Professional Documents
Culture Documents
ISA 2006 Lab Manual
ISA 2006 Lab Manual
Lab Manual
Lab Summary
Contents
There are nine modules in this lab. You can complete each of these lab modules
independent of the other modules.
The monitor icons ( ) indicate which virtual machines are needed.
The 06 code indicates exercises that are specific to ISA Server 2006.
The EE code indicates exercises that are specific to ISA Server Enterprise
Edition.
The up arrow ( ) indicates exercises that depend on the previous exercise.
4 Module A: Introduction to ISA Server
Lab Setup
To complete each lab module, you need to review the following:
Virtual PC
This lab makes use of Microsoft Virtual PC 2004, which is an application that
allows you to run multiple virtual computers on the same physical hardware.
During the lab you will switch between different windows, each of which contains
a separate virtual machine running Windows Server 2003.
Before you start the lab, familiarize yourself with the following basics of
Virtual PC:
To issue the Ctrl-Alt-Del keyboard combination inside a virtual machine, use
the <right>Alt-Del instead.
To enlarge the size of the virtual machine window,
drag the right bottom corner of the window.
To switch to full-screen mode, and to return from
full-screen mode, press <right>Alt-Enter.
Lab Computers
The lab uses five computers in virtual machines.
Ronald Beekelaar
[email protected]
Exercise 1
Exploring the User Interface
In this exercise, you will explore the user interface of ISA Server.
Note that the steps in this exercise and the other exercises in this module, do not enable,
configure or test the functionality of ISA Server. In later modules, the functionality is
configured and used in scenarios.
1. On the Paris computer, a. On the Paris computer, on the Start menu, click All Programs, click
explore the task pane. Microsoft ISA Server, and then click ISA Server Management.
The ISA Server console opens. This is the console from which all
configuration of the ISA server is done.
b. In the ISA Server console, in the left pane, expand Paris, expand
Configuration, and then select Add-ins.
Note: The Add-ins node is only used here as an example to start the
exploration of the new user interface.
The user interface of the ISA Server console consists of three main
parts:
The tree pane (or left pane) - This pane contains a short list of nodes. The
nodes logically group related management or configuration settings.
The details pane (or right pane) - For each node in the left pane, the details
pane contains detailed information related to the node. The details pane may
contain several tabs, such as Application Filters and Web Filters for the Add-
ins node.
The task pane - The task pane contains a Tasks tab with relevant commands
for the selected node in the tree pane, or for the configuration element in the
details pane. The task pane also contains an Help tab with context sensitive
help for the selected node or configuration element.
c. Drag the vertical divider between the tree pane (left) and the
details pane, to make the details pane area larger or smaller.
d. On the vertical divider between the details pane and the task pane, click
the arrow button.
The task pane closes to make a larger area of the screen available
for the details pane.
e. Click the arrow button again.
The task pane opens again to allow access to the commands on the
task pane.
Module A: Introduction to ISA Server 7
f. Ensure that in the left pane, the Add-ins node is selected, and then in the
right pane, on the Web Filters tab, select (for example)
RADIUS Authentication Filter.
Notice that the available commands in the task pane change, when
a configuration element (a web filter in this example) is selected in the right
pane.
g. In the right pane, right-click RADIUS Authentication Filter.
A context menu appears with commands applicable to this web
filter. (Do not click a command on the menu.)
At any time, you can click the most common tasks in the task pane,
or select from a more extensive list of commands by right-clicking the
configuration element.
h. In the task pane, select the Help tab.
The Help tab in the task pane provides context-sensitive help
information related to the selection configuration element.
i. In the task pane, select the Tasks tab.
The following task is related to the use of Virtual PC.
2. Explore how you can make a. Drag the bottom right corner of the Paris window, to make the window
the Virtual PC window larger, or larger or smaller.
switch to full-screen mode. Virtual PC installs a special video driver in the guest operating
system, which allows you to select any arbitrary resolution, by dragging the
bottom right corner of the Virtual PC window.
b. Press the Ctrl-key, and then drag the bottom right corner of the
Virtual PC window, to snap the window size to standard resolutions, such as
800x600.
c. Press <right>Alt-Enter.
d. If a warning message box appears, click Continue to confirm that you
can press <right>Alt-Enter again to return from full-screen mode.
The Virtual PC window switches to full-screen mode after you press
<right>Alt-Enter. The resolution of the guest operating system is automatically
adjusted to fill the entire screen of the host computer. You may need to
maximize the ISA Server console window, in order to use the entire screen.
Virtual PC calls the <right>Alt key, the "host key".
e. Press <right>Alt-Enter again to return from full-screen mode.
3. Explore the main nodes in a. In the ISA Server console, in the left pane, select Configuration.
the ISA Server console: A single ISA Server (or an array of multiple ISA Servers) has two
main areas of configuration:
- Configuration Configuration node - This node contains all configuration settings that are
- Networks relatively static. This includes Networks configuration, Cache configuration,
- Firewall Policy Add-ins (application filters and Web filters) and General. You would typically
- Monitoring not change the configuration of those elements very often. ISA Server 2006
Enterprise Edition also has a Servers node.
Firewall Policy node - This node contains a single list of all the access rules
(outgoing) and the publishing rules (incoming). These rules will change more
often, since they reflect the business rules and firewall access policy of a
company.
b. In the left pane, select Networks.
The Networks node contains the configuration of all the networks
connected to the ISA Server. Network rules are defined between each network.
This includes networks directly connected by network adapters such as
External, Internal and Perimeter, virtual networks such as all the
VPN Clients and Quarantined VPN Clients and special networks such as
Local Host.
The initial configuration of the networks and the related firewall
8 Module A: Introduction to ISA Server
policy rules is done by selecting a network template from Templates tab in the
task pane.
(Do not change the network template now.)
Exercise 2 in this lab module explores the Networks configuration.
c. In the left pane, select Firewall Policy.
The Firewall Policy node contains a list of all access rules and
publishing rules.
Exercise 3 in this lab module explores the Firewall Policy
configuration.
d. If the task pane is closed, click the arrow button to open the task pane.
The task pane for the Firewall Policy node contains an additional
tab named Toolbox. This tab has 5 sliding sections (Protocols, Users,
Content Types, Schedules and Network Objects) that list all the rule elements
that you can use in the access rules and publishing rules.
e. In the task pane, on the Toolbox tab, click the Protocols heading, and
then click Common Protocols.
The rule elements, such as protocol definitions, are selected when
new access rules or publishing rules are created.
f. In the task pane, on the Toolbox tab, click the Users heading, and then
click New.
The New User Set wizard appears. A user set is a collection of
users (from Windows, RADIUS or SecurID) and groups, defined together in a
single set. You can apply an access rule or publishing rule to one or more user
sets.
g. Click Cancel to close the New User Set Wizard.
h. In the left pane, select Monitoring.
The Monitoring node has multiple tabs (Dashboard, Alerts,
Sessions, Services, Reports, Connectivity Verifiers and Logging) that allow you
to monitor, control, investigate, troubleshoot and plan firewall operations. ISA
Server 2006 Enterprise Edition also has a Configuration tab.
The Dashboard tab contains summary boxes for five of the tabs and
a running System Performance monitor that displays a real-time graph of the
current rate of allowed and dropped packets.
Exercise 5 in this lab module explores the Monitoring node.
i. On the Dashboard tab, click the Sessions summary box header.
The Sessions tab of the Monitoring node is displayed. This tab
displays the client sessions that are currently active on the ISA Server. If you
only want to see specific sessions, you can filter the session list.
Other tabs of the Monitoring node are explored in exercise 5 in this
lab module.
4. Explore the Export and a. In the ISA Server console, in the left pane, right-click Paris.
Import configuration commands. The context menu of the Paris node contains Export and Import
commands. You can use these commands to export configuration setting to an
XML file, and import the settings later at this computer or at another computer.
The Export and Import commands are present on the context menu
of almost all the nodes in the left pane. This includes the Networks node, the
Firewall Policy node and even individual rules and rule elements.
Module A: Introduction to ISA Server 9
Exercise 2
Ease of Use: Multiple Networks
In this exercise, you will explore how ISA Server uses multiple networks.
1. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane,
explore how ISA Server uses expand Paris, expand Configuration, and then select Networks.
multiple networks with One of the most important changes in ISA Server 2004 and
IP address ranges, instead of the ISA Server 2006, in comparison with ISA Server 2000, is the concept of
concept of a Local Address Table multiple networks connected to the ISA Server, which are all treated similarly
(LAT). for configuration purposes.
All firewall policy rules can be defined in terms of Source network
and Destination network.
b. In the right pane, on the (lower) Networks tab, right-click Internal, and
then click Properties.
c. In the Internal Properties dialog box, select the Addresses tab.
Compare:
ISA Server 2004 and ISA Server 2006 - The IP addresses of the Internal
network only define what network interfaces are included in the network named
Internal. Other networks, such as Perimeter are defined in a similar fashion.
There is no equivalent to ISA Server 2000's Local Address Table (LAT). The
application of packet filters, rules and Network Address Translation (NAT) or
routing of IP packets is configured separately.
ISA Server 2000 - The LAT is a very significant part of the configuration of
ISA Server. It automatically determines on which network interface packet
filters are applied and where NAT or routing of IP packets is performed.
d. Click Cancel to close the Internal Properties dialog box.
Notice that the Perimeter network is defined as the IP address
range 23.1.1.0 - 23.1.1.255. The Local Host network is defined as the
ISA Server computer itself. All other IP addresses belong to the External
network.
The VPN Client and Quarantined VPN Clients networks have dynamic
membership and contain connecting VPN client computers.
e. On the Network Sets tab, right-click All Protected Networks and then
click Properties.
f. In the All Protected Networks Properties dialog box, select the
Networks tab.
