considered valid if its time-to-live period (TTL) did not expire, as specified in the Hypertext Transfer Protocol (HTTP) caching properties or on the object itself. Depending on how you configure the routing rule's cache properties, ISA Server will retrieve the object from the cache. You can configure ISA Server to do one of the following:

  • Route the request only if a valid object does not exist in the cache.
  • Route the request if any version of the object does not exist in the cache.
  • Never route the request.

For more information, see How caching works. For configuration instructions, see Configure how Web objects are cached.

You can also configure the routing rule so that the requested object is never saved to the cache. For more information, see Cache policy and cache filtering and Configure how Web objects are cached.

Bridging

For outgoing Web requests, ISA Server enhances standard routing functionality with an Secure Sockets Layer (SSL) bridging feature, which allows you to configure how traffic should be routed to the upstream server. For more information, see SSL bridging.

When you create a routing rule, you can configure how HTTP and SSL requests should be redirected: as HTTP requests or as SSL requests. If requests are redirected as SSL requests, then the ISA Server computer re-encrypts the packets before passing them on. In other words, a new secure channel is established for the communication with the upstream server.

The upstream Web server may require a client certificate. In this case, configure ISA Server to authenticate with a specific client-side certificate. For instructions on configuring client-side certificates, see Use client-side certificate to authenticate to upstream server.

For more information, see Configure how to redirect HTTP requests and Configure how to redirect SSL requests.

Rule order

Routing rules are ordered, with the default routing rule processed last. For each new connection, the ISA Server computer processes the routing rules, in order. The first rule is processed first. If the request matches the conditions specified by the rule, the request is routed, redirected, and cached accordingly. Otherwise, the next rule is processed. This continues until the last, default rule is processed, and applied to the request.

For more information on how ISA Server processes Web requests, see Controlling incoming requests and Controlling outgoing requests. For instructions on ordering routing rules, see Change the order of a routing rule.

Default routing rule

When you install ISA Server, it configures a default routing rule. The default rule is initially configured so that all requested objects should be retrieved from the ISA Server cache. If the object is not in the cache, then it should be retrieved directly from the Internet.

The default routing rule is ordered last. You can modify the default routing rule's action and how it redirects outgoing Web requests, but you cannot delete it.

Example

Suppose you want all HTTP requests for sites in the United Kingdom to be routed to the ISA Server computer in the United Kingdom branch office, called UK_Array. You can create a routing rule to enforce this policy, configuring the following parameters:

  • Set Destination set to a set that includes *.uk.
  • Set Action to Route requests to upstream proxy server.
  • Set the Primary route to Upstream proxy server.
  • Configure the server to UK_Array.


Configuring dial-on-demand

You can configure Microsoft Internet Security and Acceleration (ISA) Server to dial out to the Internet only when required—for example, because the requested object is not in the ISA Server cache.

To enable dial-on-demand, perform the following steps:

  1. Create a network dial-up connection. For instructions on creating network dial-up connections, see Windows 2000 Help.
  2. Create a dial-up entry.
  3. Enable dialing for the Firewall service by selecting Use dial-up entry.
  4. Enable dialing for the Web routing, by selecting the specific routing rule's Use dial-up entry for primary route and Use dial-up entry for backup route check boxes.
  5. Verify that a default gateway is not configured on any of the internal interface cards on the ISA Server computers in the array.
For more information, see Create a dial-up entry, Configure firewall chaining, Configure a primary route for Web requests, and Configure a primary route for Web requests.


Configuring outgoing Web request properties

The Microsoft Internet Security and Acceleration (ISA) Server computer must be configured so that it knows which ports and Internet Protocol (IP) addresses to listen to for requests from internal clients for objects on the Internet. The array's outgoing Web request properties determine:

  • Which IP addresses and ports on the servers in the array should listen for requests. For more information, see Configure listeners for outgoing Web requests.
  • Which authentication method to use when authentication is required.
  • Number of connections allowed.
  • Whether Cache Array Routing Protocol (CARP) is enabled.

Because incoming and outgoing Web requests are independent of each other, you can configure the authentication methods differently for each. For example, you can require integrated Windows authentication to authenticate outgoing Web requests but not require authentication for incoming Web requests. For more information, see Configuring incoming Web request properties.

Listeners

You can configure which internal IP addresses on the servers in the array will listen for Web requests from internal clients. For each IP address, you can specify the following:

  • Whether a server certificate is required and which server certificate to use. The server certificate is used when Internet clients use Secure Hypertext Transfer Protocol (HTTPS) to request objects from an internal Web server. For more information, see SSL bridging and Configure server certificates for Web requests.
  • Authentication method. See Authentication methods.

Ports

You can configure which port should be used to listen for incoming Web requests requests from external users. You can configure ports for all the IP addresses in the array. By default, the ISA Server computer listens for outgoing Transmission Control Protocol (TCP) requests on port 8080.

For background information, see SSL bridging. For configuration instructions, see Configure the TCP port and Enable SSL listeners

Authentication

You can create access policy rules, allowing or denying access to a set of computers (client address sets) or to a group of users. If the rule applies specifically to users, then ISA Server checks the array's outgoing Web request properties to determine how the user should be authenticated. If the rule does not apply to users but only to client address sets or to any user, then authentication may not be required. The only time this is not true is if ISA Server always authenticates users. In this case, if a user cannot provide proper credentials, then the request is denied. For more information, see Rules and authentication and Require authentication for all requests.

Authentication methods

ISA Server provides a secure, encrypted logon environment for those browsers that support Windows NT Challenge/Response authentication and provides basic authentication for other browsers. You can configure the following types of authentication:

  • Basic authentication
  • Digest authentication
  • Integrated authentication
  • Client certificate authentication

For more information, see Authentication methods.

Authentication methods can be set for all the IP addresses on the server, or separately for each IP address. By default, ISA Server listens on port 8080 for all HTTP requests and, if selected, on port 443 for all SSL requests. You can configure ISA Server to listen on different ports. For more information, see Configure authentication methods for Web requests.

Connection settings

You can configure the maximum number of concurrent outgoing connections for all the ISA Server computers in the array. The minimum value is one connection.

You can also configure how long a connection can be inactive before ISA Server closes it. For more information, see Configure connection settings for Web requests.

Enabling CARP

You can enable the Cache Array Routing Protocol (CARP) by telling ISA Server to resolve requests within the array before routing the request. For more information, see Cache Array Routing Protocol and Enable Cache Array Routing Protocol.


Configuring incoming Web request properties

Microsoft Internet Security and Acceleration (ISA) Server intercepts requests from external clients for internal servers. The ISA Server computer must be configured so that it knows which ports and Internet protocol (IP) addresses should be used for internal requests. The array's incoming Web request properties determine the following:

  • Which IP addresses and ports on the servers in the array should listen for requests. For more information, see Configure listeners for outgoing Web requests.
  • Which authentication method should be used, when authentication is required.
  • Number of connections that are allowed.
  • Whether Cache Array Routing Protocol (CARP) is enabled for the array.

For information on how internal Web servers interact with ISA Server, see ISA Server and IIS Server.

Listeners

You can configure which IP addresses on the servers in the array will listen for Web requests from external clients. For each IP address, you can specify the following:

  • Whether a server certificate is required and which server certificate to use. The server certificate is used when Internet clients use Secure Hypertext Transfer Protocol (HTTPS) to request objects from an internal Web server. For more information, see SSL bridging and Configure server certificates for Web requests.
  • Authentication method. For more information, see Authentication methods.

Ports

You can configure which port should be used to listen for incoming Web requests requests from external users. You can configure ports for all the IP addresses on the server or separately for each IP address. By default, the ISA Server computer does not listen for requests from external users.

You should configure the SSL port to 443 for incoming Web requests because most Web browsers cannot use other ports for Secure Socket Layer (SSL).

For configuration instructions, see Configure the TCP port and Enable SSL listeners

Authentication

You can create Web publishing rules, allowing or denying access to a set of computers (client address sets) or to a group of users. If the rule applies specifically to users, then the ISA Server checks the array's outgoing Web request properties to determine how the user should be authenticated. For example, a Web publishing rule might allow access only to specific users. ISA Server will authenticate the user requesting the object to determine if the second rule allows the requesting user access. The user must authenticate, using one of the authentication methods specified for the incoming Web requests.

Authentication Methods

ISA Server provides a secure, encrypted logon environment for those browsers that support Windows NT Challenge/Response authentication and provides basic authentication for other browsers. You can configure the following types of authentication:

  • Basic authentication
  • Digest authentication
  • Integrated authentication
  • Client certificate authentication

Authentication methods can be set for all the IP addresses on the server, or separately for each IP address. For more information, see Authentication methods and Configure authentication methods for Web requests.

Connection settings

You can configure the maximum number of concurrent outgoing connections for all the ISA Server computers in the array. The minimum value is 1 connection. You can also configure how long a connection can be inactive, before ISA Server closes it. For more information, see Configure connection settings for Web requests.

Enabling Cache Array Routing Protocol

You can enable the Cache Array Routing Protocol (CARP) by selecting to resolve requests within the array before routing the request. For more information, see Cache Array Routing Protocol and Enable Cache Array Routing Protocol.


Using an ISA Server virtual private network

Microsoft Internet Security and Acceleration (ISA) Server includes wizards that help you set up and secure a virtual private network (VPN). You can use the wizards to configure the following scenarios:

  • A mobile user connecting to the local network
  • One branch office connecting to another branch office

ISA Server includes three wizards that you can use to create ISA VPN connections:

  • Local ISA VPN Wizard. Use this wizard to set up the ISA Server computer that receives connections. The local ISA VPN Server can also be set up to initiate connections.
  • Remote ISA VPN Wizard. Use this wizard to set up the ISA Server computer that initiates and receives connections.
  • Set Up Clients to ISA Server VPN Wizard. Use this wizard to allow roaming users to connect to the VPN.

Local ISA VPN Wizard

The Local ISA VPN Wizard sets up a local ISA VPN server which can receive connections from a remote ISA VPN server. The wizard creates the dial-on-demand interfaces required to receive connections from remote VPN servers. It also configures the Internet Protocol (IP) packet filters required to protect the connection. It creates IP packet filters, depending on which protocol you select when running the VPN wizard. It also sets the static routes to forward traffic from the local network to hosts on the remote network via the tunnel.

As part of the process, the wizard also creates a VPN configuration settings (.vpc) file, which will be used when setting up the remote ISA VPN server.

For configuration instructions, see Set up a local ISA Server virtual private network.

Remote ISA VPN Wizard

The Remote ISA VPN Wizard sets up a remote ISA VPN server which initiates connections to a local ISA VPN server. The wizard uses the .vpc file that the Local ISA VPN Wizard creates to create the dial-on-demand interfaces that are required to initiate connections to a specific local VPN server. It also configures the IP packet filters required to protect the connection and sets the static routes to forward traffic from the local network to hosts on the remote network via the tunnel.

IP packet filters are created, depending on which protocol selected when the file was created by the Local ISA VPN Wizard.

For configuration instructions, see Set up a remote ISA Server virtual private network.

Clients to ISA Server VPN Wizard

The Client to ISA Server VPN Wizard sets up a VPN server on the ISA Server computer which supports roaming clients. The VPN server supports both Point-to-Point Tunneling Protocol (PPTP) and Internet Protocol security/Layer 2 Tunneling Protocol (IPSec/L2TP) tunnels and opens the appropriate ports on the ISA Server computer to allow clients to connect to the VPN service. For configuration instructions, see Set up ISA Server to accept client-side VPN requests.

Reconfiguring the VPN

After you set up the ISA VPN servers, you may want to add support for other protocols as well. For example, when you initially configure the servers, you use the PPTP protocol. Later, you may want to use the L2TP protocol. Follow these steps to configure the ISA Server to allow use of additional protocols:

  1. Use Routing and Remote Access Services to locate the appropriate demand-dial interface. Then, on the Networking tab, select the relevant protocol.
  2. To add PPTP support, use ISA Management to create an IP packet filter allowing the PTTP protocol. For instructions, see Create an IP packet filter.
    The IP packet filter should be configured with the following parameters:
    • Use both of the predefined filters, PPTP call and PPTP receive.
    • Set Local computer to the external IP address of the local ISA VPN server.
    • Set Remote computer to the IP address of the remote ISA VPN server.
  3. To add L2TP support, you must create two IP packet filters. Configure one IP packet filter with the following parameters:
    • Filter applies only to the local server.
    • Filter type is Open.
    • Custom filter, using the User Datagram Protocol (UDP) on port 500.
    • Set Local computer to the external IP address of the local ISA VPN server.
    • Set Remote computer to the IP address of the remote ISA VPN server.

    Configure another IP packet filter with the following parameters:
    • Filter applies only to the local server.
    • Filter type is Open.
    • Custom filter, using the UDP on port 1701.
    • Set Local computer to the external IP address of the local ISA VPN server.
    • Set Remote computer to the IP address of the remote ISA VPN server.


Configuring policy elements

This section introduces the key concepts and terminology about policy elements. For information about specific topics, see:

  • Policy elements
  • Configuring schedules
  • Configuring bandwidth priorities
  • Configuring destination sets
  • Configuring client address sets
  • Configuring protocol definitions
  • Configuring content groups
  • Configuring dial-up entries


Policy elements

Some rule properties can be set to values that are defined beyond the scope of the rule itself. The group of these properties is called policy elements. You can create policy elements for each array policy and for the enterprise policy. Policy elements include:

  • Bandwidth priorities
  • Client address sets
  • Content groups
  • Destination sets
  • Dial-up entries
  • Protocol definitions
  • Schedule

For more information, see Configuring destination sets, Configuring client address sets, Configuring bandwidth priorities, Configuring protocol definitions, Configuring content groups, and Configuring dial-up entries.

Array-level and enterprise-level policy elements

As an enterprise administrator, you can define enterprise-level policy elements. Enterprise-level policy elements can be used when you create enterprise-level rules.

When array policies and enterprise policies are used together, you can also apply array-level rules to enterprise-level policy elements.

For stand-alone servers, you can only create array-level policy elements.


Configuring schedules

When you create rules, you can apply a schedule to the rule to determine when it is in effect.

Microsoft Internet Security and Acceleration (ISA) Server comes preconfigured with the following two schedules:

  • Weekends, which permits access all day on Saturday and Sunday.
  • Work Hours, which permits access between 9 AM and 5 PM on Mondays through Fridays.

The following rules can specify schedules:

  • Site and content rules.
  • Protocol rules.
  • Bandwidth rules.

For more information, see Site and content rules, Protocol rules, and Configuring bandwidth rules. For configuration instructions, see Create a schedule.


Configuring bandwidth priorities

Bandwidth priorities define the priority level applied to connections that pass through Microsoft Internet Security and Acceleration (ISA) Server. Network connections without an assigned bandwidth priority have lower priority than connections with assigned priorities and network connections with lower priorities have less of a chance to pass through ISA Server than a connection with a higher bandwidth priority.

Bandwidth priorities are directional and can be controlled as:

  • Outbound bandwidth, the bandwidth priority allocated for requests from internal clients for objects on the Internet.
  • Inbound bandwidth, the bandwidth priority allocated for requests from external clients for objects on the local network.

The bandwidth priority can be any number between 1 and 200.

You can use the bandwidth priority to create and configure bandwidth rules, which determine how much scheduling priority is allocated for specific network connections. For example, you can create a bandwidth priority called Best Access with outbound and inbound bandwidth priority set to 10. You can also create a bandwidth priority called Good Access, with outbound and inbound bandwidth set to 1. Then you can use these bandwidth priorities when you configure bandwidth rules.

For more information, see Configuring bandwidth rules. For configuration instructions, see Create a bandwidth priority.


Configuring destination sets

A destination is a computer name, Internet Protocol (IP) address, or IP range and can include a path. Destination sets include one or more computers or folders on specific computers.

Rules can be applied to all destination sets, to all computers except for the specified destination sets, or to one specific destination set. For more information, see Create a destination set.

Computers can be specified by domain name or by a range of IP addresses. You can use an asterisk (*) as a wildcard when you specify the computer name. For example, to specify all computers in the microsoft.com domain, type the destination as *.microsoft.com. Note that the asterisk can appear only at the start of the domain name, and can be specified only once in the name.

You can also indicate specific paths on a computer that can or cannot be accessed by clients. The path can also include an asterisk as a wildcard. For example, to specify all URLs under path /somedir, type the path as /somedir/*. The asterisk can appear only once and can be specified only at the end of the path.

Use this format when you specify a destination. The computer name, path, and file name are not case sensitive.

  • Specify computer name, using the fully qualified domain name (FQDN). For example, write computer_name.microsoft.com, and not //computer_name.
  • To include a specific folder in the destination set:

    /Path/Folder_Name

  • To include all the files in a folder:

    /Path/Folder_Name/*

  • To select a specific file in a folder:

    /Path/Folder_Name/Filename

Rules can be applied to internal destination sets or external destination sets. Internal destination sets are groups of computers within your local network. External destination sets include computers outside the local network.

The following rules can specify destination sets:

  • Site and content rules.
  • Bandwidth rules.
  • Web publishing rules.
  • Routing rules.

For site and content rules and bandwidth rules, destination sets usually include computers that are not on your internal network. For Web publishing rules, destination sets usually include computers on your internal network. For routing rules, destination sets include external computers (on the Internet) for rules that route outgoing Web requests. Routing rules that route incoming Web requests include internal computers.

For more information, see Site and content rules, Configuring bandwidth rules, Routing Web requests, and Web publishing rules.


Configuring client address sets

Client address sets include one or more computers. You can apply rules to one or more specific client address sets or to all addresses except the specified client address sets. The following rules can specify client address sets:

  • Site and content rules
  • Protocol rules
  • Bandwidth rules
  • Server publishing rules
  • Web publishing rules

For more information, see Site and content rules, Protocol rules, Configuring bandwidth rules, and Create a client address set.

Users and groups

When you create rules, you can specify the internal clients to which the rule is applied. Clients can be specified either by user name or by Internet Protocol (IP) address.

For secure network address translation (SecureNAT) clients, you must specify clients by IP address. You can create client address sets, which group client computers by IP address.

For Firewall clients, when you specify clients by user name, you can use the Windows 2000 groups.

For configuration instructions, see Configure users for an access rule.


Configuring protocol definitions

Microsoft Internet Security and Acceleration (ISA) Server includes a wide variety of preconfigured protocol definitions, which you can use when you create protocol rules or server publishing rules. Server publishing rules use protocol definitions whose direction is inbound. For more information, see Server publishing rules and Protocol rules.

In addition, application filters may also include protocol definitions. They can be included when you install ISA Server, or you can install them later. You can further expand the set of protocol definitions by using ISA Management to create your own.

For more information, see Protocol rules and Create a protocol definition.

User-defined protocol definitions can be edited or deleted. Protocol definitions installed with application filters cannot be modified, although they can be deleted. Protocol definitions included with ISA Server cannot be modified or deleted.

When you create a protocol definition, you specify the following:

  • Port number. This is a port number between 1 and 65535 that is used for the initial connection.
  • Low-level protocol. Transmission Control Protocol (TCP) or User Datagram Protocol (UDP).
  • Direction. Send only, Receive only, Send receive, Receive send (for UDP protocol) or Inbound, Outbound (for TCP protocol).
  • (Optional) Secondary connections. This is the range of port numbers, protocol, and direction used for additional connections or packets that follow the initial connection. You can configure one or more secondary connections.

Direction

You can configure the direction of the traffic flow when you create a protocol definition. The way you specify the direction of the traffic determines how packets will be communicated. For TCP, the direction determines the direction of the initial communication. For UDP, the direction determines the flow of traffic. For example, you can configure a protocol rule that allows internal clients to initiate TCP communication on port 80 by specifying the direction as Outbound. The server with which the client is communicating can respond to the client request but cannot initiate communication.

Web protocols

You can use the taskpad to create a protocol rule that allows users to access the Internet using only specific Web protocols. The table below lists the Web protocol definitions that are preconfigured when you install ISA Server, either by ISA Server or by an application filter installed with ISA Server.

Name | Port number | Protocol type | Defined by | Description
FTP | 21 | Transmission Control Protocol (TCP) | FTP access filter | File Transfer Protocol (FTP), used for copying files between hosts.
FTP Download Only | 21 | TCP | FTP access filter | FTP, used for downloading files from FTP server to FTP client.
Gopher | 70 | TCP | ISA Server | Menu-driven front end to other Internet services, including Archie and Wide Area Information Server (WAIS).
HTTP | 80 | TCP | ISA Server | Hypertext Transfer Protocol (HTTP), used to implement the World Wide Web.
HTTPS | 443 | TCP | ISA Server | Version of HTTP that uses Secure Sockets Layer (SSL) for encryption.

Application filters and protocol definitions

Protocol definitions that are included with application filters do not have secondary connections. This is because the application filter itself informs the ISA Server computer which secondary connections to open for the client, according to the specific protocols. Here's how it works:

  1. The client opens a primary connection to a server on the Internet.
  2. The ISA Server computer notifies the filter about the connection.
  3. The filter examines the data that is flowing through the primary connection and determines which secondary connection the client is going to use.
  4. The filter informs the ISA Server computer to allow that particular secondary connection.
  5. The ISA Server computer opens the specific port, as indicated by the application filter.

Some application filters create and install new protocol definitions. When the application filter is disabled, all its protocol definitions are also disabled. That is, traffic that uses the protocol definition is blocked. For example, if you disable the streaming media filter, then all traffic that uses the Windows media and Realnetworks protocol definitions is blocked.

Other application filters filter traffic of existing protocol definitions, either user-defined or configured by ISA Server. When these application filters are disabled, the protocol definitions that they filter are not disabled. For example, even if you disable the Simple Mail Transfer Protocol (SMTP) filter, SMTP protocol definitions might still be allowed to pass (unfiltered).

For more information, see Application filters.

Protocol definitions that are installed with ISA Server

The table below lists some of the protocol definitions that are included with ISA Server.

Protocol Name | Description
AOL | AOL Internet Access
AOL Instant Messenger |
Archie |
BOOTP | Bootstrap
Chargen (TCP) | Character generator (TCP)
Chargen (UDP) | Character generator (UDP)
Daytime (TCP) |
Daytime (UDP) |
Destination Unreachable |
Discard (TCP) |
Discard (UDP) |
DNS | Domain Name System
DNS (Zone transfer) |
DNS Server | Domain Name System (server)
DNS Server - zone transfer |
Echo (TCP) |
Echo (UDP) |
Echo Reply |
Echo Request |
Exchange RPC Server |
Finger |
FTP | File Transfer Protocol
FTP Download-only | File Transfer Protocol - Download only
FTP Server | File Transfer Protocol (server)
FTP Server - Read only | File Transfer Protocol (server) - Read only
Gopher |
H.323 | H.323 video conferencing
HTTP | Hypertext Transfer Protocol
HTTP Server | Hypertext Transfer Protocol (server)
HTTPS | Secure Hypertext Transfer Protocol
HTTPS Server | Secure Hypertext Transfer Protocol (server)
ICA | Citrix Intelligent Console Architecture
ICQ | ICQ instant messenger
Ident |
IKE | Internet Key Exchange
IMAP4 | Interactive Mail Access Protocol
IMAPS | Secure Interactive Mail Access Protocol
IRC | Internet Relay Chat
Kerberos-Adm | Kerberos administration
Kerberos-IV | Kerberos IV authentication
Kerberos-Sec | Kerberos V authentication
LDAP | Lightweight Directory Access Protocol
LDAP GC (Global Catalog) |
LDAPS | Secure Lightweight Directory Access Protocol
Microsoft SQL Server |
MSN | MSN Internet Access
MSN Messenger |
Net2Phone |
Net2Phone Registration |
NetBIOS Datagram |
NetBIOS Name Service |
NetBIOS Session |
NNTP | Network News Transfer Protocol
NNTPS | Secure Network News Transfer Protocol
NTP (UDP) | Network Time Protocol (UDP)
Parameter Problem |
POP2 | Post Office Protocol v.2
POP3 | Post Office Protocol v.3
POP3S | Secure Post Office Protocol v.3
PPTP | Point-to-Point Tunneling Protocol
Quote (TCP) | Quote of the day (TCP)
Quote (UDP) | Quote of the day (UDP)
RADIUS | Remote Authentication Dial-In User Service
RADIUS Accounting |
RDP (Terminal Services) | Remote Desktop Protocol (Terminal Services)
RealAudio / RealVideo | RealNetworks streaming media (PNM)
RealAudio / RealVideo Server | RealNetworks streaming media (PNM) (server)
Redirect |
RIP | Routing Information Protocol
Rlogin | Remote login
RPC | Remote Procedure Call
RPC port mapper | Remote Procedure Call port mapper (server)
RTSP | Real Time Streaming Protocol
RTSP Server | Real Time Streaming Protocol (server)
SMTP | Simple Mail Transfer Protocol
SMTP Server | Simple Mail Transfer Protocol (server)
SMTPS | Secure Simple Mail Transfer Protocol
SNMP | Simple Network Management Protocol
SNMP Trap | Simple Network Management Protocol - Trap
Source Quence |
SSH | Secure Shell
Syslog |
Telnet |
Telnet Server |
TFTP | Trivial File Transfer Protocol
Time (TCP) |
Time (UDP) |
Time Exceeded |
Timestamp Reply |
Timestamp Request |
Whois | Nickname/Whois protocol
Windows Media | Microsoft streaming media
Windows Media Server | Microsoft streaming media (server)


Configuring content groups

Content groups specify Multipurpose Internet Mail Extensions (MIME) types and file name extensions. When you create a site and content rule or a bandwidth rule, you can limit the rule application to specific content groups. This allows you to be more specific when you configure security policy, as you can limit access not only to a particular destination, but also to specific content.

Content groups apply only to Hypertext Transfer Protocol (HTTP) and tunneled File Transfer Protocol (FTP) traffic, which passes through the Web Proxy service.

When a client requests FTP content, Microsoft Internet Security and Acceleration (ISA) Server checks the file name extension of the requested object. ISA Server determines if a rule applies to a content group that includes the requested file name extension and processes the rule accordingly.

When a client requests HTTP content, ISA Server sends the request to the Web server. When the Web server returns the object, ISA Server checks the object's MIME type or its file name extension, depending on the header information returned by the Web server. ISA Server determines if a rule applies to a content group that includes the requested file name extension, and processes the rule accordingly.

Content groups do not apply to HTTPS content.

When you create content groups, it is recommended that you specify the content's MIME type and file name extension. For example, to include all Director files in a content group, select the following file name extensions and MIME types:

  • .dir
  • .dxr
  • .dcr
  • application/x-director

When you configure a content group, specifying the MIME type, you can use asterisks as wildcards. For example, to include all application types, enter application/*. The asterisk wildcards can be used only with MIME types (and not with file extensions). The asterisk can appear only once and can be specified only at the end of the MIME type after /.

For configuration instructions, see Create a content group.

ISA Server comes preconfigured with the following content groups: Application, Application data files, Audio, Compressed files, Documents, HTML documents, Images, Macro documents, Text, Video, and VRML.

Depending on the Web server, different MIME types are associated with different file name extensions. The table below lists the Internet Information Services (IIS) default associations.

File Name Extension | MIME Type
.hta | application/hta
.isp | application/x-internet-signup
.crd | application/x-mscardfile
.pmc | application/x-perfmon
.spc | application/x-pkcs7-certificates
.sv4crc | application/x-sv4crc
.bin | application/octet-stream
.clp | application/x-msclip
.mny | application/x-msmoney
.p7r | application/x-pkcs7-certreqresp
.evy | application/envoy
.p7s | application/pkcs7-signature
.eps | application/postscript
.setreg | application/set-registration-initiation
.xlm | application/vnd.ms-excel
.cpio | application/x-cpio
.dvi | application/x-dvi
.p7b | application/x-pkcs7-certificates
.doc | application/msword
.dot | application/msword
.p7c | application/pkcs7-mime
.ps | application/postscript
.wps | application/vnd.ms-works
.csh | application/x-csh
.iii | application/x-iphone
.pmw | application/x-perfmon
.man | application/x-troff-man
.hdf | application/x-hdf
.mvb | application/x-msmediaview
.texi | application/x-texinfo
.setpay | application/set-payment-initiation
.stl | application/vndms-pkistl
.mdb | application/x-msaccess
.oda | application/oda
.hlp | application/winhlp
.nc | application/x-netcdf
.sh | application/x-sh
.shar | application/x-shar
.tcl | application/x-tcl
.ms | application/x-troff-ms
.ods | application/oleobject
.axs | application/olescript
.xla | application/vnd.ms-excel
.mpp | application/vnd.ms-project
.dir | application/x-director
.sit | application/x-stuffit
.* | application/octet-stream
.crl | application/pkix-crl
.ai | application/postscript
.xls | application/vnd.ms-excel
.wks | application/vnd.ms-works
.ins | application/x-internet-signup
.pub | application/x-mspublisher
.wri | application/x-mswrite
.spl | application/futuresplash
.hqx | application/mac-binhex40
.p10 | application/pkcs10
.xlc | application/vnd.ms-excel
.xlt | application/vnd.ms-excel
.dxr | application/x-director
.js | application/x-javascript
.m13 | application/x-msmediaview
.trm | application/x-msterminal
.pml | application/x-perfmon
.me | application/x-troff-me
.wcm | application/vnd.ms-works
.latex | application/x-latex
.m14 | application/x-msmediaview
.wmf | application/x-msmetafile
.cer | application/x-x509-ca-cert
.zip | application/x-zip-compressed
.p12 | application/x-pkcs12
.pfx | application/x-pkcs12
.der | application/x-x509-ca-cert
.pdf | application/pdf
.xlw | application/vnd.ms-excel
.texinfo | application/x-texinfo
.p7m | application/pkcs7-mime
.pps | application/vnd.ms-powerpoint
.dcr | application/x-director
.gtar | application/x-gtar
.sct | text/scriptlet
.fif | application/fractals
.exe | application/octet-stream
.ppt | application/vnd.ms-powerpoint
.sst | application/vndms-pkicertstore
.pko | application/vndms-pkipko
.scd | application/x-msschedule
.tar | application/x-tar
.roff | application/x-troff
.t | application/x-troff
.prf | application/pics-rules
.rtf | application/rtf
.pot | application/vnd.ms-powerpoint
.wdb | application/vnd.ms-works
.bcpio | application/x-bcpio
.dll | application/x-msdownload
.pma | application/x-perfmon
.pmr | application/x-perfmon
.tr | application/x-troff
.src | application/x-wais-source
.acx | application/internet-property-stream
.cat | application/vndms-pkiseccat
.cdf | application/x-cdf
.tgz | application/x-compressed
.sv4cpio | application/x-sv4cpio
.tex | application/x-tex
.ustar | application/x-ustar
.crt | application/x-x509-ca-cert
.ra | audio/x-pn-realaudio
.mid | audio/mid
.au | audio/basic
.snd | audio/basic
.wav | audio/wav
.aifc | audio/aiff
.m3u | audio/x-mpegurl
.ram | audio/x-pn-realaudio
.aiff | audio/aiff
.rmi | audio/mid
.aif | audio/x-aiff
.mp3 | audio/mpeg
.gz | application/x-gzip
.z | application/x-compress
.tsv | text/tab-separated-values
.xml | text/xml
.323 | text/h323
.htt | text/webviewhtml
.stm | text/html
.html | text/html
.xsl | text/xml
.htm | text/html
.cod | image/cis-cod
.ief | image/ief
.pbm | image/x-portable-bitmap
.tiff | image/tiff
.ppm | image/x-portable-pixmap
.rgb | image/x-rgb
.dib | image/bmp
.jpeg | image/jpeg
.cmx | image/x-cmx
.pnm | image/x-portable-anymap
.jpe | image/jpeg
.jfif | image/pjpeg
.tif | image/tiff
.jpg | image/jpeg
.xbm | image/x-xbitmap
.ras | image/x-cmu-raster
.gif | image/gif


Configuring dial-up entries

Dial-up entries specify how the Microsoft Internet Security and Acceleration (ISA) Server computer will connect to the Internet. The dial-up entry includes the following information:

  • The name of the network dial-up connection, previously configured for the remote access server on all the servers in the array.
  • The user name and password for a user who has permissions to access the dial-up connection. The user name and password you specify should be the same user name and password that you would type to manually establish a network dial-up connection. For more information, see Create a dial-up entry.

You can configure dial-up entries only for network dial-up connections that are configured on all the ISA Server computers in an array. For instructions on creating network dial-up connections, see the Windows 2000 Help.

You use dial-up entries when you configure the following:

  • Routing rules
  • Firewall chaining

Only one dial-up entry can be active for an array. The active dial-up entry is used whenever ISA Server dials out to the Internet to service a client request. For configuration instructions, see Set an active dial-up entry.

For more information, see Routing requests from Firewall and SecureNAT clients, Routing Web requests, and Configuring dial-on-demand.


Using packet filtering

You can use Microsoft Internet Security and Acceleration (ISA) Server to create static Internet protocol (IP) packet filters, which either allow or block packets from passing through specified ports.

  • Filtering and routing
  • IP packet filters
  • Configuring intrusion detection
  • Packet filter options
  • Outgoing PPTP access


Configuring filtering and routing

When you enable packet filtering on Microsoft Internet Security and Acceleration (ISA) Server, all packets on the external interface are dropped unless they are explicitly allowed, either statically, by Internet Protocol (IP) packet filters, or dynamically, by access policy or publishing rules.

The opposite scenario is configured when you enable routing on ISA Server without enabling packet filtering. In that case, ISA Server simply routes all traffic between the Internet and your corporate network. In other words, ISA Server acts as a router, a device that connects disjointed networks by forwarding packets between them. This is not a recommended scenario for ISA Server.

By enabling both packet filtering and routing, you enjoy the benefits of strict policy enforcement at the packet filter level, as well as routing capabilities for secondary connections. It is recommended that you enable filtering and routing on ISA Server, since this combines the security of packet filtering with the performance enhancement of routing.

For more information, see Enable packet filtering and Enable IP routing.


IP packet filters

With Internet Protocol (IP) packet filters, you can intercept and either allow or block packets destined for specific computers on your corporate network. You can configure two types of static IP packet filters: allow filters and block filters.

Allow filters are exception filters—all packet types are blocked except for those you specify. If you do not have a packet filter activated for a specific port, then the service cannot listen on that port unless the port is opened dynamically.

Block filters close the specified ports. You can create and configure block filters to further define the traffic allowed through the Microsoft Internet Security and Acceleration (ISA) Server computer. For example, you can create an allow filter that allows Transmission Control Protocol (TCP) traffic on port 25 between all internal and external hosts—in other words, Simple Mail Transfer Protocol (SMTP) communication is activated. You can then limit access, creating a block filter that blocks a set of external hosts—potential intruders—from sending TCP packets to port 25 on your ISA Server computer.

For more background information, see Packet filtering. For an example of how IP packet filters are used in a deployment scenario, see Three-homed perimeter network configuration.

IP packet filters are defined by the following parameters:

  • Servers. The filter allows or blocks communication on the specified server.
  • Protocol, port, and direction. The filter allows or blocks traffic at the specified port, using the specified protocol.
  • Local computer. The IP address of the computer in the internal network for which communication is open or blocked. You can specify a range or a single IP address on the ISA Server computer.
  • Remote computer. The IP address of the computer on the Internet for which communication is allowed or blocked.

For configuration instructions, see Apply an IP packet filter to a server, Configure a protocol for an IP packet filter, Configure an IP packet filter for a local computer, and Configure an IP packet filter for a remote computer.

Typically, you will follow these steps to create IP packet filters:

  1. Enable packet filtering. For more information, see Enable packet filtering.
  2. Create allow filters. This allows access between specified IP addresses at the specified ports and using the specified protocols.
  3. Create block filters. This blocks access to specific ports or from specific IPs completely. Block filters can be used to create exception to the allow filters.

For more background information on packet filters, see Packet filtering.

Logging dropped packets

When packet filter logging is active, ISA Server logs rejected packets. This helps you monitor attempts to break into the ISA Server computer. For more information, see Log blocked packets.


Configuring intrusion detection

Microsoft Internet Security and Acceleration (ISA) Server features an intrusion detection mechanism, which identifies when an attack is attempted against your network and performs a set of configured actions, or alerts, in case of an attack. To detect unwanted intruders, ISA Server compares network traffic and log entries to well-known attack methods. Suspicious activities trigger alerts. Actions include connection termination, service termination, e-mail alerts, logging, and others.

If intrusion detection is enabled, you can configure which of the following intrusions trigger alerts:

  • All ports scan attack
  • Well-known port scan attack
  • IP half scan attack
  • Land attack
  • Ping of death attack
  • UDP bomb attack
  • Windows out-of-band attack

If you configure port scan alerts, you can also configure how many port attacks trigger an alert.

For configuration instructions, see Configure intrusion detection and Create an alert. For more information, see Intrusion detection.

Intrusion detection functionality based on technology from Internet Security Systems, Inc., Atlanta, GA, USA, www.iss.net. Portions Copyright © 2000 Internet Security Systems, Inc.


Packet filter options

You can configure the following packet filtering features:

  • Internet Protocol (IP) fragment filtering
  • IP option filtering

IP fragment filtering

When Microsoft Internet Security and Acceleration (ISA) Server filters packet fragments, it drops all fragmented IP packets. A well-known attack involves sending fragmented packets and then reassembling them in such a way that may cause harm to the system. For more information, see Enable IP fragment filtering.

Do not enable IP fragment filtering if you want to allow video streams or quality audio streams to pass through ISA Server. For information on streaming media filtering, see Streaming media filter.

IP options filtering

You can configure ISA Server to refuse all packets that have the words "IP Options" in the header. For more information, see Enable IP options filtering.


Outgoing PPTP access

You can configure Microsoft Internet Security and Acceleration (ISA) Server to allow internal clients to access servers on the Internet, using Point-to-Point Tunneling Protocol (PPTP). If you allow PPTP access, all secure network address translation (SecureNAT) and Firewall clients are always allowed to access any server on the Internet, using PPTP. For configuration instructions, see Allow outgoing PPTP access.

For Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) protocols, you can create protocol rules to configure who can use the protocols, and on which ports. See Protocol rules for more information.


Configuring access policy

You can use Microsoft Internet Security and Acceleration (ISA) Server to configure an access policy, which consists of site and content rules, protocol rules, and Internet protocol (IP) packet filters. You create an array-level access policy, for stand-alone servers and arrays.

For arrays, you can alternatively create an enterprise-level access policy, an array-level access policy, or a combination of rules at both the enterprise and array levels. For more specific information on enterprise and array policies, see Applying enterprise policy.

Access policy rules apply to all types of clients: Firewall clients, secure network address translation (SecureNAT) clients, and Web Proxy clients. For more specific information, see ISA Server clients.

For background information on access policy, see Controlling outgoing requests.

This section explains the ISA Server access policy rules. For information about specific topics, see:

  • Site and content rules
  • Protocol rules
  • Creating custom HTML error messages


Site and content rules

You can grant or deny access to the Internet by creating site and content rules. Site and content rules determine if and when content on specific destination sets can be accessed by users or client address sets.

When a client requests an object, Microsoft Internet Security and Acceleration (ISA) Server checks the site and content rules. If a site and content rule specifically denies the request, access is denied. Furthermore, the request will be fulfilled only if a site and content rule specifically allows the client access to the content and if the client is allowed to communicate using the specific protocol. In other words, to allow access to the Internet, you must perform the following steps:

  1. Create a site and content rule indicating clients that are allowed access to specific destination sets.
  2. Create a protocol rule indicating which protocols can be used to access the specific destinations.

For configuration instructions, see Create a site and content rule.

Processing order

Although site and content rules are not ordered, rules that deny access are processed before rules that allow access. For example, if you create two rules, one of which allows access to all clients and one of which denies access to all users in the Sales department, the Sales department cannot gain access to the Internet.

For more information on how ISA Server processes requests, see Controlling outgoing requests and Rules and authentication.

Action

Site and content rules can either allow or deny access to specific sites. If access is denied, then for Hypertext Transfer Protocol (HTTP) objects, the request can be redirected to an alternate Uniform Resource Locator (URL)—typically a page on an internal server—explaining why access is denied.

When you specify the destination to which to redirect the request, you can specify a whole different location by typing http:// and then the URL of the location to which to redirect the request.

When access is denied, ISA Server sends the URL specified here to the Web browser client. The client Web browser then tries to access the object from the destination to which ISA Server redirected.

For example, suppose a site and content rule denies access to http://example.microsoft.com/, redirecting requests for this site to http://widgets.microsoft.com/accessdenied.htm. When a client requests an object on http://example.microsoft.com/, ISA Server denies the request, and returns http://widgets.microsoft.com/accessdenied.htm to the client. The client then requests http://widgets.microsoft.com/accessdenied.htm.

Important

  • If you choose to redirect the request, then the URL that you specify must be accessible to the selected clients or users. In other words, either the URL must be on an internal computer or some rule must explicitly allow access to the URL.

For more information, see Configure an action for a site and content rule.

Destination sets and path processing

When you create a site and content rule, you specify which destinations are accessible. Destination sets can include Internet protocol (IP) addresses of specific computers or computer names. In either case, you can specify a particular path on the computer to include in the destination set. For more information, see Configuring destination sets.

ISA Server processes the site and content rule differently, depending on which type of client requests the object and what type of content is requested. In particular, ISA Server may ignore any path specified in the destination set, for particular clients or protocols used. The table below details whether ISA Server processes the path specified for the computers in the destination set.

 | Web Proxy client | Secure network address translation (SecureNAT) client | Firewall client
File Transfer Protocol (FTP) content | Yes | No | No
HTTP content | Yes | Yes | Yes
Secure Hypertext Transfer Protocol (HTTPS) content | No | No | No

This is true only when the HTTP is enabled and configured to redirect to the local Web Proxy service. For more information, see HTTP redirector filter.

When ISA Server processes a request for which path processing is not supported (for example, any non-HTTP request), ISA Server ignores all destinations for which a path is specified. This does not imply that ISA Server ignores the rule that references the destination. For example, assume that you have a rule that denies access to two destinations: //example.microsoft.com/example and widgets.microsoft.com. A request to access Network News Transfer Protocol (NNTP) content from example.microsoft.com will not be denied. A request to access NNTP content from widgets.microsoft.com will be denied.

For Secure Hypertext Transfer Protocol (HTTPS) requests, if a rule denies requests to a destination that specifies a path, ISA Server denies all content on the computer, not limited to the path. For example, if a rule is configured to deny HTTPS access to example.microsoft.com/example, then ISA Server will deny access to all access at example.microsoft.com.

Array-level and enterprise-level site and content rules

Site and content rules can be created at both the array level and at the enterprise level. When an array policy is allowed, then its site and content rules can only further restrict enterprise-level site and content rules. The array-level site and content rules can only deny access to specific sites or content. For more information on enterprise policy, see Applying enterprise policy.

Example

If you want to deny access to all images in http://example.microsoft.com/stuff, create a site and content rule with the following properties:

  • Set Destination set to a set that includes the following path:

    example.microsoft.com/stuff/*

  • Set Schedule to Always.
  • Set Action to Deny access to the requested site.
  • Set Applies to to All requests.
  • Set Content to the Images content group.

For a deployment scenario that illustrates the use of protocol rules, see Firewall scenario.


Protocol rules

Protocol rules determine which protocols clients can use to access the Internet. You can define protocol rules that allow or deny use of one or more protocol definitions. For more information, see Create a protocol rule.

Protocols

You can configure protocol rules to apply to all Internet protocol (IP) traffic, to a specific set of protocols definitions, or to all IP traffic except selected protocols.

If Microsoft Internet Security and Acceleration (ISA) Server is installed in cache mode, protocol rules can be applied only to Hypertext Transfer Protocol (HTTP), Secure Hypertext Transfer Protocol (HTTPS), Gopher, and File Transfer Protocol (FTP) protocols.

ISA Server includes a list of preconfigured, well-known protocol definitions, including the Internet protocols which are most widely used. You can also add or modify additional protocols. For more information, see Configuring protocol definitions.

When a client requests an object using a specific protocol, ISA Server checks the protocol rules. If a protocol rule specifically denies use of the protocol, the request is denied. Furthermore, the request will be processed only if a protocol rule specifically allows the client to communicate using the specific protocol, and if a site and content rule specifically allows access to the requested object. In other words, you must perform the following to allow access:

  1. Create a protocol rule, indicating which protocols can be used to access the specific destinations.
  2. Create a site and content rule, indicating clients that are allowed access to specific destination sets.

Some application filters create and install new protocol definitions. When the application filter is disabled, all its protocol definitions are also disabled. That is, traffic that uses the protocol definition is blocked. For example, if you disable the streaming media filter, then all traffic that uses the Windows Media and Real Networks protocol definitions is blocked.

Other application filters traffic of existing protocol definitions, either user-defined or configured by ISA Server. When these application filters are disabled, the protocol definitions that they filter are not disabled. For example, even if you disable the Simple Mail Transfer Protocol (SMTP) filter, SMTP protocol definitions might still be allowed to pass, left unfiltered.

For more information, see Using extensions.

Protocol rules for SecureNAT clients

Protocol rules apply to Firewall clients and to secure network address translation (SecureNAT) clients. If the protocol is defined by an application filter, then the protocol rule applies to both Firewall and SecureNAT clients. If the protocol rule applies to a protocol that has only a primary connection—for example, HTTP—then the rule applies to both Firewall and SecureNAT clients.

If a protocol has secondary connections, and it is not defined by an application filter, then the protocol rule applies only to the primary connection. In other words, if an application uses a protocol that has secondary connection, then this application will work only on Firewall client.

For SecureNAT clients, if you configure a protocol rule to apply to all IP traffic, the rule will actually apply only to all defined protocols.

For more information on clients, see Firewall clients and SecureNAT clients.

Processing order

Although protocol rules are not ordered, rules that deny protocols are processed before rules that allow access. For example, if you create two rules, one rule that allows use of all protocols and one rule that denies use of the SMTP protocol, the SMTP protocol will not be allowed.

For more information on how ISA Server processes requests, see Controlling outgoing requests and Rules and authentication.

Array-level and enterprise-level protocol rules

Protocol rules can be created at both the array level and at the enterprise level. When an array policy is allowed, then its protocol rules can only further restrict enterprise-level protocol rules. In other words, the array-level protocol rules can only deny use of specific protocols. For more information on enterprise policy, see Applying enterprise policy.

Examples

Suppose you want to prohibit a group of users in your organization from using MSN Messenger during work hours. You can create a protocol rule to enforce this policy by configuring the following parameters:

  • Select the MSN Messenger protocol.
  • Select the Work Hours schedule.
  • Select Requests coming from specified users and groups.
  • Select the appropriate user group.
  • Set Action to Deny the request.

For a deployment scenario that illustrates the use of protocol rules, see Firewall scenario.


Creating custom HTML error messages

Microsoft Internet Security and Acceleration (ISA) Server includes a set of error messages that are returned to Web browser clients, when appropriate.

ISA Server distinguishes between external and internal client requests. For internal clients, the files are named Error_number.htm. For external clients, the files are named Error_numberR.htm (where R indicates reverse).

The table below lists the error messages included with ISA Server.

File names | Description
10060.htm and 10060R.htm | The specified Web server could not be contacted.
11001.htm and 11001R.htm | The specified host could not be found.
11002.htm and 11002R.htm | The DNS name server for the specified host could not be contacted.
11004.htm and 11004R.htm | Host was not found.

Custom HTML error messages

You can create additional Hypertext Transfer Protocol (HTTP) error messages that are customized for your organization. You can use the default HTML error files as a basis for creating additional HTML error message pages. The files are named Default.htm for internal client errors and DefaultR.htm for external client errors and are located in the \ErrorHtmls folder. Error message pages are named Errorcode.htm.

You can edit the Default.htm file just as you would any HTML page.

  • Replace [ERRORNUM] with the appropriate error code.
  • Replace [ERRORTEXT] with the appropriate error message text.
  • Replace [SERVERNAME] with the name of the server that returns the HTML page.
  • Replace [VIAHEADER] with the Via header message string that the ISA Server computer receives.

You can use inline graphics in the form of .gif or .jpg files in your custom HTML error messages. However, these files must be stored in a separate, shared directory on the ISA Server computer and fully qualified URLs must be used in the HTML error message files to point to inline graphics.


Configuring bandwidth

As communication within your network and with the Internet becomes more congested, network performance may deteriorate. You can use Microsoft Internet Security and Acceleration (ISA) Server to determine the source of network activity, and then configure bandwidth rules, allocating more relative bandwidth to prioritize communication. This can help ensure that business-critical activity gets more bandwidth.