Network Sets are groupings of existing Networks that can be used
in firewall policy rules as well. This makes it easy to refer to all networks, or
all related networks. You can define additional network sets.
The definition of the All Protected Networks network set is all
existing networks, EXCEPT the External network.
ISA Server 2006 Enterprise Edition also allows you to define
Networks and Network Sets at the enterprise-level, so that they can be used in
all ISA Server arrays. With enterprise networks, individual array
administrators don’t need to be aware of changes in the larger corporate
networks. Changes to an enterprise network take effect without requiring an
10 Module A: Introduction to ISA Server
3. Explore how a. In the ISA Server console, in the left pane, ensure that Networks is
network templates are used to selected
configure network rules b. In the task pane, select the Templates tab.
and firewall policy rules.
Network Templates are predefined XML files that contain common
network topologies. They can be used to configure the network rules between
networks and the firewall policy rules. The graphic associated with each
network template helps you understand the selected network topology.
ISA Server 2006 includes five network templates (Edge Firewall,
3-Leg Perimeter, Front Firewall, Back Firewall and Single Network
Adapter).
Normally, setting up ISA Server includes four steps:
1 Install network adapters and assign IP addresses.
2 Install the ISA Server software. The installation wizard asks you to specify
the IP addresses of the Internal network.
3 Open the ISA Server console and select the Network Template that most
closely matches your network topology.
4 Modify the created firewall policy rules to meet specific security
requirements. For example limit access to specific users.
Note: Installing ISA Server 2006 Enterprise Edition also includes a
step to install the Configuration Storage Server, which stores the configuration
information of all ISA Server arrays.
c. On the Templates tab, click 3-Leg Perimeter.
Note: 3-Leg Perimeter is already the current active network
template on Paris. It matches most closely the network topology of the lab
environment. For demonstration purposes, this task explores the Network
Template Wizard without changing any settings.
d. In the Network Template Wizard dialog box, click Next.
ISA Server allows you to export the current configuration to a
backup (XML) file, which can be restored later.
e. On the Export the ISA Server Configuration page, click Next.
f. On the Internal Network IP Addresses page, click Next.
g. On the Perimeter Network IP Addresses page, click Next.
Each network template contains one or more firewall policy rule
sets. These firewall policies allow you to start with a set of firewall policy rules
that best matches your network and security policy.
h. On the Select a Firewall Policy page, in the Select a firewall policy list
box, select Allow limited Web access, allow access to network services on
Perimeter network.
i. In the Description list box, scroll to the end of the text to see a
description of the firewall policy rules that are created, if this firewall policy is
selected.
j. On the Select a Firewall Policy page, click Next.
k. On the Completing the Network Template Wizard page, click CANCEL
(do NOT click Finish).
The network rules and firewall policy rules on the ISA Server are
not changed.
4. Explore the client support a. In the ISA Server console, in the left pane, ensure that Networks is
configuration settings per network. selected, and then in the right pane, select the (lower) Networks tab.
b. Right-click Internal, and then click Properties.
c. In the Internal Properties dialog box, select the Firewall Client tab.
The Firewall Client tab specifies whether client computers on the
selected network (Internal) can access other networks such as the Internet,
through ISA Server, by using the Firewall Client software (port 1745).
d. Select the Web Proxy tab.
The Web Proxy tab specifies whether client computers on the
12 Module A: Introduction to ISA Server
Exercise 3
Ease of Use: Single Rule Base
In this exercise, you will explore how ISA Server uses a single list of firewall rules.
1. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
explore the single firewall policy Firewall Policy.
rule list. ISA Server uses a single rule list for access rules and publishing
rules.
Create an access rule:
b. In the right pane, on the Firewall Policy tab, select Default rule.
Name: Allow Web traffic to Note: New rules are added to the rule list before the currently
Internet selected rule. Although it does not make a difference when only the default rule
exists, it is a good practice to always explicitly select an existing rule, before
Applies to: HTTP creating a new rule.
c. In the task pane, on the Tasks tab, click Create Access Rule.
From network: Internal d. In the New Access Rule Wizard dialog box, in the Access rule name
To network: External text box, type Allow Web traffic to Internet, and then click Next.
e. On the Rule Action page, select Allow, and then click Next.
f. On the Protocols page, in the This rule applies to list box, select
Selected protocols, and then click Add.
The Add Protocols dialog box appears.
g. In the Add Protocols dialog box,
click Web, click HTTP, and click Add,
and then click Close to close the Add Protocols dialog box.
h. On the Protocols page, click Next.
i. On the Access Rule Sources page, click Add.
The Add Network Entities dialog box appears.
j. In the Add Network Entities dialog box,
click Networks, click Internal, and click Add,
and then click Close to close the Add Network Entities dialog box.
k. On the Access Rule Sources page, click Next.
l. On the Access Rule Destinations page, click Add.
The Add Network Entities dialog box appears again.
m. In the Add Network Entities dialog box,
click Networks, click External, and click Add,
and then click Close to close the Add Network Entities dialog box.
n. On the Access Rule Destinations page, click Next.
o. On the User Sets page, click Next.
p. On the Completing the New Access Rule Wizard page, click Finish.
A new firewall policy rule is created that allows the HTTP protocol
from the Internal network to the External network for all users. The External
network represents the Internet.
Notice that the new rule has not been applied yet.
q. Do NOT click Apply to apply the new rule.
14 Module A: Introduction to ISA Server
2. Add the HTTPS and FTP a. In the task pane, on the Toolbox tab, in the Protocols section, click
protocol to the Allow Web traffic Web.
to Internet access rule. The Web protocol list opens up. The list includes HTTPS and FTP.
b. Drag HTTPS from the Toolbox to HTTP in the Protocols column of
the Allow Web traffic to Internet access rule.
The HTTPS protocol is added to the access rule.
c. Drag FTP from the Toolbox to HTTP/HTTPS in the Protocols column
of the Allow Web traffic to Internet access rule.
The FTP protocol is added to the access rule.
d. Click the box with the minus-sign in front of the
Allow Web traffic to Internet access rule to display the access rule with
multiple protocols on a single line.
Instead of dragging protocols from the toolbox to configure a
firewall policy rule, you can also right-click on the rule, and select Properties,
as is shown in the next task.
3. Explore the properties of a. Right-click the Allow Web traffic to Internet access rule, and then
the Allow Web traffic to Internet click Properties.
access rule. b. In the Allow Web traffic to Internet Properties dialog box, on the
Protocols tab, click Add.
c. In the Add Protocols dialog box, click Common Protocols.
You can add any TCP/UDP protocol to the access rule. You can
also add non-TCP/UDP protocols, such as Ping (ICMP) to the access rule.
d. Click Close to close the Add Protocols dialog box.
e. On the To tab, click Add.
Instead of applying the access rule to traffic to all destinations on
the External network, you can limit access to specific destinations by using any
of the other network entities (Computers, Address Ranges, Subnets,
Domain Name Sets, URL Sets and Computer Sets).
f. Click Close to close the Add Network Entities dialog box.
g. On the From tab, click Add.
h. In the Add Network Entities dialog box, click Networks.
The Local Host network (representing the ISA Server computer)
can be used as the source network in an access rule.
i. Click Close to close the Add Network Entities dialog box.
j. Click Cancel to close the Allow Web traffic to Internet Properties dialog
box.
4. Explore the HTTP protocol a. Right-click the Allow Web traffic to Internet access rule, and then
scanning features of the Allow click Configure HTTP.
Web traffic to Internet access b. In the Configure HTTP policy for rule dialog box, examine the five tabs
rule. with the HTTP filter settings.
ISA Server examines the contents of all HTTP traffic. This is called
For demonstration purposes,
application level filtering, or content filtering. HTTP packets that do not meet
configure the rule to block HTTP
the specifications on the General tab are blocked.
traffic from MSN Messenger.
Many applications use HTTP as their transport protocol or even as
HTTP Header: tunnel protocol, because the HTTP port 80 is configured to be allowed through
- User-Agent: MSMSGS most firewalls. Application level filtering can block HTTP traffic that does not
conform to the protocol specification or unwanted HTTP applications or
content.
These settings, such as limiting the maximum URL length, would have blocked
the exploitation of vulnerabilities described in more than 40 different Microsoft
Security Bulletins, between MS98-003 and now.
c. On the Signatures tab, click Add.
d. In the Signature dialog box, complete the following information:
Name: MSN Messenger traffic
Module A: Introduction to ISA Server 15
6. Discard the Allow Web a. In the right pane, click Discard to remove the unsaved Allow Web
traffic to Internet access rule. traffic to Internet access rule.
b. Click Yes to confirm that you want to discard the changes.
If you clicked Apply during this exercise, the access rule is saved.
Right-click the access rule, click Delete, and then click Apply and OK to delete
the access rule again.
16 Module A: Introduction to ISA Server
Exercise 4
Ease of Use: Monitoring
In this exercise, you will explore how ISA Server uses monitoring.
1. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane,
explore the new Monitoring expand Paris, and then select Monitoring.
features in ISA Server. The Monitoring node has multiple tabs that allow you to monitor,
control, investigate, troubleshoot and plan firewall operations.
On the first tab (Dashboard), five of the other tabs are represented
by summary boxes. By clicking the header of a summary box, you can go to the
corresponding tab to see more details.
b. Select the Alerts tab.
The Alerts tab lists events that ISA Server informs you about. You
can configure for which types of events ISA Server creates an alert.
c. Select the Sessions tab.
The Sessions tab shows the current SecureNAT, Firewall client,
Web Proxy client and VPN client sessions. You can also disconnect client
sessions on this tab.
d. Select the Services tab.
The Services tab displays the status of the Microsoft Firewall
service and other related services.