This section explains the ISA Server bandwidth rules. For information about specific topics, see:

  • Determining effective bandwidth
  • Configuring bandwidth rules


Determining effective bandwidth

Effective bandwidth is the actual bandwidth for a particular dial-up device (for example, a modem) or total effective network bandwidth. Microsoft Internet Security and Acceleration (ISA) Server uses the effective bandwidth that you specify as the basis for determining actual bandwidth to be assigned to a particular connection, based on the bandwidth priority specified for the rule.

The first step in determining effective bandwidth is determining the maximum effective bandwidth of the connections on the ISA Server computer or array. For a modem, the bandwidth depends on the actual speed of the modem, compression, and other factors. For instructions on setting the bandwidth for a modem, see Set effective bandwidth for a modem.

After you have determined the maximum bandwidth, you should study reports generated for peak-hour activity. Analyze how much bandwidth is actually allocated for all the requests, both on the internal card and the external card.

For frame relay networks, E1/T1 or E3/T3, the maximum effective bandwidth is determined by the Internet service provider. For instructions on setting the bandwidth for these types of connections, see Set effective bandwidth for network card.

After you have determined the maximum bandwidth, you should study reports generated for peak-hour activity. Analyze how much bandwidth is actually allocated for all the requests, both on the internal card and the external card.

When you configure the effective bandwidth, bear in mind that you should specify the minimum bandwidth available for all the devices on the ISA Server computer. For example, if a device used for internal communication has 100 kilobytes (KB) of effective bandwidth and the external device has 56 KB, you should configure the effective bandwidth as 56 KB. If you configure this value incorrectly, ISA Server will use the device's lower bandwidth capability instead of the effective bandwidth setting.

When you configure the effective bandwidth, bear in mind that you should specify the lowest maximum bandwidth available for the devices on the ISA Server computer. For example, if a device used for internal communication has 100 KB effective bandwidth and the external device has 56 KB, you should configure the effective bandwidth as 56 KB.

Also, when you determine bandwidth requirements for internal communication, bear in mind that internal communication includes the following:

  • Communication between computers on the local network.
  • Cached content returned from the ISA Server computer to a computer on the local network.
  • Communication between array members, unless you have an additional card configured for intra-array communication.

Bandwidth rules are not applied when ISA Server returns cached content to an internal computer or to intra-array communication.

For more information on configuring bandwidth priorities and bandwidth rules, see Configuring bandwidth rules and Configuring bandwidth priorities.


Configuring bandwidth rules

Bandwidth rules set priorities for any request passing through Microsoft Internet Security and Acceleration (ISA) Server, as defined by the following parameters:

  • One or more protocol definitions
  • Users or Internet Protocol (IP) addresses
  • Destination sets
  • Schedule
  • Content types

For configuration instructions, see Create a bandwidth rule.

You can set the bandwidth priority either to the default scheduling priority or to a bandwidth priority you have configured. If you select the default setting, then the specified communication is guaranteed a minimum network bandwidth.

Note that connections that have specific bandwidth priorities will require some additional overhead while establishing the connection.

Note

  • Bandwidth rules are not applied when ISA Server returns cached content to an internal computer or to intra-array communication.

Rule order

Bandwidth rules are ordered, with the default bandwidth rule processed last. For each new connection, the ISA Server computer processes the bandwidth rules in order. The first rule is processed first. If the request matches the conditions specified by the rule, the bandwidth priority is applied to the request. Otherwise, the next rule is processed. This continues until the last default rule is processed and applied to the request. For instructions on ordering rules, see Change the order of a bandwidth rule.

Default bandwidth rule

When you install ISA Server, it configures a default bandwidth rule. The default rule assures that communication without an assigned bandwidth rule will be allocated the minimum bandwidth assured by the Windows 2000 default scheduling.

The default bandwidth rule is always last in order. It cannot be modified or deleted.

Scenario

For example, imagine that you create a bandwidth rule called VIP that uses a bandwidth priority called Maximum, which sets outbound and inbound bandwidth to the maximum rate of 200. The bandwidth rule might allow a client set that includes all senior executives and specifies all protocols, any content, and at any time.

In the scenario, it is assumed that the network is fairly congested and only a limited amount of bandwidth remains. When two requests arrive, one from two senior executives and one from any other employee, the VIP bandwidth will be split between the two requests from the senior executives and the remaining bandwidth will be allocated to the other employee.


Configuring publishing

This section explains how you can configure Microsoft Internet Security and Acceleration (ISA) Server to protect your internal Web server. For information about specific topics, see:

  • Web publishing rules
  • Web publishing rules and routing rules
  • Server publishing rules
  • Server publishing rules and IP packet filters
  • Mail Server Security Wizard


Web publishing rules

Microsoft Internet Security and Acceleration (ISA) Server uses Web publishing rules to relieve the concerns associated with publishing Web content to the Internet without compromising internal network security. Web publishing rules determine how ISA Server should intercept incoming requests for Hypertext Transfer Protocol (HTTP) objects on an internal Web server and how ISA Server should respond on behalf of the Web server. Requests are forwarded downstream to an internal Web server, located behind the ISA Server computer. If possible, the request is serviced from the ISA Server cache.

Web publishing rules essentially map incoming requests to the appropriate Web servers behind the ISA Server computer.

Important

  • It is recommended that you do not enable directory browsing on the Web server that is published by ISA Server. Also, the Web server cannot require digest or basic authentication. If it does, the internal name or IP address of the Web server may be exposed on the Internet.

For more information, see How caching works, Controlling incoming requests, and Create a Web publishing rule.

Destination sets and client sets

For Web publishing rules, destination sets usually include the external name of your ISA Server computer and path. Client address sets probably include Internet Protocol (IP) addresses of clients located on the Internet, including those not necessarily in your corporate network. For more information, see Configure a destination set for a Web publishing rule and Configure users for a Web publishing rule.

Action

Web publishing rules specify which server (if any) should return the requested object. The request can be discarded or redirected to an alternate site, usually to a Web server on your corporate network. For more information, see Configure an action for a Web publishing rule.

When you configure the rule to redirect to a hosted site, ISA Server retrieves the object from the path, specified in the request, on the host computer. For example, suppose you specify that ISA Server redirect requests for example.microsoft.com/development to a host computer called Dev. When a client requests an object from example.microsoft.com/development, then ISA Server retrieves the object from the development folder on Dev.

Web publishing rules determine the requested destination by reading the host header.

Bridging

With bridging, you can configure how traffic should be passed to the Web server. For example, suppose a client uses Secure Sockets Layer (SSL) to communicate with the ISA Server computer and a Web publishing rule maps the request to an internal Web server. The initial communication uses SSL. However, by default, all further communication uses a protocol that is not secure, such as Hypertext Transfer Protocol (HTTP).

When you create a Web publishing rule, you can configure how SSL requests should be redirected—as HTTP requests or as SSL requests. If requests are redirected as SSL requests, then ISA Server re-encrypts the packets before passing them on to the Web server. In other words, a new secure channel is established for the communication with the SSL Web server. This redirection is also referred to as SSL bridging. For more information, see SSL bridging.

You can also secure HTTP communication. That is, even if the initial communication uses HTTP, after ISA Server passes the request to the internal Web server, the communication can be redirected using SSL. If the request is redirected as an SSL request, then the packets are encrypted.

You can also set whether HTTP or SSL requests should be passed on as an FTP request to the Web server. In other words, if the external client requests an object using HTTP or SSL, ISA Server can then redirect the request to the internal Web server using FTP. If you configure bridging in this way, you can specify which port should be used when bridging FTP requests.

The upstream Web server may require a client certificate. In this case, configure ISA Server to authenticate with a specific client-side certificate.

If you configure the Web publishing rule to require a secure channel, then all client requests for the specified destinations must be on the port specified for SSL connections.

For more information, see Configure an action for a Web publishing rule, Use client-side certificate to authenticate to Web server, Enable SSL listeners, Configure how to redirect HTTP requests for Web publishing rules, and Configure how to redirect SSL requests for Web publishing rules.

Rule order

Web publishing rules are processed in order, for each incoming Web request. When the rule matches a request, the request is routed and cached accordingly. If no rule matches the request, ISA Server processes the default rule and discards the request.

For more information, see Change the order of a Web publishing rule and Controlling incoming requests.

Default Web publishing rule

When you install ISA Server, it configures a default Web publishing rule. The default rule is configured so that all requests are discarded.

The default Web publishing rule is last in the order. You cannot modify or delete the default Web publishing rule.

Example

Suppose you want to publish two internal servers, on the example.microsoft.com domain, one called Dev and one called Mktg. The Mktg computer should return objects when a client requests //example.microsoft.com/Marketing, and Dev should return objects when a client requests //example.microsoft.com/Development.

First, create two destination sets. The first destination set, called Marketing, should include the computer \\example.microsoft.com and the path \Marketing\*. The second destination set, called Development, should include the computer \\example.microsoft.com and the path \Development\*.

Next, create two Web publishing rules which redirect requests to the appropriate internal Web servers. Configure the first Web publishing rule with the following parameters:

  • Set Destination Set to the Marketing destination set.
  • Set Applies to to Any user, group, or client computer.
  • Set Action to Redirect to a hosted site and specify Mktg as the specified host.

Configure the second Web publishing rule with the following parameters:

  • Set Destination Set to the Development destination set.
  • Set Applies to to Any user, group, or client computer.
  • Set Action to Redirect to a hosted site and specify Dev as the specified host.

When a client requests an object on //example.microsoft.com/Development, ISA Server retrieves the request from /Dev/Development.

For more detailed scenarios that illustrate the use of Web publishing rules, see Web publishing scenarios.


Web publishing rules and routing rules

Web publishing rules are processed in order, with the default Web publishing rule processed last. Routing rules are also processed in order.

When an external client requests an object from an internal Web server, rules are processed in the following order.

  1. Web publishing rules are processed.
  2. Routing rules are processed.

For more information, see Web publishing rules and Routing Web requests.

Because routing rules are processed after Web publishing rules, the caching policy specified for the routing rule may also apply to a Web publishing rule's destination sets. For example, consider the following rules:

  • A Web publishing rule that redirects requests from all clients for widgets.microsoft.com to a hosted site (Web server) specified as msweb.
  • A routing rule that routes requests for a destination set that includes msweb by servicing them directly. The rule's cache properties are configured to Never cache the response to the request.

When an external (Internet) user requests an object from widgets.microsoft.com, ISA Server intercepts the request. First, it processes the Web publishing rule, determining that the request should be redirected to the msweb computer. Next, it processes the routing rule, determining that the request should be serviced directly by the specified server (msweb). The routing rule also determines that the requested object will not be cached.

The following example illustrates what happens when you create a Web publishing rule, without creating an appropriate routing rule.

  • A Web publishing rule that redirects requests from all clients for a destination set that includes example.microsoft.com to a hosted side specified as myinternalms
  • A routing rule that routes requests for all destinations to an upstream server

In this case, the Web publishing rule is processed first; all requests fro example.microsoft.com are redirected to myinternalms. However, the routing rule specifies that the request should be routed to an upstream server (and not sent directly to the destination server). The request will always be routed to the upstream server.

For more background information on how incoming requests are processed, see Controlling incoming requests.


Server publishing rules

Microsoft Internet Security and Acceleration (ISA) Server uses server publishing to process incoming requests to internal servers, such as Simple Mail Transfer Protocol (SMTP) servers, File Transfer Protocol (FTP) servers, Structured Query Language (SQL) servers, and others. Requests are forwarded downstream to an internal server, located behind the ISA Server computer.

Server publishing allows virtually any computer on your internal network to publish to the Internet. Security is not compromised because all incoming requests and outgoing responses pass through ISA Server. When a server is published by an ISA Server computer, the Internet Protocol (IP) addresses that are published are actually the IP addresses of the ISA Server computer. Users who request objects think that they are communicating with the ISA server—whose name or IP address they specify when requesting the object—while they are actually requesting the information from the actual publishing server.

Server publishing rules determine how server publishing functions, essentially filtering all incoming and outgoing requests through the ISA Server computer. Server publishing rules map incoming requests to the appropriate servers behind the ISA Server computer. These rules will grant access dynamically, as specified, from Internet users to the specific publishing server.

The published server is actually a secure network address translation (SecureNAT) client. Because the published server is a SecureNAT client, no special configuration of the published server is required after you create the server publishing rule on the ISA Server computer. Note that ISA Server must be configured as the default gateway on the published server. For more information, see Configuring SecureNAT clients.

Use IP packet filters to publish servers located on a perimeter network (also known as a DMZ, demilitarized zone, and screened subnet). For more information on when to use packet filters and when to use server publishing rules, see Server publishing rules and IP packet filters.

Client address sets

You can limit server publishing rules to specific clients by specifying the client address sets to which the rule applies. Client address sets probably include IP addresses of clients located on the Internet, including those not necessarily in your corporate network. For configuration instructions, see Configure clients for a server publishing rule.

The server publishing rule is applied to client address sets only if IP packet filtering is enabled. If IP packet filtering is not enabled, then the server publishing rule applies to all clients.

Action

When you create the server publishing rule, you specify the following:

  • IP address of the ISA Server. This is the address made available to external clients. When external clients communicate with the publishing server, they actually are communicating with this IP address. This address must be configured as the external IP address on the ISA Server computer.
  • IP address of the publishing server. All requests arriving at the IP address specified by the ISA Server computer are forwarded to this IP address.
  • Mapped server protocol. The data is passed to the internal server, depending on which protocol you specify here. You can select from all protocol definitions configured on the ISA Server with an Inbound direction. For more information, see Configuring protocol definitions.

For more information, see Configure a server publishing rule action.

How Server Publishing Works

To do this, ISA Server takes these steps:

  1. A client computer on the Internet requests an object from an IP address known as that of the publishing server. The IP address is actually associated with the ISA Server computer—it is the IP address of the external network adapter belonging to the ISA Server computer.
  2. The ISA Server computer processes the request, mapping the IP address to an internal IP address of an internal server.
  3. The internal server returns the object to the ISA Server computer, which passes it on to the requesting client.

Example

Suppose you want to allow external clients access to an Simple Mail Transfer Protocol (SMTP) server, whose IP address is 111.111.111.111, and which listens on port 25. You should create a server publishing rule with the following parameters:

  • Set the internal server IP address to 111.111.111.111.
  • Set the mapped external address to an IP address on the external interface card belonging to the ISA Server computer.
  • Set the mapped server protocol to SMTP (server).

To see how server publishing rules are used in a deployment scenario, see Back-to-back perimeter network configuration.


Server publishing rules and IP packet filters

Server publishing rules and Internet Protocol (IP) packet filters both open specific ports for communication between the local network and the Internet. In most situations, you will use server publishing rules to make internal servers accessible to external clients. Indeed, it is recommended that you use server publishing rules, because application filters can further process requests destined for the server. For more information on application filters, see Application filters.

In some cases, IP packet filters must be used:

  • When you are publishing servers that are situated on a perimeter network (also known as a DMZ, demilitarized zone, and screened subnet), you must use IP packet filters to make them accessible to external clients
  • When you are publishing servers or services that are located on the ISA Server computer itself.

For more information, see Server publishing rules and IP packet filters.

Publishing servers on a perimeter network

You configure server publishing rules to allow external clients access to servers situated on the local network. For example, you might want to publish a Simple Mail Transport Protocol (SMTP) server. Create a server publishing rule with the following configuration:

  • Set the IP address of the internal server to the IP address of the FTP server.
  • Set the external IP address on ISA Server to an IP address on the external interface card belonging to the ISA Server computer.
  • Select the SMTP (Server) protocol.
  • Set the client type to Any user, group, or client computer to allow all external clients access to the SMTP server.

If the SMTP server is located on a perimeter network rather than on the local network, use IP packet filters to open a port on the server. For example, to publish an SMTP server located on the perimeter network, create an IP packet filter with the following configuration:

  • Set Servers that use this filter to All ISA servers in the array.
  • Set the filter mode to allow packet transmission.
  • Set the custom filter settings as follows:
    • IP Protocol to TCP
    • Direction to Both
    • Local Port to 25
    • Remote Port to Any
  • Set Local Computer to This computer and specify the IP address of the SMTP server.
  • Set Remote Computer to All remote computers.

For more information, see Three-homed perimeter network configuration.

Server on the same computer as ISA Server

When a service is located on the same computer as ISA Server, you create IP packet filters to allow communication through to the specific port used by the service—not server publishing rules. For example, ISA Server includes a preconfigured IP packet filter called DNS filter that allows DNS queries on the ISA Server computer itself.

For a scenario that illustrates how IP packet filters are used, see Using packet filters to publish a Web server on the ISA Server computer.


Mail Server Security Wizard

Microsoft Internet Security and Acceleration (ISA) Server includes the Mail Server Security Wizard, which you can use to configure ISA Server, so that it allows hosting and securing a mail server behind ISA Server. The wizard configures ISA Server rules to securely publish internal mail services to your external users.

For instructions, see Run the Mail Server Security Wizard.

The default mail server publishing rules allow incoming traffic to the mail server. The mail server publishing rules have the following parameters:

  • The protocol for the selected mail service
  • The published Internet Protocol (IP) address of the mail server, which is exposed by the ISA Server
  • The internal IP address of the mail server

The Mail Server Security Wizard also creates protocol rules, to allow outgoing mail traffic. The protocol rules have the following parameters:

  • The protocol is Simple Mail Transfer Protocol (SMTP) (client)
  • The client set includes the internal IP address of the Exchange Server computer

Depending on which settings you select when running the wizard, different rules are created. ISA Server marks rules created by the wizard with a name beginning with "Mail Wizard rule". For example, if you run the wizard, and configure it to publish outgoing SMTP mail, then ISA Server creates a protocol rule named Mail Wizard rule—SMTP (client). Internal IP: IP_Address, where IP_Address is the internal IP address that you specified when running the wizard.

If the mail server is located on the same computer as ISA Server, then IP packet filters are created, rather than protocol rules.

For more information on how to use the Mail Server Security Wizard when in a deployment scenario, see Exchange Server publishing scenarios.

Content filtering

If the SMTP filter is installed and enabled, then you can apply content filtering for all incoming mail by selecting that option in the wizard. The content will be filtered in accordance with the SMTP filter configuration. For more information, see Using the SMTP filter.

Note that, if the SMTP filter is already enabled, you cannot use the Mail Server Security Wizard to disable it. For instructions on how to disable the SMTP filter, see Enable an application filter.


Configuring ISA Server cache

This section introduces key concepts and terminology about the Microsoft Internet Security and Acceleration (ISA) Server cache.

For information on specific topics, see:

  • Configuring cache drives
  • Configuring Cache Array Routing Protocol
  • Configuring how ISA Server caches objects
  • Updating cache content automatically


Configuring cache drives

If you install Microsoft Internet Security and Acceleration (ISA) Server in cache mode or integrated mode, then as part of the setup process, you will be prompted to select cache drives. ISA Server sets aside space to store cached data on the selected drive.

For background information on the caching process, see How caching works and Cache content files.

Cache requirements and recommendations

You must use an NTFS partition for caching and the drive must be a local drive. Typically, the best performance is obtained if you use a drive different from the one on which the main ISA Server system and the Windows 2000 operating system are installed. It is further recommended that you format the drive before using it for caching.

If you want to use the ISA Server caching feature, you must install ISA Server on a computer that has at least one partition formatted as an NTFS volume. If your current server disk volume uses FAT partitions, you can convert these partitions to NTFS by using Convert, which is included with Windows 2000 Server. Convert does not overwrite the data on the disk. For more information on using Convert, type convert /? at a command prompt.

You select the disk drives that are available for caching during ISA Server installation. If your system is limited to a single disk drive, select a hard disk of sufficient size to make the cache as large as possible. Cache size can be increased later by adding more disk volumes.

By default, the setup process searches for the largest NTFS partition and sets a default cache size of 100 megabytes (MB) if there are at least 150 MB available. When configuring the cache drives, you must allocate at least one drive and 5 MB for caching. However, it is recommended that you allocate at least 100 MB and add 0.5 MB for each Web Proxy client, rounded up to the nearest full megabyte.

You might also want to change the default for the ISA Server cache to your fastest hard disk drive, preferably a small computer system interface (SCSI) drive that has adequate free space.

Windows 2000 allows you to format a drive without assigning a letter. However, ISA Server caching does not recognize these drives.

Configuring size and location

For each server, you can configure the size and location of the cache used by the Web Proxy service. It is recommended that you allocate a large cache, since objects are dropped from the cache when it reaches its capacity.

You can also configure the percentage of total memory to use for caching. For configuration instructions, see Configure percentage of available memory to use for caching.

When you modify cache properties, the Web Proxy service is stopped and restarted.

For configuration instructions, see Configure cache size on a server.


Configuring Cache Array Routing Protocol

By default, Cache Array Routing Protocol (CARP) is enabled for all the servers in the array, for outgoing Web requests. That is, the CARP algorithm will store objects in any one of the member servers' cache. By default, CARP is disabled for all incoming Web requests.

When a member server of an array determines that the requested object is not in its cache, it sends the request to another member server, using the destination server's intra-array IP address. Typically, this is the same Internet Protocol (IP) address that downstream clients and Microsoft Internet Security and Acceleration (ISA) Server computers use to communicate with this ISA Server computer. Because this value must be replicated to all ISA Server computers in the array, it is recommended that you do not change this value. For instructions on configuring a server's intra-array IP address, see Configure intra-array communication.

You can configure the member servers so that different servers have different loads. For example, if one server in the array has a disk four times as large as all the other member servers, you can configure that server to receive a proportionate amount of the cache load, by configuring its load factor. The load factor determines how to divide the load among members of an array. Changing this value increases or decreases the load on an ISA Server computer.

For more background information on CARP, see Cache Array Routing Protocol. For instructions on enabling CARP, see Enable Cache Array Routing Protocol.

For instructions on configuring the load factor, see Configure the load factor.


Configuring how ISA Server caches objects

This section describes how you can configure the Microsoft Internet Security and Acceleration (ISA) Server cache, specifying when objects should be cached and which objects should be cached.

For information on specific topics, see:

  • Configuring which content to cache
  • Configuring expiration policy
  • Configuring active caching
  • Configuring negative caching


Configuring which content to cache

You can configure whether Microsoft Internet Security and Acceleration (ISA) Server should cache the following types of Hypertext Transfer Protocol (HTTP) objects:

  • Objects larger than a specified size
  • Objects whose last modification date is not specified
  • Objects that do not have a 200 response
  • Objects with question marks in their Uniform Resource Locator (URL)

For configuration instructions, see Configure which content to cache.

In a Secure Socket Layer (SSL) bridging scenario, ISA Server can cache HTTP and Secure Socket Layer (SSL) objects. You can use the FPCWebRequestConfiguration COM object to configure whether SSL objects should be cached. For more information, see the ISA Server Software Development Kit.

RAM caching

ISA Server caches objects to random access memory (RAM) and to the disk. Objects cached to memory can be retrieved faster than objects cached to the disk. By default, objects smaller than 12,800 bytes are stored in RAM and on the disk. By default, all larger objects are cached only to the disk.

You can modify the maximum size of objects that can be stored in memory. For configuration instructions, see Configure which content to cache.

Response headers

ISA Server does not cache responses to requests that contain the following HTTP response headers:

  • cache-control: no-cache
  • cache-control: private
  • pragma: no-cache
  • www-authenticate
  • set-cookie

Request headers

In addition, the ISA Server computer does not cache responses to requests that contain the following HTTP request headers:

  • authorization, unless the origin server explicitly allowed this by including 'cache-control: public' header in the response
  • cache-control: no-store


Configuring expiration policy

Microsoft Internet Security and Acceleration (ISA) Server features highly configurable expiration policies. For Hypertext Transfer Protocol (HTTP) and File Transfer Protocol (FTP) objects, you can choose whether or not to activate caching and you can configure the expiration policy. You can also configure whether to return expired objects, under specific circumstances.

HTTP object caching

ISA Server can keep and use expired objects in the cache for a specified amount of time, if the source Internet site for an object becomes unavailable. An expired object is an object whose time-to-live period (TTL) has run out. Expiration policy balances your organization's need for fresh, current data against network performance. Depending on your particular organization's need, you can specify one of the following expiration policies for HTTP objects:

  • Frequently. This means that objects in the cache will be more timely, although there may be a degradation in network performance because objects are retrieved more regularly from the Internet.
  • Less frequently. This means that objects in the cache will be less current, but network performance will not suffer.
  • Normally. This balanced approach is the default. Objects are updated somewhat frequently, but network performance is not ignored. This is the default.
  • Custom settings. You can set TTL to zero or to a specified percentage of the content's age. The higher the percentage, the less frequently the cache is updated.

For configuration instructions, see Configure HTTP caching.

FTP object caching

You can configure how FTP objects are maintained in the ISA Server cache. For FTP objects, you can choose whether or not to activate caching, and you can configure the time-to-live period (TTL) for all objects.

By default, the TTL for all FTP objects is set to one day.

For configuration instructions, see Configure FTP caching.

Returning expired objects

Objects stored in the cache are marked with a TTL. When an object's TTL passes, the object has expired. When a client requests an object, ISA Server checks to see if a valid version of the object is in its cache. If so, the object is returned. Otherwise, depending on the cache policy, ISA Server requests the object from the specified Web server.

If the Web server is accessible, ISA Server retrieves the object and returns it to the client. If the Web server is not accessible, then you can configure ISA Server to return an expired version of the object from the ISA Server cache.

For configuration instructions, see Configure whether to return expired objects from the cache.


Configuring active caching

With active caching enabled, Microsoft Internet Security and Acceleration (ISA) Server analyzes objects that are in the cache to determine which are most frequently accessed. When popular objects in the cache get ready to expire, ISA Server automatically refreshes the content in the cache.

When active caching is enabled, if you are using a dial-up connection to the Internet, then the computer will dial out to the Internet service provider (ISP) when retrieving this content.

You can configure the active caching policy. Select one of the following:

  • Frequently. In this case, frequently-requested objects should be downloaded to the cache regularly, as they are about to expire. This will help ensure that an object requested by a client will be in the cache.
  • Less Frequently. Some frequently-requested objects will be downloaded to the cache. Although there is less likelihood that the object will be fresh and in the cache, network performance may be improved, since active caching is at a minimum.
  • Normally. This balanced approach is the default. Objects are updated somewhat frequently, but network performance is not ignored.

For more information, see Configure active caching.


Configuring negative caching

When Microsoft Internet Security and Acceleration (ISA) Server cannot retrieve an object from a specific Web server, the response may be cached. This is referred to as negative caching. You can configure negative caching, specifying that error responses to client requests should be cached.

When you configure negative caching, you specify that Hypertext Transfer Protocol (HTTP) objects with the following status code should be cached: 203, 300, 301 or 410.

For configuration instructions, see Configure negative caching.


Updating cache content automatically

Microsoft Internet Security and Acceleration (ISA) Server extends caching performance further with customizable cache download. By monitoring and analyzing Internet access, you can determine which Hypertext Transfer Protocol (HTTP) content will be needed and when. You can then use the scheduled cache content download feature to download the HTTP content directly to the ISA Server cache, upon request or as scheduled. This enables you to update the ISA Server cache with HTTP content that you anticipate will be requested by clients in your organization. This content will be available for access directly from the ISA Server cache, rather than from the Internet.

You can download a single Uniform Resource Locator (URL), multiple URLs, or an entire Web site. When you create a scheduled cache content download job, you can limit which content should be downloaded. For example, you can limit the download to a single domain. Similarly, you can limit how many links to follow. For more information, see Configure a location from which to download content.

When you schedule cache content download, you can configure dynamic content to be cached by configuring the ISA Server cache to store the objects, even if the HTTP cache control headers indicate that they are not necessarily cachable. For configuration instructions, see Cache dynamic content for scheduled content download jobs.

Warning

  • If the Web server from which the object is being downloaded requires client authentication, then the scheduled content download job will fail.

The download occurs according to a preconfigured schedule. (You can also specify whether the schedule should recur periodically.) Scheduled content download jobs can be configured for outgoing Web requests and for incoming Web requests.

For outgoing Web requests, you determine which objects on the Internet are most often requested by users. You can then schedule jobs that retrieve the objects from the Internet and load them into the cache.

For incoming Web requests, you can schedule jobs that retrieve content from your internal Web servers.

For more information, see Configure content download job schedule.

Cache Array Routing Protocol and scheduled content download

When Cache Array Routing Protocol (CARP) is enabled, ISA Server uses the CARP algorithm to determine on which server the object should be cached. When CARP is disabled, the object is cached to all the servers in the array. For more background information, see Cache Array Routing Protocol.

By default, CARP is enabled for outgoing Web requests and disabled for incoming Web requests. That is, by default, ISA Server uses CARP to cache objects from outgoing Web requests on just one specific server, but objects from incoming Web requests are cached on all servers in the array.

ISA Server checks the outgoing Web request settings for CARP when retrieving objects for a scheduled content download job. This is true for download jobs that apply to outgoing Web requests and to jobs that apply to incoming Web requests. For this reason, it is recommended that you disable CARP for outgoing Web requests, if you want the scheduled content download job to cache objects to all the servers in the array.


Using extensions

This section describes extensions that are installed with Microsoft Internet Security and Acceleration (ISA) Server. You can further enhance ISA Server functions by installing filters developed by external vendors. Application filters provide additional protection for Firewall clients. Web filters protect all clients making Web requests.

For information about specific topics, see:

  • HTTP redirector filter
  • FTP access filter
  • SOCKS filter
  • SMTP filter
  • RPC filter
  • Streaming media filter
  • Intrusion detection filters
  • Installing additional application filters
  • Using Web filters
  • H.323 protocol filter


HTTP redirector filter

The Hypertext Transfer Protocol (HTTP) redirector filter that is provided with Microsoft Internet Security and Acceleration (ISA) Server forwards HTTP requests from Firewall and secure network address translation (SecureNAT) clients to the Web Proxy service. Requests are cached, even if the Firewall client does not configure the Web browser to use the ISA Server computer.

You can configure the redirector to do one of the following:

  • Redirect requests from Firewall and SecureNAT clients to the Web Proxy service on the local ISA Server computer.
  • Send requests from Firewall and SecureNAT clients directly to the specified Web server. In this case, the request essentially bypasses the Web Proxy service and the requested object will not be cached.
  • Discard HTTP requests from Firewall and SecureNAT clients. In other words, even if all other ISA Server rules allow the request, the HTTP redirector filter might reject it. This essentially forces all clients who want to use HTTP to be set up as Web Proxy clients.

For configuration instructions, see Configure how the HTTP filter redirects requests.

HTTP redirector filter and Firewall client authentication

When the HTTP redirector filter passes a request from a Firewall client to the Web Proxy service, the client's authentication information is lost. Therefore, when the HTTP redirector filter is enabled and configured to redirect to the Web Proxy service, requests from Firewall client is handled as unauthenticated. If unauthenticated access is not allowed, such requests will be denied. For more information on how clients are authenticated, see Rules and authentication.

For example, suppose you configure a policy that allows access to all users except a user named John. If John, whose computer is configured as a Firewall client, requests an HTTP object, then the request will be allowed.


FTP access filter

The File Transfer Protocol (FTP) filter that is provided with Microsoft Internet Security and Acceleration (ISA) Server forwards FTP requests from secure network address translation (SecureNAT) clients to the Firewall service. The filter dynamically opens secondary ports, which are required by the FTP protocol, and performs necessary address translation for SecureNAT clients.

Although you could create a protocol definition for FTP, the protocol definition would not offer the full range of capabilities afforded by the FTP filter. A user-defined FTP protocol definition and the FTP access filter are different because:

  • The FTP filter dynamically opens specific ports for the secondary connection, but the protocol definition opens a range of secondary ports.
  • The FTP access filter can protect SecureNAT clients by performing the address translation required for the secondary connection. The protocol definition cannot.
  • Because the FTP access filter includes a read-only FTP protocol definition, it can distinguish between read and write permissions, enabling you to fine-tune access permissions.

Protocol definitions

The FTP access filter uses the following protocol definitions, which are installed with the filter when ISA Server is installed:

  • FTP client read only
  • FTP client
  • FTP server

For more information, see Configuring protocol definitions.

You can create protocol rules that limit access to the protocol definitions. For example, you might want to limit the client's FTP access to FTP read operations only. You can create a protocol rule that allows the FTP client read only protocol. Because ISA Server allows access only when explicitly specified, only this protocol will be allowed.

For more information, see Create a protocol rule.


SOCKS filter

The SOCKS filter provided with Microsoft Internet Security and Acceleration (ISA) Server forwards requests from SOCKS applications to the Firewall service. ISA Server checks the access policy rules to determine if the SOCKS client application can communicate with the Internet.

By default, ISA Server listens for requests from SOCKS applications on port 1080. You can modify the default port. For configuration instructions, see Change SOCKS port.


SMTP filter

Microsoft Internet Security and Acceleration (ISA) Server includes several application filters which are automatically installed when you install ISA Server. The Simple Mail Transfer Protocol (SMTP) filter is an application filter that intercepts all SMTP traffic that arrives on port 25 of the ISA Server computer. The filter accepts the traffic, inspects it, and passes it on only if it the rules allow it.

The SMTP filter can filter incoming mail based on source user or domain and can generate an alert if mail is received from specific users. The SMTP filter can filter messages, based on recipient. (The filter maintains a list of rejected users from whom mail messages are not accepted.)

Setting up the SMTP filter

After you enable the SMTP filter, you must perform the following steps to enable content filtering:

  1. Use the ISA Mail Server Security Wizard to configure content filtering on the ISA Server, specifying the following:
    • Select the following mail services: Incoming SMTP mail and Outgoing SMTP mail. Also, select Apply content filtering.
    • For the external Internet Protocol (IP) address, specify an IP address on the ISA Server computer.
    • For the mail server internal IP address, specify the IP address of a computer with both SMTP server and Internet Information Services (IIS).

    For configuration instructions, see Run the Mail Server Security Wizard.
  2. On the SMTP Server computer that you specified, configure the IIS Default SMTP Virtual Server properties as follows:
    • On the Access tab, click Relay and then select All except the list below.
    • On the Delivery tab, click Advanced and then, in Smart Host, type the real name of the mail server computer (not the virtual SMTP server).

    For more information on configuring Internet Service Manager, see Windows Help.
  3. Install the ISA Server Message screener. For instructions on installing specific ISA Server components, see Change ISA Server installation options.
  4. At a command prompt, type:

    setreg.vbs ISA_Server

    where ISA_Server is the name of the ISA Server computer.
    Setreg.vbs is available on the ISA Server CD-ROM in the \ISA\I386 folder.

Configuring SMTP filter

The SMTP filter also maintains a list of rejected domains. Messages from users in those domains are also rejected.

If you installed the message screener, you can configure the SMTP filter to check for specific attachments or keywords. You can specify the size, name, or type of content that should be held, deleted, or forwarded to the administrator. You can also specify that one of those three actions should be taken if a keyword is found.

The SMTP filter can also check for buffer overrun attacks. A buffer overrun occurs when an SMTP command is specified with a line length exceeding a specific value. When a buffer overrun attack is attempted, the SMTP filter can be configured to generate an alert.

For more information, see Stop users from gaining access to the SMTP server, Stop domains from gaining access to the SMTP server, Configure attachments for the SMTP filter, Configure keywords for the SMTP filter, and Configure SMTP filter buffer overflow thresholds.


RPC Filter

The RPC filter provided with Microsoft Internet Security and Acceleration (ISA) Server enables publishing of RPC servers, making them accessible to external clients.

The RPC filter adds the following protocols:

  • Any RPC (Server)
  • Exchange RPC (Server)

To publish a server that uses an RPC protocol, create a server publishing rule, and configure the rule to apply to the specific RPC protocol. For more information, see Server publishing rules.


Streaming media filter

The streaming media filter allows Firewall and secure network address translation (SecureNAT) clients to use the following streaming media protocols to access media streaming servers such as Microsoft Windows Media Technology (WMT) Server.

  • Microsoft Windows Media (MMS), which allows Windows Media Player client access and server publishing
  • Progressive Networks protocol (PNM), which allows RealPlayer client access and server publishing
  • Real Time Streaming Protocol (RTSP), which allows RealPlayer G2 and QuickTime 4 client access and server publishing

Making media streaming content available to internal users

The streaming media filter can enhance perceived network performance by splitting live streams. Live stream splitting refers to the ability of filters to obtain information from the Internet once, then make it available locally on a Windows Media Technology server for access by other clients.

If you make live stream splitting available, then you can select from the following options:

  • A single WMT server can retransmit the data. The WMT server must reside on the same computer as ISA Server.
  • If an array of ISA Server computers connect your network to the Internet, then you can specify a pool of one or more WMT servers. When a client requests streaming media, then the ISA Server array will obtain the data from the WMT servers.

In order to use live stream splitting, you must first install the optional Windows Media Services in Windows. If you use the WMT server pool option, then you only need to install the Windows Media Service admin.

You cannot use the local WMT Server and publish WMT server on the ISA Server computer.

For more information, see Configure live stream splitting for media streaming application filter.

Securing access to the internal WMT server

When you use an internal WMT server to make the content available to internal clients, ensure that only clients who have permission in the access policy rules can access the content, even when it is on the WMT server in the internal network. To secure access, you should make the ISA Server a client of the WMT server—no other internal clients should be WMT Server clients.

Media server publishing

Similarly, the streaming media filter can protect an internal streaming media server, which allows external clients to obtain information from the server by way of the ISA Server computer.

Protocol definitions

The streaming media filter uses the following protocol definitions, which are installed with the filter when ISA Server is installed:

  • Client PNM: RealNetworks protocol
  • Server PNM: RealNetworks protocol
  • Client RTSP
  • Client MMS: Windows Media
  • Server MMS: Windows Media
  • Server RTSP

For more information, see Configuring protocol definitions.

You can create protocol rules that limit access to the protocol definitions. For example, you might want to limit client's access to Windows media only You can create a protocol rule that allows the Client MMS: Windows media protocol and another protocol rule that denies use of the Client PNM: RealNetworks protocol. For more information, see Create a protocol rule.

If you disable the streaming media filter, all its protocol definitions are also disabled. That is, traffic that uses Windows Media Technologies, RealNetworks, and RTSP protocol definitions is blocked.


Intrusion detection filters

Microsoft Internet Security and Acceleration (ISA) Server includes application filters which analyze all incoming traffic for specific intrusions. ISA Server includes these intrusion detection application filters:

  • DNS intrusion detection filter
  • POP intrusion detection filter

Intrusion detection functionality based on technology from Internet Security Systems, Inc., Atlanta, GA, USA, www.iss.net. Portions Copyright © 2000 Internet Security Systems, Inc.

DNS intrusion detection filter

The DNS intrusion detection filter intercepts and analyzes DNS traffic destined for the internal network. You can configure the filter to check for the following intrusion attempts:

  • DNS hostname overflow
  • DNS length overflow
  • DNS zone transfer from privileged ports (1–1024)
  • DNS zone transfer from high ports (above 1024)

For more information, see Configure a DNS intrusion detection filter.

DNS hostname overflow

A DNS hostname overflow occurs when a DNS response for a host name exceeds a certain fixed length. Applications that do not check the length of the host names may return overflow internal buffers when copying this host name, allowing a remote attacker to execute arbitrary commands on a targeted computer.

DNS length overflow

DNS responses for Intenet protocol (IP) addresses contain a length field, which should be four bytes. By formatting a DNS response with a larger value, some applications executing DNS lookups will overflow internal buffers, allowing a remote attacker to execute arbitrary commands on a targeted computer.

DNS zone transfer from privileged ports (1–1024)

A DNS zone transfer from privileged ports (1–1024) occurs when a client system uses a DNS client application to transfer zones from an internal DNS server. The source port number is a privileged port number (between 1 and 1024), indicating a client process.

DNS zone transfer from high ports (above 1024)

A DNS zone transfer from high ports (above 1024) occurs when a client system uses a DNS client application to transfer zones from an internal DNS server. The source port number is a privileged port number (between 1 and 1024), indicating a client process.

POP intrusion detection filter

The Post Office Protocol (POP) intrusion detection filter intercepts and analyzes POP traffic destined for the internal network. Specifically, the application filter checks for POP buffer overflow attacks.

A POP buffer overflow attack occurs when a remote attacker attempts to gain root access of a POP server by overflowing an internal buffer on the server.


Installing additional application filters

Additional application filters developed by other vendors can work together with Microsoft Internet Security and Acceleration (ISA) Server to further extend its security model.

Application filters are effective only on the server on which they are installed. Therefore, if you want the application filter to monitor communication for every ISA Server computer, you must install it on every server.

When you install a new application filter, you must restart the Firewall service. For configuration instructions, see Start a service.


Using Web filters

Web Proxy service of Microsoft Internet Security and Acceleration (ISA) Server features can be extended by installing Web filters developed by other vendors. Web filters can monitor, evaluate, and intercept hypertext transfer protocol (HTTP) communication between an internal network and the Internet.

Web filters are loaded when the Web Proxy service is started. Once loaded, Web filters can be configured to receive a number of special filter event notifications that occur with each HTTP request and response.


H.323 protocol filter

The H.323 protocol filter, which is provided with Microsoft Internet Security andAcceleration (ISA) Server, is an application filter for the H.323 protocol. Application filters are ISA Server extensions that inspect or modify application data, such as SMTP, H.323, and streaming media. The H.323 protocol filter is used by client-to-client audio-visual applications to allow conferencing applications such as NetMeeting 3.0 and higher to work through ISA Server.

Protocol definitions

The H.323 protocol filter uses the following protocol definitions, which are installed when H.323 Gatekeeper is installed:

  • Allow incoming calls
  • Allow outgoing calls
  • Allow audio
  • Allow video
  • Allow T120 and application sharing
  • Use DNS gatekeeper lookup and LRQs for alias resolution

For more information, see Configuring protocol definitions.

You can create protocol rules that limit access to the protocol definitions. For example, you might want to deny a client's H.323 access to video, T120 data-sharing and outbound calls. You can create a protocol rule that allows the H.323 client access only to the inbound calls protocol. Because ISA Server allows access only when explicitly specified, only this protocol will be allowed.

For more information, see Enable the H.323 protocol rule and Control access to the H.323 protocol rule.


Using H.323 Gatekeeper

For information about specific topics, see:

  • H.323 Gatekeeper
  • Registering clients with H.323 Gatekeeper
  • Call routing rules
  • Placing a TAPI call through H.323 Gatekeeper
  • Related components


H.323 Gatekeeper

H.323 Gatekeeper works together with the H.323 protocol filter to provide full communications capabilities to H.323 registered clients using applications that are compliant with H.323 Gatekeeper, such as NetMeeting 3.0 or later. H.323 Gatekeeper provides registered clients with call routing and directory services and enables others to reach them using their well-known alias. (A well-known alias can be an e-mail address, such as someone@microsoft.com.) Clients registered with H.323 Gatekeeper can use H.323 Gatekeeper to participate in video, audio, and data conferences in local and wide area networks, across multiple firewalls and over the Internet.

You must use H.323 Gatekeeper for all inbound calls through ISA Server to a well-known alias. Any client who wants to be available through a well-known alias must register with H.323 Gatekeeper. In addition, clients must register with H.323 Gatekeeper if they use translation services when placing outbound calls, such as when using NetMeeting 3.0 or later to place a call to a Plain Old Telephone System (POTS) device. Outbound calls that do not require translation services may be placed without H.323 Gatekeeper.

H.323 RAS Registration Admission and Status

Every H.323 transaction has two endpoints—an origination endpoint, and a destination endpoint, usually clients. You usually register endpoints with H.323 Gatekeeper using H.323 Registration, Admission, and Status (H.323 RAS) protocol. You can use H.323 Gatekeeper to add a static registration to endpoints that do not support H.323 RAS registration. Static registrations are permanent, always active, and cannot receive inbound calls.

H.323 Gatekeeper supports three types of H.323 RAS addressing:

  • E164 phone number addressing, which uses characters 0-9.
  • H.323 ID addressing, which uses anything similar to e-mail addresses or DNS strings, including account names and machine names. No syntax is defined.
  • E-mail ID type addressing.

You can use the H.323 protocol filter to create PBX-style dial plans to route calls intelligently, based on the called party's address. You specify the rules which the H.323 Gatekeeper uses to govern which portion of an E164, H.323 RAS or H.323 ID alias address will be used to resolve an address request.

Inbound calls

When H.323 Gatekeeper receives an inbound query, it identifies the type of alias request, whether it is E164, H.323-ID, or e-mail ID. H.323 Gatekeeper then compares the alias to the list of rules. it then adds rules with patterns that match the query to an ordered rule list. Then it sorts the matching rules placing those with the lowest metric value highest on the list. It then goes through the list of rules, in order, until either the requested address is resolved, or the search fails. H.323 Gatekeeper then sends a confirmation or rejection to the originating client, depending upon whether or not the address is found.

Outbound Calls

When a registered client places an outbound call, an admission request is sent to the H.323 Gatekeeper. In the request, the H.323 client specifies the destination alias. If H.323 Gatekeeper finds the address for the destination alias, it returns an admission confirm, and the requested destination address to the originating client. If the destination address is not found, it continues to process the rule list to resolve the request.

For example, an e-mail namespace request would be processed in this manner. Suppose you are working at Microsoft and want to use NetMeeting 3.0 to call a person who also works at Microsoft and uses the e-mail alias someone@microsoft.com.

An admission request is sent to H.323 Gatekeeper for someone@microsoft.com. H.323 Gatekeeper will search the rules list, which could consist of the following rules:

Main list of rules

Domain | Matching | Rule name | Weighted metric value
microsoft.com | Suffix | Registration database | 1
microsoft.com | Suffix | Gatekeeper otherzone | 2
microsoft.com | Suffix | ILS Server named "Bogus" | 3
microsoft.com | Suffix | Active Directory | 4
microsoft.com | Suffix | None (cannot be resolved) | 6
(empty) | Suffix | Gateway/Proxy named "Bogus2" | 10
(empty) | Exact | Registration database | 2
(empty) | Exact | None (cannot be resolved) | 10

The H.323 Gatekeeper rule engine sorts the matching rules for the domain part microsoft.com and the resulting rule list is:

Domain | Matching | Rule name | Weighted metric value
microsoft.com | Suffix | Registration database | 1
microsoft.com | Suffix | Gatekeeper "otherzone" | 2
microsoft.com | Suffix | ILS Server named "Bogus" | 3
microsoft.com | Suffix | Active Directory | 4
microsoft.com | Suffix | None (cannot be resolved) | 6
(empty) | Suffix | Gateway/Proxy named "Bogus2" | 10

H.323 Gatekeeper will use the first rule to try to find someone@microsoft.com in the Registration Database. If the registration exists, H.323 Gatekeeper returns a confirmation along with the address to the origination client. If no address is returned H.323 Gatekeeper continues looking, going to the second rule, Gatekeeper "otherzone," for resolving the request. H.323 Gatekeeper works its way down the rule list until an address is returned or until it gets to the None Rule. When the None Rule is encountered, the query fails and a "Cannot be resolved" message is sent. Once the None Rule has been reached, no other rules are processed, regardless of their weighted metric value.

An outbound request to another domain will be forwarded to the ISA Server and resolved in the following way:

A NetMeeting 3.0 client at given company calls someone@microsoft.com. Using the main list of rules, from the previous example, the H.323 Gatekeeper rule engine sorts the matching rules for the domain part of the given company's URL and returns the resulting sorted list of rules.

Sorted list of rules

Domain | Matching | Rule Name | Weighted Metric Value
(empty) | Suffix | Gateway/Proxy named "Bogus2" | 10

H.323 Gatekeeper informs the ISA Server the address is external to the network. The ISA Server initiates the DNS lookup sequence.

If the query returns a fully-qualified DNS computer name, H.323 Gatekeeper performs an additional DNS query to find the IP address.

H.323 Gatekeeper considerations

  • H.323 Gatekeeper does not provide any security.
  • If you are managing ISA Server of H.323 Gatekeeper remotely on a computer running Windows 2000 Professional, you cannot access all of the tools and Help topics unless you have installed the Windows 2000 Administration Tools.
  • H.323 Gatekeeper does not enforce uniqueness of aliases for registration. However, each Q931 address must be unique. The H.323 Gatekeeper uses only the most recently registered active terminal for any one alias. This allows a user to register under one alias from multiple locations.
  • The H.323 application filter does not support H.225 signaling across ISA Server. For example, a NetMeeting 3.0 user who is located on an internal network cannot register with a gatekeeper that is located on the Internet. Also, an H.323 Gatekeeper that is running on the internal network cannot exchange location messages with a gatekeeper running on the Internet.
  • ISA Server provides support for fast kernel-mode data pumping of RTP audio and video media while making calls across ISA Serve using NetMeeting 3.0 or later. For more information, see Enable fast kernel-mode data pumping..