If you enable the ISA Server for VPN connections, then the
Routing and Remote Access service status is also displayed.
For ISA Server 2006 Enterprise Edition, if you enable NLB integration, then
the Network Load Balancing driver status is also displayed.
e. Select the Reports tab.
The Reports tab lists the defined usage reports. Reports show you
ISA Server activity over time, such as performance and security information.
You can also create new reports on this tab.
f. Select the Connectivity Verifiers tab.
The Connectivity Verifiers tab allows you to define
Connectivity Verifiers. A connectivity verifier periodically connects from the
ISA Server to a computer that you specify, to test current connectivity by using
either an HTTP GET request, a Ping request, or by attempting to establish a
TCP connection to a port that you specify. ISA Server can use connectivity
verifiers to alert you if a network connection fails.
g. Select the Logging tab.
Note: You may (temporarily) need to close the task pane in order to
see the Logging tab.
The Logging tab is used to configure the Firewall Server log files,
and to view the contents of the log files online.
h. In the task pane, on the Tasks tab, click Configure Firewall Logging.
ISA Server 2006 logging supports three log storage formats:
MSDE Database (*.mdf), SQL Database (ODBC) or File (*.w3c, text).
Module A: Introduction to ISA Server 17
1. On the Denver computer, a. On the Denver computer, open Internet Explorer. In the Address box,
test your connectivity by opening type http://istanbul.fabrikam.com, and then press Enter.
Internet Explorer and attempting to Internet Explorer is unable to connect to the Web site.
connect to http://
b. Look at the bottom of the Web page and view the reason why the Web
istanbul.fabrikam.com
page cannot be displayed.
ISA Server denies the request. (502 Proxy Error - ISA Server
denied the specified URL). This is because you have not created any access
rules yet.
The firewall policy on ISA Server always contains a rule named
Default rule. This rule denies all network traffic. This mean that ISA Server
denies any network traffic that you did not specifically allow in another rule.
c. Close Internet Explorer.
Perform the following steps on the Paris computer.
2. On the Paris computer, a. On the Paris computer, on the Start menu, click All Programs, click
create a new access rule. Microsoft ISA Server, and then click ISA Server Management.
The ISA Server console opens.
Name: Allow outbound Web
b. In the ISA Server console, expand Paris, and then select
traffic
Firewall Policy.
Applies to: HTTP, HTTPS, FTP c. In the right pane, on the Firewall Policy tab, select Default rule.
It is a good practice to always select an existing rule, before
From network: Internal creating a new rule, to indicate where the new rule is added in the list.
To network: External d. In the task pane, on the Tasks tab, click Create Access Rule.
Instead of using the task pane, you can also right-click
Firewall Policy, click New, and then click Access Rule.
e. In the New Access Rule Wizard dialog box, in the Access rule name
text box, type Allow outbound Web traffic, and then click Next.
f. On the Rule Action page, select Allow, and then click Next.
g. On the Protocols page, in the This rule applies to list box, select
Selected protocols, and then click Add.
Module A: Introduction to ISA Server 19
4. Examine the network rule a. In the left pane, expand Configuration, and then select Networks.
for connectivity between the b. In the right pane, on the Network Rules tab, select the rule that defines
Internal network and the External the connectivity between the Internal network and the External network.
network.
In the default configuration for the 3-Leg Perimeter network
template, the network rule named Internet Access (rule 5) indicates that
network traffic between the Internal network and the External network will use
NAT.
5. Examine the Web Proxy a. On the Networks tab, right-click Internal, and then click Properties.
settings of the Internal network. b. In the Internal Properties dialog box, select the Web Proxy tab.
The Enable Web Proxy clients check box indicates that ISA Server
listens (on port 8080) for requests from Web Proxy clients on the Internal
network.
c. Click Cancel to close the Internal Properties dialog box.
Perform the following steps on the Denver computer.
6. On the Denver computer, a. On the Denver computer, open Internet Explorer. In the Address box,
test your connectivity again by type http://istanbul.fabrikam.com, and then press Enter.
opening Internet Explorer and Internet Explorer displays the Istanbul Web site. The access rule
connecting to http:// that you created grants access to network traffic to the Istanbul Web server.
istanbul.fabrikam.com and by
b. In Internet Explorer, on the Tools menu, click Internet Options.
establishing an FTP session with
istanbul.fabrikam.com. c. In the Internet Options dialog box, on the Connections tab, click
LAN Settings.
Notice that Denver is indeed configured as Web Proxy client.
d. Click Cancel to close the Local Area Network (LAN) Settings dialog
20 Module A: Introduction to ISA Server
box.
e. Click Cancel to close the Internet Options dialog box.
f. Close Internet Explorer.
g. Open a Command Prompt window.
h. At the command prompt, type ftp istanbul.fabrikam.com, and then
press Enter.
The FTP server on Istanbul prompts you to log on. This result
confirms that you can connect using the FTP protocol.
i. Type Ctrl-C to close the FTP session.
j. If the ftp> prompt appears, type quit, and then press Enter.
k. Close the Command Prompt window.
Perform the following steps on the Paris computer.
7. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
create a new Computer Set rule Firewall Policy.
element. b. In the task pane, on the Toolbox tab, in the Network Objects section,
right-click Computer Sets, and then click New Computer Set.
Name: Restricted Internal
c. In the New Computer Set Rule Element dialog box, in the Name text
Computers
box, type Restricted Internal Computers.
Included in the set: d. Click Add, and then click Address Range.
10.1.1.5-10.1.1.8 e. In the New Address Range Rule Element dialog box, complete the
(Domain Controllers) following information:
Name: Domain Controllers
Start Address: 10.1.1.5
End Address: 10.1.1.8
Description: DCs on the internal network
and then click OK.
The example suggests that there are 4 domain controllers on the
Internal network. The lab only has a single domain controller named Denver
(10.1.1.5).
f. Click OK to close the New Computer Set Rule Element dialog box.
A new Computer Set rule element is created.
8. Create a new access rule. a. In the Firewall Policy list, select the Allow outbound Web traffic rule.
The new rule will be added before the selected rule.
Name: Deny restricted
b. In the task pane, on the Tasks tab, click Create Access Rule.
computers
c. In the New Access Rule Wizard dialog box, in the Access rule name
Action: Deny text box, type Deny restricted computers, and then click Next.
d. On the Rule Action page, select Deny, and then click Next.
Applies to: All outbound traffic e. On the Protocols page, in the This rule applies to list box, select
All outbound traffic, and then click Next.
From: Restricted Internal
Computers f. On the Access Rule Sources page, click Add.
To network: External g. In the Add Network Entities dialog box,
click Computer Sets, click Restricted Internal Computers, and click Add,
and then click Close to close the Add Network Entities dialog box.
h. On the Access Rule Sources page, click Next.
i. On the Access Rule Destinations page, click Add.
j. In the Add Network Entities dialog box,
click Networks, click External, and click Add,
and then click Close to close the Add Network Entities dialog box.
k. On the Access Rule Destinations page, click Next.
l. On the User Sets page, click Next.
m. On the Completing the New Access Rule Wizard page, click Finish.
Module A: Introduction to ISA Server 21
A new firewall policy rule is created that denies all network traffic
from the computers in the Restricted Internal Computers set to the External
network.
The new rule is listed first in the firewall policy rule list.
n. Click Apply to apply the new rule, and then click OK.
Perform the following steps on the Denver computer.
9. On the Denver computer, a. On the Denver computer, open Internet Explorer. In the Address box,
test your connectivity again by type http://istanbul.fabrikam.com, and then press Enter.
opening Internet Explorer and Internet Explorer is unable to connect to the Web site (502 Proxy
attempting to connect to http:// Error). ISA Server denies access to the Istanbul Web site, because Denver
istanbul.fabrikam.com. (10.1.1.5) is in the Restricted Internal Computers set and is denied access by
the new access rule.
b. Close Internet Explorer.
Perform the following steps on the Paris computer.
10. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
move the Allow outbound Web Firewall Policy.
traffic rule, before the Deny b. In the right pane, right-click the Allow outbound Web traffic rule
restricted computers rule. (order 2), and then click Move Up.
The Allow outbound Web traffic rule (order 1) is now listed before
the Deny restricted computers rule (order 2).
c. Click Apply to save the changes, and then click OK.
Perform the following steps on the Denver computer.
11. On the Denver computer, a. On the Denver computer, open Internet Explorer. In the Address box,
test your connectivity again by type http://istanbul.fabrikam.com, and then press Enter.
opening Internet Explorer and Internet Explorer displays the Istanbul Web site, even though the
connecting to http:// Firewall Policy list contains a rule that denies access from the Denver
istanbul.fabrikam.com. (10.1.1.5) computer.
Note: To evaluate access, ISA Server follows the Firewall Policy
rule order very strictly. Currently the Allow rule for Web traffic from Denver is
listed before the Deny rule for all protocols from Denver.
b. Close Internet Explorer.
Perform the following steps on the Paris computer.
12. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
delete the Deny restricted Firewall Policy.
computers access rule. b. In the right pane, right-click the Deny restricted computers rule, and
then click Delete.
c. Click Yes to confirm that you want to delete the rule.
The access rule is deleted.
d. Click Apply to save the changes, and then click OK.
22 Module A: Introduction to ISA Server
Exercise 2
Enabling the Use of the Ping command from Client Computers
In this exercise, you will configure ISA Server to allow ICMP network traffic, used by the
Ping command, from client computers on the internal network.
1. On the Denver computer, a. On the Denver computer, open a Command Prompt window.
use the Ping command to test b. At the command prompt, type ping istanbul.fabrikam.com, and then
connectivity with press Enter.
istanbul.fabrikam.com
The ping requests time out, because by default the ISA Server does
not allow outgoing ping requests (ICMP type 8 packets) from computers on the
internal network to the Internet.
c. Close the Command Prompt window.
Perform the following steps on the Paris computer.
2. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
create a new access rule. Firewall Policy.
b. In the right pane, select the first rule to indicate where the new rule is
Name: Allow outbound Ping added to the rule list.
traffic
c. In the task pane, on the Tasks tab, click Create Access Rule.
Applies to: PING d. In the New Access Rule Wizard dialog box, in the Access rule name
text box, type Allow outbound Ping traffic, and then click Next.
From network: Internal e. On the Rule Action page, click Allow, and then click Next.
To network: External f. On the Protocols page, in the This rule applies to list box, select
Selected protocols, and then click Add.
g. In the Add Protocols dialog box,
click Common Protocols, click PING, and click Add,
and then click Close to close the Add Protocols dialog box.
The PING protocol definition is ICMP protocol, ICMP type 8.
h. On the Protocols page, click Next.
i. On the Access Rule Sources page, click Add.
j. In the Add Network Entities dialog box,
click Networks, click Internal, and click Add,
and then click Close to close the Add Network Entities dialog box.
k. On the Access Rule Sources page, click Next.
l. On the Access Rule Destinations page, click Add.
m. In the Add Network Entities dialog box,
click Networks, click External, and click Add,
and then click Close to close the Add Network Entities dialog box.
n. On the Access Rule Destinations page, click Next.
o. On the User Sets page, click Next.
p. On the Completing the New Access Rule Wizard page, click Finish.
A new firewall policy rule is created that allows the ICMP protocol,
Module A: Introduction to ISA Server 23
ICMP type 8, from the Internal network to the External network for all users.
q. Click Apply to apply the new rule, and then click OK.
3. Examine the PING a. In the task pane, on the Toolbox tab, in the Protocols section, expand
protocol definition. Common Protocols, right-click PING, and then click Properties.
b. In the PING Properties dialog box, select the Parameters tab.
Note: A protocol definition for a firewall policy rule, can use other
protocols than only TCP (IP protocol 6) or UDP (IP protocol 17).
c. Click Cancel to close the PING Properties dialog box.
Perform the following steps on the Denver computer.
4. On the Denver computer, a. On the Denver computer, open a Command Prompt window.
use the Ping command to test b. At the command prompt, type ping istanbul.fabrikam.com, and then
connectivity with press Enter.
istanbul.fabrikam.com again.
The Istanbul computer returns four echo replies, because
ISA Server allows outgoing echo requests from the computers on the internal
network to the Internet.
Note: All firewall policy rules are stateful. This means that a single
rule allows the request and the corresponding reply to the sender.
c. Close the Command Prompt window.
Perform the following steps on the Istanbul computer.
5. On the Istanbul computer, a. On the Istanbul computer, open a Command Prompt window.
use the Ping command to test b. At the command prompt, type ping 39.1.1.1, and then press Enter.
connectivity with the ISA Server.
The ping requests time out, because the ISA Server does not allow
incoming ping requests from computers on the Internet. The
Allow outbound Ping traffic access rule only allows replies to earlier
outgoing ping requests to come from the Internet.
c. Close the Command Prompt window.
24 Module A: Introduction to ISA Server
Exercise 3
Allowing Outbound Access from the ISA Server
In this exercise, you will configure ISA Server to allow outbound access from the ISA Server
computer.
1. On the Paris computer, test a. On the Paris computer, open a Command Prompt window.
your connectivity by attempting to b. At the command prompt, type ftp istanbul.fabrikam.com, and then
establish an FTP session with press Enter.
istanbul.fabrikam.com.
After one minute, the ftp command will time out
("Host is unreachable"). By default, ISA Server does not allow an FTP
connection from the ISA Server to the Internet.
c. At the ftp> prompt, type quit, and then press Enter.
d. Close the Command Prompt window.
2. Create a new access rule. a. In the ISA Server console, in the left pane, select Firewall Policy.
b. In the right pane, select the first rule to indicate where the new rule is
Name: Allow FTP from firewall added to the rule list.
c. In the task pane, on the Tasks tab, click Create Access Rule.
Applies to: FTP
d. In the New Access Rule Wizard dialog box, in the Access rule name
From network: Local Host text box, type Allow FTP from firewall, and then click Next.
To network: External e. On the Rule Action page, click Allow, and then click Next.
f. On the Protocols page, in the This rule applies to list box, select
Selected protocols, and then click Add.
g. In the Add Protocols dialog box,
click Web, click FTP, and click Add,
and then click Close to close the Add Protocols dialog box.
h. On the Protocols page, click Next.
i. On the Access Rule Sources page, click Add.
j. In the Add Network Entities dialog box,
click Networks, click Local Host, and click Add,
and then click Close to close the Add Network Entities dialog box.
The Local Host network represents the ISA Server computer.
k. On the Access Rule Sources page, click Next.
l. On the Access Rule Destinations page, click Add.
m. In the Add Network Entities dialog box,
click Networks, click External, and click Add,
and then click Close to close the Add Network Entities dialog box.
n. On the Access Rule Destinations page, click Next.
o. On the User Sets page, click Next.
p. On the Completing the New Access Rule Wizard page, click Finish.
A new firewall policy rule is created that allows the FTP protocol
from the ISA Server to the External network for all users.
q. Click Apply to apply the new rule, and then click OK.
Module A: Introduction to ISA Server 25
Exercise 4
Configuring ISA Server 2006 for Flood Resiliency
In this exercise, you will configure ISA Server to block a large number of TCP connections
from the same IP address.
1. On the Paris computer, a. On the Paris computer, on the Start menu, click All Programs, click
examine the flood mitigation Microsoft ISA Server, and then click ISA Server Management.
settings. The ISA Server console opens.
b. In the ISA Server console, in the left pane, expand Paris, expand
Configuration, and then select General.
c. In the right pane, under Additional Security Policy, click
Configure Flood Mitigation Settings.
ISA Server 2006 can help stop the flooding of connections from
three different kind of attacks:
Worm propagation - A computer on the internal network starts sending out
network packets to different IP addresses on the Internet.
TCP denial-of-service attack - An attacker sends out TCP packets in order
to use up all the resources at the firewall, or server behind the firewall.
HTTP denial-of-service attack - A computer on the internal network sends a
very large number of HTTP request over the same connection.
In all these cases, the Firewall Engine component of ISA Server
limits the number of connections, connection requests, and half-open
connections per minute, or per rule, from a particular IP address.
d. In the Flood Mitigation dialog box, on the Flood Mitigation tab, click
the second Edit button.
As an example of a limit, ISA Server allows a maximum of
160 concurrent TCP connections from the same IP address. There is also a
custom limit (400) that applies to a set of exception IP addresses.
e. Click Cancel to close the Flood Mitigation Settings dialog box.
f. In the Flood Mitigation dialog box, select the IP Exceptions tab.
You can specify the IP addresses of computers to which the custom
limit applies.
2. Disable the logging of a. In the Flood Mitigation dialog box, select the Flood Mitigation tab.
network traffic blocked by flood b. Clear the Log traffic blocked by flood mitigation settings check box.
mitigation settings.
To avoid overwhelming the log file with identical block entries,
after the flood mitigation settings have blocked an attack, you can disable the
logging of those blocked network connections.
c. Click OK to close the Flood Mitigation dialog box.
3. Create a new access rule. a. In the left pane, select Firewall Policy.
b. In the right pane, select the first rule, or select Default rule if no other
Name: Allow Web access (Flood) rule exists, to indicate where the new rule is added to the rule list.
Module A: Introduction to ISA Server 27
Applies to: HTTP c. In the task pane, on the Tasks tab, click Create Access Rule.
d. In the New Access Rule Wizard dialog box, in the Access rule name
From network: Internal text box, type Allow Web access (Flood), and then click Next.
To network: External
e. On the Rule Action page, select Allow, and then click Next.
f. On the Protocols page, in the This rule applies to list box, select
Selected protocols, and then click Add.
g. In the Add Protocols dialog box,
click Common Protocols, click HTTP, click Add,
and then click Close to close the Add Protocols dialog box.
h. On the Protocols page, click Next.
i. On the Access Rule Sources page, click Add.
j. In the Add Network Entities dialog box,
click Networks, click Internal, click Add,
and then click Close to close the Add Network Entities dialog box.
k. On the Access Rule Sources page, click Next.
l. On the Access Rule Destinations page, click Add.
m. In the Add Network Entities dialog box,
click Networks, click External, click Add,
and then click Close to close the Add Network Entities dialog box.
n. On the Access Rule Destinations page, click Next.
o. On the User Sets page, click Next.
p. On the Completing the New Access Rule Wizard page, click Finish.
A new firewall policy rule is created that allows the HTTP protocol
from the Internal network to the External network.
4. Apply the changes. a. Click Apply to apply the changes, and then click OK.
Perform the following steps on the Denver computer.
9. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
examine the flooding alert. Monitoring.
b. In the right pane, select the Alerts tab.
c. In the task pane, on the Tasks tab, click Refresh Now.
d. In the alert list, expand the Concurrent TCP Connections from One
IP Address Limit Exceeded alert, and then select the alert line below that.
Notice in the Alert Information description that ISA Server
identifies which IP address (10.1.1.5) exceeded the configured limit of
concurrent TCP connections. This information allows you to further investigate
the cause of the high number of connection attempts.
10. Configure the log viewer a. In the right pane, select the Logging tab.
filter conditions: Note: You may (temporarily) need to close the task pane in order to
Log Time: Last Hour see the Logging tab.
b. In the task pane, on the Tasks tab, click Edit Filter.
Client IP:
Equals 10.1.1.5 c. In the Edit Filter dialog box, in the conditions list, select the
Log Time - Live condition.