Registering clients with H.323 Gatekeeper

Every H.323 transaction has two endpoints, an origination endpoint and a destination endpoint. An endpoint can be an H.323 client (for example, a terminal running NetMeeting), a proxy server (such as a Microsoft Internet Security and Acceleration (ISA) Server computer), or a gateway. Endpoints typically register with the H.323 Gatekeeper using H.323 Registration, Admission, and Status (H.323 RAS). You can use the H.323 Gatekeeper snap-in to add a static registration to endpoints that do not support H.323 RAS registration.

There are two versions of the H.323 RAS protocol:

H.323 RAS version one

  • uses type E164 Phone number addressing (characters 0-9)
  • and type H.323 ID addressing (anything similar to e-mail addresses or DNS strings, including account names and machine names. No syntax is defined).

H.323 RAS version two

  • uses e-mail ID type addressing

Endpoint attributes

When you register an endpoint using H.323 RAS, the following attributes are specified:

  • List of Q931 addresses for the endpoint
  • List of H.323 RAS addresses for the endpoint
  • List of Aliases

Aliases

An alias consists of two fields, a type and a name, where the type would be E164, H.323-ID or E-Mail-ID.

For example, when NetMeeting registers with H.323 Gatekeeper, it registers the account name as an H.323 ID alias, and the phone number as an E164 alias.

When you view Active Terminals in the ISA console, the first H.323 ID (e-mail ID) and E164 ID are displayed in the Account column. You can right-click the terminal in the list and choose Properties to display all registered aliases.

Notes

  • H.323 Gatekeeper enforces unique Q931 addresses, but does not enforce unique aliases. Allowing multiple instances of an alias registration with unique Q931 address provides the client with the abiltity to register at multiple terminals. Only the most recent registration for an alias is active for resolving alias requests.
  • If you are managing ISA Server or H.323 Gatekeeper remotely, on a computer running Windows 2000 Professional, you cannot access all of the tools and Help topics unless you have the Windows 2000 Administration Tools installed.


Call routing rules

If a unique Q931 address is not included in a call request, H.323 Gatekeeper tries to match each namespace rule with the requested alias. This section describes how H.323 Gatekeeper searches for the alias of a registered active terminal according to routing rules. For more information, see Create a call routing rule.

Phone number rules

Phone number (E164) rules use the following form:

Item | Description
Name | Descriptive name for the rule.
Pattern | Specifies the pattern of numbers you are trying to match.
Matching | Specifies whether the pattern type must be a string at the beginning of the phone number (also called a prefix type), or an exact match for the entire phone number (also called an exact type), for the rule to take effect.
Destination | Specifies the server to which the call request is routed if this rule takes effect.
Discard digits | Specifies how many digits are removed from the phone number before it is routed to the destination. This feature is only supported for phone numbers (E164) and gateway destinations.
Add prefix | Specifies a prefix that will be added to the destination. This feature is only supported for phone numbers (E164) and gateway destinations.
Metric | Specifies how this rule is ranked compared to other rules. The lower the metric number, the more precedence this rule is given.
Status | Specifies whether this rule is enabled or disabled.
Description | Descriptive text for this rule.

H.323 Gatekeeper determines which rules match the alias in the call request. A phone number alias can use the numbers 0 through 9 and the number sign (#), asterisk (*), and comma (,).

Example of a Call routing Rule

Imagine that a caller requests translation for the phone number 95551234#3344.

H.323 Gatekeeper attempts to match the digits up to the first special character or the end of the string, if there is no special character. In the phone number 95551234#3344, the alias used for rule matching is 95551234.

Here are some examples of patterns and matching types, prefix and exact, for the example.

Pattern | Matching
9 | Prefix
9555 | Prefix
95551234 | Exact
 | Prefix

The following items would not match the example:

Pattern | Matching
8 | Prefix
9555 | Exact

IP Address rules

IP Address rules use the following form:

Item | Description
Name | Descriptive name for the rule.
Pattern | Specifies the pattern of the IP address you are trying to match.
Destination | Specifies the destination to which the call request is routed if this rule takes effect.
Metric | Specifies how this rule is ranked compared to other rules. The lower the metric number, the more precedence this rule is given.
Status | Specifies whether this rule is enabled or disabled.
Description | Descriptive text for this rule.

IP address rules apply only to requests for translation of IP address strings that take the form of a.b.c.d. For example, 192.168.154.13

The options for IP address rules you can select are:

  1. None- The call is disconnected.
  2. Gateway/Proxy- The call is forwarded to the selected H.323 Gateway, Proxy server or Internet firewall.
  3. Gatekeeper- The call is forwarded to a gatekeeper residing in a different zone.
  4. Multicast Gatekeeper- The call is forwarded to a group of multicast gatekeepers.
  5. Local Network- The callee resides in the same network as the caller. The call is returned to the callee to resolve.

Example of an IP address Rule

Imagine that a caller requests translation for an IP address string in the form of a.b.c.d.

H.323 Gatekeeper attempts to match the digits of the string with the pattern of the IP Address Rule, and finds the following matching rules for a.b.c.d

Rule | Metric
None | 4
Multicast Gatekeeper | 1
Local Network | 3

Once H.323 Gatekeeper has established which routing rules match, the routing rules are sorted for additional processing according to the following requirements.

  1. Rules with the highest number of bits in the subnet mask have precedence over rules with fewer bits in the subnet mask. For example, an IP address string of 192.168.154.13, with a subnet mask of 255.255.255.4, would have a higher number of bits then an IP address string of 192.168.154.13 with a subnet mask of 255.255.255.0.
  2. If two rules contain the same pattern and the same matching type, a rule with a lower metric number assigned to it has precedence over a rule with a higher metric number.

IP address rules are only applicable if the dialed address is in the form of a.b.c.d.

If a request made for an IP address string in the form of someone@Microsoft.com is made the IP address rule will not take effect.

Once H.323 Gatekeeper has established which routing rules match, the routing rules are sorted for additional processing according to the following requirements:

  • Rules with patterns containing more digits have precedence over rules with patterns containing fewer digits.
  • If two rules contain the same pattern, a rule with matching type Exact has precedence over a rule with matching type Prefix.
  • If two rules contain the same pattern and the same matching type, a rule with a lower metric number has precedence over a rule with a higher metric number.

E-mail address rules

E-mail address rules take the following form:
Item | Description
Name | Descriptive name for the rule.
Pattern | Specifies the text pattern you are trying to match.
Matching | Specifies whether the pattern must be a suffix (a string at the end of the e-mail address) or exact (an exact match for the entire e-mail address) for the rule to take effect.
Destination | Specifies to which server the call request is routed if this rule takes effect.
Metric | Specifies how this rule is ranked compared to other rules. The lower the metric number, the more precedence this rule is given.
Status | Specifies whether this rule is enabled or disabled.
Description | Descriptive text for this rule.

H.323 Gatekeeper attempts to match the domain portion of the e-mail alias with the rules. The following table describes how the domain portion is obtained from an alias:

Alias example | Domain portion
Someone@microsoft.com | microsoft.com
accounting1.microsoft.com | accounting1.microsoft.com
accounting1 |

Notes

  • The last example (accounting1), also known as a dotless alias, is not a standard alias format.

If a call request contains the e-mail address someone@microsoft.com, the domain portion is microsoft.com.

Here are some examples of the pattern and matching parts Suffix and Exact, for rules that match the destination alias in the example:

Pattern | Matching
com | Suffix
microsoft.com | Suffix
microsoft.com | Exact
 | Suffix

The following items would not match the example:

Pattern | Matching
com | Exact
 | Exact

If a call request alias contains someone and the domain portion is an empty string, the only rules that match this domain portion are:

Pattern | Matching
 | Exact
 | Suffix

After H.323 Gatekeeper has established which routing rules match, the routing rules are sorted for additional processing according to the following conditions:

  • Rules with patterns containing more domain elements have precedence over rules with patterns containing fewer domain elements. For example, accounting1.accounting.microsoft.com has precedence over microsoft.com.
  • If two rules contain the same pattern, a rule with the matching type Exact has precedence over a rule with the matching type Suffix.
  • If two rules contain the same pattern and the same matching type, a rule with a lower metric number has precedence over a rule with a higher metric number.

Rule Processing

After H.323 Gatekeeper creates the sorted list of rules that match an alias, it processes each one in order. How the rules are processed depends on the type of destination specified by the rule.

The rule can specify one of the following destination types:

None

Stops rule processing. Even if there are other matching rules having lower metric values following the None rule, H.323 Gatekeeper rejects the request and returns the message Cannot be resolved.

Registration Database

Finds the alias in the local registration database. If the alias is of type E164, H.323 Gatekeeper looks for the phone number string up to, but not including, any special characters. For example, if the original string is 95551212#3344, Gatekeeper uses only 95551212.

If the alias is of E-mail-ID or H323-ID type, the lookup is done using the complete alias, not only the domain portion. Because the two types are interchangeable, a user registered with an E-mail-ID of someone@microsoft.com is successfully resolved when querying for the H323-ID of someone@microsoft.com, and vice versa. If an entry is found, its address is returned in the confirmation to the client and the processing stops. Otherwise the processing continues with the next rule.

This destination cannot be used for IP aliases.

Gateway/Proxy

This rule specifies the destination as a particular proxy, or gateway, and lists an IP, DNS, or NetBIOS address. In networks with multiple proxies or gateways, if name resolution is required, H.323 Gatekeeper randomly chooses one of the returned IP addresses. The process of random IP address selection balances the network load by allowing H.323 Gatekeeper to choose from multiple proxies or gateways. The resulting address is returned to the client. The client is responsible for proceeding with the call to connect to the supplied address. If an entry is found, the address is returned in the confirmation to the client and the processing stops. Otherwise, the processing continues with the next rule.

Internet Locator Service (ILS)

This destination specifies a server running Internet Locator Service (ILS) for name resolution. It works only for the e-mail address namespace queries. It is an uncommon format, used to support backward compatibility.

First, the H.323 Gatekeeper conducts name resolution for the IP address of the server running Site Server ILS, if necessary, then it queries the server.

It performs at least one query with the complete alias. If the query fails and the alias has the standard e-mail address format, such as someone@microsoft.com, the H.323 Gatekeeper extracts the user name and queries again the ILS for entries beginning with someone. This provides the client that tries to find someone@microsoft.com with the opportunity to find an ILS entry such as someone]accounting5.accounting.microsoft.com. If neither query returns an entry, H.323 Gatekeeper goes to the next rule.

Gatekeeper

This destination specifies the IP, DNS, or NetBIOS address of a specific H.323 Gatekeeper. H.323 Gatekeeper conducts name resolution finding the IP address of the destination H.323 Gatekeeper. After that, it queries that gatekeeper with a special location request. When H.323 Gatekeeper receives location request, it attempts to resolve the alias by using only the registration database, regardless of what the rules specify. If the distant H.323 Gatekeeper returns a Q931 address, it is returned to the client. Otherwise, rule processing continues.

Multicast Gatekeeper

The rule specifies that the destination is a multicast group. The H.323 Gatekeeper sends a location request message using the multicast protocol. H.323 Gatekeeper listens and processes incoming location requests only on the 224.0.1.41 multicast group, even though other multicast groups may exist. If any entry is found, the address is returned in the confirmation to the client and the processing stops. Otherwise, processing continues with the next rule.

DNS

This destination type can only be used for e-mail address queries. The H.323 Gatekeeper resolves the domain of the alias using DNS, regardless of the user portion of the alias. In someone@microsoft.com, the domain of the alias is microsoft.com. If any entry is found, the address is returned in the confirmation to the client and the processing stops. Otherwise, rule processing continues.

Active Directory

The H.323 Gatekeeper may use Active Directory for resolving e-mail address namespace aliases. It extracts the user name portion from the alias if the alias contains @, or uses the alias itself in the case of dotless aliases or for all aliases containing 15 characters or fewer. If the length exceeds 15 characters, no query is conducted. If the query returns a fully-qualified DNS computer name, H.323 Gatekeeper performs an additional DNS query to find the IP address. If no fully-qualified DNS computer name is returned, the rule processing continues.

Local Network

This destination type is valid only for IP aliases. H.323 Gatekeeper returns the address represented by the alias. Because a resolution or translation is not required and the destination is directly reachable, the IP address that is represented by the requested alias can be used as the query address.


Placing a TAPI call through H.323 Gatekeeper

When a user at an H.323 endpoint places a TAPI call, the endpoint requests permission from H.323 Gatekeeper using an Admission Request message, requesting that H.323 Gatekeeper translate the alias being called. H.323 Gatekeeper does not provide security services.

In the request, the client provides a list of aliases for the terminal being called. H.323 Gatekeeper processes only the first alias in the list. The client can also provide a Q931 address for the active terminal being called. If the request contains the Q931 address, H.323 Gatekeeper does not attempt to translate the aliases. Instead, H.323 Gatekeeper returns the requested address to the client as the resulting Q931 address, if the address is valid.


Related components

H.323 Gatekeeper provides directory and call routing services to registered H.323 clients. Its use allows calls to be placed using the e-mail address or phone number of the called party. It also allows the transparent use of H.323 proxies and gateways between IP and PSTN networks. Administrators can create PBX-style dial plans to route calls based on the called party address. H.323 Gatekeeper is mandatory for inbound calls through ISA Server. Outbound calls can be made without H.323 Gatekeeper.

This section describes components related to H.323 Gatekeeper.

H.323 Proxy

ISA Server includes an H.323 protocol filter that allows H.323 calls from applications compliant to H.323 Gatekeeper, such as NetMeeting 3.0 or later, to traverse multiple firewalls. This enables rich multimedia and real-time collaboration capabilities between enterprises using the Internet. Organizations that deploy inter-departmental firewalls can also use this technology to enhance communications between their own employees over their intranets. Additionally, the H.323 protocol filter protects communication between internal clients and the Internet, hiding client IP addresses and restricting access, as needed.

NetMeeting 3.0 and later

This new version of NetMeeting provides support for H.323 Gatekeeper and the H.323 protocol filter. It continues support for T.120 data conferencing, tunneling it inside of H.323 and enhancing security features. A completely redesigned user interface is provided. Site Server ILS service support is continued, but users are encouraged to use the new H.323 standards-based server infrastructure in ISA Server.

H.323 Protocol

The H.323 Protocol is a set of standards enabling real-time multimedia conferencing and communications over packet-based networks that do not guarantee Quality of Service (QoS). The standard was developed to accommodate varying usages. Due to the inadequate quality of voice over the Internet it was proposed improvements could be made if communications were carried partly on the Internet and partly on the Public Switched Telephone Network (PSTN). The H.323 standards would also provide for communications between a standard PSTN phone and a computer-based client.

H.323 defines how compliant components (terminals, gateways, gatekeepers, and Multipoint Control Units-MCUs) engage in audio, video, and multi-point conference communications. The H.323 standards define the mandatory and optional services supplied by a gatekeeper. The H.323 protocol standard contends with call control and management for both point-to-point and multipoint conferences. The standard also defines the gateway operability that allows calls to be connected between H.32x terminals as well as between LAN and PSTN devices.


Monitoring and reporting

This section describes Microsoft Internet Security and Acceleration (ISA) Server monitoring and reporting functions. For information about specific topics, see:

  • Alerts
  • Logging
  • Reporting
  • Real-time monitoring
  • Monitoring performance


Alerts

This section introduces the key concepts and terminology of alerting in Microsoft Internet Security and Acceleration (ISA) Server. For information about specific topics, see:

  • Configuring alerts
  • ISA Server events


Configuring alerts

The alert service of Microsoft Internet Security and Acceleration (ISA) Server notifies you when specified events occur. You can configure alerts to trigger a series of actions when an event occurs. The ISA Server alert service acts as a dispatcher and as an event filter. It is responsible for catching events, checking whether certain conditions are met, and taking corresponding actions.

You can use ISA Management to view the full list of events supplied with ISA Server and to configure which actions should be triggered when an event occurs.

Alert condition

You can select which event and additional condition triggers an alert action. You can also limit the event to a particular server in the array.

You can also configure the following thresholds, which determine when the alert action should be performed:

  • How many times per second the event should occur before issuing an alert (also called the event frequency threshold).
  • How many events should occur before the alert is issued.
  • How long to wait before issuing the alert again.

Alert action

You can set one or more of the following actions to be performed when an alert condition is met:

  • Send an e-mail message.
  • Take a specific action.
  • Log the event in the Windows event log.
  • Stop or start any ISA Server service: Firewall service, Web Proxy service, or Scheduled Content Download service.

You can configure which credentials should be used when an application is executed. Be sure that the specified user has Logon as batch job privileges. Use the Local Security Policy to configure user privileges.

When the alert action is to execute a command, the path specified for the command action must exist on all servers in the array. It is recommended that you use environment variables (such as %SystemDrive%) within the path name.

For more information, see ISA Server events, Modify an alert condition, Configure an alert threshold, and Modify an alert action.


ISA Server events

The table below lists the events and, where relevant, additional keys that are defined by Microsoft Internet Security and Acceleration (ISA) Server. When you create an alert, you specify one of the following events that triggers the alert.

Alert action failure | The action associated with this alert failed.
Asymmetric installation | A component that was configured for the array is missing on this server. <%user friendly component identification%>
Cache container initialization error | The cache container initialization failed and the container was ignored.
Cache container recovery complete | The recovery of a single container was completed.
Cache file resize failure | There was a failure to reduce the cache file size.
Cache initialization failure | The Web cache proxy was disabled because of global failure.
Cache recovery completed | The cache content recovery was completed.
Cache write error | There was a failure to write cached content to the cache.
Cached object ignored | During cache recovery, an object with conflicting information was detected. The object was ignored.
Client/server communication failure | Communication between the Firewall client and the Firewall service of ISA Server failed.
Component load failure | There was a failure to load an extension component. <%module name%>
Configuration error | The ISA Server configuration is invalid <%storage path%>.
Dial on demand failure | Failed to create a dial-on-demand connection, because there is no answer or the line is busy.
DNS Intrusion | A host name overflow, length overflow, zone high port, or zone transfer attack occurred.
Event logging failure | There was a failure to log the event information to the system event log.
Failed to retrieve object | The object <URL> could not be loaded. <error>
Intra-array credentials | The intra-array credentials were incorrect.
Intrusion detected | An external user attempted an intrusion attack.
Invalid dial-on-demand credentials | Invalid dial-on-demand credentials were detected.
Invalid ODBC log credentials | The specified user name or password for this ODBC database is invalid.
IP packet dropped | An IP packet that is not allowed by the policy was dropped.
IP Protocol violation | A packet with invalid IP options was detected and dropped.
IP Spoofing | The IP packet source address is not valid.
Log failure | <service name> log failed.
Network configuration changed | A network configuration change that affects ISA Server was detected.
OS component conflict | There is a conflict with one of the operating system components: network address translation (NAT) editor, Internet Connection Sharing (ICS), or Routing and Remote Access.
Oversize UDP packet | ISA Server dropped a User Datagram Protocol (UDP) packet because it exceeded maximum size, as specified in the registry key.
POP Intrusion | Detected a Post Office Protocol (POP) buffer overflow.
Report Summary Generation Failure | Received an rrror while generating a report summary from log files.
Resource allocation failure | There was a resource allocation failure, for example, the system ran out of memory.
RPC filter - server connectivity changed | The connectivity to the publishing RPC service <server name> changed. <additional key>
Server Publishing Failure | The server publishing rule cannot be applied.
Service Initialization failure | There was a service initialization failure.
Service not responding | An ISA Server service terminated or stopped functioning unexpectedly.
Service shutdown | A service stopped properly. <%service name%>
Service started | A service started properly. <%service name%>
SMTP Filter Event | A Simple Mail Transfer Protocol (SMTP) filter event occurred.
SOCKS configuration failure | The port specified in SOCKS properties is in use by another protocol.
SOCKS request was refused | A SOCKS request was refused due to policy violation.
The server is out of array's site | All members of the array must be in the same site, but this server is in a different site.
Unregistered event | An unregistered event was raised. The event internal ID is %1
Upstream chaining credentials | The upstream chaining credentials are incorrect.
Web Proxy routing failure | The Web Proxy service of ISA Server failed to route the request to an upstream proxy server.
Web Proxy routing recovery | Web Proxy resumed routing to an upstream proxy server.
WMT live stream splitting failure | The streaming application filter encountered an error during Windows Media Technology (WMT) live stream splitting.


Logging

This section introduces key logging concepts and terminology.

  • Configuring logging
  • Logging to a file
  • Logging to a database
  • Firewall and Web Proxy log fields
  • Packet filter log fields
  • Logging packets


Configuring logging

Microsoft Internet Security and Acceleration Server features detailed security and access logs, whihc can be generated in standard data formats like W3C and ODBC. New logs can be created daily, weekly, monthly, or yearly. You can configure and enable logs for the following ISA Server components:

  • Packet filters
  • Firewall service
  • Web Proxy service

When the logging feature is enabled, logs are generated for each server in the array. Subsequently, the Microsoft Internet Security and Acceleration (ISA) Server reporting system centralizes the logs, collecing data from all the servers into a single report. For more information, see Reporting.

For more information, see Logging to a file and Logging to a database.


Logging to a file

You can save Microsoft Internet Security and Acceleration (ISA) Server logs to a file, in one of the following formats:

  • W3C format
  • ISA format

Although the logging configuration is array-wide, log files are created on every ISA Server in the array. The directory that you specify for logging may be interpreted differently on each server. If you specify a relative directory, then the log is saved in the ISALogs folder, under the ISA Server installation folder. If you specify an absolute path, the actual log folder may be different on every server. The path you specify for the log file must exist on every server in the array. Otherwise, the ISA Server services fail.

Important

  • It is recommended to log to NTFS volumes.

W3C Format

W3C logs contains both data and directives describing the version, date and logged fields. Because the fields are described in the file, unselected fields are not logged. The tab character is used as delimiter. Date and time are in GMT.

ISA Format

ISA format contains only data with no directives. All fields are always logged; unselected fields are logged as dash to indicate they are empty. The comma character is used as delimiter. The date and time fields are in local time.

Options

In order to save the amount of disk space required for the log files, ISA Server allows you to configure the following options:

  • You can compress log files, to reduce the disk space required. Files are compressed only if stored on NTFS partitions. For configuration instructions, see Configure logging to a file.
  • You can limit the number of log files saved on all the servers in the array. For configuration instructions, see Set maximum number of log files.


Logging to a database

You can store Microsoft Internet Security and Acceleration (ISA) Server logs to an ODBC database. The ISA Server CD-ROM includes the following sample scripts:

  • Pf.sql defines the packet filter log table called PacketFilterLog.
  • W3PROXY.sql defines the Web Proxy service log table called WebProxyLog.
  • FWSRV.sql defines the Firewall service log table called FirewallLog

Scripts for use with SQL Server are located in a folder on the ISA Server CD-ROM:

Systemroot\ISA\Database table creation scripts\SQL Server

Scripts for use with Access are located in another folder on the ISA Server CD-ROM.

Systemroot\ISA\Database table creation scripts\Access

You can use these files to create your own log database. For example, perform the following steps to create an Access or SQL Server database file:

  1. Open the database application.
  2. Create a new query.
  3. Paste in the text from the applicable database file.
  4. Run the query to create the table.

After you create the table, you must set up the ISA Server computer to use the data source name. Perform the following steps:

  1. On the ISA Server computer, click Start, point to Programs, point to Administrative Tools, and then click Data Sources (ODBC).
  2. On the System DSN tab, click Add.
  3. In the Create New Data Source, select the appropriate driver for the database.
  4. Follow the on-screen instructions to create the database.

    5. The data source name is the ODBC data source (DSN) that you use when you configure the log database properties.

Caution

  • Do not use spaces in the data source name or ISA Server services will stop.

For configuration instructions, see Configure logging to a database.


Firewall and Web Proxy log fields

You can use the Microsoft Internet Security and Acceleration (ISA) Server log to monitor and analyze the status of the Firewall and Web Proxy services.

The table below lists the fields that you can include in each of the ISA Server log files. For configuration instructions, see Specify fields to log. The field name noted in parentheses is relevant when you use the World Wide Web Consortium (W3C) extended log file format.

Some fields are relevant for either Web Proxy Service or Firewall Service, but not both. In this case, the table indicates which service the field applies to. Note that, in ISA Server log format, the field will appear in the log with a hyphen (-). In W3C log file format, the field will not appear at all, if it is not applicable to the service.

Field position Descriptive name (field name) Description
1 Client IP
(c-ip) 		The Internet Protocol (IP) address of the requesting client.
2 Client user name
(cs-username) 		Account of the user making the request. If ISA Server Access Control is not being used, ISA Server uses anonymous.
3 Client agent
(c-agent) 		The client application type sent by the client in the Hypertext Transfer Protocol (HTTP) header. When ISA Server is actively caching, the client agent is ISA Server.
For Firewall service, this field includes information about the client's operating system. Click here to see a table of possible values.
4 Authentication status
(sc-authenticated) 		Indicates whether or not client has been authenticated with ISA Server. Possible values are Y and N.
5 Date
(date) 		The date that the logged event occurred.
6 Time
(time) 		The time that the logged event occurred. In W3C format, this is in Greenwich mean time.
7 Service name
(s-svcname) 		The name of the service that is logged.
  • w3proxy indicates outgoing Web requests to the Web Proxy service.
  • fwsrv indicates Firewall service.
  • w3reverseproxy indicates incoming Web requests to the Web Proxy service.
8 Proxy name
(s-computername) 		The name of the computer running ISA Server. This is the computer name that is assigned in Windows 2000.
9 Referring server name
(cs-referred) 		If ISA Server is used upstream in a chained configuration, this indicates the server name of the downstream server that sent the request.
10 Destination name
(r-host) 		The domain name for the remote computer that provides service to the current connection. For the Web Proxy service, a hyphen (-) in this field may indicate that an object was retrieved from the Web Proxy server cache and not from the destination.
11 Destination IP
(r-ip) 		The network IP address for the remote computer that provides service to the current connection. For the Web Proxy service, a hyphen (-) in this field may indicate that an object was sourced from the Web Proxy server cache and not from the destination. One exception is negative caching. In that case, this field indicates a destination IP address for which a negative-cached object was returned.
12 Destination port
(r-port) 		The reserved port number on the remote computer that provides service to the current connection. This is used by the client application initiating the request.
13 Processing time
(time-taken) 		This indicates the total time, in milliseconds, that is needed by ISA Server to process the current connection. It measures elapsed server time from the time that the server first received the request to the time when final processing occurred on the server—when results were returned to the client and the connection was closed.

For cache requests that were processed through the Web Proxy service, processing time measures the elapsed server time needed to fully process a client request and return an object from the server cache to the client.
14 Bytes sent
(cs-bytes) 		The number of bytes sent from the internal client to the external server during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the remote computer or that no bytes were sent to the remote computer.
15 Bytes received
(sc-bytes) 		The number of bytes sent from the external computer and received by the client during the current connection. A hyphen (-), a zero (0), or a negative number in this field indicates that this information was not provided by the remote computer or that no bytes were received from the external computer.
16 Protocol name
(cs-protocol) 		Specifies the application protocol used for the connection. Common values are HTTP, File Transfer Protocol (FTP), Gopher, and Secure Hypertext Transfer Protocol (HTTPS).
For Firewall service, the port number is also logged.
17 Transport
(cs-transport) 		Specifies the transport protocol used for the connection. Common values are Transmission Control Protocol (TCP) and User Datagram Protocol (UDP).
18 Operation
(s-operation) 		Specifies the application method used. For Web Proxy, common values are GET, PUT, POST, and HEAD.
For Firewall service, common values are CONNECT, BIND, SEND, RECEIVE, GHBN (GetHostByName), and GHBA (GetHostByAddress).
19 Object name
(cs-uri) 		For the Web Proxy service, this field shows the contents of the URL request. This field applies only to the Web Proxy service log.
20 Object MIME
(cs-mime-type) 		The Multipurpose Internet Mail Extensions (MIME) type for the current object. This field may also contain a hyphen (-) to indicate that this field is not used or that a valid MIME type was not defined or supported by the remote computer. This field applies only to the Web Proxy service log.
21 Object source
(s-object-source) 		Indicates the source that was used to retrieve the current object. This field applies only to the Web Proxy service log. Click here to see a table of some possible values.
22 Result code
(sc-status) 		This field can be used to indicate:
  • For values less than 100, a Windows (Win32) error code
  • For values between 100 and 1,000, an HTTP status code
  • For values between 10,000 and 11,004, a Winsock error code
Click here to see a table of some possible values.
23 Cache info
(s-cache-info) 		This number reflects the cache status of the object, which indicates why the object was or was not cached. This field applies only to the Web Proxy service log. Click here to see a table of some possible values.
24 Rule #1
(rule#1) 		This reflects the rule that either allowed or denied access to the request, as follows:
  • If an outgoing request is allowed, this field reflects the protocol rule that allowed the request.
  • If an outgoing request is denied by a protocol rule, this field reflects the protocol rule.
  • If an outgoing request is denied by a site and content rule, this field reflects the protocol rule that would have allowed the request.
  • If an incoming request was denied, this field reflects the Web publishing or server publishing rule that denied the request.
  • If no rule specifically allowed the outgoing or incoming request, the request is denied. In this case, the field is empty.
25 Rule #2
(rule#2) 		This reflects the second rule that either allowed or denied access to the request.
  • If an outgoing request is allowed, this field reflects the site and content rule that allowed the request.
  • If an outgoing request is denied by a site and content rule, this field reflects the site and content rule that denied the request.
  • If no rule specifically allowed the outgoing or incoming request, the request is denied. In this case, the field is empty.
26 Session ID
(sessionid) 		This identifies a session's connections. For Firewall clients, each process that connects through the Firewall service initiates a session. For secure network address translation (SecureNAT) clients, a single session is opened for all the connections that originate from the same IP address. This field is not included in the Web Proxy service log. This field applies only to the Firewall service log.
27 Connection ID
(connectionid) 		This identifies entries that belong to the same socket. Outbound TCP usually has two entries for each connection: when the connection is established and when the connection is terminated. UDP usually has two entries for each remote address. This field is not included in the Web Proxy service log. This field applies only to the Firewall service log.

Object source values

Source values | Description
0 | No source information is available.
Cache | Source is the cache. Object returned from cache.
Inet | Source is the Internet. Object added to cache.
Member | Returned from another array member.
NotModified | Source is the cache. Client performed an If-Modified-Since request and object had not been modified.
NVCache | Source is the cache. Object could not be verified to source.
Upstream | Object returned from an upstream proxy cache.
Vcache | Source is the cache. Object was verified to source and had not been modified.
VFInet | Source is the Internet. Cached object was verified to source and had been modified.

Click here to return to ISA Server log file fields.

Result code values

Value | Description
200 | OK - Successful connection
201 | Created
202 | Accepted
204 | No content
301 | Moved permanently
302 | Moved temporarily
304 | Not modified
400 | Bad request
401 | Unauthorized
403 | Forbidden
404 | Not found
500 | Internal server error
501 | Not implemented
502 | Bad gateway
503 | Service unavailable
10060 | Connection timed out
10061 | Connection refused by destination
10065 | Host unreachable
11001 | Host not found

Click here to return to ISA Server log file fields.

Cache info values

Value | Description
0x00000001 | Request should not be served from the cache
0x00000002 | Request includes the IF-MODIFIED-SINCE header
0x00000004 | Request includes one of these headers: CACHE-CONTROL:NO-CACHE or PRAGMA:NO-CACHE
0x00000008 | Request includes the AUTHORIZATION header
0x00000010 | Request includes the VIA header
0x00000020 | Request includes the IF-MATCH header
0x00000040 | Request includes the RANGE header
0x00000080 | Request includes the CACHE-CONTROL: NO-STORE header
0x00000100 | Request includes the CACHE-CONTROL: MAX-AGE, or CACHE-CONTROL: MAX-STALE or CACHE-CONTROL: MIN-FRESH header
0x00000200 | Cache could not be updated.
0x00000400 | IF-MODIFIED-SINCE time specified in the request is newer than cached LASTMODIFIED time
0x00000800 | Request includes the CACHE-CONTROL: ONLY-IF-CACHED header
0x00001000 | Request includes the IF-NONE-MATCH header
0x00002000 | Request includes the IF-UNMODIFIED-SINCE header
0x00004000 | Request includes the IF-RANGE header
0x00008000 | More than one VARY header
0x00010000 | Response includes the CACHE-CONTROL: PUBLIC header
0x00020000 | Response includes the CACHE-CONTROL: PRIVATE header
0x00040000 | Response includes the CACHE-CONTROL: NO-CACHE or PRAGMA: NO-CACHE header
0x00080000 | Response includes the CACHE-CONTROL: NO-STORE header
0x00100000 | Response includes either the CACHE-CONTROL: MUST-REVALIDATE or CACHE-CONTROL: PROXY-REVALIDATE header
0x00200000 | Response includes the CACHE-CONTROL: MAX-AGE or S-MAXAGE header
0x00400000 | Response includes the VARY header
0x00800000 | Response includes the LAST-MODIFIED header
0x01000000 | Response includes the EXPIRES header
0x02000000 | Response includes the SET-COOKIE header
0x04000000 | Response includes the WWW-AUTHENTICATE header
0x08000000 | Response includes the VIA header
0x10000000 | Response includes the AGE header
0x20000000 | Response includes the TRANSFER-ENCODING header
0x40000000 | Response should not be cached.

Click here to return to ISA Server log file fields.

Operating system values

Value | Description
0:3.95 | Windows 95 (16-bit)
2:4.10 | Windows 98 (32-bit)
2:4.0 | Windows 95 (32-bit)
3:4.0 | Windows NT 4.0
3:5.0 | Windows 2000

Click here to return to Client agent.


Packet Filter log fields

You can use the Microsoft Internet Security and Acceleration (ISA) Server log to monitor and analyze status for the packet filters.

For more information on which packets are logged, see Logging packets.

The table below lists the fields that you can include in each of the ISA Server log files.

Field position | Descriptive name (field name) | Description
1 | Date (date) | Date the packet was received.
2 | Time (time) | The time the packet was received (service info fields)
3 | Source IP (source-ip) | The Internet Protocol (IP) address of the source (remote) computer. The source computer is the computer from which the data packets originated.
4 | Destination IP (destination-ip) | The IP address of the destination (local) computer. The destination computer is usually the ISA Server computer.
5 | Protocol (protocol) | The particular transport level protocol that is used during the connection, such as Transmission Control Protocol (TCP), User Datagram Protocol (UDP), or Internet Control Message Protocol (ICMP).
6 | Source port (or protocol type, if ICMP) (param#1) | For TCP and UDP protocols, the remote port used to create a connection. For ICMP protocol, the type used when creating the connection.
7 | Destination port (or protocol code, if ICMP) (param#2) | For TCP and UDP protocols, the local port used to create a connection. For ICMP protocol, the code used when creating the connection.
8 | TCP flags (tcp-flags) | For a TCP data packet, represents the TCP flag value in the IP header. The possible values are FIN, SYN, RST, PSH, ACK, and URG.
9 | Interface (filter-rule) | Indicates whether the packet was accepted (1) or dropped (0). By default, only dropped packets are logged.
10 | Interface IP address (interface) | Interface on which the packet was received; usually only one interface.
11 | Header (ip-header) | The entire IP header of the data packet that generated the alert event. The IP header is logged in hexadecimal format.
12 | Payload (payload) | A listing of a portion of the data packet (after the IP header). The IP packet is logged in hexadecimal format.


Logging packets

All packets that pass through Microsoft Internet Security and Acceleration (ISA) Server can be logged to the packet filter log. You can configure exactly which packets are logged:

  • By default, when you install ISA Server, all dropped packets are logged to the packet filter log. When you disable packet filtering, logging is turned off altogether.
  • You can configure ISA Server to disable logging for packets that are dropped due to any specific block-mode IP packet filter.
  • You can configure ISA Server to log all packets—allowed and dropped—that are communicated by way of ISA Server. When you enable logging of allowed packets, all packets that pass through ISA Server are logged in the packet filter log.

Logging allowed packets and blocked packets causes a considerable load on the server.

For more information, see Enable logging for a specific service, Log blocked packets, and Log allowed packets.


Reporting

This section introduces key concepts and terminology about Microsoft Internet Security and Acceleration (ISA) Server reporting. For specific information, see the following topics:

  • Configuring reports
  • Configuring report log summaries
  • Scheduling reports
  • Viewing predefined reports


Configuring reports

You can use the reporting feature of Microsoft Internet Security and Acceleration (ISA) Server to summarize and analyze the communication patterns without having to write custom scripts or Structured Query Language (SQL) queries. You can schedule ISA Server to generate reports periodically. It saves the generated reports to a specified folder on the server from which the report job is created.

ISA Server can produce the following log files, which record activity on the servers:

  • Packet filter logs record attempts to pass packets through the ISA Server computer.
  • Firewall service logs record attempts to communicate using the Firewall service.
  • Web Proxy service logs record attempts to communicate using the Web Proxy service.

For more information, see Logging.

Report database

The ISA Server reporting mechanism combines the summary logs from the ISA Server computers into a database on each ISA Server. When a report is created, all relevant summary databases are combined into a single report database. The databases reside on the ISA Server computer.

The reports can be viewed only on that ISA Server computer. In other words, you will not be able to view the reports if you run ISA Management of the same array from another ISA Server computer.

For configuration instructions, see Configure the location of the daily report database.

Creating reports

Perform the following steps to create and view a report:

  1. Enable logging for the relevant ISA Server components. Although the report will be generated even if logging is disabled, the reports will not contain meaningful, current information.
  2. Enable the reporting mechanism.
  3. Enable daily and monthly report gathering.
  4. Create a scheduled report job.
  5. View the generated reports.

For more information, see Enable logging for a specific service, Enable reports, Configuring report log summaries, Scheduling reports, Viewing predefined reports.


Configuring report log summaries

Reports are generated from a database that includes data collated from the Microsoft Internet Security and Acceleration (ISA) Server logs. This data is saved in daily or monthly summaries, as specified. For example, you can save daily summary data for 35 days and generate daily reports based on those daily summaries. At least 35 daily summaries must be saved. At least 13 monthly summaries must be saved.

When you enable the summary process, the daily summary process runs every day at 12:30 A.M., regardless of whether you have scheduled reports. The process collates all the logs available on all the servers in the array.

The monthly summary process combines all the daily databases into a single monthly summary. If a daily summary is missing, then the monthly summary process checks the logs to see if the information is available from the logs. If the information is not available, then the monthly summary process generates an error.

Scheduled reports will be created even if daily and monthly summaries are disabled. If the daily and monthly processes are disabled, then the report generator will get the data from the logs. However, the data in the report may not be complete and current since it will not include the latest log information. Typically, the daily report is generated only after the daily report summary process finishes

For configuration instructions, see Enable and configure the log summary.


Scheduling reports

The Microsoft Internet Security and Acceleration (ISA) Server reporting mechanism enables you to schedule reports, based on the data collected from the log files.

You can schedule reports to be generated on a recurring, periodic basis: daily, weekly, monthly, or yearly. The report can include daily, weekly, monthly, or yearly data. For configuration instructions, see Create a report job.

When you schedule a report job, specify the following:

  • Period of activity that the report should cover.
  • When and how often the report should be generated.
  • User name of a user authorized to create the report.
For configuration instructions, see Configure a report job period, Configure a report job schedule, and Specify user credentials for a report job.

Credentials

When you create a scheduled report job, the reports are generated on the server from which you configure the job. However, if the server belongs to a multiserver array, then the reporting mechanism accesses the logs on each of the servers in the array. The user generating the reports must therefore have appropriate permissions to access and use the reporting mechanism on the servers in the array. You must configure an appropriate user name and pass appropriate credentials to generate the reports for all the servers in the array.

Similarly, when you administer ISA Server remotely, you can generate reports for the administered server or array. However, you must have appropriate permissions to access and use the reporting mechanism on each ISA Server computer in the array. All members of the Domain Admins group can generate reports. In addition, users that meet the following criteria can generate reports:

  • The user must be a local administrator on every ISA Server computer in the array.
  • The user must be able to access and launch DCOM objects on every ISA Server in the array.


Viewing predefined reports

Microsoft Internet Security and Acceleration (ISA) Server includes predefined reports, which are described below.

For viewing instructions, see View a report.

Summary Reports

Summary reports include a set of reports that illustrate network traffic usage, sorted by application. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity.

The summary reports combine data from the Web Proxy service and Firewall service logs. For more information on the logs, see Firewall and Web Proxy log fields.

Web Usage Reports

Web usage reports include a set of reports that display top Web users, common responses, and browsers. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity. It shows how the Web is being used in a company.

The Web usage reports are based on the Web Proxy service logs.

Application Usage Reports

Application usage reports illustrate Internet application usage in a company, including incoming and outgoing traffic, top users, client applications, and destinations. These reports are most relevant to the network administrator or the person managing or planning a company's Internet connectivity, because they can help you plan network capacity and determine bandwidth policies.

Application usage reports are based on the Firewall service logs.

Traffic and Utilization Reports

Traffic and utilization reports illustrate total Internet usage by application, protocol, and direction; average traffic and peak simultaneous connections; cache hit ratio; errors; and other statistics. These reports can help plan and monitor network capacity and determine bandwidth policies.

Traffic and utilization reports combine data from the Web Proxy and Firewall service logs.

Security Reports

Security reports list attempts to breach network security. Security reports can help identify attacks or security violations after they have occurred.

Security reports are based on the Web Proxy service, Firewall service, and Packet Filter logs.


Real-time monitoring

The Microsoft Internet Security and Acceleration (ISA) Server real-time monitoring feature enables you to centrally monitor the ISA Server computer activity.

You can view all the alerts that occurred on the ISA Server computers in the array. This will help you monitor, troubleshoot, and analyze ISA Server performance and activity. You can also view the active client sessions to determine which clients are using the ISA Server to communicate with the Internet.

ISA Server lists client sessions as follows:

  • Web Proxy sessions indicate the last minute of Web browser activity, even if the client is not currently browsing.
  • If a publishing server is currently being published, ISA Server will show it as a Firewall client session. Therefore, some Firewall client sessions may be listed, even if no client is actually connected.

You can also use ISA Management to stop or start services, such as the Web Proxy service, Firewall service, and scheduled content download service.

For more information, see View alerts, View sessions, Disconnect a client session, and Start a service.


Monitoring performance

Performance data is an important factor in analyzing and understanding how your Microsoft Internet Security and Acceleration (ISA) Server computer is performing. Using this data, you can:

  • Understand your server workload and its corresponding impact on resources.
  • Track trends and changes in performance, which allows you to tune configurations and plan future changes.
  • Test configuration changes, and track the effects of these changes.
  • Diagnose any problems that may occur.

For more detailed information about performance, see Performance counters.


Deployment scenarios

Microsoft Internet Security and Acceleration (ISA) Server can be deployed in varied network topologies. This section describes some typical network configurations. While your actual network configuration may differ from those described here, the basic concepts and configuration logic may provide insights. For more information on other deployment scenarios, such as network load balancing and ISA Server, refer to the ISA Server Web site. For more specific information, see:

  • Firewall and caching in a small network scenario
  • Connecting remote clients
  • Grouping ISA Server computers for fault tolerance
  • Enterprise scenario with VPN and routing
  • Web publishing scenarios
  • Exchange Server publishing scenarios
  • Perimeter network scenarios
  • H.323 Gatekeeper deployment scenarios


Firewall and caching in a small network scenario

Microsoft Internet Security and Acceleration (ISA) Server can be deployed in a small network, providing the internal clients with secured connectivity to the network. Because of its multipurpose functionality, ISA Server can also act as the caching server for the internal clients. The scenario described in this section shows a typical setup and configuration for a small business with clients requiring access to the Internet.

Characteristics and requirements

The corporation used in this scenario is a small office, with less than 500 users requiring Internet access. Most users require only Web access—using Hyptertext Transfer Protocol (HTTP) or File Transfer Protocol (FTP)—although one specific department also requires access to Windows Streaming Media servers. The corporation needs a reliable method to provide Internet access in an environment with the following requirements:

  • The ISA Server computer is the corporation's only connection to the Internet.
  • The corporation uses demand-dial connections when connecting to the Internet.
  • The corporation does not want to deploy client software to all the users.
  • Users must be able to access the network by dialing up from home or while traveling.

In this scenario, the corporation includes three departments: Sales, Research and Development, and Human Resources. Business needs stipulate that Sales and Research and Development are allowed unlimited HTTP access, but only to a specific list of Web sites. The Human Resources department is allowed HTTP access after hours. In addition, all employees can access Windows Media applications after hours, but with lower bandwidth.

Network configuration

In this scenario, ISA Server is set up on the corporate network to serve as the connection between the local network and the Internet. The users are set up either as Web Proxy clients or SecureNAT clients. An access policy, configured on the ISA Server, stipulates which users are allowed to access the Internet.

Setting up the ISA Server computer

ISA Server is installed in integrated mode as a stand-alone server. A network dial-up connection is configured to dial to the Internet Service Provider (ISP). The ISA Server computer also has a network adapter connected to the internal network and a modem for dialing out to the Internet.

Small office network

No other services (such as Web browsers, Outlook, or Terminal Server) are running on the ISA Server computer.

Setting up clients

For the most part, the users require only Web access. For this reason, most clients are configured as Web Proxy clients. For Web Proxy clients, the Web browsers are configured so that the proxy server is the ISA Server computer. The proxy server port on the Web browser should be set to 8080-assuming that the ISA Server computer's outgoing Web request settings are also set to listen on port 8080.

Some users can use Windows Streaming Media protocols—their computers will also be configured as SecureNAT clients. The default gateway for the SecureNAT clients is configured to the ISA Server computer's IP address. That way, all requests to the Internet will be forwarded to the ISA Server computer, which will handle the request in accordance with the access policy.

Configuring the ISA Server policy

After setting up the ISA Server computer, the administrator uses ISA Management to implement the access policy.

Before creating policy rules, the administrator maps the organization's business guidelines to the ISA Server's policy elements. In this scenario, the administrator creates the following policy elements:

  1. Because the different departments are allowed different access to the Internet, three client address sets are required, corresponding to each department. Each client address set includes the IP addresses of the computers in the three departments: Sales, Research and Development, and Human Resources.

    2. Note

    • If Firewall Client software is installed on the client computers, then user groups can be created, rather than client address sets.
  2. The business guidelines stipulate that specific sites on the Internet can be accessed during the work day. Therefore, the administrator creates a destination set called Work Hour Sites that includes those sites. This way, the rules can be applied to the single destination set.
  3. The business guidelines allow Internet access to all employees after the work day. Therefore, the administrator creates a schedule called After Hours, which can be used when creating rules that allow after-hour Internet access.
  4. Because a dial-up connection is used to access the Internet, the administrator creates a dial-up entry called Call_ISP. The dial-up entry will be used whenever the ISA Server computer needs to access an object on the Internet.

For more information, see Configuring client address sets, Configuring destination sets, Configuring schedules, and Configuring dial-up entries.

The administrator follows these steps to implement an access policy:

  1. Configures the ISA Server computer's outgoing Web request properties, so that ISA Server listens on port 8080.
  2. Creates a rule that routes Web requests to the destination server on the Internet.
    The administrator creates a routing rule that routes all client requests to the Internet. The routing rule is configured so that ISA Server will retrieve requests for objects for all destinations directly from the specified destination on the Internet, unless a valid version of the requested object is in the ISA Server cache. The routing rule is configured to use the Call_ISP dial-up entry, when a request is routed to the Internet.
  3. Configures Firewall chaining, so that all requests for non-Web objects are routed to the destination server on the Internet. In this way, when a client requests an object from a server on the Internet using a non-Web protocol, ISA Server dials out to the Internet, using the Call_ISP dial-up entry.
  4. Verifies that a default site and content rule that allows everyone access to all destinations exists. This rule was created when ISA Server was installed. However, users will only be allowed access after a protocol rule is created.
  5. In order to allow limited Internet access for the users in the Sales department and in the Research and Development department, the administrator creates the following rules:
    • A protocol rule, which allows the Sales and Research and Development client address sets to use the HTTP protocol, always.
    • A site and content rule that allows the Sales and Research and Development client address sets access to all destinations except those in the After Hours Sites destination set.
    • A site and content rule, which allows the Sales and Research and Development client address sets access to all destinations, during the After Hours schedule.
  6. In order to allow users in the HR department to use HTTP after the work day, the administrator creates the following rules:
    • A protocol rule, which allows the HR client address set to use the HTTP protocol, during the After Hours schedule.
    • A site and content, which allows the HR, Sales, and Research and Development client address sets to access all destinations, during the After Hours schedule.
  7. To allow all employees access to streaming media content, using limited bandwidth, the administrator creates the following rules:
    • A protocol rule, which allows all users to use the MMS–Windows Media Client protocol, during the After Hours schedule.

For more information, see Routing Web requests, Routing requests from Firewall and SecureNAT clients, and Site and content rules.


Connecting remote clients

More and more employees are working from home, dialing in from their home computer to the corporate network. It is becoming increasingly common for employees to establish a virtual private network (VPN) connection. In this scenario, the user dials in to the local ISP. On the other end, a server on the corporate network is connected to its ISP and a tunnel is established between the two.

Network configuration

Microsoft Internet Security and Acceleration (ISA) Server is installed in integrated mode, as a stand-alone server. A network dial-up connection is configured on the ISA Server computer to dial to the Internet Service Provider (ISP). The ISA Server computer also has a network adapter connected to the internal network.

The ISA Server is configured as a VPN server to allow communication from specific remote clients to network resources.

Clients that connect via VPN to the ISA Server must be able to access corporate network resources, such as DNS and WINS.

The remote client computers must have a dial-up connection configured to dial in to the local ISP.

Configuring ISA Server

After ISA Server is set up on the computer, the administrator uses ISA Management to configure the computer as an ISA Server VPN. The administrator does the following:

  1. Uses the Client to Server VPN Wizard to set up ISA Server to accept client connections. This accomplishes the following:
    • Configures Routing and Remote Access Services as a VPN server
    • Enforces authentication and encryption methods
    • Opens static packet filters on Routing and Remote Access to allow Point-to-Point Tunneling Protocol (PPTP) and Layer 2 Tunneling Protocol (L2TP) over Internet Protocol (IPSec) protocols.
  2. Creates a network dial-up connection on the client computer, configured as follows:
    • The network connection type is VPN. (Select Connect to a private network through the Internet during installation.)
    • The destination address is the IP address of the ISA Server VPN.

For more background information on VPNs, see Using an ISA Server virtual private network.


Grouping ISA Server computers for fault tolerance

In many scenarios, two or more Microsoft Internet Security and Acceleration (ISA) Server computers can be grouped together in an array, to ensure a fault-tolerant, balanced network. In an array scenario, the Cache Array Routing Protocol (CARP) algorithm is used to ensure that client requests are serviced by the appropriate ISA Server. The array configuration ensures that even if one array member fails, the other array members can continue to service client requests.

In the following scenarios, ISA Server alone cannot ensure fault tolerance and load balancing:

  • For SecureNAT clients, which cannot identify the ISA Server by array name.
  • For stand-alone servers, which cannot be grouped in arrays.

In these scenarios, ISA Server can be used together with other operating system services to create a fault-tolerance, balanced network. The following sections describe how to configure DNS Server and how to configure Windows 2000 Advanced Server Network Load Balancing to accomplish this goal. For more information, see:

  • Using DNS
  • Using Network Load Balancing


Using DNS

For Firewall clients, fault tolerance can be achieved when two or more Microsoft Internet Security and Acceleration (ISA) Server computers are used together with a DNS server.

Effectively, the ISA Server computers are assigned the same DNS name, using DNS. This way, when a client requests an object from the ISA Server computer, specifying the DNS name of the ISA Server computer, the DNS server resolves the name, in a round-robin fashion, to either one of the ISA Server computers. For more information on DNS and round robin, see "Configuring round robin" in the Windows 2000 Help.

Follow these steps to configure the DNS server, adding a new A resource record to a zone:

  1. Click Start, point to Programs, point to Administrative Tools, and click DNS.
  2. On the Action menu, click New Host.
  3. In Name, type the DNS computer name for the ISA Server computer or array.
  4. In IP address, type the IP address for the new host.
  5. Click Add Host to add the new host record to the zone.
  6. Repeat steps 3–5 for each ISA Server computer.


Using Network Load Balancing

For SecureNAT clients, fault tolerance can be achieved when two or more Microsoft Internet Security and Acceleration (ISA) Server computers are used together with Windows 2000 Advanced Server Network Load Balancing. By combining the resources of two or more computers running Windows 2000 Advanced Server into a single cluster, Network Load Balancing can deliver the reliability and performance that Web servers and other mission-critical servers need.

Network Load Balancing clusters together several computers running server programs that use the TCP/IP networking protocol. Network Load Balancing allows all of the computers in the cluster to be addressed by an IP address (while maintaining their existing addressability using unique, dedicated IP addresses). Network Load Balancing distributes incoming client requests in the form of TCP/IP traffic across the hosts.

Important

  • Network Load Balancing is only available with Windows 2000 Advanced Server.

Network Load Balancing requires that each ISA Server computer have a unique IP address on its internal network adapter. In addition, the Network Load Balancing cluster must have an IP address, which will be used by both ISA Server computers. For more information on Network Load Balancing and clusters, see Network Load Balancing in Windows 2000 Advanced Server Help.

Follow these steps to configure the ISA Server computers for Network Load Balancing:

  1. Verify that the ISA Server computers are installed in the same mode.
  2. For the internal network adapter on each ISA Server computer, modify the Network Load Balancing properties as follows:
    • Set the Primary IP address to the IP address of the Network Load Balancing cluster. This address is a cluster IP address and must be set identically for all hosts in the cluster. This IP address is used to address the cluster as a whole and it should be the IP address for the full Internet name that you specify for the cluster.
    • Assign a unique priority to each machine in the NLB cluster.
    • Set the Dedicated IP address to the IP address of the ISA Server computer's internal network adapter. This IP address is used to individually address each host in the cluster, so it should be unique for each host. In general, it is the original IP address assigned to the host prior to selecting an IP address for cluster operations.

For a single network adapter, the TCP/IP stack must be configured with both dedicated and cluster address, with the dedicated address ordered first. For a computer with two network adapters, the network adapter with the dedicated address must have a lower metric value (that is, higher priority) than that of the network adapter with the cluster address.

The default gateway for SecureNAT clients should be configured to the cluster's (dedicated) IP address. In other words, the cluster's virtual address should be used as the gateway address. This way, all requests will be handled by Network Load Balancing.


Enterprise scenario with VPN and routing

Microsoft Internet Security and Acceleration (ISA) Server can be deployed in a large network that is geographically-dispersed. Arrays of ISA Server computers can be deployed in the main office and at branch offices, as necessary to accommodate user needs. This allows corporate network administrators to centralize the security and caching policy for the entire corporation. It also alleviates performance concerns in the branch office, as an ISA Server computer can service user requests for Internet objects from the local cache.

Characteristics and requirements

The corporation used in this scenario is a large corporation, with headquarters in the United States and two branch offices, one in Canada and one in the United Kingdom. The entire corporation requires secure Internet access in an environment with the following requirements:

  • Internet access guidelines, determined at the headquarters in the United States, should be applied consistently throughout the corporation. For this scenario, all employees are allowed access to all sites, using common Web protocols: HTTP, HTTPS, and FTP.
  • There should be extra firewall security in the United Kingdom branch office.
  • There should be low costs for connecting the United Kingdom branch office to the United States headquarters.
  • The ISA Server computers in the United Kingdom branch office should cache local content from Web servers located in the United Kingdom.
  • The cache server must be in place in the Canada branch office, so that content is closer to the employees in that office and Internet traffic is reduced.

Network configuration

Because the corporation requires a common enterprise policy for all the branch offices, the ISA Server computers must be installed as array members at all the branches, even though there will be only one computer at each branch.

ISA Server array at the United States headquarters

Each member of the array at the headquarters is configured with two network adapters: one network adapter to connect to the internal network and one network adapter to connect to the Internet. For this scenario, you can assume direct connectivity to the Internet service provider takes place through a router and a T1/E1 line.

ISA Server array at the Canada branch office

The ISA Server computers at the Canada branch office are used to reduce the traffic along the pipe by caching Web content. This reduces some of the work performed by the central office ISA Server computers. The ISA Server computer in the Canada office is installed in cache mode and is chained to the ISA Server computer at the headquarters. The ISA Server computer has two network adapters: one is connected to a local router and the other is connected to a router at the headquarters.

ISA Server array at the United Kingdom branch office

The ISA Server computers at the United Kingdom branch are set up with two network adapters: one network adapter to connect to the local network at the branch office and a modem or ISDN adapter to connect to the Internet. User requests for local content from Web servers located in the United Kingdom are routed directly to an Internet Service Provider (ISP). All other requests are routed to the headquarters.

The ISA Server array in the United Kingdom is set up in integrated mode, serving as the branch firewall and cache server. The ISA Server computer is connected via a virtual private network (VPN) to the array at the headquarters.

The figure below illustrates the network configuration.

Enterprise Policy Scenario

For information on configuring the headquarters and branch offices, see:

  • Enterprise policy at headquarters
  • ISA Server policy at the Canada branch office
  • ISA Server policy at the United Kingdom branch office


Enterprise policy at Headquarters

After setting up the Microsoft Internet Security and Acceleration (ISA) Server computers at the Headquarters, the administrator uses ISA Management to implement the enterprise policy. The enterprise policy is configured at Headquarters and is applied to all the arrays in the enterprise—the Canada branch office, the United Kingdom branch office, and Headquarters in the United States.

The enterprise administrator performs the following steps:

  1. Creates an enterprise policy, called Corporate Policy, with the following rules:
    • A site and content rule that allows everyone access to all sites, always.
    • A protocol rule, which allows everyone to use the following protocols: File Transfer Protocol (FTP), Hypertext Transfer Protocol (HTTP), and Secure Hypertext Transfer Protocol (HTTPS).
    For configuration instructions, see Create an enterprise policy.
  2. The United Kingdom branch office will connect to the ISA Server array at Headquarters via a virtual private network. At least one of the ISA Server computers in the United States must be configured as a VPN server. The administrator performs the following steps:
    • Configures the local address table on the ISA Server in the United States, adding the address ranges of the network in the United Kingdom.
    • Uses the Local ISA VPN Server wizard to set up ISA Server for VPN connections. This wizard starts Routing and Remote Services and creates the dial-on-demand interfaces required to receive connections from remote VPN servers.

      The wizard creates IP packet filters, depending on which protocol you select: L2TP or PPTP. It also sets the static routes to forward traffic from the local network to hosts on the remote network via the tunnel.

      The wizard also creates a .vpc file, which is used by the remote VPN server (in the United Kingdom) when configuring ISA Server.


ISA Server policy at the Canada branch office

Since the Microsoft Internet Security and Acceleration (ISA) Server computer in the Canada branch office is on the Headquarters network, it requires only one network adapter, which connects the Canada ISA Server computer to the Headquarters ISA Server computer.

The enterprise policy is applied to the ISA Server computer in the Canada branch, so no specific access policy rules need to be configured here. For more information, see Applying enterprise policy.

Scheduled content download jobs are configured to pre-cache specific content at the branch offices. This will further improve perceived network performance.

Perform the following steps to configure the local ISA Server computer:

  1. Configure a routing rule that redirects requests from Web Proxy clients to the upstream ISA Server computer at Headquarters. For more information, see Routing Web requests.
  2. To download frequently-accessed objects to the local cache, create scheduled content download jobs. If the objects are already in the cache at Headquarters, they will be downloaded from there. Otherwise, the ISA Server computers at Headquarters will forward the requests on to the Internet. For specific instructions, see Updating cache content automatically.


ISA Server policy at the United Kingdom branch office

The branch office in the United Kingdom is connected over the Internet, by way of a virtual private network (VPN), to the headquarters in the United States.

The administrator performs the following steps to configure the United Kingdom branch office as a VPN server:

  1. Sets up a DNS server on the remote network that is secondary to the corporate network domains typically accessed. The DNS server should use a DNS server on the Internet as a forwarder to help resolve all other name queries.
  2. Configures the local address table (LAT) on the remote ISA Server (in the United Kingdom branch office), adding the address range of the corporate network (in the United States). Any external (Internet) IP addresses must be excluded. For more information on the LAT, see Configuring the local address table.
  3. Uses the Remote ISA VPN Server Wizard to set up the remote network's ISA Server for VPN connections, using the .vpc file created by the enterprise administrator at Headquarters.
    The Remote ISA VPN Wizard sets up a remote ISA VPN server, which can initiate connections to a local ISA VPN server. The wizard uses the .vpc file that the Local ISA VPN Wizard creates to create the dial-on-demand interfaces that are required to initiate connections to a specific local VPN server. It also configures the IP packet filters required to allow the connection and sets the static routes to forward traffic from the local network to hosts on the remote network via the tunnel.
    For more information, see Using an ISA Server virtual private network.

The administrator creates routing rules, to specify which requests should be routed to the array at Headquarters and which directly to an ISP in the United Kingdom.

  1. Creates a routing rule that routes all requests for Internet objects in the United Kingdom (with a .uk suffix in the domain name) directly to the Internet. For more information, see Routing Web requests/
  2. Creates a routing rule that routes all other requests to the upstream ISA Server array at Headquarters.


Web publishing scenarios

The Web publishing functions of Microsoft Internet Security and Acceleration (ISA) Server benefit organizations that want to securely publish Web content from within their protected intranet. ISA Server can protect an organization's Web server that is hosting a commercial Web business or providing access to business partners. The ISA Server impersonates a Web server to the outside world, while the Web server maintains access to internal network services.

The Web server you are publishing can be located either on the same computer as ISA Server or on a different computer.

Configuring the ISA Server computer

Regardless of how you set up the Web publishing scenario, ISA Server must be configured to listen for incoming Web requests. The incoming Web request properties specify which IP addresses and ports on the ISA Server computer listen for incoming Web requests. The incoming Web request properties also determine the necessary authentication required when accessing internal servers.

Configuring DNS server

When you publish Web servers, external clients may need to resolve their names, using the internal DNS server. As such, the internal DNS server is itself a publishing server. If the DNS Server is a SecureNAT client, then no configuration is required. After you install ISA Server, create a server publishing on the ISA Server that publishes the DNS Server. For more information on server publishing rules, see the on-line help provided with ISA Server.

The following sections detail network configurations for Web publishing scenarios.

The following sections describe Web publishing scenarios:

  • Web server on local network
  • Web server on ISA Server computer
  • Using packet filters to publish a Web server on the ISA Server computer


Web server on local network

The figure below illustrates a Web publishing scenario, with the Web servers located behind the Microsoft Internet Security and Acceleration (ISA) Server computer.

Incoming Web requests

Two Web servers are located on the internal network, which is protected by ISA Server. When an Internet user requests an object on example.microsoft.comMarketing or example.microsoft.com\Development, the request is actually sent to the ISA Server computer, which routes the request to the appropriate Web server.

Notice that when external clients request objects from the Web servers, they actually gain access to the ISA Server computer. This way, ISA Server ensures that the network is never penetrated by external users. Furthermore, the Internet Protocol (IP) addresses of the Web servers are never exposed. Instead, the Internet users gain access to the Web servers by specifying the ISA Server computer's IP address.

Suppose you want to publish two internal servers, on the example.microsoft.com domain, one called Dev and one called Mktg. The Mktg computer should return objects when a client requests example.microsoft.com/Marketing, and Dev should return objects when a client requests example.microsoft.com/Development.

Follow these steps to publish the Web servers, as illustrated in the figure:

  1. Verify that the DNS server maps the fully-qualified domain name to the IP address of the ISA Server computer. Internet clients use the domain name to request content.
  2. Configure the ISA Server incoming Web request properties. The IP address should include the IP address of the external interface. For more information, see Configuring incoming Web request properties.
  3. Create a destination set, called Marketing, which should include the computer example.microsoft.com and the path \Marketing\*. For more information, see Configuring destination sets.
  4. Create a destination set, called Development, which should include the computer example.microsoft.com and the path \Development\*.
  5. Configure a Web publishing rule with the following parameters:
    • Set Destination Set to the Marketing destination set.
    • Set Applies to to Any user, group, or client computer.
    • Set Action to Redirect to a hosted site and specify Mktg as the specified host.
  6. Configure the second Web publishing rule with the following parameters:
    • Set Destination Set to the Development destination set.
    • Set Applies to to Any user, group, or client computer.
    • Set Action to Redirect to a hosted site and specify Dev as the specified host.

For more information, see Web publishing rules.


Web server on the ISA Server computer

The figure below illustrates another common Web publishing scenario, with the Web server located on the same computer as ISA Server.

Combined ISA Server and Web server

In this scenario, you configure the ISA Server computer to listen for incoming requests on port 80 of the external network adapter. For more information, see Configuring incoming Web request properties.

However, by default, the Web server also listens on port 80 for incoming requests. To avoid this conflict, configure the Web server so that it listens on a port other than 80. Then modify the ISA Server Web publishing rule so that ISA Server forwards the requests to the appropriate port on the Web server.

You can also configure the Internet Information Services (IIS) server to listen on a different IP address. You can set the IIS Server to listen on 127.0.0.1, thereby accepting requests only from the ISA Server computer.

For example, you can configure the Web server to listen on port 9999. After that, create a Web publishing rule with the following parameters:

  • Set Destination Set to a destination set that includes the IP address of the ISA Server computer.
  • Set Action to Route requests to an alternate site.
  • Set the site to the host name of the Web server.
  • Set the port to 9999.

For more information, see Web publishing rules.


Using packet filters to publish a Web server on the ISA Server computer

Another way to publish a Web server located on the ISA Server computer is by configuring Internet Protocol (IP) packet filters. In this way, ISA Server allows the Web server to listen on port 80 for the incoming Web requests.

There is no conflict for outgoing Web requests, as ISA Server listens on port 8080 and the Web server listens for requests from internal clients on port 80. However, be sure that the automatic discovery feature of ISA Server is not configured to listen on port 80.

Follow these steps to publish a Web server on the ISA Server computer:

  1. Enable packet filtering. For configuration instructions, see Enable packet filtering.
  2. Create an IP packet filter with the following parameters:
    • Set Servers to Only this server and select the local computer.
    • Set Filter Mode to Allow packet transmission.
    • Set Filter type to Custom.
    • Set IP Protocol to TCP.
    • Set Direction to Inbound.
    • Set Local Port to Fixed port, 80.
    • Set Remote Port to Any port.
    • Set Local computer to This ISA Server's external IP address.
    • Set Remote computers to All remote computers.
  3. Disable automatic discovery. For configuration instructions, see Publish automatic discovery.

Since port 80 is used by Internet Information Services (IIS), do not create Web publishing rules when using the method described here to publish the Web server located on the ISA Server computer.

Automatic discovery can be used on port 8080. Further, it can be used if you configure a DHCP server. For configuration instructions, see Configure DHCP for automatic discovery of ISA Server.

For more information, see IP packet filters.


Exchange Server publishing scenarios

As business-to-business e-commerce becomes more prevalent, more organizations realize the need to protect internal servers, while at the same time making them accessible to specific external users. The reverse publishing feature in Microsoft Internet Security and Acceleration (ISA) Server secures internal server access by external clients.

A common ISA Server scenario involves securing the Simple Mail Transfer Protocol (SMTP) communication of mail servers. For example, ISA Server can protect a Microsoft Exchange Server. The Exchange Server Setup Wizard configures the policy needed to allow communication between an Exchange Server computer and the Internet. The wizard adds a set of server publishing rules which redirect communication from Internet users at a particular port to a specified internal Internet Protocol (IP) address. The wizard also creates protocol rules that dynamically open ports for outgoing communication. For more information, see Mail Server Security Wizard.

The Exchange Server that you are publishing can be installed on the ISA Server computer or on the local network. The following sections describe some Exchange Server publishing scenarios:

  • Exchange Server on local network
  • Exchange Server on the ISA Server computer


Exchange Server on local network

In this scenario, the Microsoft Exchange Server computer is on the local network, protected by the Microsoft Internet Security and Acceleration (ISA) Server computer, as illustrated in the figure.

Exchange Server behind ISA Server computer

You can use the ISA Server Mail Server Security Wizard to configure the Exchange Server so that it is available to external clients by using one or more of the following protocols:

  • Messaging Application Programming Interface (MAPI)
  • Post Office Protocol 3 (POP3)
  • Internet Messaging Access Protocol 4 (IMAP4)
  • Network News Transfer Protocol (NNTP)
  • Secure NNTP

The wizard creates one or more server publishing rules, corresponding to each mail service that ISA Server protects. The server publishing rules created by the wizard have the following parameters:

  • The mail server's internal Internet Protocol (IP) address
  • The external address exposed by the ISA Server
  • The protocol for the selected mail service

The new rules created by the wizard are all named with the prefix Mail wizard rule.

The Mail Server Security Wizard also creates protocol rules, to allow outgoing mail traffic. The protocol rules have the following parameters:

  • The protocol is Simple Mail Transfer Protocol (SMTP) (client).
  • The client set includes the internal IP address of the Exchange Server computer.

Name resolution for clients

Since Post Office Protocol 3 (POP3), IMAP4 and Hypertext Transfer Protocol (HTTP) clients can access the computer that is running Exchange Server either by DNS name or IP address, it is recommended that you map the DNS name used by mail clients to the ISA Server computer external IP addresses.

For MAPI clients, a DNS server on the Internet must resolve the name of the computer running Exchange Server and match it to an IP address on the ISA Server computer external network interface card. The DNS should resolve the published name to the external IP address on the ISA server.

For more information, see Mail Server Security Wizard.


Exchange Server on the ISA Server computer

In this scenario, Microsoft Internet Security and Acceleration (ISA) Server and Microsoft Exchange Server are on the same computer, as illustrated below.

Exchange Server and ISA Server on same computer

You can use the Mail Server Security Wizard to publish the Exchange Server located on the ISA Server computer. In this scenario, the Mail Server Security Wizard creates an Internet Protocol (IP) packet filter. IP packet filters are created for each mail service that you select. For example, imagine that you run the Mail Server Security Wizard and specify Outgoing Simple Mail Transport Protocol (SMTP) mail and Post Office Protocol 3 (POP3) client requests. In this scenario, Outlook clients cannot access the Exchange Server from outside the local network. The following IP packet filters are created:

  • An IP packet filter allowing Inbound Transmission Control Protocol (TCP) connections on local port 25 from any remote port (to allow incoming SMTP packets).
  • An IP packet filter allowing Outbound TCP connections on all local ports from remote port 25 (to allow outgoing SMTP packets).
  • An IP packet filter allowing Inbound TCP connections on local port 110 from any remote port (to allow incoming POP3 packets).
  • An IP packet filter allowing Outbound TCP connections on all local ports from remote port 110 to allow outgoing POP3 packets).

For more information, see Mail Server Security Wizard.


Perimeter network scenarios

A perimeter network (also known as a DMZ, demilitarized zone, and screened subnet) is a small network that is set up separately from an organization's private network and the Internet. The perimeter network allows external users access to the specific servers located in the perimeter network while preventing access to the internal corporate network. An organization may also allow very limited access from computers in the perimeter networks to computers in the internal network.

A perimeter network is commonly used for deploying the e-mail and Web servers for the company. The perimeter network can be set up in one of these configurations:

  • Back-to-back perimeter network configuration, with two Microsoft Internet Security and Acceleration (ISA) Server computers on either side of the perimeter network. For more information, see Back-to-back perimeter network configuration.
  • Three-homed ISA Server computer, with the perimeter network and the local network protected by the same ISA Server computer. For more information, see Three-homed perimeter network configuration.

For example, the perimeter network may include the company's Web server, so that Web content can be sent to the Internet. However, the perimeter network does not allow access to any other company data that may be available on computers in the local network. Even if an external user penetrates the perimeter network security, only the perimeter network servers are compromised.


Back-to-back perimeter network configuration

In a back-to-back perimeter network configuration, two Microsoft Internet Security and Acceleration (ISA) Server computers are located on either side of the perimeter network (also known as a DMZ, demilitarized zone, and screened subnet). The figure illustrates a back-to-back perimeter network configuration.

Back-to-back perimeter network configuration

In this configuration, two ISA Server computers are hooked up to each other, with one connected to the Internet and the other to the local network. The perimeter network resides between the two servers. Both ISA Server computers are set up in integrated or firewall mode, which reduces the risk of compromise, since an attacker would need to break into both systems in order to get to the internal network.

Perform the following steps to make the servers on the perimeter network available to external (Internet) clients:

  1. Configure the local address table (LAT) on the ISA Server computer that is connected to the corporate network (ISA Server computer 2) to include the Internet Protocol (IP) addresses of the computers in the corporate network. For more information, see Configuring the local address table.
  2. Configure the LAT on the ISA Server computer connected to the Internet to include the IP address of the ISA Server connected to the corporate network and the IP addresses of all the publishing servers in the perimeter network.
  3. Create a server publishing rule for each of the publishing servers on the perimeter network. To publish Web servers, create a Web publishing rule. For example, the figure illustrates a Telnet server and an Internet Information Services (IIS) server. To publish the Telnet server, create a server publishing rule with the following parameters:
    • Set the IP address of the internal server to the IP address of the IIS server. This address should be in the LAT.
    • Set the external IP address on the ISA Server computer. This is the address made available to external clients.
    • Set the protocol settings to Telnet Server.
    • Set the client to Any user, group, or client computer.
    For more information, see Server publishing rules and Web publishing rules.
  4. To publish the IIS server, create a Web publishing rule with the following parameters:
    • Set the destination sets to a destination set that includes the external IP address of the ISA Server on the perimeter network.
    • Set the client type to Any user, group, or client computer.
    • Set the rule action to Redirect the request to a hosted site and specify the IP address or computer name of the publishing Web server.


Three-homed perimeter network configuration

In a three-homed perimeter network (also known as a DMZ, demilitarized zone, and screened subnet), an array of Microsoft Internet Security and Acceleration (ISA) Server computers is set up. Each computer has three network adapters.

  • One network adapter connects to the corporate network's internal clients.
  • The second network adapter connects to the corporate network's servers, which are located in the perimeter network. The Internet Protocol (IP) addresses of the perimeter network should not be in the local address table (LAT).
  • The third network adapter connects to the Internet.

The figure illustrates this perimeter network scenario.

Perimeter network scenario

Follow these steps to set up a perimeter network with a three-homed ISA Server.

  1. Configure the LAT to include all the addresses on the corporate network. The LAT should not include the addresses on the perimeter network.
  2. Enable packet filtering.
  3. Enable IP routing.
  4. Create IP packet filters for each of the servers in the perimeter network. Each IP packet filter should have the following parameters:
    • Filter type should be Open.
    • Protocol used by the server. For example, the protocol for an Simple Mail Transport Protocol (SMTP) server would be Transmission Control Protocol (TCP), with local port set to 25.
    • The remote port is set to Any port.
    • Local computer should be set to the IP address of the perimeter network server.
    • Remote computer should be Any Computer (or a specific computer, if access is limited to specific computers).

For more information, see Configuring the local address table, Filtering and routing, Enable packet filtering, Enable IP routing, and IP packet filters

Before you locate a File Transfer Protocol (FTP) server on the perimeter network using the three-homed configuration, carefully consider the implications. An FTP client can instruct an FTP server to use PORT mode or PASV mode. In addition to using port 21 for a control connection, an FTP server also uses a second port for a data connection. If the client initiates a data connection in PORT mode, the server uses port 20. If the client initiates a connection in PASV mode, it instructs the FTP server to use an arbitrary port. Because an administrator cannot predict which port is used in PASV mode, creating secure packet filters becomes impossible when allowing FTP clients to connect in PASV mode. If you want to enable clients to connect in PASV mode to the FTP server, consider configuring the perimeter network using a Back-to-back perimeter network configuration.

As an alternative, so that clients can only connect in PORT mode, create two IP packet filters. The first IP packet filter should allow incoming traffic on port 21. The second IP packet filter should allow outgoing traffic on port 20 (for the data channel). However, doing so may prevent FTP clients that connect in PASV mode from connecting to the FTP server.


H.323 Gatekeeper deployment scenarios

This section provides deployment scenarios using H.323 Gatekeeper and the H.323 protocol filter.

  • Intra-enterprise IP telephony call scenario
  • Inter-enterprise IP telephony call scenario
  • Public switched telephone network (PSTN) call scenario


Intra-enterprise IP telephony call scenario

In this scenario, numerous users within the organization are using applications that are compliant with H.323 Gatekeeper, such as NetMeeting 3.0 or later. Microsoft Internet Security and Acceleration Server and H.323 Gatekeeper are installed and running. Users register themselves with H.323 Gatekeeper using a well-known alias (for example, an e-mail address) and a phone number. All users are able to call each other using the called party's well-known alias or phone number. Users are able to use audio, video, and T.120 data and application sharing. Site Server ILS service is not required for providing directory services.

Intra-enterprise telephony calls


Inter-enterprise IP telephony call scenario

In this scenario, numerous users within the organization are using applications that are compliant with H.323 Gatekeeper, such as NetMeeting 3.0 or later. Microsoft Internet Security and Acceleration Server, H.323 Gatekeeper, and the H.323 protocol filter are installed and running on the firewalls of both organizations. Users register themselves with their respective H.323 Gatekeeper using a well-known alias (for example, an e-mail address). All users in both organizations are able to call all users in the other organization using the called party's e-mail address. Users are able to use audio, video, and T.120 data and application sharing. For example, User1 can communicate with User4 by typing User4@organizationB.microsoft.com in NetMeeting 3.0 and placing the call. The call reaches User4, regardless of their location within organization B. User4's IP address is concealed from User1 and all other callers from organization A.

Inter-enterprise telephony calls


Public switched telephone network (PSTN) call scenario

The public switched telephone network (PSTN) is a standard, circuit-switched network that is optimized for real-time voice communication. When you place a call, you close a switch by dialing and establish a circuit with the other party. The PSTN guarantees quality of service (QoS) by dedicating the circuit to your call until you disconnect. Whether you and your connected party are talking or silent, you continue to use the same circuit until you disconnect.

In this scenario, numerous users within the organization are using applications that are compliant with H.323 Gatekeeper, such as NetMeeting 3.0 or later. H.323 Gatekeeper is installed and running on the network. Users register themselves with H.323 Gatekeeper using a well-known alias (such as an e-mail address) and a phone number. An H.323 gateway is also installed and running on the network. It is configured to enable H.323 Gatekeeper to direct calls between the IP and PSTN networks. All users are able to make calls to PSTN numbers by using NetMeeting to dial the number from their desktops. Users are also able to receive calls from the PSTN network through NetMeeting 3.0 or later.


Troubleshooting and additional resources

  • Troubleshooting
  • Additional resources


Troubleshooting

  • Troubleshooting access policy
  • Troubleshooting authentication
  • Troubleshooting caching
  • Troubleshooting client connections
  • Troubleshooting dial-up entries
  • Troubleshooting logging
  • Troubleshooting publishing
  • Troubleshooting services


Troubleshooting access policy

Clients cannot browse external Web sites.

Cause: Initially, Microsoft Internet Security and Acceleration (ISA) Server does not allow any communication to or from the Internet. You can create rules that will allow communication, according to your corporate security policy.

Solution: Create protocol rules to allow specific users to use the protocols. Then create site and content rules which allow users access to particular sites, using the protocols specified by the protocol rules.

Solution: Check the browser settings of the client to ensure that the proxy port is specified correctly. The default port for ISA Server is 8080.

Clients receive a 502 error every time they try to browse the Web.

Cause: Initially, Microsoft Internet Security and Acceleration (ISA) Server does not allow any communication to or from the Internet. You can create Internet protocol (IP) packet filters or rules that will allow communication, according to your corporate security policy. For more information, see Configuring access policy.

Solution: Create protocol rules to allow specific users to use the protocols. Then create site and content rules which allow users access to particular sites, using the protocols specified by the protocol rules. For more information, see Protocol rules and Site and content rules.

Cause: Some access policy rule requires authentication, but no authentication methods were configured for the listener

Solution: Select an authentication method for the listener. Clients will be allowed access, in accordance with configured rules, if they can authenticate using the method. For more information, see Rules and authentication. For configuration instructions, see Configure authentication methods for Web requests.

Clients cannot use specific protocol, such as Hypertext Transfer Protocol (HTTP), RealAudio, or others.

Cause: Initially, Microsoft Internet Security and Acceleration (ISA) Server does not allow any communication to and from the Internet. You can configure IP packet filters or rules that will allow use of particular protocols.

Solution: Create protocol rules to allow users to communicate using the specified protocols. For more information, see Protocol rules.

After disabling a protocol rule, clients can still use the specified protocol, allowed by the rule.

Cause: Existing client sessions are not terminated when you disable a protocol rule, although new sessions will not be opened. For example, if a client is using a RealAudio protocol, in accordance with configured rules, the session will continue even after you disable the protocol rule allowing the access.

Solution: Disconnect the client sessions. For instructions, see Disconnect a client session.

Clients cannot use a specific protocol definition, although a protocol rule has been configured to allow access.

Cause: If you disable an application filter, all traffic that uses the protocol definition is blocked, even if protocol rules seem to allow the traffic.

Solution: Enable the application filter. Create a protocol rule that allows access to the specific clients. For more information, see Create a protocol rule and Enable an application filter.


Troubleshooting authentication

Microsoft Internet Security and Acceleration (ISA) Server failed to authenticate a Netscape user.

Cause: ISA Server may have been configured only to accept Windows integrated authentication. Netscape browsers cannot pass user credentials in NTLM format.

Solution: You can configure ISA Server to require other authentication methods, including Basic or Digest. For more information, see Configuring incoming Web request properties and Configuring outgoing Web request properties.


Troubleshooting caching

Not all traffic is saved to the ISA Server cache.

Cause: Microsoft Internet Security and Acceleration (ISA) Server caches only items that meet the caching criteria.

Solution: When clients access objects that can be cached, network performance seems to improve, as the objects are retrieved from the ISA Server cache rather than from the network. However, if your clients are commonly accessing objects that are not cached, then you may not perceive improved performance. For more information, see Configuring which content to cache.

Web Proxy service will not start.

Cause: The cache contents file is corrupted.

Solution: If the cache contents file becomes corrupted for whatever reason, the Web Proxy service will not be able to start. To overcome this problem, reconfigure the drives allocated for caching. For more information, see Configuring cache drives.


Troubleshooting client connections

Server cannot bind to or allocate required port.

Cause: There is an allocation conflict for a port. More than one service on the Microsoft Internet Security and Acceleration (ISA) Server computer is requesting to bind with a specific port on the external interface, possibly including ISA Server itself.

Solution: In general, Microsoft recommends that you do not run additional services on your primary firewall. If possible, install the other server behind the ISA Server computer.

Solution: Bind the other server to the internal interface, so that only ISA Server listens on the external interface.

Client connection is slow.

Cause: If packet filtering is not available, then secure network address translation (SecureNAT) client connections may be slow.

Solution: Enable Internet Protocol (IP) packet forwarding. When IP forwarding is available, you should also make dynamic packet filtering available. For more information, see Enable IP forwarding and Enable packet filtering.

Clients cannot connect via modem.

Cause: If Firewall Client is available, then the Firewall client will not be able to dial out directly to the Internet.

Solution: Disable Firewall Client. For more information, see Enable the Firewall client.

Internal connections are slow for Firewall clients.

Cause: Clients are unable to resolve local names using a external DNS server because the external DNS server may not have the correct records needed. The client must waste time waiting for the queries to the DNS server to time out before trying other methods of name resolution.

Solution: An internal DNS server should be configured with the names and addresses of all internal hosts and the clients using the Firewall service should not be configured with a DNS server address. All client name resolution requests are automatically handled by the ISA Server computer.

In addition, if packet filtering is operating, create an Internet Protocol (IP) packet filter that uses DNS Lookup—a predefined filter—to allow the ISA Server computer to send out DNS name queries for Internet names. For configuration instructions, see IP packet filters.

Secure network address translation (SecureNAT) clients cannot connect to the Internet.

Cause: If SecureNAT clients are not configured properly, then the ISA Server will not be able to connect them to the Internet.

Solution: Configure the default gateway and configure the DNS server.

Clients cannot connect to external Secure Socket Layer (SSL) sites.

Cause: When a client connects through the Web Proxy service to a secure Web site, ISA Server must open a tunnel for the traffic, since the traffic is encrypted end-to-end. By default, ISA Server only allows tunnel connections to ports 443 and 563 (Secure-News). If a client attempts to connect to a secure site that is running on a port other the 443 or 563, the connection fails.

Solution: To allow tunneling on additional ports, modify the ISA Administration COM object, FPCProxyTunnelPortRange. For more information, see SSL tunneling.

Secure network address translation (SecureNAT) connections work when the client specifies IP addresses but not when the client specifies computer names.

Cause: If the DNS server used by the client is an internal DNS server, it cannot resolve Internet domain names.

Solution: Configure the DNS server to forward the request to an external (Internet) DNS server. As an alternative, configure the clients to use a DNS server that forwards name resolution requests to an external DNS server.

Secure network address translation (SecureNAT) clients cannot connect to a specific port because the connection times out, even though a protocol rule allows "Any IP traffic".

Cause: SecureNAT clients can only connect using protocols that are listed in the protocol definitions. Furthermore, the protocol cannot require a secondary connection, unless an application filter that implements the protocol is available. For more information, see Configuring protocol definitions.

Solution: If the application only uses a single port, define a protocol in which the specific port is the primary port. If the application uses multiple ports, some of which are determined dynamically, they must be specified and defined by a application filter. For more information, see and Protocol rules.


Troubleshooting dial-up entries

Dial-out to the Internet failed, although manual dial-out works.

Cause: The dial-up entry credentials were not specified correctly, even though you may have specified credentials for the network dial-up connection correctly.

Solution: Reconfigure the dial-up entry credentials. For instructions, see Modify a dial-up entry.

Cause: The ISA Server computer does not have permissions to use the dial-up connection.

Solution: Reconfigure the dial-up connection and allow everyone to use the connection. For more information, see Windows 2000 Help.

Failed to dial out to the Internet because the connection is already being dialed.

Cause: Another service on the computer is connecting with this dial-up connection.

Solution: Wait a while. ISA Server will attempt the connection again when a request is made. If the problem persists, restart the ISA Server services. For configuration instructions, see Start a service.

The dial-up connection was dropped.

Cause: Someone may have inadvertently disconnected the dial-up connection.

Solution: Restart the ISA Server services. The services will automatically re-establish the connection. For configuration instructions, see Start a service.

The dial-up connection never hangs up, even though there is no dialing activity.

Cause: Whenever a client request is made, even if for a computer on the local network, ISA Server sends name resolution requests to both the internal DNS server and an external DNS server.

Solution: Configure ISA Server to use only internal DNS servers. The internal DNS server should be configured as a client of ISA Server. Then, configure the internal DNS server to forward unresolved requests to an external DNS server.


Troubleshooting logging

Can't find client authentication (user names) information in the log file.

Cause: Microsoft Internet Security and Acceleration (ISA) Server does not always require that clients authenticate themselves. If clients are not authenticated, then they are granted anonymous access and their authentication information is not logged.

Solution: You can configure ISA Server to always require that Web Proxy clients authenticate themselves, by configuring the incoming and outgoing Web request properties. For more information, see Require authentication for all Web requests and Rules and authentication.


Troubleshooting publishing

Clients receive a 403 error every time they try to access the published Web server.

Cause: Some access policy rule requires authentication, but no authentication methods were configured for the listener

Solution: Select an authentication method for the listener. Clients will be allowed access, in accordance with configured rules, if they can authenticate using the method. For more information, see Rules and authentication. For configuration instructions, see Configure authentication methods for Web requests.

External clients cannot send mail via the computer running Microsoft Exchange Server that is set up as a Firewall client behind the Microsoft Internet Security and Acceleration (ISA) Server computer.

Cause: There is a port conflict between a server publishing rule and a Firewall client configuration file.

Solution: If you published a mail server in a Microsoft Proxy Server 2.0 environment, then you had to configure the mail server as a Winsock Proxy client. In this case, you created a Wspclnt.ini file on the mail server.
With ISA Server, publishing servers do not require special configuration, since they are published as secure network address translation (SecureNAT) clients. Remove the Wspclnt.ini file from the publishing server. Then, in ISA Management, run the Mail Server Security Wizard. For more information, see Mail Server Security Wizard.

Cause: The Microsoft Exchange Server may be unable to bind to the Simple Mail Transport Protocol (SMTP) port on the Microsoft Internet Security and Acceleration (ISA) Server computer.

Solution: Be sure that there is no other local service or application running on the ISA Server computer that is binding to port 25 before the Exchange Server.

Cause: The Exchange Server loses its connection to the ISA Server computer.

Solution: If the connection between the ISA Server computer and the Exchange Server was temporarily disrupted, you must restart the Exchange services so that it will bind to the necessary ports on the ISA Server computer.

External clients cannot send mail via the Exchange Server, which is set up as a secure network address translation (SecureNAT) client, behind the ISA Server computer.

Cause: The server publishing rules may not be configured correctly.

Solution: Check that the server publishing rules are configured so that the external interface passes all traffic on port 25 for SMTP traffic and port 110 for Post Office Protocol 3 traffic to the correct Internet protocol (IP) address and port on the internal Exchange Server. For more information, see Create a server publishing rule.


Troubleshooting services

Services did not start after installation completed successfully.

Cause: If the local address table (LAT) was configured incorrectly and does not include the internal network adapter that communicates with Active Directory, then the ISA Server services cannot start.

Solution: Perform the following steps to add the appropriate entries to the LAT:

  1. Stop ISA Server services and packet filtering. To do this, at a command prompt, type net stop mspfltext.
  2. Reconfigure the LAT. Since you cannot run ISA Management, you will have to configure the LAT using the ISA Server Administration COM objects. For more information, see "Constructing the Local Address Table" in the ISA Server Software Development Kit.
  3. Reboot the computer.


Additional resources

  • Glossary
  • Event messages
  • Ident Simulation Service
  • Performance counters
  • Registry keys


Glossary

A

access control list (ACL)
A level of Windows NT permission that can be set on a file or a directory allowing specified users access within an NTFS directory. An access control entry (ACE) is an entry in the list. For details, see the Windows NT documentation.
access policy
A set of protocol rules and site and content rules that determines the behaviour of an enterprise or array.
active caching
An ISA Server feature that automatically initiates new requests to update cached file objects without user intervention. Requests can be activated based on the length of time an object has been cached or was last retrieved from the object's source location. This type of caching can be used to assure the validity of specified data in the cache.
Active Directory
The directory service that is included with Windows 2000 Server.
address resolution
The mapping of an IP address to a hardware address.
address resolution protocol (ARP)
A protocol in the TCP/IP suite that provides IP address-to-MAC address resolution for IP packets.
alerting
A feature that warns administrators about suspicious network events, such as rejected packets and protocol violations. Alerting is made available when packet filtering is turned on and is recorded in the packet filtering log. A message generated as the result of an alert can be sent to a user account by e-mail.
anonymous logon
A feature that allows a user remote access to a computer on the Internet without supplying a user name or password, but only with the guest permissions assigned to that account. Commonly used in FTP requests.
application filter
Software that can perform protocol-specific or system-specific tasks, such as authentication. An application filter provides an extra layer of security for the Firewall service.
array
A group of ISA Server computers grouped together to provide distributed caching, load balancing, and fault tolerance. Arrays allow a group of ISA Server computers to be treated and managed as a single, logical enterprise.
array member
An ISA Server computer that is part of an array.
authentication
Validation of a user's logon information to determine permission to access a resource or perform an operation.
automatic discovery
A feature that allows clients to be configured so that they automatically find the appropriate ISA Server computer.

B

bandwidth control
An ISA Server mechanism which informs the Windows 2000 QoS packet scheduling service how to prioritize connections which pass through ISA Server.
bandwidth priority
A priority level set with bandwidth rules to define priority for connections passing through ISA Server.
Bandwidth rules
A mechanism used to determine which connection gets priority over another.
basic authentication
A method of authentication that encodes the user name and password. Basic authentication is called plaintext because the encoding (base-64) can be decoded by anyone with a common decoding utility. Note that encoding is not the same as encryption.
broadcasting
The delivery of data packets to all computers on a network.

C

cache
A store of frequently-retrieved objects and URLs located on the cache drive of an ISA Server computer. Instead of retrieving an object directly from an Internet Web server, the object is stored and retrieved from the cache instead. Caches improve network performance by reducing the number of objects which need to be retrieved from the Internet. This means faster client access to popular objects and less bandwidth overhead.
Cache Array Routing Protocol (CARP)
A routing algorithm used to provide efficiency and prevent duplication of cache contents when multiple ISA Server computers are arrayed as a single logical cache.
cache drive
The amount of space reserved on a selected server disk drive for use in storing cached files.
cache mode
One of the selections available during the setup process to define features available for ISA Server. If caching mode is chosen, caching features will be available.
cache filtering
The ability to either cache or not cache objects retrieved from World Wide Web, FTP, or Gopher sites.
cache policy
A set of rules and configuration parameters which determine the behaviour of the ISA Server cache.
CARP
See Cache Routing Array Protocol.
chaining
A method of linking multiple ISA Server computers together. Individual ISA Server and proxy computers and arrays or any combination can be chained. Communication is in an upstream, hierarchical order.
chained authentication
The authentication that an ISA Server computer provides when routing requests to an upstream server.
client certificate
Used when the SSL protocol provides authentication by checking the contents of an encrypted digital identification submitted by the client's Web browser during the logon process. This certificate contains information about the client and about the organization that issued the certificate.
client set
A group of one or more local client computers, joined together for the purpose of applying rules and policies to the set.
.cdat
The .cdat file is created when a cache drive is configured. The size of the .cdat file will be the size of the cache drive specified.

D

datagram
See packet
database logging
A feature that logs events that are generated by ISA Server services to a database instead of a text file.
default gateway
In TCP/IP, the intermediate network device on the local network that has knowledge of the network IDs of the other networks in the Internet, so it can forward the packets to other gateways until they are delivered to the one connected to the specified destination.
destination set
A group of one or more computer or folders on specific computers, grouped together for the purpose of applying rules and policies.
DHCP
See Dynamic Host Configuration Protocol.
dial-up connection
A connection that uses a telephone device, such as a modem.
digest authentication
A means of passing credentials by a secure method known as hashing, which means that credentials cannot be deciphered by an unauthorized person. It can only be used in Windows 2000 domains.
distributed caching
A means by which the cache is distributed across an array of ISA Server computers and set up as a single, logical entity, preventing duplication and increasing efficiency.
domain controller
A computer that manages user access to a network, including logging on, authentication and access to shared resources.
DMZ
See perimeter network
DNS
See Domain Name System (DNS).
DNS server
The server containing information for name resolution involved in mapping computer IP addresses to their domain name.
Domain name
The computer name that substitutes for a network IP address. For example, you may use http://www.microsoft.com instead of the IP address 157.45.60.81.
Domain Name System
A protocol and computer-naming hierarchy used throughout the Internet to map computer IP addresses to their domain name.
Dynamic Host Configuration Protocol
A protocol that offers dynamic assignment of IP addresses and related information for temporarily connected network users. DHCP provides safe, reliable, and simple TCP/IP network configuration, prevents address conflicts, and helps conserve the use of IP addresses through centralized management of address allocation.
dynamic IP filtering
A method of controlling the flow of IP packets to and from ISA Server, by means of access policy or publishing rules. A dynamic packet filter will be applied as rule conditions are met.

E

encryption
The process of making information indecipherable to protect it from unauthorized viewing or use, especially during network transmission or when it is stored on a transportable magnetic medium.
endpoint
The originating or destination location of a call requests. Each person participating in a conference call is an endpoint.
enterprise
A collection of one or more ISA Server arrays that share common enterprise policy settings.
enterprise policy
A configuration which enables centralized management of arrays in a corporate network, allowing common rules to be applied to arrays within the enterprise.
event messages
A text message generated during the operation of Microsoft ISA Server. These messages appear in the Event Viewer, which can be used to monitor and troubleshoot events.

F

File Transport Protocol (FTP)
The Internet standard protocol for transferring files between computers. FTP uses the Telnet and TCP protocols. The server requires a client to supply a logon user name and password before honoring requests
Firewall
A system or combination of systems that enforces a boundary between two or more networks and keeps intruders out of internal networks. Firewalls serve as barriers for packets passing from one network to another.
firewall chaining
Configures how requests from Firewall clients should be routed, either directly to the Internet (with or without a dial-up connection), or to an upstream proxy server (with or without a dial-up connection).
Firewall client
A computer with Firewall client software installed and enabled.
firewall mode
One of the selections available during the setup process to define features available for ISA Server. If Firewall mode is chosen, features are available that will secure network communication between the corporate network and the Internet.
Firewall service
The Firewall service (fwsrv) is a Windows 2000 service that supports requests from Firewall and SecureNAT clients.
forward caching
Caching that is implemented for clients on the internal network accessing servers on the Internet.
FTP
See File Transport Protocol

G

gatekeeper
A program that supplies call control services for registration, address translation and bandwidth management. Gatekeepers are not required in an H.323 network, but if a gatekeeper is present, endpoints must use the gatekeeper service.
gateway
A device that connects networks that use different communication protocols. A gateway translates different transmission formats and protocols so that information can be passed from one to another.
Gopher
A hierarchical system for finding and retrieving information from the Internet or an intranet. An enhanced version, Gopher Plus, returns more information about an item, such as file size, last date of modification, and the administrator's name.