Destination IP: d. In the Condition drop-down list box, select Last Hour, and then click
Greater or Equal 42.1.0.0 Update.
The condition is changed to Log Time - Last Hour.
e. Complete the following information:
Filter by: Client IP
Condition: Equals
Value: 10.1.1.5
and then click Add To List.
f. Complete the following information:
Filter by: Destination IP
Module A: Introduction to ISA Server 29
11. Restore the log viewer filter a. In the task pane, on the Tasks tab, click Edit Filter.
conditions: b. In the Edit Filter dialog box, in the conditions list, select
Log Time - Last Hour.
Log Time: Live
c. In the Condition drop-down list box, select Live, and then click
Update.
Client IP: (remove)
The condition is changed to Log Time - Live.
Destination IP: (remove) d. In the conditions list, select the Destination IP condition, and then click
Remove.
e. In the conditions list, select the Client IP condition, and then click
Remove.
f. Click Start Query to close the dialog box.
g. In the task pane, on the Tasks tab, click Stop Query.
Perform the following steps on the Denver computer.
12. On the Denver computer, a. On the Denver computer, open Internet Explorer.
configure Internet Explorer to use b. In Internet Explorer, on the Tools menu, click Internet Options.
a proxy server.
c. In the Internet Options dialog box, on the Connections tab, click
LAN Settings.
d. In the Local Area Network (LAN) Settings dialog box, complete the
following information:
Use a proxy server for your LAN: enable
Address: 10.1.1.1
Port: 8080
Bypass proxy server for local address: enable
and then click OK to close the Local Area Network (LAN) Settings dialog box.
e. Click OK to close the Internet Options dialog box.
f. Close Internet Explorer.
30 Module A: Introduction to ISA Server
1. On the Paris computer, a. On the Paris computer, on the Start menu, click All Programs, click
create a new Web listener. Microsoft ISA Server, and then click ISA Server Management.
The ISA Server console opens.
Name: External Web 80
b. In the ISA Server console, expand Paris, and then select
Firewall Policy.
SSL: disable
c. In the task pane, on the Toolbox tab, in the Network Objects section,
Network: External right-click Web Listeners, and then click New Web Listener.
Compression: disable d. In the New Web Listener Definition Wizard dialog box, in the
Web listener name text box, type External Web 80, and then click Next.
Authentication: none e. On the Client Connection Security page, select
Do not require SSL secured connections with clients, and then click Next.
f. On the Web Listener IP Addresses page, complete the following
information:
Listen on network: External
ISA Server will compress content: disable
and then click Next.
g. On the Authentication Settings page, in the drop-down list box, select
No Authentication, and then click Next.
h. On the Single Sign On Settings page, click Next.
i. On the Completing the New Web Listener Wizard page, click Finish.
A new Web listener (port 80 on the IP address on the adapter on
the External network) with the name External Web 80 is created.
j. Click Apply to save the changes, and then click OK.
2. Examine the effect of the a. Open a Command Prompt window.
Web listener definition on the b. At the command prompt, type netstat -ano | find ":80", and then
listening ports. press Enter.
The output of the command shows the listening ports that contain
":80". Currently the ISA Server does NOT listen on port 80. The creation of the
Web listener definition did not change the listener configuration of the firewall
yet.
Module A: Introduction to ISA Server 31
Note: The displayed line with port 8080 on the internal IP address
10.1.1.1, is the opened Web Proxy port for client computers on the Internal
network.
The last column lists the process ID of the process that listens on the port.
c. Close the Command Prompt window.
3. Create a Web publishing a. In the ISA Server console, in the left pane, select Firewall Policy.
rule. b. In the right pane, select the first rule, or select Default rule if no other
rule exists, to indicate where the new rule is added to the rule list.
Name: Web Home Page (on
c. In the task pane, on the Tasks tab, click Publish Web Sites.
Denver)
Instead of using the task pane, you can also right-click
Publishing type: Firewall Policy, click New, and then click Web Site Publishing Rule.
single Web site d. In the New Web Publishing Rule Wizard dialog box, in the
Web publishing rule name text box, type Web Home Page (on Denver), and
Internal site name: then click Next.
denver.contoso.com e. On the Select Rule Action page, select Allow, and then click Next.
Public name: f. On the Publishing Type page, select Publish a single Web site, and then
www.contoso.com click Next.
g. On the Server Connection Security page, select Use non-secured
Web listener: connections to connect to the published Web server, and then click Next.
External Web 80 h. On the Internal Publishing Details page, complete the following
information:
Delegation: none Internal site name: denver.contoso.com
Use a computer name or IP address: disable (is default)
and then click Next.
i. On the next Internal Publishing Details page, complete the following
information:
Path: (leave empty)
Forward the original host header: disable (is default)
and then click Next.
j. On the Public Name Details page, complete the following information:
Accept requests for: This domain name (type below):
Public name: www.contoso.com
Path: (leave empty)
and then click Next.
k. On the Select Web Listener page, in the Web listener drop-down list
box, select External Web 80, and then click Next.
If you did not create the Web listener before starting the New Web
Publishing Rule Wizard, you can click the New button and create a new Web
listener definition from the Select Web Listener page.
l. On the Authentication Delegation page, select No delegation, and client
cannot authenticate directly, and then click Next.
m. On the User Sets page, click Next.
n. On the Completing the New Web Publishing Rule Wizard page, click
Finish.
A new Web publishing rule is created which publishes the Web site
at denver.contoso.com (10.1.1.5) as www.contoso.com on the External
network.
o. Click Apply to apply the new rule, and then click OK.
4. Examine the effect of the a. Open a Command Prompt window.
Web publishing rule on the b. At the command prompt, type netstat -ano | find ":80", and then
listening ports. press Enter.
The output of the command shows that the process with
process ID nnnn (last column) listens on the external IP address 39.1.1.1 on
port 80.
32 Module A: Introduction to ISA Server
6. On the Istanbul computer, a. On the Istanbul computer, open a Command Prompt window.
verify that www.contoso.com b. At the command prompt type ping www.contoso.com, and then press
resolves to 39.1.1.1. Enter.
The output of the ping command verifies that www.contoso.com
resolves to the external IP address of Paris 39.1.1.1. (ISA Server does not reply
to the ping request.)
c. Close the Command Prompt window.
7. Connect to the published a. Open Internet Explorer. In the Address box, type
Web server on www.contoso.com, http://www.contoso.com, and then press Enter.
and attempt to connect to 39.1.1.1. Internet Explorer displays the home page of Denver. ISA Server
successfully published the Denver home page as www.contoso.com on the
External network (Internet).
b. In the Address box, type http://39.1.1.1, and then press Enter.
Internet Explorer displays an error page. ISA Server returns error
code 403 (Forbidden - The server denied the specified URL).
Currently the home page of Denver is only published with the
public name www.contoso.com, not when using the IP address 39.1.1.1
directly.
Perform the following steps on the Paris computer.
8. On the Paris computer, add a. On the Paris computer, in the ISA Server console, in the left pane, select
the 39.1.1.1 public name to the Firewall Policy.
Web Home Page (on Denver) b. In the right pane, select the Web Home Page (on Denver) Web
Web publishing rule. publishing rule.
c. In the task pane, on the Tasks tab, click Edit Selected Rule.
d. In the Web Home Page (on Denver) Properties dialog box, on the
Public Name tab, click Add.
e. In the Public Name dialog box, type 39.1.1.1, and then click OK.
The Web publishing rule now contains two public names:
Module A: Introduction to ISA Server 33
9. On the Istanbul computer, a. On the Istanbul computer, in Internet Explorer, ensure that
connect to the published Web http://39.1.1.1 is in the Address box, and then click the Refresh button.
server on 39.1.1.1. Internet Explorer displays the home page of Denver. ISA Server
successfully published the Denver home page as www.contoso.com and
39.1.1.1 on the External network (Internet).
b. Close Internet Explorer.
34 Module A: Introduction to ISA Server
Exercise 2
Publishing the Web Server on the ISA Server Computer
In this exercise, you will configure ISA Server to publish a Web server on the ISA Server to
client computers on the Internet.
1. On the Paris computer, a. On the Paris computer, on the Start menu, click Administrative Tools,
configure the default Web site to and then click Internet Information Services (IIS) Manager.
use port 81, and then start the Web The IIS Manager console opens.
site.
b. In the IIS Manager console, expand PARIS (local computer), expand
Web Sites, right-click Default Web Site (Stopped), and then click Properties.
c. In the Default Web Site (Stopped) Properties dialog box, on the
Web Site tab, in the TCP port text box, type 81, and then click OK.
The default HTTP TCP port is 80. Because ISA Server uses port 80
for publishing Web sites (and publishing automatic discovery information for
Web clients), the Web site on the ISA Server computer must be changed to
another port.
d. Right-click Default Web Site (Stopped), and then click Start.
The default Web site is started. The Web site listens on port 81.
e. Close the IIS Manager console.
2. Examine the effect of a. Open a Command Prompt window.
starting the default Web site on the b. At the command prompt, type netstat -ano | find ":81", and then
listening ports. press Enter.
The output of the command shows that the process with
process ID mmmm (last column) listens on all IP addresses (0.0.0.0) on port
81.
c. At the command prompt, type tasklist /svc | find "mmmm", and then
press Enter. (Replace mmmm with the actual process ID displayed in output of
the previous step.)
The output of the command shows that the process with
process ID mmmm hosts the World Wide Web Publishing Service (W3SVC),
which is part of IIS.
Currently, the Firewall service listens on port 80, and IIS listens on
port 81.
d. Close the Command Prompt window.
3. Create a Web publishing a. In the ISA Server console, in the left pane, select Firewall Policy.
rule. b. In the right pane, select the first rule to indicate where the new rule is
added to the rule list.
Name: Products Web Site (on
c. In the task pane, on the Tasks tab, click Publish Web Sites.
Paris)
d. In the New Web Publishing Rule Wizard dialog box, in the
Publishing type: Web publishing rule name text box, type Products Web Site (on Paris), and
single Web site then click Next.
e. On the Select Rule Action page, select Allow, and then click Next.
Internal site name: Paris f. On the Publishing Type page, select Publish a single Web site, and then
IP address: 10.1.1.1
Module A: Introduction to ISA Server 35
4. On the Istanbul computer, a. On the Istanbul computer, open Internet Explorer. In the Address box,
connect to the published Web type http://www.contoso.com/products, and then press Enter.
servers on www.contoso.com Internet Explorer displays the home page of Paris (10.1.1.1). ISA
/products Server successfully published the Paris home page as
and www.contoso.com/products on the External network.
www.contoso.com.
b. In the Address box, type http://www.contoso.com, and then press
Enter.
Internet Explorer displays the home page of Denver (10.1.1.5). This
result confirms that ISA Server publishes two Web sites now.
c. Close Internet Explorer.
Perform the following steps on the Paris computer.
5. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
create a Web publishing rule. Firewall Policy.
b. In the right pane, select the first rule to indicate where the new rule is
Name: Public Web Site (on added to the rule list.
Paris)
c. In the task pane, on the Tasks tab, click Publish Web Sites.
Publishing type: d. In the New Web Publishing Rule Wizard dialog box, in the
single Web site Web publishing rule name text box, type Public Web Site (on Paris), and
then click Next.
Internal site name: Paris e. On the Select Rule Action page, select Allow, and then click Next.
IP address: 10.1.1.1 f. On the Publishing Type page, select Publish a single Web site, and then
Path: publicweb/* click Next.
Port: 81
g. On the Server Connection Security page, select Use non-secured
Public name: connections to connect to the published Web server, and then click Next.
public.contoso.com h. On the Internal Publishing Details page, complete the following
information:
Web listener: Internal site name: Paris
External Web 80 Use a computer name or IP address: enable
Computer name or IP address: 10.1.1.1
Delegation: none and then click Next.
i. On the next Internal Publishing Details page, complete the following
information:
Path: publicweb/*
Forward the original host header: disable (is default)
and then click Next.
The published Web site is 10.1.1.1/publicweb.
j. On the Public Name Details page, complete the following information:
Accept requests for: This domain name (type below):
Public name: public.contoso.com
Path: (remove /publicweb/*, and leave empty)
and then click Next.
The public name of the Web site is public.contoso.com.
k. On the Select Web Listener page, in the Web listener drop-down list
box, select External Web 80, and then click Next.
l. On the Authentication Delegation page, select No delegation, and client
cannot authenticate directly, and then click Next.
m. On the User Sets page, click Next.
n. On the Completing the New Web Publishing Rule Wizard page, click
Finish.
Module A: Introduction to ISA Server 37
A new Web publishing rule is created that publishes the Web site at
10.1.1.1/publicweb (Paris) as public.contoso.com on the External network.
o. In the right pane, select the Public Web Site (on Paris) Web publishing
rule, and then in the task pane, on the Tasks tab, click Edit Selected Rule.
p. In the Public Web Site (on Paris) Properties dialog box, select the Paths
tab.
Web publishing rules can redirect requests for the root of a Web
site (/) to a path (/publicweb) on a Web server.
You can also translate a path in the public name, to another path on the
published Web server.
q. On the Bridging tab, in the Redirect requests to HTTP port text box,
type 81.
The Web publishing rule now redirects requests for
public.contoso.com (port 80) to 10.1.1.1/publicweb (port 81).
r. Click OK to close the Public Web Site (on Paris) Properties dialog box.
s. Click Apply to apply the new rule, and then click OK.
Perform the following steps on the Istanbul computer.
6. On the Istanbul computer, a. On the Istanbul computer, open Internet Explorer. In the Address box,
connect to the published Web type http://public.contoso.com, and then press Enter.
servers on public.contoso.com. Internet Explorer displays the home page of Paris (10.1.1.1) from
the /publicweb folder. ISA Server successfully published the Paris home page in
the /publicweb folder as public.contoso.com on the External network.
b. Close Internet Explorer.
38 Module A: Introduction to ISA Server
Exercise 3
Performing Link Translation on a Published Web Server
In this exercise, you will configure ISA Server to enable link translation for a published Web
site.
1. On the Istanbul computer, a. On the Istanbul computer, open Internet Explorer. In the Address box,
connect to the Web page type http://www.contoso.com/links.htm, and then press Enter.
www.contoso.com Internet Explorer displays a demonstration Web page for the Link
/links.htm. Translation Filter. The Web Home Page (on Denver) Web publishing rule
from an earlier exercise makes the links.htm page available on the External
network (Istanbul).
Notice that the two of the three images are displayed correctly.
The first image uses a relative address (pic1.jpg). Internet Explorer
automatically adds the current host name (www.contoso.com) to the relative
address.
The second image uses the full name of the Web server computer itself
(denver.contoso.com), which ISA Server automatically replaces (translates)
with www.contoso.com, so that it can be resolved when the Web server is
published on the Internet.
The link to the third image still uses the internal name (ronsbox) of the Web
server computer, and does not resolve correctly on the Internet.
b. Hold the mouse pointer over the Translated link for pic1.jpg URL.
In the status bar, you can see that Internet Explorer translates the
<a href="pic1.jpg"> HTLM code to include the entire address that is used in
the Address box.
c. Right-click on the displayed image (pic1.jpg), and then click Properties.
In the Properties dialog box, you can see that Internet Explorer
also translates <img src="pic1.jpg"> HTML code to include the entire
address.
d. Click Cancel to close the Properties dialog box.
e. Do not close Internet Explorer.
Perform the following steps on the Paris computer.
2. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane,
examine the expand Configuration, and then select Add-ins.
Link Translation Filter Web b. In the right pane, select the Web Filters tab.
filter.
One of the Web filters is the Link Translation Filter. Responses
from published Web servers pass through the list of Web filters, including the
Link Translation Filter, before they are sent to the client computers.
3. Examine the current link a. In the left pane, select Firewall Policy, and then in the right pane, select
translation mappings for the Web the Web Home Page (on Denver) Web publishing rule.
Home Page (on Denver) Web This Web publishing rule redirects requests for www.contoso.com
publishing rule. (and 39.1.1.1) to the Web server on denver.contoso.com.
b. In the task pane, on the Tasks tab, click Edit Selected Rule.
Module A: Introduction to ISA Server 39
c. In the Web Home Page (on Denver) Properties dialog box, select the
Link Translation tab.
By default, link translation is applied to Web publishing rules.
Based on the names used in the rule definition, ISA Server will
create link translation mappings (such as "http://denver.contoso.com" to
"http://www.contoso.com") to perform link translation for this Web publishing
rule. This ensures that the second graphical image (using
http://denver.contoso.com) is displayed correctly.
d. On the Link Translation tab, click Mappings.
Internet Explorer opens a Web page that displays the currently
defined link translation mappings for this rule, including the mapping from
URL http://denver.contoso.com to URL http://www.contoso.com.
e. Close Internet Explorer.
f. Click Cancel to close the Web Home Page (on Denver) Properties
dialog box.
4. Create a new global link a. In the left pane, select General.
translation mapping: b. In the right pane, under Global HTTP Policy Settings, click
Configure Global Link Translation.
Replace this text:
c. In the Link Translation dialog box, select the Global Mappings tab.
http://ronsbox
In ISA Server 2006, you can define global link translation
With this text: mappings that apply to all Web publishing rules.
http://www.contoso.com d. On the Global Mappings tab, click Add.
e. In the Add Mapping dialog box, complete the following information:
Internal URL: http://ronsbox
Translated URL: http://www.contoso.com
and then click OK.
It is a good practice to also consider adding a link translation
mapping for https://ronsbox, but that is not needed for this exercise.
f. Click OK to close Link Translation dialog box.
g. Click Apply to save the changes, and then click OK.
Perform the following steps on the Istanbul computer.
5. On the Istanbul computer, a. On the Istanbul computer, in Internet Explorer, ensure that the
refresh the content of the Web http://www.contoso.com/links.htm Web page is opened.
page at www.contoso.com b. Hold the Ctrl-key, and then click the Refresh button on the toolbar, to
/links.htm again, by pressing refresh the content of the Web page.
Ctrl-F5 or Ctrl-Refresh.
The third image (pic3.jpg) is also displayed correctly.
The Link Translation Filter on ISA Server has translated the http://ronsbox link
that was returned by the Denver Web server for the URL of pic3.jpg, to
http://www.contoso.com.
c. Close Internet Explorer.
40 Module A: Introduction to ISA Server
Exercise 4
Using Cross-Site Link Translation to Publish SharePoint Server
In this exercise, you will configure ISA Server to publish a SharePoint Server.
The portal Web site contains links to other Web servers. By using cross-site link translation,
you can access the links from the published portal Web site.
1. On the Denver computer, a. On the Denver computer, open Internet Explorer. In the Address box,
connect to http://portal, and type http://portal, and then press Enter.
examine the links on the Project-D Internet Explorer displays a sample Project-D Portal Web site,
Portal Web site. which runs on Denver on IP address 10.1.1.10.
b. In the portal Web site, under Shared Documents, move the mouse
pointer over Agenda (do not click).
In the status bar, notice that the Agenda.doc link refers to
http://portal.
c. Click Agenda.
d. In the File Download dialog box, click Open to confirm that you want to
open the Agenda.doc file.
WordPad opens the Agenda.doc file.
e. Close WordPad.
f. In the portal Web site, under Links, move the mouse pointer over
Research Web Site (do not click).
In the status bar, notice that the Research Web Site link refers to
http://server1.