H

H.323 client
A client who has registered with H.323 Gatekeeper and who uses computer applications that support H.225 registration admission and status (RAS) protocol.
H.323 Gatekeeper
H.323 is a communications standard for audio, video and data communication across IP-based networks, including the Internet. In ISA Server, H.323 Gatekeeper works together with the H.323 protocol filter to provide full communications capabilities to H.323 registered clients using applications that are compliant with H.323 Gatekeeper. Any client who wants to be available through a well-known alias, such as someone@microsoft.com, must register with H.323 Gatekeeper. Any client using translation services when placing outbound calls, must also register with H.323 Gatekeeper.
H.323 gateway
A gateway translates different transmission formats and protocols so that information can be passed from one network to another. Gateways commonly provide translation for communications between H.323 terminals and public switched telephone devices. H.323 gateways provide H.323 clients with services so that they are able to communicate with endpoints that are not H.323 compliant.
header
In data packet communications, a specified number of bytes that precedes the actual data being transmitted. It identifies control information used to deliver, route, and process the data contents of a packet.
hierarchal caching
The forwarding of a client HTTP request from an ISA Server computer to another proxy upstream. The downstream (source) proxy forwards client requests that it cannot service from its own cache.
hit rate
The percentage of client requests fulfilled through previously cached data, in contrast to the total of all client requests that have been processed by the caching service.
host name
The name of a device on a network. For a device on a Windows NT 4.0 or Windows 2000 network, this can be the same as the computer name, but it does not have to be.
HTTPS
See Secure HTTP

I

ICMP
See Internet Control Message Protocol
Inbound bandwidth
Bandwidth allocated for requests from external clients for objects on the local network.
integrated authentication
A secure form of authentication, where user name and password are not sent across the network.
integrated mode
One of the selections available during the setup process to define features available for Microsoft ISA Server. If integrated mode is chosen, both caching and firewall features will be available.
Internet Control Message Protocol(ICMP)
An extension to Internet Protocol that supports packets containing error, control and informational messages. For example, PING uses ICMP to test an Internet connection.
Internet Protocol (IP)
Specifies the format of data in packets, also known as datagrams, and the addressing scheme for these packets. Most networks combine IP with a higher level protocol, TCP, to establish a virtual connection between a destination and a source.
Internet Service Provider (ISP)
A company that provides access to the Internet.
Intra-array addressing
The address used when sending a request to another server in the same array. This address must be in the local address table (LAT).
Intrusion detection
A mechanism to detect when an attack is attempted against a network protected by ISA Server.
IP
See Internet Protocol.
IP address
An identifier for a computer or device on a TCP/IP network, including the Internet.
IP fragment
A single IP datagram can be broken up into multiple datagrams of a smaller size, known as IP fragments. These fragments can be filtered by the ISA Server, since one method of intrusion is to send fragmented packets and then reassemble them to cause harm to the system.
ISA Management
The interface tool used to manage ISA Server enterprise, arrays and stand-alone servers.
ISA Server schema
ISA Server stores information in multiple containers within the Active Directory. This information is known as the ISA Server schema. For an ISA Server to be an array member, this ISA Server schema must be installed to Active Directory. This only needs to be done once.
ISA Server Control service
The ISA Server Control service (mspadmin) is a Windows 2000 service that is responsible for various services and functions within ISA Server.
ISP
See Internet Service Provider

J

K

Kerberos
A network authentication protocol supporting authentication services. Windows 2000 implements Kerberos V5 in its security schema.

L

L2DP
See Layer Two Tunneling Protocol
Layer Two Tunneling Protocol
An extension to the PPP protocol that enables ISP's to operate VPNs.
LAT
See local address table
LDT
See local domain table
load factor
A number which determines the proportionate amount of the cache load on each member server in an array. Different member servers can be configured to have different loads.
local address table
A table of all internal IP address ranges used by the local network behind the ISA Server computer.
local domain table
A table of all the computer names in the local network served by the ISA Server computer.

M

MCU
See Multiple control units.
MIME
See Multipurpose Internet Mail Extensions.
Multiple control units (MCU)
The central connection or hub that provides support for conferencing between three or more terminals. An MCU may also manage the media stream and audio-video negotiations between endpoints. Sometimes called Multipoint Conferencing Server (MCS)
Multipurpose Internet Mail Extensions (MIME)
A way of configuring browsers to view files that are in multiple formats. MIME makes available the exchanging of objects, different character sets, and multimedia in e-mail on different computer systems.

N

NAT
See network address translation
NAT editor
NAT provides translation of the IP, TCP, UDP headers. A NAT editor is used to make modification to the IP packet beyond the translation of these headers.
network address translation (NAT)
An Internet standard that enables a local network to use one set of IP addresses for internal traffic and a second set for external traffic. In effect it hides internal IP addresses and enables a company to use more internal IP addresses, which, since they are only used internally, will not conflict with IP addresses used by other organizations.
Network News Transfer Protocol (NNTP)
The Internet standard protocol for posting, distributing, and reading network news messages posted among news groups on the Internet. Messages are posted to NNTP servers and are accessed by NNTP clients (newsreaders).
negative caching
The caching of HTTP error conditions associated with accessing a particular URL. If the URL is unavailable, the error response message can be cached and returned to subsequent clients that request the same URL.
NIC
Network interface card
NNTP
See Network News Transfer Protocol
NTFS
An advanced file system designed for use specifically within the Windows 2000 operating system.

O

outbound bandwidth
Bandwidth allocated for requests from internal clients for objects on the Internet.

P

packet
A piece of a message transmitted as a fixed number of bytes over a packet-switching network, which is a network using a protocol that divides messages into packets before sending them. Each packet is transmitted individually, perhaps through different routes, and the original message is reassembled at the destination. A packet will contain the destination address, as well as the data. In an IP network, these packets are often known as datagrams.
packet filtering
A method of controlling the flow of IP packets to and from ISA Server. When packet filtering is enabled, all packets are dropped unless explicitly allowed by a packet filter.
pass-through authentication
A feature of ISA Server that allows a client's authentication information to be passed on to a destination server for both incoming and outgoing Web requests.
performance counter
A tool that tracks ISA Server activity to monitor array performance and usage.
perimeter network(DMZ)
A network set up separately from an organization's private network and the Internet. The advantage of a perimeter network is that it allows external users access to specific servers located in the perimeter network, while preventing access to the internal corporate network.
PING
A TCP/IP utility that verifies connections to one or more remote computers by sending ICMP packets and listening for reply packets.
Point-to-Point Tunneling Protocol (PPTP)
A newer networking protocol that enables remote users to access corporate networks securely across the Internet by dialing into an Internet Service Provider (ISP) or by connecting directly to the Internet. PPTP supports multiprotocol virtual internal networks (VPNs). Because PPTP allows multiprotocol encapsulation, users can send any packet type over an IP network.
policy element
A group of properties defined for a rule.
POP
See Post Office Protocol
Post Office Protocol (POP)
A network protocol that permits a client computer to access e-mail on a server. Usually, this means that a POP3 server is used to allow a client computer to retrieve mail that an SMTP server is holding for it.
port
In TCP/IP networks, a port is an endpoint to a logical connection. Certain services and protocols will often use default port numbers, identifying a certain Internet application with a specific connection.
PPTP
See Point-to-Point Tunneling Protocol
protocol
Software that allows computers to communicate over a network. The Internet protocol is TCP/IP.
publishing rule
ISA Server uses publishing rules to control the handling of incoming requests for internal network resources. Web publishing rules are configured to decide how incoming requests to internal Web servers are handled, while server publishing rules are used to deal with incoming requests to servers (such as SMTP and FTP) on the internal network.

Q

Q931 address
The combination of the IP address and the port address. Each registered endpoint has a unique Q931 address.
QoS
See Quality of Service
QoS Admission Control
A Windows 2000 Server feature which can be installed and configured to centrally control how, by whom, and when shared network resources are used.
QoS Packet Scheduling service
A Windows 2000 Server feature used by ISA Server in setting bandwidth priorities. ISA Server bandwidth control does not limit bandwidth used. It informs the Windows 2000 QoS packet scheduling service how to prioritize network connections. If there is no bandwidth rule for a connection, a default priority will apply.
Quality of Service(QoS)
A Windows 2000 Server set of service requirements that the network must meet to assure an adequate service level for data transmission. Implementing QoS enabled real-time programs to make the most efficient use of network bandwidth.

R

remote administration
The practice of administering a computer from another computer connected across the network.
reverse caching
Caching implemented for incoming requests to local Web servers from the Internet.
routing
The process of routing client requests for one ISA Server to a specified upstream server.

S

scheduled cache
A cache feature that can be customized to download HTTP content directly to the ISA Server cache, upon request or by configuring a schedule. This means that cache content can be updated in anticipation of client requests.
secondary connection
A range of port numbers, protocol and direction used for additional connections or packets that follow the initial connection. One or more secondary connections can be configured.
Secure HTTP (HTTPS)
A proposed extension to HTTP that supports various encryption and authentication measures to keep all transactions secure from end to end.
SecureNAT
See secure network address translation clients
secure network address translation clients (SecureNAT clients)
Client computers that do not have Firewall client software installed. Requests from SecureNAT clients are essentially handled by the Firewall service and derive the benefits provided by this service.
Secure Sockets Layer (SSL)
A protocol that supplies secure data communication through data encryption and decryption. SSL enables communications privacy over networks.
security template
A snap-in provided with ISA Server that provides a view of the configuration see with the ISA Server security wizard, which is used to apply a full range of predefined system security settings to all the servers in the array.
server certificate
A means of identifying information about the server. When a client requests an SSL object from a server, it requests that the server authenticate itself to the client. A server certificate does this
server publishing rule
A rule that is configured to specify how incoming requests to internal servers on the local network should be handled.
HTTPS
See Secure HTTP
Simple Mail Transport Protocol (SMTP)
An Internet standard protocol used for exchanging e-mail between SMTP servers on the Internet.
Simple Network Management Protocol (SNMP)
A standard protocol used for monitoring your network.
SMTP
See Simple Mail Transport Protocol
SNMP
See Simple Network Management Protocol
socket
A logical communications channel used by TCP/IP applications. Sockets are data structures created by using a combination of device IP addresses and reserved TCP/UDP port numbers to indicate connection and delivery service information. Winsock is a Windows-based implementation of sockets.
SOCKS filter
The SOCKS filter provided with ISA Server forwards requests from SOCKS applications to the Firewall service.
SSL
See Secure Sockets Layer
SSL bridging
The ability of ISA Server to encrypt or decrypt client requests and pass on the request to a destination Web server.
SSL tunneling
The ability of ISA Server to allow a client to establish a tunnel through the ISA Server directly to the Web server with the requested HTTPS object. Whenever a client browser requests an HTTPS object through the ISA Server, SSL tunneling is used.
static IP filtering
A type of IP filter that involves configuration of a static, ever-present IP packet filter. In most cases, dynamic IP filtering is preferred, meaning that the creation of access policy rules results in an IP packet filter, which is dynamically applied as policy rule conditions are met.
stand-alone server
A single ISA Server that is not installed as an array member. Stand-alone servers do not require that the computer belong to a Windows 2000 domain, do not require Active Directory, and have no enterprise policy.
subnet mask
A TCP/IP configuration parameter that extracts network and host configuration from an IP address. This 32-bit value enables the recipient of IP packets to distinguish the network ID portion (domain name) of the IP address from the host ID (host name.

T

TCP
See Transmission Control Protocol
TCP/IP
See Transmission Control Protocol/Internet Protocol
terminals
Equipment that provides real-time communications. Terminals must support audio communications, but support for video or data communications is optional. A computer running Microsoft NetMeeting 3.0 or higher is an example of an H.323 terminal.
time-to-live
A custom setting that can be set to 0 or to a specified percentage of the age of an HTTP object. This setting determines the expiration policy of HTTP objects held in the ISA Server cache.
Transmission Control Protocol (TCP)
The Internet standard transport protocol that provides the reliable, two-way connected service that allows an application to send a stream of data end-to-end between two computers across a network. The Internet protocol suite is often called TCP/IP.
Transmission Control Protocol/Internet Protocol(TCP/IP)
A family of networking protocols that allows computers with diverse hardware architectures and various operating systems to communicate across interconnected networks and the Internet. TCP/IP includes standards for how computers communicate and conventions for connecting networks and routing traffic. Every computer on the Internet supports TCP/IP.
TTL
See time-to-live

U

UDP
See User Datagram Protocol
User Datagram Protocol (UDP)
A standard transport protocol in TCP/IP networking that provides connectionless service for unacknowledged delivery of packets. UDP adds port addresses to the service provided by IP.

V

verbose logging
An option that supplies additional or supplemental information for a network event in a log file.
Virtual Private Network (VPN)
A network that is constructed using public systems such as the Internet but uses security mechanisms to ensure privacy and that only authorized users are allowed access.
VPN
See Virtual Private Network

W

Web Proxy client
A client computer that has a Web browser application, which complies with HTTP 1.1, and is configured to use the Web Proxy service of ISA Server.
Web Proxy service (w3Proxy)
A Windows 2000 service that supports requests from any Web browser. It works at the application level on behalf of a client requesting an Internet object that can be retrieved by one of the Web Proxy supported protocols: FTP, HTTP, HTTPS, and Gopher.
Web publishing rule
A rule that is configured to specify how incoming requests to internal Web servers should be handled.
well-known alias
An alternative name that is used to direct calls or connection to a person at a terminal. An alias can be a phone number, account name, computer name, e-mail address, or other similar name.
well-known port
A well-known port is any port in the range of 1-2048.
Windows NT challenge/response authentication
A method of authentication in which a server uses Windows NT security to allow access to its resources.
Winsock
A Windows implementation of the widely used UC Berkeley Sockets API. Windows Sockets is a networking API used to create TCP/IP-based sockets applications. Windows Sockets provides interfaces between applications and the transport protocol and works as a bidirectional connection for incoming and outgoing data. Also called WinSock.

X

Y

Z


Event messages

Microsoft Internet Security and Acceleration (ISA) Server records events that occur during its operation in Event Viewer. You can use Event Viewer to monitor and troubleshoot events.

This section provides information about ISA Server events, including:

  • ID number. The number that identifies the event type. The event number helps technical support representatives track events in the system.
  • Event message. A description of the event that also appears on the property page for the event.
  • Explanation. A description of the possible cause of the event.
  • User action. A description of the actions you can take to solve or prevent the problem.

There are four severity levels for individual event messages:

  • Success
  • Informational
  • Warning
  • Error

Use Event Viewer to view the severity level or to view more information regarding individual messages. Successful events do not appear in the Event Viewer.

Here is a list of event messages by category

  • Alert event messages
  • Bandwidth event messages
  • Caching event messages
  • Common service event messages
  • Dial-up connection event messages
  • Intrusion detection event messages
  • ISA Server Control service event messages
  • ISA Server Firewall service event messages
  • ISA Server Web Proxy service event messages
  • Log event messages
  • Packet filter event messages
  • Server event messages


Alert event messages

These messages refer to events related to alerts in Microsoft Internet Security and Acceleration (ISA) Server.

Message ID | Description
14033 | Alert notification did not start. Alerts are limited to event reporting.
14040 | Mail alerting stopped responding because Mapi.dll could not be located.
14045 | Mail alert for %1 failed.
14050 | Mail alert %1 stopped because of a configuration error (%2).
14051 | Mail alert %1 (%2) stopped because it could not log on or connect to the server.
14052 | Mail alert %1 stopped because the mail server refused to accept the message.
14053 | Mail alert %1 stopped because the sender name is not valid.
14054 | Mail alert %1 stopped because the recipient name is not valid.
14064 | Unknown event %1 signaled the alert aervice.
14065 | Alert service: One or more of the actions associated with alert %1 has failed.
14069 | The alert service found more then one alert with the same event condition.
14072 | The alert service failed to logon as user %2 to run the command %3 specified for the alert '%1'.
14144 | The alert service failed to initialize because system call %1 failed.
14180 | Alert service: failed to log event to system log.


Bandwidth event messages

These messages refer to events related to the bandwidth control in Microsoft Internet Security and Acceleration (ISA) Server.

Message ID | Description
13002 | Bandwidth control completed successfully.
13103 | Initialization of bandwidth control failed.
13104 | The call to %1 failed.
13105 | Insufficient memory for %1.
13106 | Cannot match IP to an interface.


Cache Event Messages

These messages refer to events connected to Microsoft Internet Security and Acceleration (ISA) Server cache.

Message ID | Description
13107 | The scheduled content download service has stopped the job %1...
13108 | The scheduled content download service found an unauthorized URL...
13109 | The scheduled content download service was unable to connect to...
14094 | The scheduled cache content download service cannot start...
14111 | ISA Server cache could not start because it was configured incorrectly...
14137 | Some of this information may be out of date because of network problems...
14138 | Some of this information has not been updated in the past 24 hours...
14140 | Some of this information may be out of date.
14150 | The ISA Server cache could not initialize the URL cache on disk. The ISA Server cache files are corrupted.
14151 | The ISA Server cache could not initialize the URL cache on disk. The ISA Server cache disk is full.
14164 | Cache drives failed to initialize properly...
14165 | There is inconsistency in some cache files...
14166 | Cache is intentionally disconnected from the rest of the network.
14167 | Recovery of data cache file %1 was completed...
14168 | Some errors were encountered during the restoration of specific data cache files.
14169 | While restoring cache data, %1 objects with conflicting information were found...
14170 | Restoration of cache data completed...
14171 | Cache data was restored successfully from all data cache files.
14172 | Cache failed to initialize correctly. Caching is disabled...
14173 | Path name too long for the disk cache %1. Specify a shorter path name...
14174 | Invalid size specified for disk cache %1...
14175 | Invalid volume specified for disk cache %1.
14176 | Disk cache %1 failed to initialize and is disabled.
14184 | The scheduled cache content download service was stopped gracefully.
14185 | The scheduled cache content download service was started successfully.


Common service event messages

These messages refer to events common to Microsoft Internet Security and Acceleration (ISA) Server services.

Message ID | Description
11000 | %1 failed to start. The failure occurred during %5 because the configuration property %4 of the key %3 could not be accessed.
11001 | %1 failed. The failure occurred during %5 because the configuration property %4 of the key %3 could not be accessed.
11002 | %1 failed to start. The failure occurred during %5 because the configuration property %4 of key %3 is not valid.
11003 | %1 failed. The failure occurred during %5 because the configuration property %4 of key %3 is not valid.
11004 | %1 failed to start. The failure occurred during %4 because the system call %3 failed.
11005 | %1 failed. The failure occurred during %4 because the system call %3 failed.
11006 | %1 failed to start. A shortage of available memory caused the service to fail during %2.
11007 | A shortage of available memory caused the %1 to fail during %2.
11008 | %1 failed to start. The service failed to register for storage notification on key during %3.
14048 | Failed to stop the %1 during %2.
14077 | Failed to start the %1 during %2.
14079 | Due to an unexpected error, the service %1 stopped responding to all requests.


Dial-up connection events

These messages refer to events related to dial-up connections in Microsoft Internet Security and Acceleration (ISA) Server.

Message ID | Description
14066 | Failed to read the dial-up entry configuration.
14067 | Failed to load Rasapi32.dll.
14136 | ISA Server dial-out connection failed.
14142 | A dial-out to the Internet failed.


Firewall service event messages

These messages refer to events connected with the Microsoft Internet Security and Acceleration (ISA) Server Firewall service.

Message ID | Description
14001 | Firewall service failed to initialize.
14002 | Firewall service could not initialize WinSock.
14003 | The Firewall service started.
14004 | Firewall service was unable to start due to a shortage of available memory.
14006 | Firewall service cannot start the performance counters.
14007 | A shortage of available memory caused Firewall service to fail.
14010 | Firewall Service did not start due to corrupted data in the registry or in the Active Directory configuration.
14011 | The Firewall service failed to bind its socket to %1 port %2.
14012 | Client from %1 attempted to access ISA Server using control protocol version %2.
14013 | Firewall service requires a Windows 2000 server.
14014 | The Firewall service requires a Windows 2000 server.
14015 | The Firewall service failed to load a security DLL.
14016 | The Firewall service failed to determine network addresses.
14017 | Incorrect network configuration. None of the server's addresses is internal.
14021 | The Firewall service failed to initialize because the system call %1 failed.
14028 | The Firewall service did not initialize the network dial-up entry.
14029 | The Firewall Service failed to create a socket.
14030 | The Firewall service failed to associate a control socket with a completion port.
14031 | The Firewall service failed to initialize control or refresh sockets.
14034 | The Firewall Service did not listen on all TCP sockets.
14035 | The Firewall Service failed to listen on the TCP socket bound to %1.
14036 | Firewall clients cannot use address %1 because it is missing from configuration file %2.
14048 | Failed to stop the %1 during %2.
14055 | The Firewall service performed an illegal operation because an application filter component (%2) failed at method %1 GUID=%3.
14056 | The Firewall service stopped because an application filter module %1 generated an exception code %3 in address %2 when function %4 was called.
14057 | The Firewall service stopped because an application filter module %1 generated an exception code %3 in address %2 when function %4 was called..
14058 | The Firewall service could not connect to another proxy.
14059 | The Firewall service could not connect to another proxy. Authentication failed.
14060 | Could not load an application filter %1 (%4). %2 failed with code 0x%3.
14061 | The Firewall service detected that the upstream ISA server '%1' is not available.
14062 | The Firewall service detected that the upstream proxy '%1' is now available.
14063 | The Firewall Service failed to initialize because of a corrupted registry.
14071 | The Firewall Service failed to start because the application filter component %1 did not start on time.
14093 | The Firewall service cannot start because the ISA Server was installed using cache mode.
14152 | A User Datagram Protocol (UDP) packet was dropped.
14182 | The Firewall service was stopped gracefully.

Winsock Error Code Messages

Message id | Message description
10000 | Name entered is too long.
10001 | System is not ready.
10002 | Current version is not supported.
10003 | Service cannot send after socket shutdown.
10004 | An interrupted system call was received.
10005 | Host was not found.
10006 | Try again.
10007 | Non-recoverable error encountered.
10008 | No data record is available.
10009 | Bad file number encountered.
10010 | Operation would block.
10011 | Operation is in progress.
10012 | Operation is already in progress.
10013 | Bad network address encountered.
10014 | Destination address required.
10015 | Message is too long.
10016 | Protocol family not supported.
10017 | Directory is not empty.
10018 | EPROCLIM returned.
10019 | EUSERS returned.
10020 | Disk quota exceeded.
10021 | ESTALE returned.
10022 | Invalid argument.
10023 | Too many open files.
10024 | Too many levels of symbolic links.
10025 | The object is remote.
10026 | Socket operation attempted on non-socket.
10027 | Bad or unassigned address.
10028 | Address is already in use.
10029 | Address family is not supported by protocol family.
10030 | Socket type is not supported.
10031 | Protocol is not supported.
10032 | No buffer space is supported.
10033 | Connection timed out.
10034 | Socket is already connected.
10035 | Socket is not connected.
10036 | Bad protocol option used.
10037 | Connection reset by peer.
10038 | Software caused connection to abort.
10039 | Network is down.
10040 | Network was reset.
10041 | Connection refused.
10042 | Host is down.
10043 | Host is unreachable.
10044 | Protocol is wrong type for socket.
10045 | Operation is not supported on socket.
10046 | ICMP network is unreachable.
10047 | Too many references used.
10048 | Not owner.
10049 | No such file or directory exists.
10050 | No such process exists.
10051 | System call interrupted.
10052 | I/O Error encountered.
10053 | No such device or address exists.
10054 | Argument list too long.
10055 | Executed format error.
10056 | Bad file number encountered.
10057 | No children exist for parent object.
10058 | Operation would block one in progress.
10059 | Not enough memory is available.
10060 | Permission denied.
10061 | Bad address encountered.
10062 | Mount device or directory is busy.
10063 | File already exists.
10064 | A cross-device link exists.
10065 | No such device exists.
10066 | Is not a directory.
10067 | Is a directory.
10068 | Invalid argument used.
10069 | File table has overflowed.
10070 | Too many files are open.
10071 | Is not a typewriter.
10072 | File is too large.
10073 | No space is left on device.
10074 | Illegal seek performed.
10075 | Read-only file system in use.
10076 | Too many links used.
10077 | Pipe has broken.
10078 | Math argument used.
10079 | Result is too large.
10080 | A resource deadlock would occur.
10081 | No message of desired type exists
10082 | Identifier removed.
10083 | Channel number is out of range.
10084 | Level 2 is not synchronized.
10085 | Level 3 halted.
10086 | Level 3 reset.
10087 | Link number is out of range.
10088 | Protocol driver is not attached.
10089 | No CSI structure is available.
10090 | Level 2 halted.
10091 | An invalid exchange was made.
10092 | Invalid request descriptor used.
10093 | Exchange is full.
10094 | No anode exists.
10095 | Invalid request code used.
10096 | Invalid slot used.
10097 | Bad font file format used.
10098 | Device is not a stream.
10099 | No data was found.
10100 | Timer has expired.
10101 | System is out of streams resources.
10102 | Machine is not on network.
10103 | Package is not installed.
10104 | The object is remote.
10105 | The link has been severed.
10106 | Advertise error occurred.
10107 | Server mount error occurred.
10108 | Communication error in sending.
10109 | Protocol error encountered.
10110 | Multihop attempted.
10111 | Inode is remote.
10112 | Cross mount point achieved.
10113 | Trying to read unreadable message.
10114 | Log name used is not unique.
10115 | Remote address changed.
10116 | Can't access a needed shared library.
10117 | Accessing a corrupted shared.
10118 | Library section in code file corrupted.
10119 | Attempting to link in too many libraries.
10120 | Attempting to execute a shared library.
10121 | Socket operation attempted on non-socket.
10122 | Cannot assign requested address.
10123 | Address is already in use.
10124 | Address family is not supported by protocol family.
10125 | Socket type is not supported.
10126 | Protocol is not supported.
10127 | No buffer space is available.
10128 | Connection timed out.
10129 | Socket is already connected.
10130 | Socket is not connected.
10131 | Bad protocol option used.
10132 | Connection reset by peer.
10133 | Software caused connection to abort.
10134 | Network is down.
10135 | Connection refused.
10136 | Host is unreachable.
10137 | Protocol is wrong type for socket.
10138 | Operation not supported on socket.
10139 | IP Subnet table is full.
10140 | Subnet module not linked.
10141 | Unknown I/O control call used.
10142 | Failure in streams buffer allocation.
10143 | ICMP protocol is unreachable.
10144 | ICMP port is unreachable.
10145 | ICMP network is unreachable.
10146 | Invalid Ethernet packet in use.
10147 | An error in type registration occurred.
10148 | Sockets library is not initialized.
10149 | Unknown error number encountered.


Intrusion detection event messages

These messages refer to events connected to intrusion detection in Microsoft Internet Security and Acceleration (ISA) Server.

Message ID | Description
15001 | ISA Server detected windows out of band attack.
15002 | ISA Server detected IP half scan attack.
15003 | ISA Server detected land attack.
15004 | ISA Server detected enumerated port scan attack.
15005 | ISA Server detected generic port scan attack.
15006 | ISA Server detected UDP bomb attack.
15007 | ISA Server detected ping of death attack.
15101 | ISA Server detected windows out of band attack on IP address %1.
15102 | ISA Server detected IP half scan attack on IP address %1.
15103 | ISA Server detected land attack on IP address %1.
15104 | ISA Server detected enumerated port scan attack on IP address %1.
15105 | ISA Server detected generic port scan attack on IP address %1.
15106 | ISA Server detected UDP bomb attack on IP address %1.
15107 | ISA Server detected ping of death attack on IP address %1.


Log event messages

These messages refer to events related to logging in Microsoft Internet Security and Acceleration (ISA) Server.

Message ID | Description
1 | The server was unable to load Odbc32.dll for SQL logging due to the following error.
2 | The server was unable to open ODBC Data Source %1, Table: %2, under User Name %3.
3 | The server was unable to create the log file directory %1.
4 | The server failed to log information. The log object was never created, possibly due to the wrong configuration.%0.
5 | The server failed to log information to file %1 in path %2.
6 | The server failed to log information to ODBC Data Source %1, Table: %2, under User Name %3.
7 | The server created the log file directory %1 due to logging configuration changes.
14102 | The server was unable to load Odbc32.dll for SQL logging because of the following error: %1.
14103 | The server was unable to open ODBC Data Source %1, Table: %2, under User Name %3. The ODBC Error is: %4.
14104 | The logging parameters that are specified are too long.
14107 | The server could not log information.
14108 | The server was unable to find the log file directory %1.
14047 | Failed to write to %1 log file in directory %2.
14049 | %1 was stopped because of logging failure.


Control service event messages

These messages refer to events connected to the Microsoft Internet Security and Acceleration (ISA) Server control service.

Message ID | Description
14022 | Microsoft ISA Server Control Service failed to initialize because the system call %1 failed.
14024 | Microsoft ISA Server Control Service requires a Windows 2000 Server. It will not run on previous versions, including Beta versions of Windows 2000.
14025 | Microsoft ISA Server Control Service requires a Windows 2000 server.
14026 | Microsoft ISA Server Control Service failed to initialize.
14027 | Microsoft ISA Server Control service started.
14076 | Microsoft ISA Server Control Service failed to execute the security editing application.
14078 | Microsoft ISA Server Control Service failed to delete Web Proxy Cache file %1 during %2.
14080 | Microsoft ISA Server Control Service failed because an application filter component (%2) performed an illegal operation at method %1 GUID=%3.
14081 | ISA Server Control Service discovered a missing application filter component (%1) GUID %2.
14082 | ISA Server Control Service cannot load the application filter component (%1) GUID %2, because it does not support necessary interfaces.
14083 | ISA Server Control Service cannot load the application filter component (%1) GUID %2.
14084 | ISA Server Control Service failed to start. All array members must be in the same site (%2).
14085 | ISA Server Control Service failed to start. All array members must be in the same domain (%2).
14181 | ISA Server Control Service was stopped gracefully.


Packet filter event messages

These messages refer to events connected to packet filtering in Microsoft Internet Security and Acceleration (ISA) Server.

Message ID | Description
14038 | ISA Server packet filter log service could not allocate memory.
14039 | ISA Server packet filter logging component cannot obtain the log contents.
14043 | Could not create the system-wide packet filter log event.
14044 | The packet filter is dropping IP packets.
14046 | Packet filter protocol violation.
14086 | Insecure configuration detected.
14119 | An external interface could not be found for packet filtering.
14120 | The ISA Server services could not create a packet filter %1.
14121 | The packet filter dial-out interface cannot be rebound.
14122 | A packet filter interface could not be bound.
14123 | Failed to create the IP packet filter.
14124 | Filtering disabled as requested.


Server event messages

These messages are connected to server and server publishing events in Microsoft Internet Security and Acceleration (ISA) Server.

Message ID | Description
12260 | Fatal error occurred when attempting to access '%1' certificate private key.
14087 | Insecure configuration detected. ISA Server uses its own NAT editor to fully secure your system.
14088 | Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] violates %6 rule [%7].
14089 | Server publishing rule [%1] failed.
14090 | Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] failed to bind to external interface.
14091 | Server publishing rule [%1] failed. The protocol specifed can't be used for publishing.
14092 | Server publishing rule [%1] failed. The protocol specified can't be used for publishing.
14095 | Failed to initialize server publishing. Location %1.
14096 | Failed to read server publishing rules. Location %1.
14097 | Failed to read one or more server publishing rules. Location %1.
14098 | Failed to read parameters of the publishing rule [%1].
14099 | Publishing rule [%1] could not be applied to this array member because IP %2 is not available.
14100 | The server was unable to log on the Windows 2000 account '%1' due to the following error: %2.
14101 | The server could not add the virtual root '%1' for the directory '%2' due to the following error: %3.
14105 | ISA Manager may not be able to see this server, because the server was unable to register the information.
14143 | ISA Server is too busy to handle this request.
14145 | ISA Server failed to initialize because of corrupted registry.
14146 | ISA Server failed to load ISAPI Filter DLL %1.
14159 | Failed to read reference to the protocol from the server publishing rule [%1].
14160 | Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] is not applied since enterprise policy does not allow publishing.
14161 | Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] was applied sucessfully.
14162 | Server publishing rule [%1] will not be applied since the filter that supports the protocol is not enabled.
14163 | Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] failed because the port on the external interface is being used by another application.


Web Proxy service event messages

These messages refer to events connected to the Microsoft Internet Security and Acceleration (ISA) Server Web Proxy service.

Message ID | Description
14125 | The Web Proxy service received %1 requests from the Internet port during the past %2 seconds while Web publishing was disabled.
14126 | The Web Proxy service configuration has been modified %1 times during the past %2 seconds.
14127 | The Web Proxy service could not initialize (Error code %1).
14128 | The Web Proxy service is paused.
14129 | The Web Proxy service was resumed.
14130 | The Web Proxy service detected that the upstream proxy '%1' is not available.
14131 | The Web Proxy service detected that the upstream proxy '%1' is now available.
14132 | The Web Proxy service detected that the array member '%1' is down.
14133 | The Web Proxy service detected that the array member '%1' is available.
14141 | ISA Server detected a proxy chain loop.
14148 | Web Proxy service failed to bind its socket to %1 port %2.
14149 | Web Proxy service failed to listen to %1 port %2.
14153 | The Web Proxy service is not listening on the defined intra-array address although resolving requests within array is enabled.
14154 | The Scheduled Content Download Service started the job %1.
14155 | The Scheduled Content Download Service finished the job %1.
14156 | The Web Proxy Service switched from primary route %1 to backup route %2.
14157 | The Web Proxy Service switched from backup route %1 to primary route %2.
14158 | The intra-array address defined on this server is not in the LAT.
14177 | Some certificates cannot be initialized (error code %1).
14178 | The Web Proxy service identified that the address %1 was removed from the interface table.
14179 | The Web Proxy Service identified that the address %1 was added to the interface table.
14183 | The Web Proxy Service was stopped gracefully.

HTTP messages

Message id | Description
12150 | The requested header was not found.
12151 | The server does not support the requested protocol level.
12152 | The server returned an invalid or unrecognized response.
12153 | The supplied HTTP header is invalid.
12154 | The request for a HTTP header is invalid.
12155 | The HTTP header already exists.
12201 | A chained proxy server or array member requires proxy-to-proxy authentication.
12202 | The ISA Server denies the specified URL.
12204 | SSL port specified is not allowed.
12206 | The ISA Server detected a proxy chain loop.
12209 | The ISA Server requires authorization to fulfill the request.
12210 | An ISAPI filter has finished handling the request.
12211 | The ISA Server requires a secure channel connection to fulfill the request.
12212 | The ISA Server requires a high-security connection to fulfill the request.
12213 | The ISA Server requires a client certificate to fulfill the request.
12214 | An ISAPI filter has caused an error or terminated with an error.
12221 | A chained server requires authentication.
12227 | The dial-out connection failed.
12228 | The server is too busy to handle this request.
12229 | The server requires authorization to fulfill the request.
12230 | An ISAPI filter has finished handling the request.
12231 | The page must be viewed over a secure channel.
12232 | The page must be viewed with a high-security Web browser.
12233 | The page requires a client certificate.
12234 | An ISAPI filter has caused an error or terminated with an error.

HTML Messages

Message id | Description
14201 | HTTP Proxy Report Message.
14202 | HTTP Proxy reports.
14203 | The ISA Server encountered an error.
14204 | Server Error Message.
14205 | ISA Server: Extended error message.
14206 | Directory is empty\r\n.
14207 | Root Directory.
14208 | Gopher root at %%s.
14209 | FTP root at %%s.
14210 | Gopher directory at %%s.
14211 | FTP directory %%s at %%s.
14212 | Web Proxy Cache initialization failed due to thread initialization failure.

Gopher Messages

Message id | Description
12130 | A Gopher protocol error occurred.
12131 | The URL must be for a file.
12132 | An error was detected while parsing the data.
12133 | There is no more data.
12134 | The URL is not valid.
12135 | The URL type is incorrect for this operation.
12136 | The request must be for a Gopher Plus item.
12137 | The requested attribute was not found.
12138 | The URL type is not recognized.

FTP Messages

Message id | Description
12110 | There is already an FTP request in progress during this session.
12111 | The FTP session was terminated.

Internet Messages

Message id | Description
12001 | No more Internet handles can be allocated.
12002 | The operation timed out.
12003 | The server returned extended information.
12004 | An internal error occurred in the Windows Internet extensions.
12005 | The URL is invalid.
12006 | The URL does not use a recognized protocol.
12007 | The server name or address could not be resolved.
12008 | A protocol with the required capabilities was not found.
12009 | The option is invalid.
12010 | The length is incorrect for the option type.
12011 | The option value cannot be set.
12012 | Windows Internet Extension support has been shut down.
12013 | The user name was not allowed.
12014 | The password was not allowed.
12015 | The login request was denied.
12016 | The requested operation is invalid.
12017 | The operation has been cancelled.
12018 | The supplied handle is the wrong type for the requested operation.
12019 | The handle is in the wrong state for the requested operation.
12020 | The request cannot be made on an ISA Server session.
12021 | The registry value could not be found.
12022 | The registry parameter is incorrect.
12023 | Direct Internet access is not available.
12024 | No context value was supplied.
12025 | No status callback was supplied.
12026 | There are outstanding requests.
12027 | The information format is incorrect.
12028 | The requested item could not be located.
12029 | A connection with the server could not be established.
12030 | The connection with the server was terminated abnormally.
12031 | The connection with the server was reset.


Ident simulation service

Microsoft Internet Security and Acceleration (ISA) Server includes an Ident server (also called Identd) that responds to Ident queries from the Internet.

Some Internet servers (typically File Transfer Protocol (FTP), Simple Mail Transport Protocol (SMTP), and Internet relay chat (IRC) servers require identification from a client before providing services to the client. To do this, the server sends an identification protocol query to the client. When the client is located behind ISA Server (or any other proxy server), the Ident request is dropped and never reaches the client.

Running the Identd Simulation service that is included with ISA Server allows the ISA Server computer to respond to the Ident query on behalf of the client. ISA Server always responds to the Ident query with a random user identification string.

Perform the following steps to install and configure the Identd Simulation service:

  1. On the computer that is running ISA Server, create a folder named \Identd.
  2. Copy Identd.exe from the ISA_Server_CD-ROM\ISA\Identd\Platform\ folder to the folder you created in step 1.
  3. At a command prompt, in the Identd folder on the ISA Server computer, type identd -install.
  4. At a command prompt, type net start identd.
  5. Create an IP packet filter with the following parameters:
    • Allows packet transmission
    • Applies to the predefined Identd filter
    • Applies to Default IP addresses for each external interface on the ISA Server computer
    • Applies to All remote computers


Performance counters

This section describes Microsoft Internet Security and Acceleration (ISA) Server performance counters. For information about specific topics, see:

  • Bandwidth control performance counters
  • Cache performance counters
  • Firewall service performance counters
  • H.323 filter performance counters
  • Packet filter performance counters
  • Performance counter overview
  • Web Proxy service performance counters


Bandwidth control performance counters

These are the counters for the bandwidth control object of Microsoft Internet Security and Acceleration (ISA) Server.

Performance counter | Description
Actual Inbound Bandwidth | Measures the actual inbound bandwidth.
Actual Outbound Bandwidth | Measures the actual outbound bandwidth.
Assigned Connections | Tracks the number of connections with an assigned bandwidth priority. Connections with assigned bandwidth priorities have higher precedence than those without assigned priorities.
Assigned Inbound Bandwidth | Tracks the assigned inbound bandwidth
Assigned Outbound Bandwidth | Tracks the assigned outbound bandwidth.


Cache performance counters

Counter | Description
Active Refresh Bytes Rate (KB/Sec) | Measures the rate at which bytes of data are retrieved from the Internet to actively refresh popular Uniform Resource Locators (URLs) in the cache. This will relate to the configuration set for active caching.
Active URL Refresh Rate (URL/Sec) | Measures the rate at which popular cached URLs are actively refreshed from the Internet. This will relate to the configuration set for active caching.
Disk Bytes Retrieve Rate (KB/sec) | This counter measures that rate at which "bytes of data" are retrieved from the disk cache. This counter is similar to Disk URL Retrieve Rate, but monitors bytes, rather than URLs.
Disk Cache Allocated Space(KB) | Measures how much space is being used by the disk cache. It will be equal to or less than the amount configured for the disk cache.
Disk Content Write Rate (Writes/Sec) | Measures the number of writes per second to the disk cache for the purpose of writing URL content to the cache disk.
Disk Failure Rate (Fail/Sec) | Measures the number of input/output (I/O) failures per second. An I/O failure occurs when ISA Server fails to read from or write to the disk cache. This counter, together with Total Disk Failures, will give a clear indication of disk cache problems.
Disk URL Retrieve Rate (URL/Sec) | Measures how many URLs are sent to clients from the disk cache in one second. This is a useful counter to measure at peak and offpeak times to check how the disk cache is performing. It can be compared with Memory URL Retrieve Rate to see how cache disk and memory are being utilized.
Max URLs Cached | Measures the maximum number of URLs that have been stored in the cache.
Memory Bytes Retrieved Rate (KB/Sec) | Measures the rate at which bytes of data are retrieved from the memory cache. This counter is similar to Memory URL Retrieve Rate, but monitors bytes, rather than URLs.
Memory Cache Allocated Space (KB) | Measures how much space is being used by the memory cache. It should be equal to or less than the amount configured for the memory cache.
Memory URL Retrieve Rate (URL/Sec) | Measures how many URLs are sent to clients from the memory cache in one second. This is a useful counter to measure at peak and offpeak times, to check how the memory cache is performing and whether available memory allocated for caching purposes is being used efficiently.
Memory Usage Ratio Percent (%) | Shows the ratio between the amount of cache fetches from the memory cache in a percentage and the amount of cache fetches in total. A high percentage may indicate that it is worthwhile allocating more available memory resources to the cache. A low counter may indicate that memory resources may be better used elsewhere.
Total Actively Refreshed URLs | Displays the cumulative number of popular URLs in the cache that have been actively refreshed from the Internet. This counter will give an indication of active caching performance.
Total Bytes Actively Refreshed (KB) | Displays the total number of bytes that have been retrieved from the Internet to actively refresh popular URLs in the cache. This counter will give an indication of active caching performance.
Total Disk Bytes Retrieved (KB) | Measures the cumulative number of disk bytes that have been retrieved from the disk cache. This counter, added to Total Memory Bytes Retrieved (KB), will indicate the total number of bytes retrieved from the cache.
Total Disk Failures | Measures the number of times that the Web Proxy service failed to read from or write to the disk cache due to an input/output (I/O) failure. A low counter will indicate that a disk is performing properly. A high counter will indicate a cache disk that is too small, too slow, or corrupted.
Total Disk URLs Retrieved | Measures the cumulative number of URLs that have been retrieved from the disk cache. This counter, added to Total Memory URLs Retrieved, will indicate the total number of URLs retrieved from the cache.
Total Memory Bytes Retrieved (KB) | Measures the cumulative number of memory bytes that have been retrieved from the memory cache in response to client requests to the cache. A low number might indicate that memory resources dedicated to the cache are not being used efficiently. A high number might indicate that more memory resources should be allocated to the cache.
Total Memory URLs Retrieved | Measures the cumulative number of URLs that have been retrieved from the memory cache in response to client requests to the cache. A low number might indicate that memory resources dedicated to the cache are not being used efficiently. A high number might indicate that more memory resources should be allocated to the cache.
Total URLs Cached | Measures the cumulative number of URLs that have been stored in the cache. If this counter and URLs in Cache is low, it may indicate a problem with the cache. The cache may not be configured for optimal use or the cache size may be too small.
URL Commit Rate (URL/Sec) | Indicates the speed at which URLs are being written to the cache. If rate of this counter is comparable to the rate of Disk Failure Rate(Fail/Sec), it indicates that a high proportion of attempts to write to the cache are failing. This could indicate a problem with cache configuration, a cache disk that is too slow, or a cache size that is too small.
URLs in Cache | Measures the current number of URLs in the cache.


Firewall service performance counters

Performance Counter | Description
Accepting TCP Connections | Number of connection objects that wait for a Transmission Control Protocol (TCP) connection from Firewall clients.
Active Sessions | The number of active sessions for the Firewall service.
Active TCP Connections | The total number of active TCP connections currently passing data. Connections pending or not yet established are counted elsewhere.
Active UDP Connections | Total number of active User Datagram Protocol (UDP) connections.
Available Worker Threads | The number of Firewall worker threads that are available or waiting in the completion port queue.
Back-connecting TCP Connections | Total number of TCP connections awaiting an inbound connect call to complete. These are connections placed by the Firewall service to a client after the Firewall service accepts a connection from the Internet on a listening socket.
Bytes Read/sec | Number of bytes read by the data-pump per second.
Bytes Written/sec | Number of bytes written by the data-pump per second.
Connecting TCP Connections | Total number of TCP connections pending. These are connections awaiting completion between the Firewall service and remote computers.
DNS Cache Entries | The current number of DNS domain name entries cached as a result of Firewall service activity.
DNS Cache Flushes | The total number of times that the DNS domain name cache has been flushed or cleared by the Firewall service.
DNS Cache Hits | The total number of times a DNS domain name was found within the DNS cache by the Firewall service.
DNS Cache Hits % | The percentage of DNS domain names serviced by the DNS cache, from the total of all DNS entries that have been retrieved by the Firewall service.
DNS Retrievals | The total number of DNS domain names that have been retrieved by the Firewall service.
Failed DNS Resolutions Number of
gethostbyname
and
gethostbyaddr
application programming interface (API) calls that have failed. These are calls used to resolve host DNS domain names and IP addresses for Firewall service connections.
Kernel Mode Data Pumps | The number of kernel mode data pumps created by the Firewall service.
Listening TCP Connections | Number of connection objects that wait for TCP connections from remote Internet computers.
Memory Allocation Failures | Number of memory allocation errors.
Non-connected UDP mappings | The number of mappings available for UDP connections.
Pending DNS Resolutions Number of
gethostbyname
and
gethostbyaddr
application programming interface (API) calls pending resolution. These are calls used to resolve host DNS domain names and Internet Protocol (IP) addresses for Firewall service connections.
SecureNAT Mappings | The number of mappings created by secure network address translation (SecureNAT).
Successful DNS Resolutions Number of
gethostbyname
and
gethostbyaddr
API calls successfully returned. These are calls used to resolve host DNS domain names and IP addresses for Firewall service connections.
TCP Bytes Transferred/sec by Kernel Mode Data Pump | The number of TCP bytes transferred by the kernel mode data-pump per second.
UDP Bytes Transferred/sec by Kernel mode Data Pump | The number of UDP bytes transferred by the kernel mode data-pump per second.
Worker Threads | The number of Firewall worker threads that are currently active.


H.323 filter performance counters

The H.323 filter object contains counters for the number of H.323 calls handled by the Microsoft Internet Security and Acceleration (ISA) Server H.323 Filter.

Performance Counter | Description
Active H.323 Calls | The number of H.323 calls that are currently active.
Total H.323 Calls | The total number of H.323 calls handled by the H.323 filter since the ISA Server computer was started


Packet filter performance counters

Performance counter | Description
Packets Dropped Due to Filter Denial | This counter tracks the total number of packets dropped because dynamic packet filtering rejected the data. Dropped packets counted here are any packets which are not covered by Packets Dropped Due to Protocol Violations. In other words, this counter represents packets dropped because of the default "deny-all" policy in ISA Server. The only exception will be where exception filters have been set, explicitly allowing these packets through.
Packets Dropped Due to Protocol Violations | This counter represents the total number of packets dropped as a result of a protocol anomaly. These are packets dropped due to reasons other than the default filtering rules. For example, if you have chosen to implement packet filtering of Internet Protocol (IP) fragments, or you have enabled intrusion detection, packets dropped because of these configuration choices will increment this counter.
Total Dropped Packets | This counter represents the total number of dropped or filtered packets, regardless of why they have been dropped or filtered.
Total Lost Logging Packets | The total number of dropped packets that cannot be logged.