It is very common that SharePoint sites contain links to other
servers on the internal network.
g. Click Research Web Site.
Internet Explorer opens the research.htm file on server1. Server1 is
a Web site running on Denver on IP address 10.1.1.21.
h. On the toolbar, click the Back button.
i. Close Internet Explorer
Perform the following steps on the Paris computer.
2. On the Paris computer, a. On the Paris computer, on the Start menu, click All Programs, click
create a new Web listener. Microsoft ISA Server, and then click ISA Server Management.
The ISA Server console opens.
Name: External Web 80
b. In the ISA Server console, expand Paris, and then select
Firewall Policy.
SSL: disable
c. In the task pane, on the Toolbox tab, in the Network Objects section,
Network: External expand Web Listeners (if possible).
Module A: Introduction to ISA Server 41
Compression: disable Note: If a Web Listener named External Web 80 is already created
in an earlier exercise, then you can skip the rest of this task.
Authentication: none d. If a Web listener named External Web 80 does not exist, then
right-click Web Listeners, and then click New Web Listener.
(If this is not done already)
e. In the New Web Listener Definition Wizard dialog box, in the
Web listener name text box, type External Web 80, and then click Next.
f. On the Client Connection Security page, select
Do not require SSL secured connections with clients, and then click Next.
g. On the Web Listener IP Addresses page, complete the following
information:
Listen on network: External
ISA Server will compress content: disable
and then click Next.
h. On the Authentication Settings page, in the drop-down list box, select
No Authentication, and then click Next.
i. On the Single Sign On Settings page, click Next.
j. On the Completing the New Web Listener Wizard page, click Finish.
A new Web listener (port 80 on the IP address on the adapter on
the External network) with the name External Web 80 is created.
3. Create a Web publishing a. In the right pane, select the first rule, or select Default rule if no other
rule to publish a SharePoint server. rule exists, to indicate where the new rule is added to the rule list.
b. In the task pane, on the Tasks tab, click Publish SharePoint Sites.
Name: Portal Web Site
c. In the New SharePoint Publishing Rule Wizard dialog box, in the
SharePoint publishing rule name text box, type Portal Web Site, and then
Publishing type:
click Next.
single Web site
d. On the Publishing Type page, select Publish a single Web site, and then
Internal site name: click Next.
portal e. On the Server Connection Security page, select Use non-secured
connections to connect to the published Web server, and then click Next.
Public name: f. On the Internal Publishing Details page, in the Internal site name text
portal.contoso.com box, type portal, and then click Next.
Web listener: g. On the Public Name Details page, in the Public name text box, type
External Web 80 portal.contoso.com, and then click Next.
h. On the Select Web Listener page, in the Web listener drop-down list
Delegation: none box, select External Web 80, and then click Next.
i. On the Authentication Delegation page, select No delegation, and client
cannot authenticate directly, and then click Next.
j. On the Alternate Access Mapping Configuration page, select
SharePoint AAM is not yet configured, and then click Next.
ISA Server forwards the public name (portal.contoso.com) to the
SharePoint site. If SharePoint limits which names can be used to access the
site, then you have to add portal.contoso.com to the Extranet URL list
(Alternate Access Mapping list) on the SharePoint site.
k. On the User Sets page, click Next.
l. On the Completing the New SharePoint Publishing Rule Wizard page,
click Finish.
A new Web publishing rule is created, which publishes the
SharePoint site portal as portal.contoso.com on the External network.
4. Apply the changes. a. Click Apply to apply the changes, and then click OK.
Perform the following steps on the Istanbul computer.
5. On the Istanbul computer, a. On the Istanbul computer, open Internet Explorer. In the Address box,
connect to type http://portal.contoso.com, and then press Enter.
http://portal.contoso.com, and
42 Module A: Introduction to ISA Server
examine the links on the Project-D Internet Explorer displays the sample Project-D Portal Web site.
Portal Web site. This result demonstrates that you have successfully published the
SharePoint site.
b. In the portal Web site, under Shared Documents, move the mouse
pointer over Agenda (do not click).
In the status bar, notice that the Agenda.doc link refers to
http://portal.contoso.com.
The SharePoint publishing rule wizard configured the Web
publishing rule to forward the original host header (http://portal.contoso.com)
to the SharePoint site.
SharePoint uses that information to create URLs that refer to the host name
(portal.contoso.com) that the client can use.
c. Click Agenda.
d. In the File Download dialog box, click Open to confirm that you want to
open the Agenda.doc file.
WordPad opens the Agenda.doc file.
You can access documents on the published SharePoint Web site, in
the same way you can access them on the internal network when connecting to
http://portal.
e. Close WordPad.
f. In the portal Web site, under Links, move the mouse pointer over
Research Web Site (do not click).
In the status bar, notice that the Research Web Site link refers to
http://server1.
g. Click Research Web Site.
Internet Explorer on Istanbul is not able to resolve the name
server1 name to connect to the Web server on the internal network.
h. On the toolbar, click the Back button.
i. Close Internet Explorer.
Perform the following steps on the Paris computer.
6. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
create a Web publishing rule. Firewall Policy.
b. In the right pane, select the first rule to indicate where the new rule is
Name: Server1 Web Site added.
c. In the task pane, on the Tasks tab, click Publish Web Sites.
Publishing type:
single Web site d. In the New Web Publishing Rule Wizard dialog box, in the
Web publishing rule name, type Server1 Web Site, and then click Next.
Internal site name: e. On the Select Rule Action page, select Allow, and then click Next.
server1 f. On the Publishing Type page, select Publish a single Web site, and then
click Next.
Public name:
web1.contoso.com g. On the Server Connection Security page, select Use non-secured
connections to connect to the published Web server, and then click Next.
Web listener: h. On the Internal Publishing Details page, in the Internal site name text
External Web 80 box, type server1, and then click Next.
i. On the next Internal Publishing Details page, leave the Path text box
Delegation: none empty, and then click Next.
j. On the Public Name Details page, in the Public name text box, type
web1.contoso.com, and then click Next.
k. On the Select Web Listener page, in the Web listener drop-down list
box, select External Web 80, and then click Next.
l. On the Authentication Delegation page, select No delegation, and client
cannot authenticate directly, and then click Next.
Module A: Introduction to ISA Server 43
9. On the Istanbul computer, a. On the Istanbul computer, open Internet Explorer. In the Address box,
connect to type http://portal.contoso.com, and then press Enter.
http://portal.contoso.com, and Internet Explorer displays the sample Project-D Portal Web site.
examine the links on the Project-D The site is published through the Portal Web Site publishing rule.
Portal Web site.
b. In the portal Web site, under Links, move the mouse pointer over
Research Web Site (do not click).
In the status bar, notice that the Research Web Site link refers to
http://web1.contoso.com.
The Portal Web Site rule used the link translation entry from the
Server1 Web Site rule.
c. Click Research Web Site.
Internet Explorer displays the Research Web page from Server1.
The site is published through the Server1 Web Site publishing rule.
d. On the toolbar, click the Back button.
e. Close Internet Explorer.
44 Module A: Introduction to ISA Server
Exercise 5
Publishing a Web Farm for Load Balancing
In this exercise, you will publish two Web servers (10.1.1.21 and 10.1.1.22) as a Web farm.
ISA Server load balances Web requests to servers in a Web farm.
The exercise uses both Cookie-Based Load Balancing and Source-IP Based Load Balancing.
1. On the Paris computer, a. On the Paris computer, on the Start menu, click All Programs, click
create a new Web listener. Microsoft ISA Server, and then click ISA Server Management.
The ISA Server console opens.
Name: External Web 80
b. In the ISA Server console, expand Paris, and then select
Firewall Policy.
SSL: disable
c. In the task pane, on the Toolbox tab, in the Network Objects section,
Network: External expand Web Listeners (if possible).
Compression: disable Note: If a Web Listener named External Web 80 is already created
in an earlier exercise, then you can skip the rest of this task.
Authentication: none d. If a Web Listener named External Web 80 does not exist, then
right-click Web Listeners, and then click New Web Listener.
(If this is not done already)
e. In the New Web Listener Definition Wizard dialog box, in the
Web listener name text box, type External Web 80, and then click Next.
f. On the Client Connection Security page, select
Do not require SSL secured connections with clients, and then click Next.
g. On the Web Listener IP Addresses page, complete the following
information:
Listen on network: External
ISA Server will compress content: disable
and then click Next.
h. On the Authentication Settings page, in the drop-down list box, select
No Authentication, and then click Next.
i. On the Single Sign On Settings page, click Next.
j. On the Completing the New Web Listener Wizard page, click Finish.
A new Web listener (port 80 on the IP address on the adapter on
the External network) with the name External Web 80 is created.
2. Create a new Server Farm a. In the task pane, on the Toolbox, in the Network Objects section,
network element. right-click Server Farms, and then click New Server Farm.
The New Server Farm Definition Wizard opens.
Name: Shop Web Servers
b. In the New Server Farm Definition Wizard dialog box, in the
Server farm name text box, type Shop Web Servers, and then click Next.
Addresses:
- 10.1.1.21 c. On the Servers page, click Add.
- 10.1.1.22 d. In the Server Details dialog box, complete the following information:
Computer name or IP address: 10.1.1.21
Module A: Introduction to ISA Server 45
Select the server farm (drop-down list box): Shop Web Servers
Cookie-based Load Balancing: enable (is default)
and then click Next.
ISA Server can use two different methods to load balance request to
the servers in the farm:
Cookie-based Load Balancing - ISA Server uses round-robin to distribute
new connections to the Web servers. It sends a temporary session cookie to
each client that connects, so that client session affinity to the selected Web
server is maintained.
Source-IP based Load Balancing - ISA Server uses a hash value of the
client's IP address to distribute connections to the Web servers. All requests
from the same client IP address go the same Web server.