Performance counter overview

Performance data can be viewed in a report or in various graph and log formats. A performance log can be useful in monitoring counters over an extended period of time. Performance alerts can be configured to create an event as a result of counters reaching certain values. These events could include a log entry, sending a network message, or running a program.

When you open ISA Server Performance Monitor, the default counters are already installed. More counters can be added for each performance object within Microsoft Internet Security and Acceleration (ISA) Server. To open ISA Server Performance Monitor, click Start, point to Programs, point to Microsoft ISA Server, then click ISA Server Performance Monitor. For information about using performance monitoring, see Windows 2000 help.

The performance monitoring facility is not available in a remote administration installation.

Default counters

Active Sessions

This ISA Server Firewall service counter counts the number of active sessions for the Firewall service. By comparing this counter at both peak and off-peak times, a good picture of routine ISA Server usage can be built up. Sessions can be viewed in ISA Management.

Active TCP Connections

This ISA Server Firewall service counter counts the total number of active TCP connections.

Active UDP Connections

This ISA Server Firewall service counter counts the total number of active UDP connections.

Cache Hit Ratio (%)

This Web Proxy service counter measures the relationship between two other Web Proxy counters—Total Cache Fetches as a percentage of Total Successful Requests. This counter value, together with the value of Cache Running Hit Ratio, gives a good indication of the effectiveness of the cache. A higher percentage for these counters indicates that a high level of requests are being serviced from the cache, meaning faster response times. A zero counter indicates that caching is not enabled. A low counter may indicate a configuration problem. The cache size may be too small, or requests not cacheable. Web usage reports may also be checked, since user trends may also affect this counter. A scenario where many users access the same sites will mean that cache can be used more efficiently than in a situation where users access many disparate sites.

Cache Running Hit Ratio (%)

This Web Proxy service counter measures the amount of requests served from the cache, as a percentage of total successful requests serviced. This ratio is the same as that measured by another counter, Cache Hit Ratio (%). The difference between these two counters is that Cache Running Hit Ratio(%) measures this ratio for the last 10,000 requests serviced, and Cache Hit Ratio(%) measures this ratio since the last time that the Web Proxy service was started. Effectively, this means that Cache Running Hit Ratio(%) gives a more dynamic evaluation of cache effectiveness.

Client Bytes Total/Sec

This Web Proxy service counter represents the sum of two other counters, Client Bytes Sent/Sec and Client Bytes Received/Sec. This is the total rate for all bytes transferred between the ISA Server computer and Web Proxy clients.

Current Average Milliseconds/Request

This ISA Server Web Proxy service counter displays the average amount of time that it takes ISA Server to process a request; a lower number indicates a faster response. It is useful to compare this counter together with the Requests/Sec counter, at peak and off-peak times. A consistently high value indicates that ISA Server is working at maximum capacity and that requests may be kept waiting. If this is the case, consider adding another server to the configuration.

Current Users

This ISA Server Web Proxy service counter indicates how many clients are currently running the Web Proxy service. Monitoring this counter at both peak and offpeak times will give a good indication of server usage. The configuration setting for maximum Web request connections will influence this value. This counter may also be useful if you need to temporarily stop ISA Server services.

Disk Cache Allocated Space (KB)

This ISA Server cache counter measures how much space is being used by the disk cache. It is equal to or less than the amount configured for the disk cache.

Max URLs Cached

This ISA Server cache counter represents the maximum number of URLs that have been stored in the cache.

Memory Cache Allocated Space (KB)

This ISA Server cache counter measures how much space is being used by the memory cache.

Memory Usage Ratio Percent (%)

This ISA Server cache counter monitors the ratio between the amount of cache fetches from the memory cache and the amount of cache fetches in total. A high percentage may indicate that it is worthwhile allocating more available memory resources to the cache. A low counter may indicate that memory resources may be better used elsewhere.

Requests/Sec

This ISA Server Web Proxy service counter monitors the rate of incoming requests made to the Web Proxy service. A higher value means that more ISA Server resources will be required to service incoming requests. This counter can be compared with another counter, Failing Requests/Sec, to give an idea of how successfully ISA Server is dealing with requests. If Failing Requests/Sec is high in proportion to Requests/sec, this is a good indication that ISA Server is not able to cope with all the requests. This will impact performance, as requests are either serviced more slowly or fail.

SecureNAT Mappings

This Firewall service counter tracks the number of mappings created by secure network address translation (SecureNAT).

Total Dropped Packets

This packet filter counter represents the total number of dropped or filtered packets, regardless of why they have been dropped or filtered.

URL Commit Rate (URL/sec)

An ISA Server cache counter that measures the speed at which URLs are written to the cache. If this rate is comparable to the value of another ISA Server cache counter, Disk failure rate(fail/sec), it indicates that a high proportion of attempts to write to the cache are failing. This could indicate a problem with cache configuration, perhaps a cache disk that is too slow or a cache size that is too small.

URLs in Cache

An ISA Server cache counter that measures the current number of URLs in the cache.

For a complete list of performance counters by ISA Server object, see:

  • Bandwidth control performance counters
  • Cache performance counters
  • Firewall service performance counters
  • H.323 performance counters
  • Packet filter performance counters
  • Web Proxy service performance counters


Web Proxy service performance counters

Performance counter | Description
Array Bytes Received/Sec (Enterprise) | Tracks the rate at which data bytes are received from other ISA Server computers within the same array.
Array Bytes Sent/Sec (Enterprise) | Tracks the rate at which data bytes are sent to other ISA Server computers within the same array.
Array Bytes Total/Sec (Enterprise) | Represents the sum of Array Bytes Sent/Sec and Array Bytes Received/Sec. This is the total rate for all data bytes transferred between the ISA Server computer and other members of the same array.
Cache Hit Ratio % | Determines how many Web Proxy client requests have been served using cached data (Total Cache Fetches), as a percentage of the total number of successful Web Proxy client requests to the ISA Server computer (Total Successful Requests). Its value gives a good indication of the effectiveness of the cache. A high counter will indicate that a high level of requests are being serviced from the cache, meaning faster response times. A zero counter indicates that caching is not enabled. A low counter may indicate a configuration problem. The cache size may be too small, or requests may not be cacheable.
Cache Running Hit Ratio (%) | Measures the amount of requests served from the cache as a percentage of total successful requests serviced. This ratio is the same as that measured by Cache Hit Ratio(%). The difference between these two counters is that Cache Running Hit Ratio measures this ratio for the last 10,000 requests serviced, and Cache Hit Ratio measures this ratio since the last time that the Web Proxy service was started. This means that Cache Running Hit Ratio gives a more dynamic evaluation of cache effectiveness.
Client Bytes Received/sec | Indicates the rate at which data bytes are received from Web Proxy clients. The value will change according to the volume of Web Proxy client requests, but a consistently slow rate may indicate a delay in servicing requests.
Client Bytes Sent/Sec | Measures the rate at which data bytes are sent to Web Proxy clients. The value will change according to the volume of Web Proxy client requests, but a consistently slow rate may indicate a delay in servicing requests.
Client Bytes Total/Sec | Represents the sum of Client Bytes Sent/Sec and Client Bytes Received/Sec. This is the total rate for all bytes transferred between the ISA Server computer and Web Proxy clients.
Current Array Fetches Average (Milliseconds/Request) | Gives the mean number of milliseconds required to service a Web Proxy client request that is fetched through another array member. This does not include requests for services by the Secure Sockets Layer (SSL) tunnel.
Current Average Milliseconds/Request | Represents the mean number of milliseconds required to service a Web Proxy client request, not including requests serviced by the SSL tunnel. This counter can be monitored at peak and off-peak times to get a comprehensive picture of how fast client requests are being serviced. A counter that is too high might indicate that the ISA Server is having difficult in handling all requests and that requests are being delayed.
Current Cache Fetches Average(Milliseconds/Request) | The mean number of milliseconds required to service a Web Proxy client request from cache. This does not include requests for services by the SSL tunnel.
Current Direct Fetches Average (Milliseconds/Request) | The mean number of milliseconds required to service a Web Proxy client request directly to the Web server or upstream proxy. This does not include requests for services by the SSL tunnel.
Current Users | Indicates how many clients are currently running the Web Proxy service. Monitoring this counter at both peak and off-peak times will give a good indication of server usage. The configuration setting for maximum Web request connections will influence this value. This counter may also be useful if you need to temporarily stop ISA Server services.
DNS Cache Entries | Details the current number of DNS domain name entries cached by the Web Proxy service. A high counter suggests a beneficial impact on performance, since a DNS cache entry eliminates the need for a DNS lookup, saving system resources.
DNS Cache Flushes | Details the total number of times that the DNS domain name cache has been flushed or cleared by the Web Proxy service. When there is no room left for more data in the DNS cache, the DNS cache is flushed to allow new entries to be made.
DNS Cache Hits | Tracks the total number of times a DNS domain name was found within the DNS cache by the Web Proxy service. This counter can be compared with previous DNS counters to find out if DNS caching is working efficiently. A low number of DNS cache hits will impact performance, as every DNS lookup will slow performance down, particularly if a problem arises in the lookup process.
DNS Cache Hits % | Determines how many DNS entries have been resolved using cached data (DNS cache hits), as a percentage of the total number of DNS domain names retrieved by the Web Proxy service (DNS retrievals). A high counter means better performance as the DNS data is served from the cache, rather than incurring the overhead of resolving DNS lookups.
DNS Retrievals | Represents the total number of DNS domain names that have been retrieved by the Web Proxy service.
Failing Requests/Sec | Monitors the rate per second that Web Proxy client requests that have completed with some type of error. This counter can be compared with Requests/Sec to give an indication of how well ISA Server is servicing incoming Web requests. A high failure rate, in comparison to the rate of incoming requests, will suggest that ISA Server is having difficulty in coping with all incoming requests. Connection settings for incoming Web requests may be incorrectly configured, or connection bandwidth may be insufficient.
FTP Requests | Tracks the number of File Transfer Protocol (FTP) requests that have been made to the Web Proxy service. A consistently low counter may influence the caching policy for FTP objects.
Gopher Requests | Tracks the number of Gopher requests that have been made to the Web Proxy service.
HTTP Requests | Tracks the number of Hypertext Transfer Protocol (HTTP) requests that have been made to the Web Proxy service.
HTTPS Sessions | Represents the total number of Secure Hypertext Transfer Protocol (HTTPS) secured sessions serviced by the SSL tunnel.
Maximum Users | Tracks the maximum number of users that have connected to the Web Proxy service simultaneously. This counter can be useful for determining load usage and license requirements.
Requests/Sec | Monitors the rate of incoming requests that have been made to the Web Proxy service. A higher value means that more ISA Server resources will be required to service incoming requests.
Reverse Bytes Received/sec | Monitors the rate at which data bytes are received by the Web Proxy service from Web publishing servers in response to incoming requests. This rate can be monitored at peak and off-peak times as an indication of how ISA Server is performing in servicing incoming Web requests.
Reverse Bytes Sent/sec | Monitors the rate at which data bytes are sent by the Web Proxy service to Web publishing servers in response to incoming requests. This rate can be monitored at peak and off-peak times as an indication of how ISA Server is performing in servicing incoming Web requests.
Reverse Bytes Total/sec | Represents the total sum of Reverse Bytes Sent/Sec and Reverse Bytes Received/Sec. This is the total rate for all bytes transferred between the Web Proxy service and Web publishing servers in response to incoming requests.
Site Access Denied | Tracks the total number of Internet sites to which the Web Proxy service has denied access. An excessively high number might indicate a access policy that is too restrictive.
Site Access Granted | Tracks the total number of Internet sites to which the Web Proxy service has granted access. This can be compared with Site Access Denied to give a numeric summary of the results of access policy configuration.
SNEWS Sessions | Represents the total number of SNEWS sessions serviced by the SSL tunnel.
SSL Client Bytes Received/Sec | Measures the rate at which SSL data bytes are received by the Web Proxy service from secured Web Proxy clients. Similar to Client Bytes Recieved/Sec, but counts only SSL requests.
SSL Client Bytes Sent/Sec | Measures the rate at which SSL data bytes are sent by the Web Proxy service to secured Web Proxy clients. Similar to Client Bytes "Sent"/Sec, but counts only SSL requests.
SSL Client Bytes Total/Sec | Represents the sum of SSL Client Bytes Sent/Sec and SSL Client Bytes Received/Sec. This is the total rate for all bytes transferred between the Web Proxy service and SSL clients.
Thread Pool Active Sessions | Represents the number of sessions being actively serviced by thread pool threads.
Thread Pool Failures | Represents the number of requests rejected because the thread pool was full.
Thread Pool Size | Represents the number of threads in the thread pool. This thread pool represents the resources available to service client requests.
Total Array Fetches (Enterprise) | Totals the number of Web Proxy client requests that have been served by requesting the data from another ISA Server within this array. These requests are the result of the Cache Array Routing Protocol (CARP) algorithm, which randomly stores objects in any one of the member servers cache. This counter is influenced by the cache size for each ISA Server in the array, since a server with a larger cache will hold more cache items. The load factor for each server can also be configured, to determine how workload is divided amongst array members.
Total Cache Fetches | Monitors the total number of Web Proxy client requests that have been served by using cached data. A high number will indicate a cache being fully exploited.
Total Failed Requests | Represents the total number of requests that have failed to be processed by the Web Proxy service due to errors. Errors can be the result of the Web Proxy service failing to locate a requested server URL on the Internet or because the client did not have authorized access to the requested URL. This counter should be far lower than Total Successful Requests. If it is not, it is an indication that ISA Server is failing to service requests effectively. This could be a configuration problem, or a connection that is too slow. It could also indicate an access policy that is too restrictive.
Total Pending Connects | The total number of pending connections to the Web Proxy service.
Total Requests | Represents the total number of requests that have been made to the Web Proxy service. It is the total of two other counters, Total Successful Requests and Total Failed Requests.
Total Reverse Fetches | Represents the total number of incoming requests that have been served by requesting the data from Web publishing servers.
Total SSL Sessions | Represents the total number of SSL sessions serviced by the SSL tunnel.
Total Successful Requests | Represents the total number of requests that have been successfully processed by the Web Proxy service. This counter can be compared with Total Requests and Total Failed Requests to indicate the effectiveness of ISA Server in servicing requests.
Total Upstream Fetches | Tracks the total number of requests that have been served by using data from the Internet or from a chained proxy computer. This counter can be compared to Total Cache Fetches to see what proportion of requests are being serviced from remote servers on the Internet or upstream proxies, compared with those being serviced from the cache.
Total Users | Represents the total number of users that have ever connected to the Web Proxy service. It represents a history of past server usage.
Unknown SSL Sessions | Represents the total number of unknown SSL sessions serviced by the SSL tunnel.
Upstream Bytes Received/Sec | Indicates the rate at which data bytes are received by the Web Proxy service from remote servers on the Internet or from a chained proxy computer in response to requests from the Web Proxy service. The value of this counter will depend to some extent on the connection bandwidth. If the counter value is consistently low, it may indicate a bottleneck caused by a slow connection. Changing the bandwidth priority configuration may help in this situation, or a faster connection may be required.
Upstream Bytes Sent/Sec | Indicates the rate at which data bytes are sent by the Web Proxy service to remote servers on the Internet or to a chained proxy computer. The value of this counter will depend to some extent on the connection bandwidth. If the counter value is consistently low, it may indicate a bottleneck caused by a slow connection. Changing the bandwidth priority configuration may help in this situation, or a faster connection may be required.
Upstream Bytes Total/Sec | The sum of Upstream Bytes Sent/Sec and Upstream Bytes Received/Sec. It represents the total rate for all bytes transferred between the Web Proxy service and remote servers on the Internet or a chained proxy server.


Registry keys

Microsoft Internet Security and Acceleration (ISA) Server includes Administration COM objects, which are described in the SDK documentation included on the ISA Server CD-ROM. You can access the ISA Server configuration via a script that includes these COM objects.

You can use ISA Management to configure ISA Server. A few additional configuration options are available only via the Administration COM objects. Some low-level settings, which can help fine-tune performance, can be set only via the registry. After you change these registry settings, you usually have to reset the computer before they take affect.

Caution

  • Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer.

Modifying registry keys for performance tuning

You can modify some registry key settings on the ISA Server to achieve optimal cache performance. The table below lists and describes the registry keys and recommended values.

The Location column indicates the location of the registry key under HKey_Local_Machine\System\CurrentControlSet\Services\

Registry Key | Value (dword) | Description | Location
TZ Persist Interval Threshold | 00000001 | Sets the maximum time interval (in minutes) for which recovery data is inconsistent. This value indicates that at most one minute will be lost when cache is recovered after the w3proxy service stops unexpectedly. | W3Cache\Parameters
Recovery Mru Size Threshold | 00000005 | Sets the time interval (in minutes) which will be recovered first from the time the w3proxy service stops unexpectedly. This value indicates that content cached in the last five minutes (prior to service shutdown) will be recovered first. | W3Cache\Parameters
MaxClientSession | 00002800 | Sets the size of the pool for the Client Session object. This value means that a client session object is freed and its memory returned to system memory management only if the pool has more than 10240 (2800 Hex) objects. Since freeing an object is time consuming, this key is set to a high value, to ensure that objects are freed less frequently. | W3Proxy\Parameters
OutstandAccept | 000003e8 | Sets the number of listeners that are waiting for a connection to be established. This value means that there can be 1000 (3e8 Hex) accepts pending for a connection to be established before rejecting new connection requests. This value was set to a high value, to minimize the number of rejected connection requests. | W3Proxy\Parameters
MaxUserPort | 0000ffff | Sets the maximum number of TCP/IP ports that can be allocated by a client requesting a connection. This value sets the range for client port numbers to maximum. | Tcpip\Parameters
TcpTimedWaitDelay | 3c | Sets the time interval (in seconds) before a given socket can be reused for a new connection. This value was set to obtain 60 seconds. | Tcpip\Parameters
StrictTimeWaitSeqCheck | 1 | This value indicates that a socket should not be reused before the time specified by TcpTimedWaitDelay passes. | Tcpip\Parameters


TITLENAME

The tool that you requested is not available.

To access the tool, try the following:

Configure your computer.

To have access to certain administrative tools, you must be using either a computer running Windows 2000 Server that is configured to be a domain controller, or a client or server computer running Windows 2000 that has been added to a domain and has the Windows 2000 Administration Tools installed.

For more information about configuring a domain controller and installing the Windows 2000 Administration Tools, see Windows 2000 Help. (To open Help, click Start, and then click Help.)

Install the necessary hardware.

Some programs are installed automatically when you install the hardware associated with them. For example, when you install a fax device, Windows 2000 installs Fax. To install new hardware in Windows 2000 click Start, point to Settings, click Control Panel, and then double-click Add/Remove Hardware.

Install the tool.

The tool might not be installed on your computer because:

  • It is a Windows 2000 optional component. To install optional components, click Start, point to Settings, click Control Panel, and then double-click Add/Remove Programs.
  • If your computer is on a network, your system administrator may have removed this program or set a policy that prevents you from starting it.
  • You have installed the Windows 2000 Administration Tools and this tool is one of the optional components that you have not yet added.

Contact your system administrator.

If your computer is on a network, your system administrator may have removed the tool.


TITLENAME

This program could not start

Possible reasons are:

    • It was removed by a system administrator.
    • The system administrator changed the policy associated with the file.
    • The program is not installed on your computer.
    • It was accidentally deleted.
    • The file is corrupt.

If a system administrator controls your machine, you should contact the administrator to find out why you cannot start the program.


TITLENAME

This Help file contains components integrated into Help and is not meant for browsing.

Latest Build: 30 MAR 1999 11:07


About this Help file

This Help file contains topics integrated into the main Microsoft Internet Security and Acceleration Server 2000 Help and is not meant for browsing. For overviews of features and help with specific tasks, click Help.


Event Message: 1

Event ID

1

Event Message

The %1 was unable to load Odbc32.dll for SQL logging due to the following error: %2. The data is the error code. For more information about this event, see ISA Server Help.

Explanation

Open Database Connectivity (ODBC) allows applications to access data in a DBMS (database management system). Odbc32.dll (dynamic-link library file) is required for this process and it could not be located in the current system path.

User Action

Verify the existence of Odbc32.dll in the Windows system directory. The system directory is typically %systemroot%\system32. If the file does not exist, then reinstall ODBC.


Event Message: 2

Event ID

2

Event Message

The %1 was unable to open ODBC Data Source %2, Table: %3, under User Name %4. The ODBC Error is: %5. For more information about this event, see ISA Server Help.

Explanation

Open Database Connectivity (ODBC) allows applications to access data in a database management system (DBMS). It uses a data source to maintain connection information for the database. The ODBC-specified data source could not be opened because it does not exist or because the table and user name information is incorrect.

User Action

Open ISA Management and check the log properties to verify that the ODBC Data Source, Table name, User Name, and Password are correct in the corresponding logging service. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Monitoring Configuration, and then click Logs. Check the property sheet where logging is enabled for this service.


Event Message: 3

Event ID

3

Event Message

The %1 was unable to create the log file directory %2. For more information about this event, see ISA Server Help.

Explanation

The log file folder specifies where log files should be saved. This information may be missing or incorrect.

User Action

Open ISA Management and check the log properties to verify that the ODBC Data Source, Table name, User Name, and Password are correct in the corresponding logging service. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Monitoring Configuration, and then click Logs. Check the property sheet where logging is enabled for this service.


Event Message: 4

Event ID

4

Event Message

The %1 failed to log information. The log object was never created, possibly due to wrong configuration. For more information about this event, see ISA Server Help.

Explanation

The server failed to find correct logging information. This information may be missing or incorrect.

User Action

Open ISA Management and check the log properties to verify that the ODBC Data Source, Table name, User Name, and Password are correct in the corresponding logging service. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Monitoring Configuration, and then click Logs. Check the property sheet where logging is enabled for this service.


Event Message: 5

Event ID

5

Event Message

The %1 failed to log information to file %2 in path %3. The data is the error code. For more information about this event, see ISA Server Help.

Explanation

The server failed to find the correct location for logging information. This information may be missing or incorrect.

User Action

Open ISA Management and check the log properties to verify that file information is correct in the corresponding logging service. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Monitoring Configuration, and then click Logs. Check the property sheet where logging is enabled for this service.


Event Message: 6

Event ID

6

Event Message

The %1 failed to log information to ODBC Data Source %2, Table: %3, under User Name %4. The ODBC Error is: %5. For more information about this event, see ISA Server Help. The data is the error code.

Explanation

Open Database Connectivity (ODBC) allows applications to access data in a database management system (DBMS). It uses a data source to maintain connection information for the database. Information connected with the data source is either missing or incorrect.

User Action

Open ISA Management and check the log properties to verify that the ODBC Data Source, Table name, User Name, and Password are correct in the corresponding logging service. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Monitoring Configuration, and then click Logs. Check the property sheet where logging is enabled for this service.


Event Message: 7

Event ID

7

Event Message

The %1 created the log file directory %2 due to logging configuration changes.


Event Message: 10000

Event ID

10000

Event Message

Name entered is too long. The name entered is either incorrect or has too many characters. Check that the name entered is a valid name. Type the name again and check that no added characters were included.


Event Message: 10001

Event ID

10001

Event Message

System is not ready.


Event Message: 10002

Event ID

10002

Event Message

Current version is not supported. For more information about this event, see ISA Server Help.

Explanation

The application is using a later version of Windows Sockets that is not supported.

User Action

Check to see if you have the WinSock dynamic link library (DLL) that supports the version of the WinSock specification required by the application. If so, check if there is an older DLL in a folder in the path ahead of the folder containing the newer DLL. If not, obtain a later version of Windows Sockets.


Event Message: 10003

Event ID

10003

Event Message

Service cannot send after socket shutdown. For more information about this event, see ISA Server Help.

Explanation

The operation cannot be completed because the connection for this application has been closed.

User Action

Restart the application or place a new connection before retrying the operation.


Event Message: 10004

Event ID

10004

Event Message

An interrupted system call was received. For more information about this event, see ISA Server Help.

Explanation

The current connection was interrupted, and the socket operation did not complete as expected. The problem might be caused by the current application, or caused by a temporary problem or condition on the network.

User Action

Check the network connection for the computer or try reconnecting. If the problem continues, contact your network administrator.


Event Message: 10005

Event ID

10005

Event Message

Host was not found. For more information about this event, see ISA Server Help.

Explanation

The name you have used is not an official hostname or alias. Most WinSock implementations use domain name system (DNS) protocol for hostname to address resolution, although a few use Network Information System (NIS). Assuming you have a name server configured instead of or as well as a host table, a hostname resolution request causes a WinSock DLL to send an address query to the configured DNS server. If you have more than one server configured, the hostname query fails only after the WinSock DLL has queried all servers.

User Action

Check that you have a name server and/or host table configured. If you have a name server, use Ping to check that the server host is available. Check that DNS/NIS is running by trying to resolve another hostname you know should work. If you have using a host table exclusively, add the destination hostname and address to the table.


Event Message: 10006

Event ID

10006

Event Message

Try again. For more information about this event, see ISA Server Help.

Explanation

The server was temporarily unable to process the current request.

User Action

Reenter the request or renew the connection to the server (now or at a later time).


Event Message: 10007

Event ID

10007

Event Message

Nonrecoverable error encountered. For more information about this event, see ISA Server Help.

Explanation

The Firewall service encountered a fatal error. The name server encountered an error. Most WinSock implementations use domain name system (DNS) protocol for hostname to address resolution, although a few use Network Information System (NIS). Assuming you have a name server configured instead of or as well as a host table, a hostname resolution request causes a WinSock DLL to send an address query to the configured DNS server. If you have more than one server configured, the hostname query fails only after the WinSock DLL has queried all servers.

User Action

Try restarting the Firewall application on the client and initiating a new connection. You can also check that you have a name server and/or host table configured. If you have a name server, use Ping to check that the server host is available. Check that DNS/NIS is running by trying to resolve another hostname you know should work. If you have using a host table exclusively, add the destination hostname and address to the table.


Event Message: 10008

Event ID

10008

Event Message

No data record is available. For more information about this event, see ISA Server Help.

Explanation

For host resolution, the requested name is valid, but does not have an Internet IP address at the name server. For protocol or service resolution, the name or number was not found in the respective database. Most WinSock implementations use domain name system (DNS) protocol for hostname to address resolution, although a few use Network Information System (NIS).

User Action

Check that you have a name server(s) and/or host table configured. If you have a name server, use Ping to check that the server hosts are available. Check that the name resolution server application is running by trying to resolve another hostname you know should work. If you are using a host table exclusively, add the destination hostname and address to the table.


Event Message: 10009

Event ID

10009

Event Message

Bad file number encountered. For more information about this event, see ISA Server Help.

Explanation

The specified file number is not a valid file handle value or it does not refer to an open file. An attempt might have been made to write to a file or device opened for read-only access. Or, the socket input parameter is not a valid socket handle: either it never was valid; or it is a file handle (not a socket handle); or, if it was a socket handle, it has been closed.

User Action

If this message was displayed when you tried to open or write to a file, check the permissions on the file or directory that you were trying to open. Otherwise, no user action is required.


Event Message: 10010

Event ID

10010

Event Message

Operation would block. For more information about this event, see ISA Server Help.

Explanation

The socket is marked as nonblocking (that is, nonblocking operation mode), and the requested operation is not complete at this time. This is a temporary condition. Later calls to the same routine might complete normally.

User Action

Try the operation again later.


Event Message: 10011

Event ID

10011

Event Message

Operation is in progress. For more information about this event, see ISA Server Help.

Explanation

A blocking operation is outstanding. Only a single blocking operation can be outstanding per task (or thread). Any other function call, to this or any other socket, will fail with this error.

User Action

Handle this as a non-fatal error.


Event Message: 10012

Event ID

10012

Event Message

Operation is already in progress. For more information about this event, see ISA Server Help.

Explanation

The asynchronous operation you attempted to cancel has already been canceled.

User Action

None.


Event Message: 10013

Event ID

10013

Event Message

Bad network address encountered. For more information about this event, see ISA Server Help.

Explanation

The system detected an invalid address used as an argument of a call. This error can occur if the length of the buffer is too small. This error can also occur when an application passes an invalid pointer value.

User Action

For developers, check the return value from a memory allocation to be sure it succeeded. Always be sure to allocate enough space.


Event Message: 10014

Event ID

10014

Event Message

Destination address required. For more information about this event, see ISA Server Help.

Explanation

A required address was omitted from an operation on a socket. In order to connect to or send to a destination address, the address must be provided.

User Action

If a destination hostname was entered the application might have had a problem resolving the name. Check that you have a name server(s) and/or host table configured. If you are using a name server, use Ping to check that the server host(s) are available. Check that the name resolution server application is running by trying to resolve another hostname you know should work. If you are using a host table exclusively, add the destination hostname and address to the table.


Event Message: 10015

Event ID

10015

Event Message

Message is too long. For more information about this event, see ISA Server Help.

Explanation

A message sent on a socket was larger than the internal message buffer or some other network limit. Since the buffering requirements for sending datagrams are less than for receiving datagrams, it is conceivable that you can send a datagram larger than you can receive.

User Action

None


Event Message: 10016

Event ID

10016

Event Message

Protocol family not supported. For more information about this event, see ISA Server Help.

Explanation

The protocol family has not been configured on the system or no implementation for it exists.

User Action

If you are using a third-party Transmission Control Protocol/Internet Protocol (TCP/IP), verify that it is compatible with Wsock32.dll. If you are using Microsoft TCP/IP, remove and reinstall TCP/IP. Or use another protocol that is compatible with Wsock32.dll.


Event Message: 10017

Event ID

10017

Event Message

Directory is not empty. For more information about this event, see ISA Server Help.

Explanation

The directory cannot be removed. It still contains other files or subdirectories.

User Action

Move or delete the other files or subdirectories and try the operation again.


Event Message: 10018

Event ID

10018

Event Message

EPROCLIM returned. A software error occurred. Too many processes are running simultaneously. Quit and restart the current application.


Event Message: 10019

Event ID

10019

Event Message

EUSERS returned. For more information about this event, see ISA Server Help.

Explanation

Inbound and outbound packets that include a Fully Qualified Domain Name longer than 255 characters cannot be processed by Windows 2000 Server. Such packets usually remain in the queue until the queue is flushed. Also, directory paths and file names cannot exceed 255 characters.

User Action

Verify that domain names do not exceed 255 characters. For example, if you are running Gopher, the domain name for e-mail addresses should be less than 255 characters. Also, verify that all directory paths and file names are less than 255 characters.


Event Message: 10020

Event ID

10020

Event Message

Disk quota exceeded. The operation required additional disk space that is not authorized by the server. Cancel the current disk operation and change file share permissions to allow more space for the current user.


Event Message: 10021

Event ID

10021

Event Message

ESTALE returned. An unexplained service error occurred in the current environment. Quit the application and restart it.


Event Message: 10022

Event ID

10022

Event Message

Invalid argument. For more information about this event, see ISA Server Help.

Explanation

An application passed an invalid input parameter in a function call. The error refers to content as well as a value (for example, it might occur when a pointer to a structure is invalid or when a value in a structure field is invalid). In some instances, it also refers to the current state of the socket input parameter.

User Action

Contact the vendor of the application that issued this message. A software patch might be available.


Event Message: 10023

Event ID

10023

Event Message

Too many open files. For more information about this event, see ISA Server Help.

Explanation

The network system has run out of socket handles. You might have too many WinSock applications running simultaneously, but this is unlikely because most network systems have many socket handles available. This message can also occur if an application opens and closes sockets often without closing them properly (that is, leaving them open as "orphans").

User Action

To recover the orphaned sockets, close and restart the application. You might have to quit all WinSock applications to force the WinSock DLL to unload.


Event Message: 10024

Event ID

10024

Event Message

Too many levels of symbolic links. A software error occurred. Contact the supplier of the current application.


Event Message: 10025

Event ID

10025

Event Message

The object is remote


Event Message: 10026

Event ID

10026

Event Message

Socket operation was attempted on non-socket. For more information about this event, see ISA Server Help.

Explanation

The socket input parameter is not a valid socket handle. Either it was never valid; or it is a file handle (not a socket handle). If it is a socket handle, it has been closed.

User Action

For developers, use socket state in an application or handle this error as a non-fatal error.


Event Message: 10027

Event ID

10027

Event Message

Bad or unassigned address. For more information about this event, see ISA Server Help.

Explanation

The network address used for the remote server is invalid for the current network. An attempt was made to create a socket with a remote socket name (protocol, port and address).

User Action

Before retrying, verify that the address is typed correctly and that you can reach the remote network address from the local network.


Event Message: 10028

Event ID

10028

Event Message

Address is already in use. For more information about this event, see ISA Server Help.

Explanation

The requested address cannot be obtained because it is in use elsewhere on the network. Only one usage of each address is permitted. The "address" refers to the local "socket name", which is comprised of the following three elements: protocol, port-number, and IP address.

User Action

Verify that network address settings for the client are correct for the local network. Do not run two server applications of the same type on the same computer. For instance, this error occurs if you try to run two applications that connect to one FTP server. Check that the network address setting for the client is correct on the local machine and assign a different fixed network address to the client. Contact your network administrator to resolve problems of address duplication.


Event Message: 10029

Event ID

10029

Event Message

Address family is not supported by protocol family. For more information about this event, see ISA Server Help.

Explanation

An address incompatible with the requested protocol was used. For example, you might not be able to use NS addresses with ARPA Internet protocols.

User Action

Check that the address is in the correct format and has been typed correctly before retrying the operation. If the problem continues, contact the network administrator.


Event Message: 10030

Event ID

10030

Event Message

Socket type is not supported. For more information about this event, see ISA Server Help.

Explanation

The support for the socket type has not been configured on the system or no implementation for it exists.

User Action

Check that the correct transport protocol (for example, Transmission Control Protocol (TCP), User Datagram Protocol (UDP)) is selected for use with the current application and with the Firewall service. For developers, handle the request as a non-fatal error (if possible), since some WinSock calls can legally fail the request.


Event Message: 10031

Event ID

10031

Event Message

Protocol is not supported. For more information about this event, see ISA Server Help.

Explanation

The protocol selected for use with the current application is not supported for the Firewall service or has not been defined for this service. An incompatible protocol has been selected for establishing the connection.

User Action

Check that the protocol is defined for use with the Firewall service. Try again, using a different protocol. If you are using a third-party Transmission Control Protocol/Internet Protocol (TCP/IP), verify that it is compatible with Wsock32.dll. If you are using Microsoft TCP/IP, remove and reinstall TCP/IP. Or use another protocol that is compatible with Wsock32.dll. For developers, if you are trying to use an optional feature, handle the request as a non-fatal error (if possible), since some WinSock calls can legally fail the request.


Event Message: 10032

Event ID

10032

Event Message

No buffer space is supported. The WinSock implementation was unable to allocate additional memory to accommodate the function request. For more information about this event, see ISA Server Help.

Explanation

This error indicates a shortage of resources on your system. It can occur when you try to run too many applications simultaneously on your computer. An operation on a socket or pipe was not performed because the system lacked sufficient buffer space to buffer connection throughput or a queue was full. WinSock was unable to allocate additional memory to accommodate the function request. If this error tends to occur when you run certain applications, it might indicate that the applications do not properly return system resources (for example, memory). It might also indicate that you are not closing the applications correctly.

User Action

Close unnecessary applications. If you continue to get this message, close Windows 2000 and restart your computer. Also, verify that buffer space is adjusted for the server. For the Firewall service, check the server registry entries for User Datagram Protocol (UDP) or Transmission Control Protocol (TCP) buffer size and consider increasing these values.


Event Message: 10033

Event ID

10033

Event Message

Connection timed out. For more information about this event, see ISA Server Help.

Explanation

A connection cannot be placed between the client and the remote server within the preset time allowed for a response. (The time-out period is dependent on the communication protocol.) No connection was opened.

User Action

Verify that the remote server and the client are present on the network and configured properly. If the current client or application supports adjusted time-out values, you can also adjust the connection time-out interval. Check that the destination address is a valid IP address. If you used a hostname, check that it resolved to the correct address. If the hostname resolution uses a local host table, it is possible you resolved to an obsolete address. Try to ping the hostname. If a router is configured, check that the router is up and running (check by pinging it, and then ping an address on the other side of it). Use the tracert command at the command prompt to determine the path to the destination address and to check that all the routers are functioning. Check your subnet mask. If you don't have the correct subnet mask, your network system might treat a local address as a remote address (so it forwards addresses on the local subnet to the router, rather than broadcasting an ARP request locally), or vice versa.


Event Message: 10034

Event ID

10034

Event Message

Socket is already connected. For more information about this event, see ISA Server Help.

Explanation

A connect request was made on an already connected socket.

User Action

Contact the vendor of the application. They might have a software patch to fix the problem.


Event Message: 10035

Event ID

10035

Event Message

Socket is not connected. For more information about this event, see ISA Server Help.

Explanation

A request to send or receive data was disallowed because the socket is not connected and (when sending on a datagram socket) no address was supplied. An application attempted an input/output network function call before establishing an association with a remote socket (i.e. before calling connect() or accept().)

User Action

Open a connection to the remote source using the current application. If you were previously connected, try reconnecting. Ping the remote host you were connected to. If it does not respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again). In addition, ping a local host to verify that your local network is still functioning. For a serial connection, ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP. In addition, ping a host on the same subnet as the host you were connected to (if you know of one). This will verify that the destination network is functioning. Use the tracert command at the command prompt to determine the path to the host you were connected to. This will not reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way.


Event Message: 10036

Event ID

10036

Event Message

Unsupported protocol option used. For more information about this event, see ISA Server Help.

Explanation

The application selected an unsupported protocol for this operation. Check the protocol settings.

User Action

For developers, check the parameters. Are you using an optional level or socket option that might not be supported on all WinSock implementations? If so, treat this as a non-fatal error and ignore it, if possible.


Event Message: 10037

Event ID

10037

Event Message

Connection reset by peer. For more information about this event, see ISA Server Help.

Explanation

A connection was forcibly closed by a peer. This normally results from a loss of the connection on the remote socket due to a time-out or a reboot. This error is also possible on a datagram socket. For instance, this error could result if your application sends a UDP datagram to a host, which rejects it by responding with an ICMP Port Unreachable.

User Action

You can attempt to reestablish the connection. Report the problem to your network administrator or check the connection logs for other servers on the network for more information. In addition you can ping the remote host you were connected to. If it does not respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again). You can also ping a local host to verify that your local network is still functioning. For a serial connection, ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP. In addition, ping a host on the same subnet as the host you were connected to (if you know of one). This will verify that the destination network is functioning. 5. Use the tracert command at the command prompt to determine the path to the host you were connected to. This will not reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way.


Event Message: 10038

Event ID

10038

Event Message

Software caused connection to abort. For more information about this event, see ISA Server Help.

Explanation

This error can occur when the local network system aborts a connection, such as when WinSock closes an established connection after data retransmission fails (receiver never acknowledges data sent on a datastream socket).

User Action

Exit the application, restart and try to reconnect. You can also check the following: 1. Ping the remote host you were connected to. If it does not respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again). 2. Ping a local host to verify that your local network is still functioning (if on a serial connection, see next step) 3. Ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP.4. Ping a host on the same subnet as the host you were connected to (if you know of one). This will verify that the destination network is functioning.5. Use the tracert command at the command prompt to determine the path to the host you were connected to. This won't reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way.


Event Message: 10039

Event ID

10039

Event Message

Network is down. For more information about this event, see ISA Server Help.

Explanation

There are problems maintaining a connection to the local network. The current connection has failed because a socket operation encountered an unavailable network.

User Action

Check the client network connection or reconnect the client to the network. You can also check your WinSock, protocol stack, network driver, and network adapter configuration. If this message appears when you try to connect from other clients, check for problems in network cabling or termination, and verify that network hardware or software is not offline. Note that this error occurs rarely since a WinSock implementation cannot reliably detect hardware problems.


Event Message: 10040

Event ID

10040

Event Message

Network was reset. For more information about this event, see ISA Server Help.

Explanation

The host you were connected to crashed and rebooted or the network temporarily went down.

User Action

Check the following: 1. Ping the remote host you were connected to. If it does not respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again). 2. Ping a local host to verify that your local network is still functioning (if on a serial connection, see next step). 3. Ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP. 4. Ping a host on the same subnet as the host you were onnected to (if you know of one). This will verify that the destination network is functioning. 5. Use the tracert command at the command prompt to determine the path to the host you were connected to. This won't reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way.


Event Message: 10041

Event ID

10041

Event Message

Connection refused. For more information about this event, see ISA Server Help.

Explanation

No connection could be made because the target computer actively refused it. This usually results from trying to connect to a service that is inactive on the foreign host. You might have gone to the wrong host, or the server application you are trying to contact might not be running. In TCP, an attempt to connect (TCP SYN packet) caused the destination host to respond by returning a reset (TCP RST packet). If an application sends a UDP packet to a host that has no socket listening, the host may send by a ICMP Port Unreachable packet.

User Action

Check the destination address you are using. If you used a hostname, verify that it was resolved to the correct address. If your hostname resolution uses a local host table, it is possible the name was resolved to an obsolete address. It is also possible that the local services file has an incorrect port number (although this is unlikely). You can run netstat -a at the command line to check port configuration. You can verify that the remote computer is rejecting your connection attempt by checking the network statistics locally and to verify that you are receiving TCP resets or ICMP Port Unreachable packets each time you attempt to connect.


Event Message: 10042

Event ID

10042

Event Message

Host is down. For more information about this event, see ISA Server Help.

Explanation

The socket operation failed because the destination host was down.

User Action

Contact your network administrator to confirm the status of the remote host. Check the following: 1. Ping the remote host you were connected to. If it does not respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again). 2. Ping a local host to verify that your local network is still functioning (if on a serial connection, see next step). 3. Ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP. 4. Ping a host on the same subnet as the host you were connected to (if you know of one). This will verify that the destination network is functioning. 5. Use the tracert command at the command prompt to determine the path to the host you were connected to. This won't reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way.


Event Message: 10043

Event ID

10043

Event Message

Host is unreachable. For more information about this event, see ISA Server Help.

Explanation

The remote host cannot be reached at this time or has been shut down. A socket operation was attempted on an unreachable target host. The ICMP message means that the router cannot forward the IP datagram to the target host, possibly because it did not get a response to the ARP request (which might mean the destination host is down).

User Action

Try to ping the destination host, to see if you get the same results, which is likely. Check the destination address. Check whether you have a router configured in your network system (your WinSock implementation). Use the tracert command at the command prompt to try to determine where the failure occurs along the route between your host and the destination host. You can also contact your network administrator to confirm the status of the remote host.


Event Message: 10044

Event ID

10044

Event Message

Protocol is the wrong type for socket. For more information about this event, see ISA Server Help.

Explanation

The application requires a socket call that is not supported by the current protocol settings for the client application. For example, you cannot use the ARPA Internet UDP protocol with the SOCK_STREAM socket type. This error occurs if you specifically reference a protocol that is not part of the Internet address family you are also referencing. An incompatible protocol has been selected for the socket. The device driver for the protocol stack might not be compatible with Wsock32.dll.

User Action

Check the current configuration for the protocol type in use for the remote connection and check the Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) configuration for the Firewall service. Also, if you are using a third-party Transmission Control Protocol/Internet Protocol (TCP/IP), verify that it is compatible with Wsock32.dll. If you are using Microsoft TCP/IP, remove and reinstall TCP/IP.


Event Message: 10045

Event ID

10045

Event Message

Operation is not supported on socket. For more information about this event, see ISA Server Help.

Explanation

The attempted operation was not supported for the type of object referenced. Usually this occurs when a file descriptor refers to a file or socket that cannot support this operation, for example, trying to accept a connection on a datagram socket. Or the device driver for the protocol stack might not be compatible with Wsock32.dll.

User Action

You can contact your network administrator to confirm the status of the remote host. If you are using a third-party Transmission Control Protocol/Internet Protocol (TCP/IP), verify that it is compatible with Wsock32.dll. If you are using Microsoft TCP/IP, remove and reinstall TCP/IP. Or use another protocol that is compatible with Wsock32.dll.


Event Message: 10046

Event ID

10046

Event Message

Internet Control Message Protocol (ICMP) network is unreachable. For more information about this event, see ISA Server Help.

Explanation

The local network system might generate this error if there is no default route configured. Typically though, WinSock generates this error when it receives a "host unreachable" Internet Control Message Protocol (ICMP) message from a router. Note: This error might also result if you are trying to send a multicast packet and the default gateway does not support multicast (check your interface configuration).

User Action

Investigate routers on local or remote networks to see that they are active and properly configured. Contact your network administrator to confirm the status of the remote host. Try to ping the destination host, to see if you get the same results, which is likely. Check the destination address. Check whether you have a router configured in your network system (your WinSock implementation). Use the tracert command at the command prompt to try to determine where the failure occurs along the route between your host and the destination host.


Event Message: 10047

Event ID

10047

Event Message

Too many references used. The requested operation contained additional information that cannot be processed correctly through the remote connection. Retry the request, or contact the supplier for the current application.


Event Message: 10048

Event ID

10048

Event Message

Not owner. You do not have permission or ownership rights to access this remote shared resource. Ask the network administrator to check permissions.


Event Message: 10049

Event ID

10049

Event Message

No such file or directory exists. The requested file operation cannot be completed because the file or directory does not exist on the remote server. Check file or directory settings.


Event Message: 10050

Event ID

10050

Event Message

No such process exists. The requested operation is not recognized by the remote server. The operation might be the result of errors in data or invalid user input. Try the operation again.


Event Message: 10051

Event ID

10051

Event Message

System call interrupted. For more information about this event, see ISA Server Help.

Explanation

The current connection was interrupted, and the socket operation did not complete as expected. The problem might be with the current application, or a temporary problem or condition on the network.

User Action

Check the network connection for the computer or try to reconnect. If the problem continues, contact the network administrator to confirm the status of the remote host. For developers, be prepared to handle this error on any functions that reference blocking sockets, or any calls to blocking functions, if you allow the user to cancel a blocking call. You can handle it as a fatal error or non-fatal error, depending on the application and the context.


Event Message: 10052

Event ID

10052

Event Message

Input/Output (I/O) Error encountered. The problem might be caused by instability in the local system environment. Quit the application and restart the computer. Try the operation again.


Event Message: 10053

Event ID

10053

Event Message

No such device or address exists. For more information about this event, see ISA Server Help.

Explanation

The device or address cannot be located on the network.

User Action

Verify that the device name and address were entered correctly and that the device is operational. Verify that the address can reply to test utilities (for example, Ping) and is active on the network.


Event Message: 10054

Event ID

10054

Event Message

Argument list too long. The requested operation contained additional information or parameters that cannot be processed correctly through the current connection. Retry the request.


Event Message: 10055

Event ID

10055

Event Message

Executed format error. A software error has occurred. Retry the operation.


Event Message: 10056

Event ID

10056

Event Message

Bad file number encountered. For more information about this event, see ISA Server Help.

Explanation

The specified file number might not be a valid file handle value or it does not refer to an open file. An attempt might have been made to write to a file or device opened for read-only access. Or, the socket input parameter is not a valid socket handle: either it never was valid or it is a file handle (that is, not a socket handle). If it is a socket handle, it has been closed.

User Action

If this message was displayed when you tried to open or write to a file, check the permissions on the file or directory that you were trying to open. Otherwise, no user action is required.


Event Message: 10057

Event ID

10057

Event Message

No children exist for parent object


Event Message: 10058

Event ID

10058

Event Message

Operation would block one in progress. For more information about this event, see ISA Server Help.

Explanation

The requested operation would prevent an operation already in progress from completing. WinSock only allows a single blocking operation to be outstanding per task (or thread). It means that there is a blocking operation outstanding. It is also possible that WinSock might return this error after an application calls connect() a second time on a non-blocking socket while the connection is pending.

User Action

Wait for the system to complete the processing of the current operation, or cancel the current operation before retrying. If this does not work, then contact the vendor of the application that issued this message. They might have a software patch to fix this problem. For developers, handle this as a non-fatal error. Any application that uses a blocking socket or calls any blocking functions must handle this error.


Event Message: 10059

Event ID

10059

Event Message

Not enough memory is available. For more information about this event, see ISA Server Help.

Explanation

There is a shortage of memory resources.

User Action

Close other applications that are not in use before retrying. In Task Manager, identify applications that are consuming memory resources. For more information about managing memory resources, see Windows 2000 Help.


Event Message: 10060

Event ID

10060

Event Message

Permission denied. The remote server refused access to the requested resource. Contact the administrator for the remote server and report the problem.


Event Message: 10061

Event ID

10061

Event Message

Bad address encountered. For more information about this event, see ISA Server Help.


Event Message: 10062

Event ID

10062

Event Message

Mount device or directory is busy. The remote server drive is unavailable or is out of space. Wait and retry the requested operation.


Event Message: 10063

Event ID

10063

Event Message

File already exists. The attempt to create or save a file on the remote server cannot be completed because a file of the same name already exists. Save the new file under a different name, or rename the old file.


Event Message: 10064

Event ID

10064

Event Message

A cross-device link exists. A device on the remote server system that is required for this operation cannot be accessed for the current connection. Confirm that the device is available and is not already in use by other connected sessions.


Event Message: 10065

Event ID

10065

Event Message

No such device exists. The device or address entered cannot be located on the network. Make sure that the device name or address has been entered correctly and that the device is operational and configured properly on the client computer.


Event Message: 10066

Event ID

10066

Event Message

Is not a directory. A file object has been selected for the current operation where a directory was expected. Select a directory to complete this operation, or cancel the operation.


Event Message: 10067

Event ID

10067

Event Message

Is a directory. A directory object has been selected for the current operation where a file was expected. Select a file to complete this operation, or cancel the operation.


Event Message: 10068

Event ID

10068

Event Message

Invalid argument used. For more information about this event, see ISA Server Help.

Explanation

The requested operation contained additional information or parameters that cannot be processed correctly through the current connection. An application passed an invalid input parameter in a function call. The error refers to content as well as a value (e.g. it might occur when a pointer to a structure is invalid or when a value in a structure field is invalid). In some instances, it also refers to the current state of the socket input parameter.

User Action

Retry the request. If this does not solve the problem then contact the vendor of the application that issued this message. The vendor might have a software patch to fix this problem.


Event Message: 10069

Event ID

10069

Event Message

File table has overflowed. For more information about this event, see ISA Server Help.

Explanation

The current operation has exceeded available disk capacity or other resources on the system.

User Action

Clear the message and verify that sufficient disk space and resources are available on the local system before retrying.


Event Message: 10070

Event ID

10070

Event Message

Too many files are open. For more information about this event, see ISA Server Help.

Explanation

The system defines the number of file descriptors that any process can open at one time. That number has been reached and no more files can be opened. You might have too many WinSock applications running simultaneously, but this is unlikely because most network systems have many socket handles available. This message can also occur if an application opens and closes sockets often without closing them properly (that is, leaving them open as "orphans").

User Action

To recover the orphaned sockets, close and restart the application. You might have to quit all WinSock applications to force the WinSock DLL to unload.


Event Message: 10071

Event ID

10071

Event Message

Is not a typewriter. The current configuration does not support the attempted method of input. Check application instructions or contact the supplier of the application and report the problem.


Event Message: 10072

Event ID

10072

Event Message

File is too large. A disk restriction did not permit the file operation to be completed. A disk quota might be set for the destination folder, or there is a lack of available space on the targeted drive. Verify that sufficient space is available on the drive and that the folder does not have disk space restrictions.


Event Message: 10073

Event ID

10073

Event Message

No space is left on device. There is a lack of available space on the destination drive. The file copy operation cannot be completed, possibly because a disk quota has been set for the destination folder path. Make sure that the amount of disk space is sufficient on the destination drive and the folder does not have disk-space restrictions.


Event Message: 10074

Event ID

10074

Event Message

Illegal seek performed. There is an error in shared file permissions or possible errors in the file table. Verify that permissions are set. If the problem continues, verify the integrity of the disk by using appropriate utilities for the disk operating system that is in use.


Event Message: 10075

Event ID

10075

Event Message

Read-only file system in use. For more information about this event, see ISA Server Help.

Explanation

The file system that is selected for a file copy or transfer operation does not allow write modification. Permissions might be in effect to prohibit write access, or the drive media might be of a type that does not permit write access.

User Action

Verify that the drive is using a media type that supports write access, and that write permissions are assigned and in effect.


Event Message: 10076

Event ID

10076

Event Message

Too many links used. You have reached the maximum number of links that can be opened. Close other connections or applications and retry the operation. If the problem continues, report it to the application supplier.


Event Message: 10077

Event ID

10077

Event Message

Pipe has broken. The current operation was suspended because the data or connection is experiencing a failing network connection or errors on the network. Reconnect to the remote source. If the problem continues, check for further errors on the network or excessive traffic on the network segment.


Event Message: 10078

Event ID

10078

Event Message

Math argument used. The input for the current operation was of an invalid type or unexpected for the current application, possibly because of an error in the data or software-based restrictions. Enter the data again. If the problem continues, report the problem to the application supplier.


Event Message: 10079

Event ID

10079

Event Message

Result is too large. The output for the current operation was invalid for the system or application, possibly because of an error in the data or because of software-based restrictions. Enter the data again. If the problem continues, report the problem to the application supplier.


Event Message: 10080

Event ID

10080

Event Message

A resource deadlock would occur. The requested operation cannot be completed because sufficient resources do not exist or are not available on the local system. Close other applications to free resources or restart the system. If the problem continues, check your computer configuration.


Event Message: 10081

Event ID

10081

Event Message

No message of desired type exists. A message cannot be located, or the current application does not support messages of this type. Verify that the message exists at the expected source location. If a message exists, report the problem to the application supplier or see the application's documentation.


Event Message: 10082

Event ID

10082

Event Message

Identifier removed. For more information about this event, see ISA Server Help.

Explanation

Some identifying information for the connecting socket is missing or was parsed in communications transfer or operation. The cause might be a software problem or an intermediate device used to service the connection.

User Action

Retry the operation. If the problem continues, contact the application supplier to report the problem and obtain an updated file or workaround. Also, when troubleshooting the network, check for invalid packet errors. If unusual numbers of errors are occurring, interference on cabling or data lines could be causing the problem.


Event Message: 10083

Event ID

10083

Event Message

Channel number is out of range. A port or protocol error has occurred in the application or network environment. Check that all service ports are defined correctly for the application and the Firewall service. If the problem continues, contact the application supplier to report the problem and obtain an updated file or workaround.


Event Message: 10084

Event ID

10084

Event Message

Level 2 is not synchronized. There is a data line problem for the currently connected operation, possibly because of noise or interference on the line. Check for performance problems or further errors on the line. For further assistance in resolving the problem, report the line problem to your appropriate service provider.


Event Message: 10085

Event ID

10085

Event Message

Level 3 halted. The network has been stopped. The current connection probably failed. Check the client network connection or have the client reconnect to the network. If the message is repeated for other clients, check for problems in network cabling or termination. Or, check that network hardware or software has not been stopped.


Event Message: 10086

Event ID

10086

Event Message

Level 3 reset. The network has been reset, probably because an intermediate network host servicing the current connection (for example, a router) was reset. The current connection has failed. Reestablish the remote connection. If the problem continues, check for errors or excess traffic on the network.


Event Message: 10087

Event ID

10087

Event Message

Link number is out of range. The number specified for linking is invalid. The link is broken. Attempt to re-create the link by using the options within the application. If the problem continues, contact the application supplier to report the problem and obtain an updated file or workaround.


Event Message: 10088

Event ID

10088

Event Message

Protocol driver is not attached. There is no driver for a supported protocol bound to the network adapter on the local computer. Check the network configuration for the local computer. Verify that a supported network protocol for the Firewall service is bound to the network adapter.


Event Message: 10089

Event ID

10089

Event Message

No CSI structure is available. A required, specialized component is missing. The operation cannot be completed within the active application. For further assistance in resolving the problem, contact the application supplier to report the problem and obtain an updated file or workaround.


Event Message: 10090

Event ID

10090

Event Message

Level 2 halted. A problem has occurred at the data-link level, or the link connection has been cleared. Check for errors logged for data link or data communications hardware devices. For further assistance in resolving the problem, report the line to the appropriate service provider.


Event Message: 10091

Event ID

10091

Event Message

An invalid exchange was made. There is an error in the data, or an exchange between the remote server and the client has been attempted that is not allowed within the software. Reenter the data and retry the operation. If the problem continues, contact the supplier of the current application to report the problem and obtain a fix or workaround.


Event Message: 10092

Event ID

10092

Event Message

Invalid request descriptor used. There is an error in the data, or an exchange between the remote server and the client has been attempted that is not allowed within the software. Reenter the data and retry the operation. If the problem continues, contact the supplier of the current application to report the problem and obtain a fix or workaround for the problem.


Event Message: 10093

Event ID

10093

Event Message

Exchange is full. There is an error in the data, or an exchange between the remote server and the client has been attempted that cannot be completed. The system might be too busy to process the request at this time. Retry the operation later. If the problem continues, contact the application supplier to report the problem and obtain an updated file or workaround.


Event Message: 10094

Event ID

10094

Event Message

No anode exists. There is an error in the data or an exchange between the remote server and the client has been attempted that is not allowed within the software. Reenter the data and retry the operation. If the problem continues, contact the application supplier to report the problem and obtain an updated file or workaround.


Event Message: 10095

Event ID

10095

Event Message

Invalid request code used. For more information about this event, see ISA Server Help.

Explanation

The requested operation is not recognized or supported by protocol services that are in use between the remote server and the client.

User Action

Confirm that the protocol and port types are correctly configured for the Firewall service and for use with the current application. Specifically, verify that any port types (that is, User Datagram Protocol (UDP) or Transmission Control Protocol (TCP)), port initial direction (that is, inbound or outbound), and port numbers in use for the connection. If the problem cannot be traced to port settings or if the problem continues, report the problem to the application supplier.


Event Message: 10096

Event ID

10096

Event Message

Invalid slot used. A configuration error in hardware settings has been applied by the current operation. Review the settings used for hardware device access or communication within the application to ensure that the settings are correct.


Event Message: 10097

Event ID

10097

Event Message

Bad font file format used. A font file is of incorrect format or is outdated. To report the problem and obtain an updated file or workaround, contact the application supplier to report the problem and obtain an updated file or workaround.


Event Message: 10098

Event ID

10098

Event Message

Device is not a stream. There is an error in the data, or an exchange between the remote server and the client has been attempted that is not allowed within the software. Reenter the data and try the operation again. If the problem continues, contact the application supplier to report the problem and obtain an updated file or workaround.


Event Message: 10099

Event ID

10099

Event Message

No data was found. No data was received to complete the current operation. Enter the data again and retry the operation. If the problem continues, verify that the connection to the network is still active.


Event Message: 10100

Event ID

10100

Event Message

Timer has expired


Event Message: 10101

Event ID

10101

Event Message

System is out of streams resources. Insufficient streams buffers are available, or a buffer overrun has occurred. Increase the buffer count for streaming protocol (that is, Transmission Control Protocol (TCP)) or modify the connection rate.


Event Message: 10102

Event ID

10102

Event Message

Machine is not on network. The local computer is not connected to the network. Connection to the network must be made before the request can be processed.


Event Message: 10103

Event ID

10103

Event Message

Package is not installed. The requested application feature is not currently installed. Reinstall the application or upgrade to install the missing application feature. For more information, see the application documentation.


Event Message: 10104

Event ID

10104

Event Message

The object is remote. For more information about this event, see ISA Server Help.

Explanation

The selected object cannot be used for the current operation because it is not locally sourced. The attempt to operate on the remote object was not completed.

User Action

1. Check that the WinSock DLL (WinSock.dll or Wsock32.dll) is in the current path. 2. Check that the WinSock DLL file is from the same vendor as your underlying protocol stack. (WinSock DLL files must be supplied by the vendor who provided your underlying protocol stack). 3. You cannot use more than one WinSock implementation simultaneously. If you have more than one WinSock DLL file on your system, be sure the first one in the path is appropriate for the network subsystem currently loaded. 4. Check your WinSock implementation documentation to be sure all necessary components are currently installed and configured correctly.


Event Message: 10105

Event ID

10105

Event Message

The link has been severed. The current connection has been broken. Quit the application and check for other related communications hardware and software failures on the local computer. Restart the application and try to connect again. If the problem continues, check for other failures on the network or verify that the remote server has not been shut down or removed from the network.


Event Message: 10106

Event ID

10106

Event Message

Advertise error occurred. For more information about this event, see ISA Server Help.

Explanation

A network shared resource cannot advertise service on the local network. Possibly, network or routing problems, or packet filtering is being applied.

User Action

Verify that the network is online. Also, verify that any required routing advertising protocols, such as Routing Information Protocol (RIP) or Service Advertising Protocol (SAP), are implemented properly on the network and that the current application requires these routing services. Use other utilities to verify that the shared resource can be accessed or browsed from the network.


Event Message: 10107

Event ID

10107

Event Message

Server mount error occurred. The server is advertising on the network, but a resource on the server is not mounted or is otherwise unavailable. Check for hardware failure on the remote server or to verify that the requested server resource is mounted.


Event Message: 10108

Event ID

10108

Event Message

Communication error in sending. An error occurred in sending information between the remote server and the local client. Retry the requested communication. If the problem continues, check for network errors. If there are no significant errors on the network, contact the application supplier to report the problem.


Event Message: 10109

Event ID

10109

Event Message

Protocol error encountered. A protocol error has occurred in the application or network environment. Check that all service ports are defined correctly for the application and the Firewall service. If the problem continues, contact the application supplier.


Event Message: 10110

Event ID

10110

Event Message

Multihop attempted. For more information about this event, see ISA Server Help.

Explanation

The remote connection attempted to cross an excessive number of intermediate routes between devices. If the connection has multiple routers available for forwarding, this might indicate a problem in other network forwarding devices, such as routers or bridges on the network.

User Action

Check that the maximum number of hops allowed for the protocol service with this connection is sufficient. Also, use network monitoring tools to check statistics on bridges or routers to see if excessive hhop counts have been obtained.


Event Message: 10111

Event ID

10111

Event Message

Inode is remote. Input for the current operation cannot be obtained from a remote source. Contact the supplier of the current application to obtain and report the problem.


Event Message: 10112

Event ID

10112

Event Message

Cross mount point achieved


Event Message: 10113

Event ID

10113

Event Message

Trying to read unreadable message. The message input has errors or is of an incorrect type to be processed by this operation. Check the message data for errors or report the problem to the supplier of the current application.


Event Message: 10114

Event ID

10114

Event Message

Log name used is not unique. For more information about this event, see ISA Server Help.

Explanation

The service is attempting to name a log by using a file name that is already in use at the service logging path.

User Action

Rename or delete the previous log file or select a different name for the new log file.


Event Message: 10115

Event ID

10115

Event Message

Remote address changed. The network address for the remote server has been changed to a different address. Reconnect to the remote server, or contact the administrator for the remote server to obtain more information about this problem.


Event Message: 10116

Event ID

10116

Event Message

Can't access a needed shared library. Software components installed or called by the current application are missing or corrupted. Or, there might be disk errors. Reinstall the current application and retry the current operation. If the problem continues, contact the application supplier to obtain an update, fix, or workaround.


Event Message: 10117

Event ID

10117

Event Message

Accessing a corrupted shared. There might be disk errors on the remote drive. In some cases, the file system might be of an unrecognized or unsupported type for the current application or platform. Check that the remote disk drive is not corrupted, and review the installation requirements for the current application.


Event Message: 10118

Event ID

10118

Event Message

Library section in code file corrupted. Software components installed or called by the current application are missing or corrupted, or there might be disk errors. Reinstall the current application and check the system for disk errors by using disk utilities appropriate for the current disk operating system. If the problem continues, contact the application supplier to obtain an update, fix, or workaround.


Event Message: 10119

Event ID

10119

Event Message

Attempting to link in too many libraries. For more information about this event, see ISA Server Help.

Explanation

The current operation is attempting to link to libraries that are not permitted by the system or application.

User Action

Check that the current platform meets the application manufacturer's requirements for installation and that any special additional software and configuration changes have been implemented. If the problem continues, contact the application supplier to obtain an update, fix, or workaround for the problem.


Event Message: 10120

Event ID

10120

Event Message

Attempting to execute a shared library. An incorrect file type was specified for execution on the system, possibly because a required shared library is missing. Reinstall the current application to restore missing libraries or components. If the problem continues, contact the application supplier to obtain an update, fix, or workaround.


Event Message: 10121

Event ID

10121

Event Message

Socket operation attempted on non-socket


Event Message: 10122

Event ID

10122

Event Message

Cannot assign requested address. For more information about this event, see ISA Server Help.

Explanation

A request for a server-provided address was not honored. The address might already be in use elsewhere on the network, or there might not be addresses left to assign for the local subnetwork. This error normally results from an attempt to create a socket with an address found on another computer. The "address" it refers to is the remote socket name (protocol, port, and address).

User Action

Check the network address configuration to verify that the client is configured for dynamic addressing or assign a different address for the client. For networks using DHCP dynamic addressing for clients, check that there are addresses available to assign in the available address pool.


Event Message: 10123

Event ID

10123

Event Message

Address is already in use. For more information about this event, see ISA Server Help.

Explanation

The requested address cannot be obtained because it is in use elsewhere on the network. Only one usage of each address is permitted. The "address" refers to the local "socket name", which is comprised of the following three elements: protocol, port-number, and IP address.

User Action

Check that network address settings for the client are correct for the local network. Assign a different fixed network address to the client. Contact your network administrator for further assistance in resolving address duplication on the local network. Do not run two server applications of the same type on the same computer. For instance, this error occurs if you try to run two applications that connect to one FTP server.


Event Message: 10124

Event ID

10124

Event Message

Address family is not supported by protocol family. For more information about this event, see ISA Server Help.

Explanation

The network address provided is not correct or is not supported for the local network. An address incompatible with the requested protocol was used. For example, you might not be able to use NS addresses with ARPA Internet protocols.

User Action

Make sure that the address is of the correct format and has been typed correctly before retrying the operation. If the problem continues, report the problem to your network administrator or to your technical support team.


Event Message: 10125

Event ID

10125

Event Message

Socket type is not supported. For more information about this event, see ISA Server Help.

Explanation

The support for the socket type has not been configured on the system or no implementation for it exists. You can expect this error is a WinSock implementation does not support socket type SOCK_RAW, for example, within the Internet address family (AF_INET).

User Action

For developers, handle the request as a non-fatal error (if possible), since some WinSock calls can legally fail the request.


Event Message: 10126

Event ID

10126

Event Message

Protocol is not supported. For more information about this event, see ISA Server Help.

Explanation

The protocol selected for use with the current application is not supported for the Firewall service, or has not been defined for the service. The support for the socket type has not been configured for the system, or no implementation of it exists.

User Action

Check that the protocol used for the current application has been added, or defined correctly for use with the Firewall service.


Event Message: 10127

Event ID

10127

Event Message

No buffer space is available. There is no buffer space available to maintain the current streamed connection. Allocate space for streams buffers on the server. For more information about setting Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) buffer size for clients by using the registry on the server, see Windows 2000 Help.


Event Message: 10128

Event ID

10128

Event Message

Connection timed out. For more information about this event, see ISA Server Help.

Explanation

A connect or send request failed because the connected party did not properly respond after a period of time. (The time-out period is dependent on the communication protocol.)

User Action

Check that the destination address is a valid IP address. If you used a hostname, check that it resolved to the correct address If the hostname resolution uses a local host table, it is possible you resolved to an obsolete address. Try to ping the hostname. Is a router configured? Check that the router up and running (check by pinging it, and then ping an address on the other side of it) Use the tracert command at the command prompt to determine the path to the destination address and to check that all the routers are functioning. Check your subnet mask. If you do not have the correct subnet mask, your network system might treat a local address as a remote address (so it forwards addresses on the local subnet to the router, rather than broadcasting an ARP request locally), or vice versa.


Event Message: 10129

Event ID

10129

Event Message

Socket is already connected. For more information about this event, see ISA Server Help.

Explanation

The current operation is unnecessary. A connect request was made on an already connected socket.

User Action

Contact the vendor of the application. They might have a software patch to fix the problem. For developers, make your application more portable with datagram sockets do not use connect() and sendto() on the same datagram socket in an application, and always "disconnect" before calling connect() more than once. With datastream sockets, do not call connect() more than once (use select() (or WSAAsyncSelect() to detect connection completion).


Event Message: 10130

Event ID

10130

Event Message

Socket is not connected. For more information about this event, see ISA Server Help.

Explanation

The current operation cannot be completed because the remote connection has been lost or was not made. A request to send or receive data was disallowed because the socket is not connected and (when sending on a datagram socket) no address was supplied. An application attempted an input/output network function call before establishing an association with a remote socket (i.e. before calling connect() or accept().)

User Action

Check the following: 1. Ping the remote host you were connected to. If it doesn't respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again). 2. Ping a local host to verify that your local network is still functioning (if on a serial connection, see next step). 3. Ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP. 4. Ping a host on the same subnet as the host you were connected to (if you know of one). This will verify that the destination network is functioning. 5. Use the tracert command at the command prompt to determine the path to the host you were connected to. This will not reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way.


Event Message: 10131

Event ID

10131

Event Message

Bad protocol option used. For more information about this event, see ISA Server Help.

Explanation

The application has selected an unsupported protocol for use with this operation.

User Action

Check your application for protocol settings, or review the documentation included with the application on how to review or change the current settings. If the problem continues, contact the supplier of the current application. For developers, check the parameters. Are you using an optional level or socket option that might not be supported on all WinSock implementations? If so, treat this as a non-fatal error and ignore it, if possible.


Event Message: 10132

Event ID

10132

Event Message

Connection reset by peer. For more information about this event, see ISA Server Help.

Explanation

The current connection has been closed by another peer user or peer server process. This normally results from a lost connection on the remote socket due to a time-out or a reboot.

User Action

You can attempt to reestablish the connection. Check the following: 1. Ping the remote host you were connected to. If it does not respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again). 2. Ping a local host to verify that your local network is still functioning (if on a serial connection, see next step). 3. Ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP. 4. Ping a host on the same subnet as the host you were connected to (if you know of one). This will verify that the destination network is functioning. 5. Use the tracert command at the command prompt to determine the path to the host you were connected to. This will not reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way. Report the problem to your network administrator, or check the connection logs for other servers on the network for more information.


Event Message: 10133

Event ID

10133

Event Message

Software caused connection to abort. For more information about this event, see ISA Server Help.

Explanation

Another application process has caused the current connection to fail. This error can occur when the local network system aborts a connection, such as when WinSock closes an established connection after data retransmission fails (receiver never acknowledges data sent on a datastream socket).

User Action

Check the following: 1. Ping the remote host you were connected to. If it does not respond, it might be off-line or there might be a network problem along the way. If it does respond, then this problem might have been a transient one (so you can reconnect now), or the server application you were connected to might have terminated (so you might not be able to connect again). 2. Ping a local host to verify that your local network is still functioning (if on a serial connection, see next step). 3. Ping your local router address. If you are on a serial connection, your local router is the IP address of the host you initially logged on to using SLIP or PPP. 4. Ping a host on the same subnet as the host you were connected to (if you know of one). This will verify that the destination network is functioning. 5. Use the tracert command at the command prompt to determine the path to the host you were connected to. This will not reveal too much unless you know the router addresses at the remote end, but it might help to identify if the problem is somewhere along the way. Exit and restart the application, then reconnect. If the problem continues, report it to the supplier of the current application.


Event Message: 10134

Event ID

10134

Event Message

Network is down. For more information about this event, see ISA Server Help.

Explanation

There are problems maintaining a connection to the local network. The current connection has failed. A socket operation encountered an unavailable network.

User Action

Check the client network connection or have the client reconnect to the network. If the message is repeated for other clients, check for problems in network cabling or termination or that network hardware or software has not been taken offline. Check your WinSock, protocol stack, network driver, and network adapter configuration. Note that this error occurs rarely since a WinSock implementation cannot reliably detect hardware problems.


Event Message: 10135

Event ID

10135

Event Message

Connection refused. For more information about this event, see ISA Server Help.

Explanation

No connection could be made because the target computer actively refused it. This usually results from trying to connect to a service that is inactive on the foreign host. You might have gone to the wrong host, or the server application you are trying to contact might not be running.

User Action

Check the destination address you are using. If you used a hostname, verify that it was resolved to the correct address. If your hostname resolution uses a local host table, it is possible the name was resolved to an obsolete address. It is also possible that the local services file has an incorrect port number (although this is unlikely). You can verify that the remote computer is rejecting your connection attempt by checking the network statistics locally. If your network system has a WinSock utility such as ping or nbtstat that shows network statistics, use this to verify that you are receiving TCP resets or ICMP Port Unreachable packets each time you attempt to connect. Try again later. If connection is still refused, contact your network administrator.


Event Message: 10136

Event ID

10136

Event Message

Host is unreachable. For more information about this event, see ISA Server Help.

Explanation

The remote host cannot be reached at this time or has been shut down. A socket operation was attempted to an unreachable target host. The ICMP message means that the router cannot forward the IP datagram to the target host, possibly because it did not get a response to the ARP request (which might mean the destination host is down).

User Action

Try again later.


Event Message: 10137

Event ID

10137

Event Message

Protocol is wrong type for socket. For more information about this event, see ISA Server Help.

Explanation

The application requires a socket call that is not supported by the current protocol settings for the client application. A protocol was specified that does not support the semantics of the socket type requested. For example, you cannot use the ARPA Internet UDP protocol with the SOCK_STREAM socket type. This error occurs if you specifically reference a protocol that is not part of the Internet address family you are also referencing.

User Action

Check the current application settings for the protocol type in use for the remote connection. Also check to see if TCP or UDP protocol support is used for the application and configure accordingly. If you are using a third-party Transmission Control Protocol/Internet Protocol (TCP/IP), verify that it is compatible with Wsock32.dll. If you are using Microsoft TCP/IP, remove and reinstall TCP/IP.


Event Message: 10138

Event ID

10138

Event Message

Operation not supported on socket. For more information about this event, see ISA Server Help.

Explanation

The current operation is not supported for Windows Sockets with the current application. Usually this occurs when a file descriptor refers to a file or socket that cannot support this operation, for example, trying to accept a connection on a datagram socket. Or the device driver for the protocol stack might not be compatible with Wsock32.dll.

User Action

Check your application settings or contact the supplier for the current application and report the problem. If you are using a third-party Transmission Control Protocol/Internet Protocol (TCP/IP), verify that it is compatible with Wsock32.dll. If you are using Microsoft TCP/IP, remove and reinstall TCP/IP. Or use another protocol that is compatible with Wsock32.dll For developers, if you close a socket inadvertently in one part of an application without keeping another part notified, use socket state in an application and/or handle this error gracefully as a non-fatal error.


Event Message: 10139

Event ID

10139

Event Message

IP Subnet table is full. The address table for routing hosts on the network indicates that all addresses on this subnetwork are in use. Rebuild routing tables for affected hosts, or assign the host to a new subnetwork with available address space.


Event Message: 10140

Event ID

10140

Event Message

Subnet module not linked. A required software component is missing or is not configured. Check network configuration settings for the client and try to reinstall the application. If the problem continues, report the problem to the application supplier.


Event Message: 10141

Event ID

10141

Event Message

Unknown input/output (I/O) control call used. A software error occurred. Report the problem to the application supplier.


Event Message: 10142

Event ID

10142

Event Message

Failure in streams buffer allocation. There is insufficient buffer space available to maintain the currently streamed connection. Increase the allocated space for streams buffers on the server. For more information about setting Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) buffer size for clients by using the registry on the server, see Windows 2000 Help.


Event Message: 10143

Event ID

10143

Event Message

Internet Control Message Protocol (ICMP) protocol is unreachable. The remote server is not responding. You might be unable to reach the remote server because hardware has failed or because a nonexistent address was specified. Verify that the address entered for the connection is correct and retry the operation. If the problem reoccurs, contact the network administrator for the remote server.


Event Message: 10144

Event ID

10144

Event Message

Internet Control Message Protocol (ICMP) port is unreachable. The remote server port is not responding. You might be unable to reach the remote server because hardware has failed or because a nonexistent address was specified. Verify that the address entered for the connection is correct and retry the operation. If the problem reoccurs, contact the network administrator for the remote server.


Event Message: 10145

Event ID

10145

Event Message

Internet Control Message Protocol (ICMP) network is unreachable. A routing failure has occurred. The local network system might generate this error if there is no default route configured. Typically, WinSock generates this error when it receives a "host unreachable" Internet Control Message Protocol (ICMP) message from a router. Investigate routers on local or remote networks to see that they are active and properly configured. Contact your network administrator to confirm the status of the remote host.


Event Message: 10146

Event ID

10146

Event Message

Invalid Ethernet packet in use. For more information about this event, see ISA Server Help.

Explanation

A routing failure has occurred. The local network system might generate this error if there is no default route configured. Typically, though, WinSock generates this error when it receives a "host unreachable" ICMP message from the router. The ICMP message means that a router cannot forward the IP datagram, possibly because it did not get a response to the ARP request (which might mean the destination host is down). Note: This error might also result if you are trying to send a multicast packet and the default gateway does not support multicast (check your interface configuration).

User Action

Check the client network configuration to confirm that the selected frame type matches the frame type used by servers on the local network. If the problem continues, review the local router configuration for packet-length settings, or use a packet analysis tool to further investigate packet framing that is currently in effect on the network. You can also try to ping the destination host, to see if you get the same results (chances are, you will). Check the destination address. Check whether you have a router configured in your network system (your WinSock implementation). Use the tracert command at the command prompt to try to determine where the failure occurs along the route between your host and the destination host. Investigate routers on local or remote networks to see that they are active and properly configured.


Event Message: 10147

Event ID

10147

Event Message

An error in type registration occurred. A software error occurred. Report the problem to the application supplier.


Event Message: 10148

Event ID

10148

Event Message

Sockets library is not initialized. For more information about this event, see ISA Server Help.

Explanation

Linked libraries for Windows Sockets are not initialized properly for client configuration. The Hypertext Transfer Protocol (HTTP) failed to initialize the sockets library. This problem occurs if there is some incorrect TCP/IP configuration.

User Action

  • Check the bindings, and verify that TCP/IP is bound at the top of the protocol stack. If you continue to receive this message, reinstall TCP/IP.
  • Check that the WinSock DLL (WinSock.dll or Wsock32.dll) is in the current path.
  • Check that the WinSock DLL file is from the same vendor as your underlying protocol stack. (WinSock DLL files must be supplied by the vendor who provided your underlying protocol stack).
  • You cannot use more than one WinSock implementation simultaneously. If you have more than one WinSock DLL file on your system, be sure the first one in the path is appropriate for the network subsystem currently loaded.
  • Check your WinSock implementation documentation to be sure all necessary components are currently installed and configured correctly.


Event Message: 10149

Event ID

10149

Event Message

Unknown error number encountered. A software error occurred. Report the problem to the application supplier.


Event Message: 11000

Event ID

11000

Event Message

%1 failed to start. The failure occurred during %5 because the configuration property %4 of the key %3 could not be accessed. Use the source location %6 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help. The error description is: %2.

Explanation

The service failed to start because the data in the storage is corrupt, due to incorrect configuration of either the registry or Active Directory.

User Action

If a backup exists, in ISA Management click Servers and Arrays, then right-click Name, and choose Restore. This restores the configuration, except for server-specific configuration information, such as cache content. If this does not solve the problem, uninstall ISA Server from the Control Panel. When you uninstall, you lose all the configuration parameters and you have to reinstall ISA Server. Reinstalling ISA Server without uninstalling the previous copy does not resolve this problem.


Event Message: 11001

Event ID

11001

Event Message

%1 failed. The failure occurred during %5 because the configuration property %4 of the key %3 could not be accessed. Use the source location %6 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help. The error description is: %2.

Explanation

The service failed to start because the data in the storage is corrupt, due to incorrect configuration of either the registry or Active Directory.

User Action

If a backup exists, in ISA Management click Servers and Arrays, then right-click Name, and choose Restore. This will restore the configuration, except for server-specific configuration information, such as cache content. If this does not solve the problem, uninstall ISA Server from the Control Panel. You will lose all the configuration parameters and will have to reinstall. Reinstalling a new copy of ISA Server without uninstalling the previous copy will not solve the problem.


Event Message: 11002

Event ID

11002

Event Message

%1 failed to start. The failure occurred during %5 because the configuration property %4 of key %3 is not valid. Use the source location %6 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help. The error description is: %2.

Explanation

Service failed to start because the data in the storage is corrupt, due to incorrect configuration of either the registry or Active Directory.

User Action

If a backup exists, in ISA Management click Servers and Arrays, then right-click Name, and choose Restore. This will restore the configuration, except for server-specific configuration information, such as cache content. If this does not solve the problem, uninstall ISA Server from the Control Panel. You will lose all the configuration parameters and will have to reinstall. Reinstalling a new copy of ISA Server without uninstalling the previous copy will not solve the problem.


Event Message: 11003

Event ID

11003

Event Message

%1 failed. The failure occurred during %5 because the configuration property %4 of key %3 is not valid. Use the source location %6 to report the failure. For more information about this event, see ISA Server Help. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help. The error description is: %2.

Explanation

Service failed to start because the data in the storage is corrupt, due to incorrect configuration of either the registry or Active Directory.

User Action

If a backup exists, in ISA Management click Servers and Arrays, then right-click Name, and choose Restore. This will restore the configuration, except for server-specific configuration information, such as cache content. If this does not solve the problem, uninstall ISA Server from the Control Panel. You will lose all the configuration parameters and will have to reinstall. Reinstalling a new copy of ISA Server without uninstalling the previous copy will not solve the problem.


Event Message: 11004

Event ID

11004

Event Message

%1 failed to start. The failure occurred during %4 because the system call %3 failed. Use the source location %5 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help. The error description is: %2.

Explanation

The failure is due to a shortage of resources, probably memory.

User Action

Close other applications that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. Make sure that Active Directory is working. For more information about managing memory resources, see Windows 2000 Help.


Event Message: 11005

Event ID

11005

Event Message

%1 failed to start. The failure occurred during %4 because the system call %3 failed. Use the source location %5 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help. The error description is: %2

Explanation

The failure is due to a shortage of resources, probably memory.

User Action

Close other applications that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. Make sure that Active Directory is working. For more information about managing memory resources, see Windows 2000 Help.


Event Message: 11006

Event ID

11006

Event Message

%1 failed to start. A shortage of available memory caused the service to fail during %2. Use the source location %3 to report the failure. For more information about this event, see ISA Server Help.

Explanation

Either the service or some processes are utilizing excessive memory resources.

User Action

Close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. For more information about managing memory resources, see Windows 2000 Help.


Event Message: 11007

Event ID

11007

Event Message

A shortage of available memory caused the %1 to fail during %2. Use the source location %3 to report the failure. For more information about this event, see ISA Server Help.

Explanation

Either the service or some processes are using excessive memory.

User Action

Close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. For more advice on managing memory resources, check Windows 2000 help.


Event Message: 11008

Event ID

11008

Event Message

%1 failed to start. The service failed to register for storage notification on key during %3. Use the source location %4 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help. The error description is: %2.

Explanation

The failure is probably due to insufficient memory or a problem accessing the storage.

User Action

Close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. For more information about managing memory resources, see Windows 2000 Help.


Event Message: 12001

Event ID

12001

Event Message

No more Internet handles can be allocated. The Web server does not have enough available resources to support the request for service at this time. Try again later.


Event Message: 12002

Event ID

12002

Event Message

The operation timed out. The remote server did not respond within the set time allowed. The server might be unavailable at this time. Try again later or contact the server administrator.


Event Message: 12003

Event ID

12003

Event Message

The server returned extended information. This is typically a string or buffer containing a verbose error message. For more information, review the request output.


Event Message: 12004

Event ID

12004

Event Message

A software error occurred for a Windows Internet extension application that is required for the current operation.


Event Message: 12005

Event ID

12005

Event Message

The Uniform Resource Locator (URL) is invalid. The request was not entered correctly. Enter the correct URL and try again.


Event Message: 12006

Event ID

12006

Event Message

The Uniform Resource Locator (URL) does not use a recognized protocol. Either the protocol is not supported or the request was not typed correctly. Confirm that a valid protocol is in use (for example, HTTP for a Web request).


Event Message: 12007

Event ID

12007

Event Message

The server name or address could not be resolved. This message might indicate an error in client or server configuration settings for DNS, WINS, or DHCP services that are actively in use. Review the TCP/IP properties for these services.


Event Message: 12008

Event ID

12008

Event Message

A protocol with the required capabilities was not found. ISA Server does not support the request protocol. Enter the request again. Verify that the protocol is a supported type (for example, HTTP, FTP, or Gopher).


Event Message: 12009

Event ID

12009

Event Message

The option is invalid. The requested option is not available with your current configuration. Clear the message and select a different option, or check configuration.


Event Message: 12010

Event ID

12010

Event Message

The length is incorrect for the option type. Reselect the current option and type the data again. Verify that you did not type extra characters and that the value you typed in is within the permitted length.


Event Message: 12011

Event ID

12011

Event Message

The option value cannot be set. The server does not support this value, or the value was typed incorrectly. Retry the operation. If you still get this message, ask your network administrator to check the status of the remote computer.


Event Message: 12012

Event ID

12012

Event Message

Windows Internet Extension support has been shut down. Open the required Internet Extension application and reselect the command option.


Event Message: 12013

Event ID

12013

Event Message

The user name was not allowed. Try a different name, or retry the same name after verifying that it is typed correctly.


Event Message: 12014

Event ID

12014

Event Message

The password was not allowed. The password might have been changed or typed incorrectly. Try typing the password again. If the problem continues, contact the administrator for the remote server and report the problem.


Event Message: 12015

Event ID

12015

Event Message

The login request was denied. The logon account might have been disabled or logon information might have changed. Log on again to verify that the information was typed correctly. If the problem continues, report the problem to the administrator of the Internet server you are requesting.


Event Message: 12016

Event ID

12016

Event Message

The requested operation is invalid. The operation entered in the Uniform Resource Locator (URL) is not allowed or is not recognized by the remote Internet server. Type the URL again or select a different operation.


Event Message: 12017

Event ID

12017

Event Message

The operation has been cancelled. Try the operation again.


Event Message: 12018

Event ID

12018

Event Message

The supplied handle is the wrong type for the requested operation.


Event Message: 12019

Event ID

12019

Event Message

The handle is in the wrong state for the requested operation.


Event Message: 12020

Event ID

12020

Event Message

The request cannot be made on an ISA Server session.


Event Message: 12021

Event ID

12021

Event Message

The registry value could not be found.


Event Message: 12022

Event ID

12022

Event Message

The registry parameter is incorrect


Event Message: 12023

Event ID

12023

Event Message

Direct Internet access is not available


Event Message: 12024

Event ID

12024

Event Message

No context value was supplied. An asynchronous request could not be made because a zero context value was supplied.


Event Message: 12025

Event ID

12025

Event Message

No status callback was supplied.


Event Message: 12026

Event ID

12026

Event Message

There are outstanding requests. The required operation could not be completed because one or more requests are pending.


Event Message: 12027

Event ID

12027

Event Message

The information format is incorrect.


Event Message: 12028

Event ID

12028

Event Message

The requested item could not be located.


Event Message: 12029

Event ID

12029

Event Message

A connection with the server cannot be established.


Event Message: 12030

Event ID

12030

Event Message

The connection with the server was terminated abnormally.


Event Message: 12031

Event ID

12031

Event Message

The connection with the server was reset.


Event Message: 12110

Event ID

12110

Event Message

There is already an File Transfer Protocol (FTP) request in progress during this session. For more information about this event, see ISA Server Help.

Explanation

You can make only one File Transfer Protocol (FTP) request per session.

User Action

Wait for the current request to finish. You can also disconnect from the FTP server and then reconnect to check for server availability. No further action is required.


Event Message: 12111

Event ID

12111

Event Message

The File Transfer Protocol (FTP) session was terminated. The connection was closed because of either a possible attempted security violation or a time out on the remote server. Reconnect to the server or check for server availability. No further action is required.


Event Message: 12130

Event ID

12130

Event Message

A Gopher protocol error occurred. In some cases, protocol errors can occur between a server that supports only standard Gopher and a client that uses Gopher Plus. Verify that the server supports the same version of Gopher protocol used by the client.


Event Message: 12131

Event ID

12131

Event Message

The Uniform Resource Locator (URL) must be for a file. The URL that was entered describes a directory location and not a file. Type a Gopher URL that contains a file name. Browse through the directory listing to locate the file.


Event Message: 12132

Event ID

12132

Event Message

An error was detected while parsing the data. There may be a problem with the Gopher server that you are trying to connect to. In some cases, protocol errors can occur between a server that supports only standard Gopher and a client that uses Gopher Plus. Try again later and in addition, verify that the server supports the same version of Gopher protocol that is used by the client.


Event Message: 12133

Event ID

12133

Event Message

There is no more data. No more data exists beyond the last block of data returned from the server. Stop the request for additional data by canceling the operation in progress.


Event Message: 12134

Event ID

12134

Event Message

The Uniform Resource Locator (URL) is not valid for the remote Gopher server. Browse through the directory to verify that you used the correct path to locate the requested file.


Event Message: 12135

Event ID

12135

Event Message

The Uniform Resource Locator (URL) type is incorrect for this operation. A file name or directory name might be applied incorrectly. Verify that the name that specifies the location is a file or directory name and matches the operation.


Event Message: 12136

Event ID

12136

Event Message

The request must be for a Gopher Plus item. The server and client do not support the same version of Gopher protocols. Modify or upgrade the client to use Gopher Plus.


Event Message: 12137

Event ID

12137

Event Message

The requested attribute is supported for Gopher Plus servers and was not found on the server. Reconfigure the client to use standard Gopher protocol and resend the request.


Event Message: 12138

Event ID

12138

Event Message

The Uniform Resource Locator (URL) type is not recognized. An incorrect Gopher type was used, or the Gopher type is not supported. Verify that the name that specifies the location is a file or directory name and is correctly matched for the operation.


Event Message: 12150

Event ID

12150

Event Message

The requested header was not found. Reload the document using the Refresh function of your Web browser.


Event Message: 12151

Event ID

12151

Event Message

The server does not support the requested protocol level. Verify that the protocol you typed is a supported protocol (such as FTP, Gopher, HTTP) for the Web Proxy service.


Event Message: 12152

Event ID

12152

Event Message

The server returned an invalid or unrecognized response. The HTTP request cannot be fully or correctly interpreted by the server. The request might have been corrupted by transmission errors. Try reloading the document in your Web browser to correct the problem.


Event Message: 12153

Event ID

12153

Event Message

The supplied HTTP header is invalid and not recognized by the remote server. Check that your browser is supported.


Event Message: 12154

Event ID

12154

Event Message

The request for a HTTP header is invalid. A header contained within the Uniform Resource Locator (URL) request is not recognized by the remote server. Check that your browser is supported.


Event Message: 12155

Event ID

12155

Event Message

The HTTP header already exists. Contact your ISA Server administrator.


Event Message: 12201

Event ID

12201

Event Message

A chained proxy server or array member requires proxy-to-proxy authentication. Please contact your server administrator.


Event Message: 12202

Event ID

12202

Event Message

The ISA Server denies the specified Uniform Resource Locator (URL).


Event Message: 12203

Event ID

12203

Event Message

The ISA Server has detected the server software expired.


Event Message: 12204

Event ID

12204

Event Message

The specified Secure Sockets Layer (SSL) port is not allowed. ISA Server is not configured to allow SSL requests from this port. Most Web browsers use port 443 for SSL requests. Check the configuration for outgoing Web requests. Contact your ISA Server administrator.


Event Message: 12205

Event ID

12205

Event Message

The ISA Server evaluation version expired. For more information, contact Microsoft.


Event Message: 12206

Event ID

12206

Event Message

The ISA Server detected a proxy chain loop. There is a problem with the configuration of the ISA Server routing policy. Please contact your server administrator.


Event Message: 12209

Event ID

12209

Event Message

The ISA Server requires authorization to fulfill the request. Access to the Web Proxy service is denied. The configuration for outgoing Web requests should be checked. Contact your ISA Server administrator.


Event Message: 12210

Event ID

12210

Event Message

An Internet Server API (ISAPI) filter caused an error or terminated with an error.


Event Message: 12211

Event ID

12211

Event Message

The ISA Server requires a secure channel connection to fulfill the request. ISA Server is configured to respond to outgoing secure (that is, Secure Sockets Layer (SSL)) channel requests. The configuration for outgoing Web requests need to be checked. Contact your ISA Server administrator.


Event Message: 12212

Event ID

12212

Event Message

The ISA Server requires a high-security connection to fulfill the request. An Secure Sockets Layer (SSL) Web server requires 128-bit encryption, an enhanced security mechanism, for access to published sites. Use a browser that supports this enhanced encryption.


Event Message: 12213

Event ID

12213

Event Message

The ISA Server requires a client certificate to fulfill the request. An Secure Sockets Layer (SSL) Web server, during the authentication process, requires a client certificate. The configuration for outgoing Web requests should be checked. Contact your ISA Server administrator.


Event Message: 12214

Event ID

12214

Event Message

An Internet Server API (ISAPI) filter caused an error or terminated with an error.


Event Message: 12215

Event ID

12215

Event Message

The size of the request header is too large. Contact your ISA server administrator.


Event Message: 12216

Event ID

12216

Event Message

The size of the response header is too large. Contact your ISA server administrator.


Event Message: 12221

Event ID

12221

Event Message

A chained server requires authentication. Contact the server administrator.


Event Message: 12222

Event ID

12222

Event Message

The server denies the specified Uniform Resource Locator (URL). Contact the server administrator.


Event Message: 12223

Event ID

12223

Event Message

The server has detected the server software expired. Contact the server administrator.


Event Message: 12225

Event ID

12225

Event Message

The server evaluation version expired.


Event Message: 12226

Event ID

12226

Event Message

The server detected a chain loop. There is a problem with the configuration of the server routing policy. Contact the server administrator.


Event Message: 12227

Event ID

12227

Event Message

The dial-out connection failed. The dial-out connection failed with the specified phonebook entry. The administrator should manually dial the specified phonebook entry to confirm that the problem is not the Windows 2000 auto-dial facility.


Event Message: 12228

Event ID

12228

Event Message

The server is too busy to handle this request. Reenter request or try again later.


Event Message: 12229

Event ID

12229

Event Message

The server requires authorization to fulfill the request. Access to the Web server is denied. Contact the server administrator.


Event Message: 12230

Event ID

12230

Event Message

An Internet Server API (ISAPI) filter has finished handling the request. Contact the server administrator.


Event Message: 12231

Event ID

12231

Event Message

The page must be viewed over a secure (that is, Secure Sockets Layer (SSL)) channel. Contact the server administrator.


Event Message: 12232

Event ID

12232

Event Message

The page requires 128-bit encryption, an enhanced security mechanism. To view the page contents, use a browser that supports this enhanced encryption.


Event Message: 12233

Event ID

12233

Event Message

The page requires a client certificate as part of the authentication process. Contact the server administrator.


Event ID

12234

Event Message

An Internet Server API (ISAPI) filter caused an error or terminated with an error.


Event Message: 12235

Event ID

12235

Event Message

The size of the request header is too large. Contact the server administrator.


Event Message: 12236

Event ID

12236

Event Message

The size of the response header is too large. Contact the server administrator.


Event Message: 12260

Event ID

12260

Event Message

Fatal error occurred when attempting to access '%1' certificate private key. For more information about this event, see ISA Server Help. The error code in the Data area of the event properties indicates the cause of the failure.

Explanation

The server cannot access certificate private key because the certificate and its private key are not installed in the same store.

User Action

Check configuration of certificates.


Event Message: 13002

Event ID

13002

Event Message

Bandwidth control completed successfully.


Event Message: 13103

Event ID

13103

Event Message

Initialization of bandwidth control failed. The ISA Server that uses the bandwidth controller failed to initialize the client dynamic-link library (DLL). Look at previous event entries to find the reason for the failure.


Event Message: 13104

Event ID

13104

Event Message

The call to %1 failed. The failure is probably due to insufficient memory. Close some applications and try again. If that does not work, verify that Active Directory is working. For more information about managing memory resources, see Windows 2000 Help.


Event Message: 13105

Event ID

13105

Event Message

Insufficient memory for %1. The bandwidth control did not have sufficient memory resources. Close some applications and try again. For more information about managing memory resources, see Windows 2000 Help.


Event Message: 13106

Event ID

13106

Event Message

Cannot match IP to an interface. Flow control for the specified IP address did not take effect. If message was reported during network configuration changes it can be ignored. If you continue to receive this message, you may need to restart ISA services.


Event Message: 13107

Event ID

13107

Event Message

The Scheduled Content Download Service has stopped the job %1. %2 pages (objects) visited.


Event Message: 13108

Event ID

13108

Event Message

The Scheduled Content Download Service found an unauthorized URL and called unauthorized page %2 while executing the job %1.


Event Message: 13109

Event ID

13109

Event Message

The Scheduled Content Download Service was unable to connect to the Web Proxy Service while executing the job %1. Check that the Web Proxy Service is running using ISA Management. If not, start the service.


Event Message: 14001

Event ID

14001

Event Message

Firewall Service failed to initialize. The internal error code in the Data area of the event properties indicates the cause of the failure. Previous event log entries might help determine the proper action.


Event Message: 14002

Event ID

14002

Event Message

The Firewall service cannot initialize WinSock. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The Firewall service cannot start. The system is probably out of memory, or the registry might be corrupt.

User Action

Check the Firewall service configuration. To do this, click Start, point to Programs, point to Administrative Tools, and then click Component Services. Try to stop and restart the service. If this does not work, restart the computer.


Event Message: 14003

Event ID

14003

Event Message

Firewall service started.


Event Message: 14004

Event ID

14004

Event Message

The Firewall service cannot start due to a shortage of available memory. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

Either an application is using too much memory or the page file size is too small.

User Action

Close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. For more information about managing memory resources, see Windows 2000 Help.


Event Message: 14006

Event ID

14006

Event Message

The Firewall service cannot start the performance counters. Restart the Firewall service. The error code in the Data area of the event properties indicates the cause of the failure.


Event Message: 14007

Event ID

14007

Event Message

A shortage of available memory caused the Firewall service to fail. The Event Viewer Data window displays the number of active connections. For more information about this event, see ISA Server Help.

Explanation

The ISA Server computer cannot support additional connections for the server.

User Action

Check the number of current connections and reduce that number to an acceptable level. Close other programs that are running. Use the Task Manager to check programs and processes using large amounts of system resources. For more information about managing memory resources, see Windows 2000 Help.


Event Message: 14010

Event ID

14010

Event Message

The Firewall service did not start due to corrupt data in the registry or Active Directory, depending on the ISA Server configuration. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The Firewall service did not start due to corrupted data in the registry or in the Active Directory configuration

User Action

Wait a few minutes and then restart the service. If this does not work and a backup exists, in ISA Management click Servers and Arrays, then right-clickName, and choose Restore. This restores the configuration, except for server-specific configuration information, such as cache content. If this does not solve the problem, uninstall ISA Server from Control Panel. When you uninstall, you lose all the configuration parameters and you have to reinstall ISA Server. Reinstalling ISA Server without uninstalling the previous copy does not resolve this problem.


Event Message: 14011

Event ID

14011

Event Message

The Firewall service failed to bind its socket to %1, port %2. This could be caused by another service that is already using the same port or by the network interface that is not functional. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

Either the requested service port is already in use or there is a problem with the network interface.

User Action

Click Start, click Run and then type netstat -a to display statistics for the current TCP/IP connections. Check for port conflicts or network problems. Close the other application that is using the requested port. For more information about the netstat command, see Windows 2000 Help.


Event Message: 14012

Event ID

14012

Event Message

Client from %1 attempted to access ISA Server using control protocol version %2. The server supports version %3. The version of the client software is incompatible with the server version. If the client software is older than the server software, upgrade the client software. If the server software is older, either upgrade the server or direct the client to a different server that uses the newer software.


Event Message: 14013

Event ID

14013

Event Message

The Firewall service requires Windows 2000 Server with Service Pack 1 or later.


Event Message: 14014

Event ID

14014

Event Message

The Firewall service requires Windows 2000 Server with Service Pack 1 or later.


Event Message: 14015

Event ID

14015

Event Message

The Firewall service failed to load a security dynamic-link library (DLL). The required DLL is missing or cannot be found. Make sure that the Security.dll is located in the Windows 2000 system directory (typically, %systemroot%\System32 directory), and then restart the Firewall service.


Event Message: 14016

Event ID

14016

Event Message

The Firewall service failed to determine the network addresses because either there are improper network connections or there is insufficient memory. Check network connections and restart the service. If this problem occurs again, close some applications, stop the service, and then restart the service.


Event Message: 14017

Event ID

14017

Event Message

Incorrect network configuration. The server address is not internal and is not in the Local Address Table (LAT). For more information about this event, see ISA Server Help.

Explanation

An Internet Protocol (IP) address configured for the internal network adapter for the server needs to be included within the Local Address Table (LAT) for the server.

User Action

To configure the Local Address Table (LAT), open ISA Management, click Network configuration and then click Local Address Table (LAT). To modify an existing LAT entry, in the ISA Management console tree, click Servers and Arrays, click Name, click Network Configuration, and then click the relevant LAT entry.


Event Message: 14021

Event ID

14021

Event Message

The Firewall service failed to initialize because the system call %1 failed. If an error code appears in the Data area of the event properties, it indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The failure is probably due to insufficient memory or a problem accessing the storage.

User Action

Close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. Verify that Active Directory is working. For more information about managing memory resources, see Windows 2000 Help.


Event Message: 14022

Event ID

14022

Event Message

Microsoft ISA Server Control Service failed to initialize because the system call %1 failed. The error occurred during %2. Use the source location %3 to report the failure. If an error code appears in the Data area of the event properties, it indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The failure is probably due to insufficient memory or a problem accessing the storage.

User Action

Restart the service. If that does not resolve the problem, close other programs that are running. Use the Task Manager to check programs and processes that are using large amounts of system resources. For more information about managing memory resources, see Windows 2000 Help.


Event Message: 14024

Event ID

14024

Event Message

Microsoft ISA Server Control Service requires Windows 2000 Server with Service Pack 1 or later.


Event Message: 14025

Event ID

14025

Event Message

Microsoft ISA Server Control Service requires Windows 2000 Server with Service Pack 1 or later.


Event Message: 14026

Event ID

14026

Event Message

The Microsoft ISA Server Control Service failed to initialize. The internal error code in the Data area of the event properties indicates the cause of the failure. Restart the service.


Event Message: 14027

Event ID

14027

Event Message

The Microsoft ISA Server Control Service started.


Event Message: 14028

Event ID

14028

Event Message

The Firewall service did not initialize the network dial-up entry. Try an alternative manual dial-up entry. If successful, retry the dial-up entry. If the problem still exists, restart the Firewall service. If this does not solve the problem, restart Windows 2000.


Event Message: 14029

Event ID

14029

Event Message

The Firewall service failed to create a socket. If an error code appears in the Data area of the event properties, it indicates the source of the failure.


Event Message: 14030

Event ID

14030

Event Message

The Firewall service failed to associate a control socket with a completion port.


Event Message: 14031

Event ID

14031

Event Message

The Firewall service failed to initialize control or refresh sockets.


Event Message: 14033

Event ID

14033

Event Message

Alert service did not start. Alerts are limited to event reporting. There might be a problem in the Microsoft ISA Server Control Service. Restart the service. The Firewall and Web Proxy services are dependent on this service, so you also need to restart them.


Event Message: 14034

Event ID

14034

Event Message

The Firewall service did not listen on all Transmission Control Protocol (TCP) sockets. The reason for the failure of the service can be determined by examining previous event log entries.


Event Message: 14035

Event ID

14035

Event Message

The Firewall service failed to listen on the Transmission Control Protocol (TCP) socket bound to %1. The error code in the Data area of the event properties indicates the cause of the failure.


Event Message: 14036

Event ID

14036

Event Message

The IP address (or DNS name) %1, from configuration file %2, cannot be used to connect to the ISA Server. Use ISA Management to configure the IP address or DNS name to which Firewall clients should connect.


Event Message: 14038

Event ID

14038

Event Message

ISA Server packet filter log service cannot allocate memory. The packet filter log component of ISA Server logs this event when it fails to allocate memory where memory resources are low. The packet filter log component cannot operate until the low memory situation is resolved. The ISA Server administrator can stop and restart the ISA Server services to resolve the low memory situation if logging of packet filter data is mandatory.


Event Message: 14039

Event ID

14039

Event Message

ISA Server packet filter logging component cannot obtain the log contents. Restarting the service might solve the problem.


Event Message: 14040

Event ID

14040

Event Message

Mail Alert service stopped responding because Mapi.dll cannot be located.


Event Message: 14043

Event ID

14043

Event Message

The system-wide packet filter log event cannot be created.


Event Message: 14044

Event ID

14044

Event Message

The packet filter is dropping Internet Protocol (IP) packets. For more information about this event, see ISA Server Help.

Explanation

The IP packet drop rate of the ISA Server exceeds the specified level. The Internet Protocol (IP) packet drop rate is configured in ISA Management. To configure the drop rate, in the ISA Management console tree, click Servers and Arrays, click Name, click Monitoring Configuration, click Alerts, and then click Dropped packets alert properties.

User Action

An administrator can examine the packet filter logs to detect the nature of the drop rate and take further action.


Event Message: 14045

Event ID

14045

Event Message

Mail alert for %1 failed


Event Message: 14046

Event ID

14046

Event Message

Packet filter protocol violation. For more information about this event, see ISA Server Help.

Explanation

The dropped packet rate of some special kinds of packets (for example, spoofed packets or fragments) exceeds the rate specified in the configuration for dropped packets. To configure the drop rate, in the ISA Management console tree, click Servers and Arrays, click Name, click Monitoring Configuration, click Alerts, and then click Dropped packets alert properties.

User Action

Examine the packet filter logs to detect the nature of the drop rate and take further action.


Event Message: 14047

Event ID

14047

Event Message

Failed to write to %1 log file in directory %2. There is no space on the disk drive. Delete unnecessary files.


Event Message: 14048

Event ID

14048

Event Message

Failed to stop the %1 during %2. Use the source location %3 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. The computer should be restarted.


Event Message: 14049

Event ID

14049

Event Message

%1 was stopped because of a logging failure. For more information about this event, see ISA Server Help.

Explanation

A service stops when an activity log stops responding. If you log to a file on your local file system, it is most likely that a logging failure was caused by insufficient disk space. If you log to a database, the failure is probably related to an error in configuration, insufficient disk space, or connectivity problems.

User Action

If the failure is the result of insufficient disk space, move old files to another media or delete them manually and configure the system to delete old files in the future. To edit logging configuration, in the ISA Management console tree, click Servers and Arrays, click Name, click Monitoring Configuration, and then click Logs. If you log to a database, check the database configuration. To reconfigure disk space, select a shorter period for logging (for example, weekly or daily), click Location and then select the option to compress log files.


Event Message: 14050

Event ID

14050

Event Message

Mail alert %1 stopped because of a configuration error (%2).


Event Message: 14051

Event ID

14051

Event Message

Mail alert %1 (%2) stopped because it could not log on or connect to the server. The server may be down or incorrectly specified.


Event Message: 14052

Event ID

14052

Event Message

Mail alert %1 stopped because the mail server refused to accept the message.


Event Message: 14053

Event ID

14053

Event Message

Mail alert %1 stopped because the sender name is not valid.


Event Message: 14054

Event ID

14054

Event Message

Mail alert %1 stopped because the recipient name is not valid.


Event Message: 14055

Event ID

14055

Event Message

The Firewall service encountered an illegal operation (runtime error R6025), in a pure virtual function. To resolve this error, remove recently installed application filters and restart the service.


Event Message: 14056

Event ID

14056

Event Message

The application filter (%2, CLSID=%3) performed an illegal operation inside the Firewall service process at method %1. The Firewall service terminated. To resolve this error, remove recently installed application filters and restart the service. If this does not resolve the problem, contact the component vendor.


Event Message: 14057

Event ID

14057

Event Message

The Firewall service stopped because an application filter module %1 generated an exception code %3 in address %2 when function %4 was called. To resolve this error, remove recently installed application filters and restart the service.


Event Message: 14058

Event ID

14058

Event Message

The Firewall service cannot connect to another proxy server. Authentication was rejected. Check the credentials for the account that is used for proxy-to-proxy authentication.


Event Message: 14059

Event ID

14059

Event Message

The Firewall service cannot connect to another proxy server. Authentication failed. A chained proxy server or array member requires proxy-to-proxy authentication. Authentication failed because the credentials that were supplied were incorrect. Check authentication credentials and try again.


Event Message: 14060

Event ID

14060

Event Message

Cannot load an application filter %1 (%4). %2 failed with code 0x%3. To attempt to activate this application filter again, stop and restart the Firewall service.


Event Message: 14061

Event ID

14061

Event Message

The Firewall service detected that the upstream proxy server '%1' is not available. If the upstream proxy server %1 becomes available, you may proceed as usual. If it does not become available, check the status of the upstream proxy server.


Event Message: 14062

Event ID

14062

Event Message

The Firewall service detected that the upstream proxy '%1' is now available.


Event Message: 14063

Event ID

14063

Event Message

The Firewall service failed to initialize because of a corrupted registry. Error Code %1, Key='%2' Value='%3'. For more information about this event, see ISA Server Help.

Explanation

The Firewall Service failed to initialize because of a corrupted registry.

User Action

If a backup exists, in ISA Management click Servers and Arrays, then right-clickName, and choose Restore. This restores the configuration, except for server-specific configuration information, such as cache content. If this does not solve the problem, uninstall ISA Server from Control Panel. When you uninstall, you lose all the configuration parameters and you have to reinstall ISA Server. Reinstalling ISA Server without uninstalling the previous copy does not resolve this problem.


Event Message: 14064

Event ID

14064

Event Message

Unknown event %1 signaled the alert service. The reported event does not appear in storage. If you recently installed an application filter, it is probably the source of the error. Remove any application filters that have been installed recently. If this does not solve the problem, reinstall ISA Server.


Event Message: 14065

Event ID

14065

Event Message

Alert service: One or more of the actions associated with alert %1 has failed. The failure is linked to configuration settings. The mail server may be down, or the specified command may not exist. Check the Event Viewer for related errors and fix them accordingly.


Event Message: 14066

Event ID

14066

Event Message

Failed to read the dial-up entry configuration. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

This event is logged when the specified dial-up configuration or the Firewall service configuration cannot be recognized.

User Action

Check the configuration for dial-up entries in ISA Management and the Firewall service. To view the dial-up entries, in the ISA Management console tree, click Servers and Arrays, click Name, click Policy Elements, and then click Dial-up entries. To view the dial-up entries for the Firewall service, click Start, point to Programs, point to Administrative Tools, and then click Services.


Event Message: 14067

Event ID

14067

Event Message

Failed to load Rasapi32.dll. The system configuration is incorrect. Check the system configuration for errors. Manually dial an entry to verify that the dial-out works and then restart the failed service. The error code in the Data area of the event properties indicates the cause of the failure.


Event Message: 14069

Event ID

14069

Event Message

The alert service found more then one alert with the same event condition, server name, and additional key. The duplicated alert '%1'is ignored. For more information about this event, see ISA Server Help.

Explanation

The alert duplication is the result of one or more configuration settings that are inconsistent or missing in the registry or Active Directory, depending on ISA Server configuration. This could be the result of an error in the configuration, an incomplete administration operation, or other internal errors. The actions in this duplicate alert are specified in the initial alert and are ignored by the service.

User Action

Delete the erroneous alert with ISA Management or a script. To locate the alert, use the name of the alert as it appears in the message.


Event Message: 14071

Event ID

14071

Event Message

The Firewall service did not start because the application filter component %1 did not start on time. Reinstall the application filter. Contact the application filter vendor.


Event Message: 14072

Event ID

14072

Event Message

The alert service failed to logon as user %2 to run the command %3 specified for the alert '%1'. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

Incorrect credentials can be caused by a misspelled user name, password, or domain name. It is also possible that the Windows 2000 password has changed and the password that is stored in ISA Server is now incorrect or that the domain name changed.

User Action

Verify that all the credentials for this alert are set correctly.


Event Message: 14076

Event ID

14076

Event Message

Microsoft ISA Server Control Service failed to execute the security editing application. For more information about this event, see ISA Server Help. Error code: %1.

Explanation

The Secedit system application, which is used for security configuration and analysis, might fail due to an incorrect configuration specified in the security template files.

User Action

Use the Securwiz.log file in the ISA Server installation directory to identify the error. The file contains text in UNICODE (use Notepad to edit it). Search for the keywords "Warning" and "Error."


Event Message: 14077

Event ID

14077

Event Message

Failed to start the %1 during %2. Use the source location %3 to report the failure. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

Service failed to start.

User Action

Restart the service by doing one of the following:

  • In the ISA Management console tree, click Servers and Arrays, Name, Monitoring Configuration, click Services and then right-click the service and choose Start).
  • Click Start, point to Programs, point to Administrative Tools, and then click Services.
Look at the Event Viewer for errors regarding the failed service.


Event Message: 14078

Event ID

14078

Event Message

Microsoft ISA Server Control Service failed to delete Web Proxy cache file %1 during %2. Use the source location %3 to report the failure. Try to delete the folder manually.


Event Message: 14079

Event ID

14079

Event Message

Due to an unexpected error, the service %1 stopped responding to all requests. This occurred %2 time(s) in the past %3 hours. Try to stop the service or kill the corresponding process if it does not respond, and start it again. Check the Event Viewer for related error messages.


Event Message: 14080

Event ID

14080

Event Message

Microsoft ISA Server Control Service failed because an application filter component (%2) performed an illegal operation at method %1 GUID=%3. Try removing recently installed application filters and restart the service. Otherwise, contact the component vendor.


Event Message: 14081

Event ID

14081

Event Message

ISA Server Control Service discovered a missing application filter component (%1) GUID %2. The application filter cannot be found on this server. Check that the specified filter was installed. The error code in the Data area of the event properties indicates the cause of the failure.


Event Message: 14082

Event ID

14082

Event Message

ISA Server Control Service cannot load the application filter component (%1) GUID %2, because it does not support necessary interfaces. This indicates a version mismatch, and the filter can no longer be used. Check the filter was installed correctly, or contact the component vendor. The error code in the Data area of the event properties indicates the cause of the failure.


Event Message: 14083

Event ID

14083

Event Message

ISA Server Control Service cannot load the application filter component (%1) GUID %2. Check that the application filter is installed properly. The error code in the Data area of the event properties indicates the cause of the failure.


Event Message: 14084

Event ID

14084

Event Message

ISA Server Control Service failed to start. All array members must be in the same site (%2). However, this server is in site %1. The server may have been moved to a different site that its containing array. Move the server to an array in its new site.


Event Message: 14085

Event ID

14085

Event Message

ISA Server Control Service failed to start. All array members must be in the same domain (%2). However, this server is in domain %1. The server was apparently moved to a different domain than its containing array. The server should be added to an array in its new domain.


Event Message: 14086

Event ID

14086

Event Message

Insecure configuration detected. Internet Protocol (IP) routing is enabled while packet filtering is disabled. All packets will be routed, regardless of access policy. It is recommended that you enable IP routing only when you also enable packet filtering.


Event Message: 14087

Event ID

14087

Event Message

Insecure configuration detected. ISA Server uses its own Network Address Translation (NAT) editor to fully secure your system. However, ISA Server found one or more different NAT editors, which might have been installed by the following drivers: %1. It is recommended that you uninstall the drivers listed. For more information about this event, see ISA Server Help.

Explanation

Non-system Network Address Translation (NAT) editors are considered insecure by default. Such editors enable Internet Protocol (IP) traffic to pass through without applying policies.

User Action

It is not recommended to allow any third party to install NAT editors. Uninstall the driver that installed the insecure NAT editor.


Event Message: 14088

Event ID

14088

Event Message

Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] violates %6 rule [%7]. For more information about this event, see ISA Server Help.

Explanation

There is a conflict between the configuration of the server publishing rule and the configuration of an access policy rule.

User Action

Change the rule configurations to resolve the conflict. To view server publishing rules in ISA Management, click Servers and Arrays, click Name, click Publishing, and then click Server Publishing Rules. To view access policy rules in ISA Management, click Servers and Arrays, click Name, click Access Policy, and then click the appropriate rule.


Event Message: 14089

Event ID

14089

Event Message

Server publishing rule [%1] failed. Cannot create session for the server %2. Location %3. For more information about this event, see ISA Server Help.

Explanation

The server publishing rule cannot be applied. The Firewall service failed to obtain a session with the server. The internal server address might not be included in the Local Address Table (LAT).

User Action

Check that the internal server address is included in the LAT. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Network Configuration, click Local Address Table (LAT) and review the existing LAT entries. If the internal server address in not included, construct a new LAT entry by right-clicking Local Address Table (LAT).


Event Message: 14090

Event ID

14090

Event Message

Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] failed to bind to external interface. The server publishing rule cannot be applied. The Firewall service failed to bind a socket for the server. The error code in the Data area of the event properties indicates the cause of the failure.


Event Message: 14091

Event ID

14091

Event Message

Server publishing rule [%1] failed. The protocol specified cannot be used for publishing. Location %2. The server publishing rule cannot be applied. The protocol must be inbound. Check with the application filter vendor.


Event Message: 14092

Event ID

14092

Event Message

Server publishing rule [%1] failed. The protocol specified cannot be used for publishing. Location %2. For more information about this event, see ISA Server Help.

Explanation

The server publishing rule cannot be applied. The protocol definition used for this rule is not inbound and is not valid.

User Action

Define a protocol that has an inbound primary connection for use with server mapping rules. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Policy Elements, and then click Protocol Definitions.


Event Message: 14093

Event ID

14093

Event Message

The Microsoft Firewall Service cannot start because the ISA Server was installed in Cache mode. Usually the Firewall service is disabled if ISA Server is not installed in Integrated or Firewall mode. It is possible that during the first boot after the Firewall component was uninstalled, the service was started, and shortly after stopped. To use the service, reinstall ISA Server in Integrated or Firewall mode.


Event Message: 14094

Event ID

14094

Event Message

The Microsoft Scheduled Cache Content Download service cannot start because the ISA Server was installed in Firewall mode. Usually the Scheduled cache content download service is disabled if ISA Server is not installed in Cache or Integrated mode. It is possible that during the first boot after the Cache component was uninstalled, the service was started, and shortly after stopped. To use the service, reinstall ISA Server in Integrated or Cache mode.


Event Message: 14095

Event ID

14095

Event Message

Failed to initialize server publishing. Location %1. Internal error. Storage might be corrupted.


Event Message: 14096

Event ID

14096

Event Message

Failed to read server publishing rules. Location %1. Internal error. Storage might be corrupted.


Event Message: 14097

Event ID

14097

Event Message

Failed to read one or more server publishing rules. Location %1. Internal error. Storage might be corrupted.


Event Message: 14098

Event ID

14098

Event Message

Failed to read parameters of the publishing rule [%1]. The rule is discarded. Location %2. The storage might be corrupted. Delete this rule and create a new one.


Event Message: 14099

Event ID

14099

Event Message

Publishing rule [%1] could not be applied to this array member because IP %2 is not available. A server publishing rule can only be applied to one server from the array. All other servers will report this event. Note that an Internet Protocol (IP) address might be temporarily unavailable (for example, dial-up connection is disconnected).


Event Message: 14100

Event ID

14100

Event Message

The server was unable to log on the Windows 2000 account '%1' due to the following error: %2. The account name that was entered is not an account recognized by Windows 2000. Confirm that you entered the correct user name. The error code in the Data area of the event properties indicates the cause of the failure.


Event Message: 14101

Event ID

14101

Event Message

The server could not add the virtual root '%1' for the directory '%2' due to the following error: %3. The directory name is not recognized for the server volume that is specified in the virtual root mapping. Check that the directory name entered for drive mapping is correct. The error code in the Data area of the event properties indicates the cause of the failure.


Event Message: 14102

Event ID

14102

Event Message

The server was unable to load Odbc32.dll for SQL logging because of the following error: %1. The specified dynamic-link library (DLL) could not be located in the current system path. Verify the existence of the specified DLL in the Windows system directory. The system directory is typically %systemroot\Winnt\System32%. The error code in the Data area of the event properties indicates the cause of the failure.


Event Message: 14103

Event ID

14103

Event Message

The server was unable to open Open Database Connectivity (ODBC Data Source %1, Table: %2, under User Name %3. The ODBC Error is: %4. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The Open Database Connectivity (ODBC) data source could not be opened because it does not exist or because the table and user name information is incorrect.

User Action

Open ISA Management and check the log properties to verify that the ODBC Data Source, Table name, User Name, and Password are correct in the corresponding logging service. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Monitoring Configuration, and then click Logs.


Event Message: 14104

Event ID

14104

Event Message

The logging parameters specified are too long. Field: %1; Data Given: %2. The database table used for service logging requires an adjustment. Either the field is not long enough to contain the data or the field type is incorrectly set in the database design. Check configuration of table fields and data types for each field.


Event Message: 14105

Event ID

14105

Event Message

ISA Management might not be able to recognize this server, because the server was unable to register on the network. Check for a server name conflict on the Internet. The error code in the Data area of the event properties indicates the cause of the failure.


Event Message: 14107

Event ID

14107

Event Message

The server could not log information. The log object was never created. For more information about this event, see ISA Server Help.

Explanation

Information for configuring service logging might be missing or incorrect.

User Action

In ISA Management, verify that logging information is configured correctly for the service. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Monitoring Configuration, and then click Logs.


Event Message: 14108

Event ID

14108

Event Message

The server was unable to find the log file directory %1. The error code in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The log file folder is either missing or has been set incorrectly.

User Action

In ISA Management, verify that logging information is configured correctly for the service. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Monitoring Configuration, and then click Logs. For a specified log file location, verify that the specified folder location exists. Create the folder again, if necessary.


Event Message: 14111

Event ID

14111

Event Message

ISA Server Cache could not start because it was configured incorrectly. Use ISA Management or manually edit the registry to correct the error, and then restart the service. For more information about this event, see ISA Server Help.

Explanation

The cache could not start because of incorrect settings in the cache configuration or conflicts with other configuration settings.

User Action

Stop the Web Proxy Service. In ISA Management, correct cache settings. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Cache Configuration, click the HTTP tab, and then select the Restore defaults check box. Restart the Web Proxy Service. If cache initialization still fails, run Setup and click Reinstall.


Event Message: 14119

Event ID

14119

Event Message

An external interface could not be found for packet filtering. For more information about this event, see ISA Server Help.

Explanation

This event can occur if the Local Address Table (LAT) includes all the addresses associated with the external interfaces. The event might also occur if another application is controlling the packet filter driver. Since only one application can control the packet filter driver at a time, the Firewall service cannot filter packets.

User Action

Verify that the LAT is configured properly and no other applications are configured to use packet filtering on the external network interfaces of the ISA Server. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Network Configuration, and then click Local Address Table.


Event Message: 14120

Event ID

14120

Event Message

The ISA Server services cannot create a packet filter %1. This event occurs when there is a conflict between the Local Address Table (LAT) configuration and the Windows 2000 routing table. Check the routing table and the LAT to find the source of the conflict.


Event Message: 14121

Event ID

14121

Event Message

The packet filter dial-out interface cannot be rebound. For more information about this event, see ISA Server Help.

Explanation

This alert is generated when the ISA Server services are not able to bind a network interface with the packet filter driver. ISA Server typically rebinds interfaces and packet filters for the dial-out connections when they are dialed and disconnected. The alert also logs the error code that the underlying layers return.

User Action

This alert should not occur on a properly configured system. Check the configuration, including the LAT table. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Network Configuration, and then click Local Address Table. Confirm that configuration of the specified phonebook entry in the dial-up entries configuration is correct. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Policy Elements, and then click Dial-Up Entries.


Event Message: 14122

Event ID

14122

Event Message

A packet filter interface could not be bound. For more information about this event, see ISA Server Help.

Explanation

Packet filtering cannot be enabled on a specific interface. The configuration of the interface might have changed, been enabled or disabled, or a dial-out connection might have been dropped immediately after being connected.

User Action

Restart the Firewall and Web Proxy services. In ISA Management, check the system configuration to make sure it is consistent with packet filtering configuration, including the internal network addresses in the Local Address Table (LAT), or run Ipconfig at the command line to check current TCP/IP configuration values. To check the system configuration, in the ISA Management console tree, click Servers and Arrays, click Name, click Network configuration, and then click Local Address Table.


Event Message: 14123

Event ID

14123

Event Message

Failed to create the Internet Protocol (IP) packet filter. For more information about this event, see ISA Server Help.

Explanation

A static packet filter could not be created. System configuration might be incorrect, and the service might have attempted to create the filter for an external remote host on an ISA Server internal interface, due to incorrect configuration for default routing. Otherwise, memory resources might be low.

User Action

For system configuration problems, check the Local Address Table (LAT) configuration, run ipconfig/all to check TCP/IP configuration, and run Route -Print to obtain a list of registered, persistent routes. To check the LAT, in the ISA Management console tree, click Servers and Arrays, click Name, click Network Configuration, and then click Local Address Table. For low memory resources, close other applications or stop and restart the services.


Event Message: 14124

Event ID

14124

Event Message

Filtering disabled as requested.


Event Message: 14125

Event ID

14125

Event Message

The Web Proxy service received %1 requests from the Internet port during the past %2 seconds while Web publishing was disabled. When ISA Server publishing is disabled, this event message displays the number of requests from the Internet during the specified time, in seconds.


Event Message: 14126

Event ID

14126

Event Message

The Web Proxy service configuration has been modified %1 times during the past %2 seconds.


Event Message: 14127

Event ID

14127

Event Message

The Web Proxy service could not initialize (error code %1). The internal error code in the Data area of the event properties indicates the cause of the failure.


Event Message: 14128

Event ID

14128

Event Message

The Web Proxy service is paused.


Event Message: 14129

Event ID

14129

Event Message

The Web Proxy service was resumed. No further action necessary.


Event Message: 14130

Event ID

14130

Event Message

The Web Proxy service detected that the upstream proxy '%1' is not available. For more information about this event, see ISA Server Help.

Explanation

The upstream proxy is offline.

User Action

Verify the reason and predicted time frame for the continuation of the problem. If necessary, configure a backup route. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Network Configuration, and then click Routing. Open the rule and then click the Action tab. Or, you can route the request to an alternate destination.


Event Message: 14131

Event ID

14131

Event Message

The Web Proxy service detected that the upstream proxy '%1' is now available. If you were able to work around the upstream proxy server, no further action is necessary. If you changed the configuration of the primary route to the upstream ISA Server, you might want to change it back.


Event Message: 14132

Event ID

14132

Event Message

The Web Proxy service detected that the array member '%1' is down. Check the array member intra-array address or the network to find out why this array member is not available.


Event Message: 14133

Event ID

14133

Event Message

The Web Proxy service detected that the array member '%1' is available.


Event Message: 14136

Event ID

14136

Event Message

ISA Server dial-out connection failed. The administrator should manually dial the specified phonebook entry to determine if the number can be reached.


Event Message: 14137

Event ID

14137

Event Message

Some of this information may be out of date because of network problems. An attempt to respond to this request from a remote location was unsuccessful. The response is an expired version of the object found in the cache.


Event Message: 14138

Event ID

14138

Event Message

Some of this information has not been updated in the past 24 hours.


Event Message: 14140

Event ID

14140

Event Message

Some of this information may be out of date.


Event Message: 14141

Event ID

14141

Event Message

ISA Server detected a proxy chain loop. There is a problem with the configuration of the ISA Server routing policy. In ISA Management, check the routing configuration on all chained proxies. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Network Configuration, and then click Routing.


Event Message: 14142

Event ID

14142

Event Message

A dial-out to the Internet failed. The error code shown in the Data area of the event properties is specific to the Routing and Remote Access service (RRAS). For more information about this event, see ISA Server Help.

Explanation

This log entry or event is generated by the dial-up entry component of ISA Server when a dial- attempt fails. The problem could be related to authentication.

User Action

The ISA Server administrator should verify that the specified phonebook entry in the dial-up entry configuration can be dialed manually. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Policy Elements, and then click Dial-Up Entries. In addition, check authentication settings.


Event Message: 14143

Event ID

14143

Event Message

ISA Server is too busy to handle this request. Reenter the request or renew the connection to the server (now or at a later time).


Event Message: 14144

Event ID

14144

Event Message

The alert service failed to initialize because system call %1 failed. Some information in the response may have already expired in the cache. If an error code is shown in the Data area of the event properties, it indicates the cause of the failure.


Event Message: 14145

Event ID

14145

Event Message

ISA Server failed to initialize due to a corrupted registry. Restart the service. If this does not resolve the problem, reinstall the server to replace any missing files. If the condition persists, restore the registry. Error Code %1, Key='%2', Value='%3'.


Event Message: 14146

Event ID

14146

Event Message

ISA Server failed to load ISAPI Filter DLL %1. The error code shown in the Data area of the event properties indicates the cause of the failure.


Event Message: 14148

Event ID

14148

Event Message

Web Proxy service failed to bind its socket to %1 port %2. This could be caused by another service that is already using the same port or by a network interface card that is not functional. The error code specified in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The requested service port is already in use, or data loss may have resulted from a large number of packet collisions on the local network segment. It is also possible that there is a problem with the network interface card (NIC).

User Action

Check the NIC. Monitor the service that failed for the server and the client, or monitor traffic on your local network.


Event Message: 14149

Event ID

14149

Event Message

Web Proxy service failed to listen to %1 port %2. The network interface card might not be functional. The error code specified in the Data area of the event properties indicates the cause of the failure. For more information about this event, see ISA Server Help.

Explanation

The Web Proxy service is unable to register itself to listen on the port specified. Some other application might be using the port.

User Action

Use netstat -a to check which ports are in use. Check the port details for each protocol defined for ISA Server. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Policy Elements, and then click Protocol Definitions.


Event Message: 14150

Event ID

14150

Event Message

The ISA Server cache could not initialize the URL cache on disk. The ISA Server cache files are corrupted.


Event Message: 14151

Event ID

14151

Event Message

The ISA Server cache could not initialize the URL cache on disk. The ISA Server cache disk is full.


Event Message: 14152

Event ID

14152

Event Message

A User Datagram Protocol (UDP) packet was dropped because it was larger than the maximum UDP packet allowed by the Firewall service.


Event Message: 14153

Event ID

14153

Event Message

The Web Proxy service is not listening on the defined IntraArrayAddress although resolving requests within an array is enabled. For more information about this event, see ISA Server Help.

Explanation

If Cache Array Routing Protocol (CARP) is enabled, the Web Proxy service on each ISA Server in the array must listen on its Intra-array address.

User Action

Verify that there is a listener set for the Intra-array address on the server for all the directions on which CARP is enabled.


Event Message: 14154

Event ID

14154

Event Message

The Scheduled Content Download Service started the job %1.


Event Message: 14155

Event ID

14155

Event Message

The Scheduled Content Download Service finished the job %1. %2 pages visited.


Event Message: 14156

Event ID

14156

Event Message

The Web Proxy Service switched from primary route %1 to backup route %2. The Web Proxy Service is configured to switch to the backup route if there is some problem with the primary route.


Event Message: 14157

Event ID

14157

Event Message

The Web Proxy Service switched from backup route %1 to primary route %2. Following a problem with the primary route, the Web Proxy service switches to the configured backup route. While using the backup route, the service moves back to the primary route when it is available.


Event Message: 14158

Event ID

14158

Event Message

The Intra-array address defined on this server is not in the Local Address Table (LAT). For more information about this event, see ISA Server Help.

Explanation

The Intra-array address defined in the storage for this server is not in the Local Address Table (LAT).

User Action

Set an Internet Protocol (IP) that is in the LAT as the value of the Intra-array address property. To do this, in the ISA Management console tree, click Servers and Arrays, click Name, click Computer, click the computer name and then click the Array membership tab.


Event Message: 14159

Event ID

14159

Event Message

Failed to read reference to the protocol from the server publishing rule [%1]. Location %2. Storage may be corrupted. Delete this rule and create a new rule.


Event Message: 14160

Event ID

14160

Event Message

Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] is not applied since enterprise policy does not allow publishing. The enterprise policy can be changed to allow publishing.


Event Message: 14161

Event ID

14161

Event Message

Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] was applied successfully. This rule previously failed, but now completed successfully.


Event Message: 14162

Event ID

14162

Event Message

Server publishing rule [%1] will not be applied since the filter that supports the protocol is not enabled. Enable the filter and then apply the rule.


Event Message: 14163

Event ID

14163

Event Message

Server publishing rule [%1] that maps %2 %3 to %4 for protocol [%5] failed because the port on the external interface is being used by another application. The Firewall service failed to bind socket for the server on the firewall since another process is using the same port. Check for any other process using the same port and terminate if necessary.


Event Message: 14164

Event ID

14164

Event Message

Cache drives failed to initialize properly. Caching is disabled. Identify the specific reason for failure from previous event logs. If previous events indicate that the error belongs to a specific drive, then check the drive configuration and then stop and restart the Web Proxy service to enable caching.


Event Message: 14165

Event ID

14165

Event Message

There is inconsistency in some cache files. While initializing cache, some cache files were detected as being from previous cache configurations. For more information about this event, see ISA Server Help.

Explanation

When changes are made to cache configurations some cache data may remain from old configurations and this can cause inconsistencies in cache data.

User Action

Identify warning events regarding data inconsistencies. To avoid inconsistent data retrieval, consider deleting the cache files that were added recently to the configuration. To apply changes, restart the Web Proxy service.


Event Message: 14166

Event ID

14166

Event Message

Cache is intentionally disconnected from the rest of the network. Information is now being served from the cache and there is no connection to the Internet at the present time.


Event Message: 14167

Event ID

14167

Event Message

Recovery of data cache file %1 was completed. If the operation did not complete successfully the error code in the Data area of the Event Viewer indicates the cause of the failure. All cache data is now available. Recovery operation result is: %2%0.


Event Message: 14168

Event ID

14168

Event Message

Some errors were encountered during the restoration of specific data cache files. For more information about this event, see ISA Server Help.

Explanation

Restoration of cache data file failed, only partial cache data may only be available. If an error code appears in the Data area of the event properties, it will indicate the cause of the failure. If the error code indicates that data is corrupt, then consider deleting the cache file. If error code does not indicate file corruption, stop and then restart the Web Proxy service to retry restoration of the cache file.

User Action

Identify warning events regarding data inconsistencies. To avoid inconsistent data retrieval, consider deleting the cache files that were recently added to the configuration. To apply changes, restart the Web Proxy service.


Event Message: 14169

Event ID

14169

Event Message

While restoring cache data, %1 objects with conflicting information were detected. These objects were ignored, and were not restored. This may occur when there is conflict between cache data from previous and present cache configurations. You may consider deleting the cache files that were added to the current configuration, in order to avoid inconsistent data retrieval.


Event Message: 14170

Event ID

14170

Event Message

Restoration of cache data completed. Cache performance will now be at optimal level.


Event Message: 14171

Event ID

14171

Event Message

Cache data was restored successfully from all data cache files.


Event Message: 14172

Event ID

14172

Event Message

Cache failed to initialize properly. Caching will be disabled. The error code in the Data area of the event properties indicates the cause of the failure. (internal code %2). Identify the specific reason for failure from previous relevant event logs. Fix the problem and restart the Web Proxy service to enable caching.


Event Message: 14173

Event ID

14173

Event Message

Path name too long for disk cache %1. Specify a shorter path name.


Event Message: 14174

Event ID

14174

Event Message

Invalid size specified for disk cache %1. Specify a valid disk cache size and restart the Web Proxy service.


Event Message: 14175

Event ID

14175

Event Message

Invalid volume specified for disk cache %1. The volume used as cache drive is invalid. The volume must be a NTFS volume with supported sector sizes. Specify a valid volume as a cache drive. You may need to change your hardware if the required sector size is not supported. Restart the Web Proxy service.


Event Message: 14176

Event ID

14176

Event Message

Disk cache %1 failed to initialize and is disabled. Identify the reason for cache failure by examining previous recorded events, or the error code. Once the problem has been fixed, restart the Web Proxy service to enable the cache. The error code in the Data area of the event properties indicates the cause of the failure (internal code: %2).


Event Message: 14177

Event ID

14177

Event Message

Some certificates cannot be initialized (error code %1). The Web Proxy service could not initialize. Check that all certificates used by the Web Proxy servce are valid. The internal error code in the Data area of the event properties indicates the cause of the failure.


Event Message: 14178

Event ID

14178

Event Message

The Web Proxy service identified that the address %1 was removed from the interface table and stopped listening on port %2.


Event Message: 14179

Event ID

14179

Event Message

The Web Proxy Service identified that the address %1 was added to the interface table and start listening on port %2.


Event Message: 14180

Event ID

14180

Event Message

Alert Service: failed to log event to system log. The following message '%1' could not be logged.


Event Message: 14181

Event ID

14181

Event Message

The ISA Server Control Service was stopped gracefully.


Event Message: 14182

Event ID

14182

Event Message

The Firewall Service was stopped gracefully.


Event Message: 14183

Event ID

14183

Event Message

The Web Proxy Service was stopped gracefully.


Event Message: 14184

Event ID

14184

Event Message

The Schedule Cache Content Download Service was stopped gracefully.


Event Message: 14185

Event ID

14185

Event Message

The Scheduled Cache Content Download Service was started successfully.


Event Message: 14201

Event ID

14201

Event Message

HTTP proxy report message


Event Message: 14202

Event ID

14202

Event Message

HTTP proxy reports


Event Message: 14203

Event ID

14203

Event Message

The ISA Server encountered an error.


Event Message: 14204

Event ID

14204

Event Message

Server error message


Event Message: 14205

Event ID

14205

Event Message

ISA Server: extended error message


Event Message: 14206

Event ID

14206

Event Message

Directory is empty.


Event Message: 14207

Event ID

14207

Event Message

Root directory


Event Message: 14208

Event ID

14208

Event Message

Gopher root at %%s.


Event Message: 14209

Event ID

14209

Event Message

FTP root at %%s.


Event Message: 14210

Event ID

14210

Event Message

Gopher directory at %%s.


Event Message: 14211

Event ID

14211

Event Message

FTP directory %%s at %%s.


Event Message: 14212

Event ID

14212

Event Message

Web Proxy Cache initialization failed due to thread initialization failure.


Event Message: 15001

Event ID

15001

Event Message

ISA Server detected a windows out-of-band attack. For more information about this event, see ISA Server Help.

Explanation

A windows out-of-band denial-of-service attack was attempted against a computer protected by ISA Server. If successful, this attack crashes the computer.

User Action

If logging for dropped packets has been set you can view details of this attack in the packet filter log in the ISALogs, which is located under the ISA Server installation folder. You can use this log to monitor any further intruder activity. Steps against intruder activity might include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.


Event Message: 15002

Event ID

15002

Event Message

ISA Server detected an Internet Protocol (IP) half scan attack. For more information about this event, see ISA Server Help. For more information about this event, see ISA Server Help.

Explanation

An Internet Protocol (IP) half scan attack was attempted against a computer protected by ISA Server. This alert occurs when an unexpected Transmission Control Protocol (TCP) packet with a particular flag (for example, Fin, Ack, All, None) is detected.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.


Event Message: 15003

Event ID

15003

Event Message

ISA Server detected a land attack. For more information about this event, see ISA Server Help.

Explanation

A land attack was attempted against a computer protected by ISA Server. This alert occurs when a Transmission Control Protocol (TCP) SYN packet or User Datagram Protocol (UDP) packet is sent with a spoofed source Internet Protocol (IP) address and port number that is identical to that of the destination IP address and port. The effect of this makes it appear that the host computer has sent a packet to itself. If this attack is successful, then a loop is created and the computer crashes.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.


Event Message: 15004

Event ID

15004

Event Message

ISA Server detected a well-known port scan attack. A well-known port is any port in the range of 1-2048. For more information about this event, see ISA Server Help.

Explanation

A well-known port scan attack was attempted against a computer protected by ISA Server. This alert occurs when an attempt is made to scan well-known ports on a computer to detect services running on these ports.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.


Event Message: 15005

Event ID

15005

Event Message

ISA Server detected a all port scan attack. For more information about this event, see ISA Server Help.

Explanation

A all port scan attack was attempted against a computer protected by ISA Server. This alert occurs when an attempt is made to scan ports on a computer to detect services running on these ports.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.


Event Message: 15006

Event ID

15006

Event Message

ISA Server detected a User Datagram Protocol (UDP) bomb attack. For more information about this event, see ISA Server Help.

Explanation

A User Datagram Protocol (UDP) bomb attack was attempted against a computer protected by ISA Server. This alert occurs when there is an attempt to send an illegal UDP packet.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.


Event Message: 15007

Event ID

15007

Event Message

ISA Server detected a ping of death attack. For more information about this event, see ISA Server Help.

Explanation

A ping of death attack was attempted against a computer protected by ISA Server. This alert occurs when a large amount of information is appended to an Internet Control Message Protocol (ICMP) echo request (a ping) packet. If this attack is successful, the computer crashes.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a static packet filter to block incoming ICMP packets or enabling the filtering of IP fragments by using ISA Management. To enable filtering, in the ISA Management console tree, click Servers and Arrays, click Name, click Access Policy, click IP Packet Filters properties, and then click the Packet Filters tab.


Event Message: 15101

Event ID

15101

Event Message

ISA Server detected a windows out-of-band attack from Internet Protocol (IP) address %1. For more information about this event, see ISA Server Help.

Explanation

A windows out-of-band denial-of-service attack was attempted against a computer protected by ISA Server. If successful, this attack crashes the computer.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.


Event Message: 15102

Event ID

15102

Event Message

ISA Server detected an Internet Protocol (IP) half-scan attack from IP address %1. For more information about this event, see ISA Server Help.

Explanation

An Internet Protocol (IP) half-scan attack was attempted against a computer protected by ISA Server. This alert occurs when an unexpected Transmission Control Protocol (TCP) packet with a particular flag (for example, Fin, Ack, All, None) is detected.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.


Event Message: 15103

Event ID

15103

Event Message

ISA Server detected a land attack on Internet Protocol (IP) address %1. For more information about this event, see ISA Server Help.

Explanation

A land attack was attempted against a computer protected by ISA Server. This alert occurs when a Transmission Control Protocol (TCP) SYN packet or User Datagram Protocol (UDP) packet is sent with a spoofed source Internet Protocol (IP) address and port number that is identical to that of the destination IP address and port. The effect of this makes it appear that the host computer has sent a packet to itself. If this attack is successful, a loop is created and the computer crashes.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.


Event Message: 15104

Event ID

15104

Event Message

ISA Server detected a well-known port scan attack from Internet Protocol (IP) address %1. A well-known port is any port in the range of 0-2048. For more information about this event, see ISA Server Help.

Explanation

A well-known port scan attack was attempted against a computer protected by ISA Server. This alert occurs when an attempt is made to scan ports on this computer to detect the services running on these ports.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.


Event Message: 15105

Event ID

15105

Event Message

ISA Server detected all port scan attack from Internet Protocol (IP) address %1. For more information about this event, see ISA Server Help.

Explanation

A all port scan attack was attempted against a computer protected by ISA Server. This alert occurs when an attempt is made to scan ports on this computer to detect the services running on it.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.


Event Message: 15106

Event ID

15106

Event Message

ISA Server detected a User Datagram Protocol (UDP) bomb attack from Internet Protocol (IP) address %1. For more information about this event, see ISA Server Help.

Explanation

A User Datagram Protocol (UDP) bomb attack was attempted against a computer protected by ISA Server. This alert occurs when there is an attempt to send an illegal UDP packet.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include setting up a packet filter or policy rules to inhibit traffic from the source of the intrusion.


Event Message: 15107

Event ID

15107

Event Message

ISA Server detected a ping-of-death attack from Internet Protocol (IP) address %1. For more information about this event, see ISA Server Help.

Explanation

A ping-of-death attack was attempted against a computer protected by ISA Server. This alert occurs when a large amount of information is appended to an Internet Control Message Protocol (ICMP) echo request (ping) packet. If this attack is successful, the computer crashes.

User Action

If logging for dropped packets has been set, you can view details of this attack in the packet filter log in the ISALogs folder, which is located under the ISA Server installation folder. You can use this log to monitor intruder activity. Steps against intruder activity include identifying the source of the intrusion, setting up a static packet filter to block incoming ICMP packets, creating a protocol rule that specifically denies incoming ICMP echo request packets from the Internet, or enabling the filtering of IP fragments by using ISA Management. To enable filtering, in the ISA Management console tree, click Arrays, click Name, click Access Policy, click IP Packet Filters properties, and then click the Packet Filters tab.


Microsoft Internet Security and Acceleration Server

Online support
and information

  • ISA Server home page
  • Contact product support
  • Learn more about third-party solutions


Microsoft Product Support Services on the Web

Additional help on the Internet

If you have a technical question about Microsoft Internet Security and Acceleration Server and can't find your answer in the product Help files or other documentation, contact the computer manufacturer that provided your software.

You can also find the latest technical information on Microsoft products through online product support at the Microsoft Web site. (http://www.microsoft.com/)