Note: For load balancing Outlook Web Access or SharePoint
access, both of which use Internet Explorer, the Cookie-based Load Balancing
is the recommended solution. For load balancing Outlook RPC over HTTP
access, you need to use Source-IP based Load Balancing. Outlook cannot work
with HTTP cookies.
j. On the Public Name Details page, complete the following information:
Accept request for: This domain name (type below)
Public name: www.contoso.com
Path (optional): /shop/* (automatic)
and then click Next.
k. On the Select Web Listener page, in the Web listener drop-down list
box, select External Web 80, and then click Next.
l. On the Authentication Delegation page, in the drop-down list box, select
No delegation, and client cannot authenticate directly, and then click Next.
m. On the User Sets page, click Next.
n. On the Completing the New Web Publishing Rule Wizard page, click
Finish.
A new Web publishing rule named Sales Web Site is created. The
icon with the four small servers indicates that this rule publishes a server farm.
4. Apply the changes. a. Click Apply to apply the changes, and then click OK.
5. Examine the connectivity a. In the ISA Server console, in the left pane, select Monitoring.
verifiers for the Shop Web Servers b. In the right pane, select the Connectivity Verifiers tab.
farm.
Note: You may (temporarily) need to close the task pane in order to
see the Connectivity Verifiers tab.
c. Right-click the first Farm: Shop Web Servers connectivity verifier, and
then click Properties.
d. In the Farm: Shop Web Servers Properties dialog box, select the
Connectivity Verification tab.
Every 30 seconds, ISA Server connects to the published Web
servers (using GET http://10.1.1.21/, and GET http://10.1.1.22/). If the Web
server responds with HTTP code 200 (OK) within 5 seconds, ISA Server
considers the Web server to be available, and load balances requests to the
Web server.
Note: For the GET http://*/ request to succeed, the Web server
must accept anonymous access to the root, and must have a default document
available. Otherwise, the connectivity verifier fails to connect.
e. Click Cancel to close the Farm: Shop Web Servers Properties dialog
box.
When the Web servers are available, the connectivity verifier icon
contains a green check mark, and the Result column displays the observed
response time.
Module A: Introduction to ISA Server 47
6. On the Istanbul computer, a. On the Istanbul computer, open Internet Explorer. In the Address box,
use Internet Explorer to connect to type http://www.contoso.com/shop/web.asp, and then press Enter.
http://www.contoso.com/ Internet Explorer displays the web.asp page from Web server
shop/web.asp 10.1.1.21 (Server1). The client did not include a cookie in the Web request.
Note: Due to the round-robin nature of the Cookie-based Load
Balancing, and depending on earlier Web requests that you may have done, it
is possible that the Web page in this task is returned from 10.1.1.22. In that
case, close the Internet Explorer window, and connect to the Web address
again.
b. On the toolbar, click the Refresh button to refresh the content of the
Web page.
The same Web server handles the Web request. For the second and
the subsequent requests, the client includes the session cookie (starting with
ISAWPLB), which it received in the response of the first request. The cookie
text contains a Global Unique Identifier (GUID) that ISA Server uses to
identify which Web server it should send the Web request to. This ensures the
session affinity with the same Web server. (ISAWPLB stands for ISA Web
Publishing Load Balancing.)
Note: In the response, ISA Server also forwards an ASP Session
cookie from the Web server to the client computer.
7. Create two new Internet a. On the Start menu, click All Programs, and then click
Explorer sessions, and connect to Internet Explorer.
http://www.contoso.com/ A second Internet Explorer window opens.
shop/web.asp
b. In Internet Explorer, in the Address box, type
http://www.contoso.com/shop/web.asp, and then press Enter.
The new Web request does not contain a session cookie. Therefore
ISA Server forwards the request to the other Web server 10.1.1.22 (Server2),
and includes a new cookie in the response.
c. On the toolbar, click the Refresh button to refresh the content of the
Web page.
The second Internet Explorer session uses a different cookie.
d. On the Start menu, click All Programs, and then click
Internet Explorer again.
A third Internet Explorer window opens.
e. In Internet Explorer, in the Address box, type
http://www.contoso.com/shop/web.asp, and then press Enter.
ISA Server load balances the third session to Web server 10.1.1.21
(Server1) again.
Perform the following steps on the Denver computer.
8. On the Denver computer, a. On the Denver computer, on the Start menu, click
stop the Server1 Web Site to Administrative Tools, and then click
simulate a connectivity problem Internet Information Services (IIS) Manager.
with the Web server on 10.1.1.21. The IIS Manager console opens.
b. In the IIS Manager console, expand DENVER (local computer),
expand Web Sites, and then select Server1 Web Site.
c. Right-click Server1 Web Site, and then click Properties.
Notice that Server1 Web Site is listening on IP address 10.1.1.21.
d. Click Cancel to close the Server1 Web Site Properties dialog box.
e. Right-click Server1 Web Site, and then click Stop.
The Web site at 10.1.1.21 is no longer responding to Web requests.
48 Module A: Introduction to ISA Server
9. On the Istanbul computer, a. On the Istanbul computer, switch to one of the Internet Explorer
attempt to refresh the content of windows that currently displays the web.asp page from 10.1.1.21 (Server1).
the Web pages that were from b. On the toolbar, click the Refresh button to refresh the content of the
10.1.1.21 (Server1). Web page.
Internet Explorer displays an error message: Bad request (invalid
hostname).
c. Wait 20 seconds, and then on the toolbar, click the Refresh button
again.
Internet Explorer displays the web.asp page from 10.1.1.22
(Server2). ISA Server has forwarded the Web request to the remaining Web
server in the farm.
Note: Because ISA Server checks the connectivity to the 10.1.1.21
Web server every 30 seconds, and then waits for the timeout for another
5 seconds, on average it takes 15+5 seconds after the Web server is no longer
available, before ISA Server forwards all the Web requests to the other Web
server. Due the way http.sys works on the Denver computer, it still returned a
response (Bad request) when connecting to 10.1.1.21.
d. Switch to the other Internet Explorer window that displays the web.asp
page from 10.1.1.21 (Server1).
e. On the toolbar, click the Refresh button.
Internet Explorer immediately displays the web.asp page from
10.1.1.22 (Server2).
Perform the following steps on the Paris computer.
10. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
examine the connectivity verifier Monitoring.
and the alert for the connection to b. In the right pane, select the Connectivity Verifiers tab.
10.1.1.21.
Notice that the icon for the connectivity verifier to 10.1.1.21
contains a red mark, indicating a connectivity issue.
c. In the right pane, select the Alerts tab.
d. In the task pane, on the Tasks tab, click Refresh Now.
e. In the right pane, expand the No Connectivity alert, and then select the
lower No Connectivity line.
The alert information describes that the connection to 10.1.1.21
failed.
f. Right-click the lower No Connectivity line, and then click Reset.
g. Click Yes to confirm that you want to reset the No Connectivity alert.
Perform the following steps on the Denver computer.
11. On the Denver computer, a. On the Denver computer, in the IIS Manager console, right-click
start the Server1 Web Site. Server1 Web Site, and then click Start.
The Web site at 10.1.1.21 is available again.
Perform the following steps on the Istanbul computer.
12. On the Istanbul computer, a. On the Istanbul computer, switch to any of the Internet Explorer
refresh the Web page from windows that currently displays the web.asp page from 10.1.1.22 (Server2).
10.1.1.22, and create a new b. On the toolbar, click the Refresh button to refresh the content of the
connection to Web page.
http://www.contoso.com/
ISA Server continues to forward the Web requests to 10.1.1.22
shop/web.asp.
(Server2), even though 10.1.1.21 is available again. All current sessions
already use a cookie that contains the GUID of Server2, and will stay on this
Module A: Introduction to ISA Server 49
13. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
change the load balancing Firewall Policy.
mechanism for the Sales Web Site b. In the right pane, right-click the Sales Web Site rule, and then click
rule to Source-IP based. Properties.
c. In the Sales Web Site Properties dialog box, on the Web Farm tab, in
the Load Balancing Mechanism section, select Source-IP based.
ISA Server will no longer send cookies to manage load balancing
Web requests, but will use a hash of the source IP address instead.
d. Click OK to close the Sales Web Site Properties dialog box.
14. Apply the changes. a. Click Apply to apply the changes, and then click OK.
Perform the following steps on the Istanbul computer.
15. On the Istanbul computer, a. On the Istanbul computer, on the Start menu, click All Programs, and
create two new Internet Explorer then click Internet Explorer.
sessions, and connect to b. In Internet Explorer, in the Address box, type
http://www.contoso.com/ http://www.contoso.com/shop/web.asp, and then press Enter.
shop/web.asp
Internet Explorer displays the web.asp page from Web server
10.1.1.22 (Server2).
c. On the toolbar, click the Refresh button to refresh the content of the
Web page.
In the response to the first Web request, ISA Server did not include
an ISAWPLB cookie, but instead only forwarded the ASP Session cookie that
the Web server provides.
d. On the Start menu, click All Programs, and then click
Internet Explorer.
A second Internet Explorer window opens.
e. In Internet Explorer, in the Address box, type
http://www.contoso.com/shop/web.asp, and then press Enter.
The new Web request is also handled by the same Web server
10.1.1.22 (Server2). Unlike cookie-based load balancing, ISA Server does not
round-robin the Web requests to the Web servers, but uses the hash of the
client IP address (39.1.1.7). All Web requests from the Istanbul computer will
go to the same Web server.
50 Module A: Introduction to ISA Server
16. On the Denver computer, a. On the Denver computer, in the IIS Manager console, right-click
stop the Server2 Web Site to Server2 Web Site, and then click Stop.
simulate a connectivity problem The Web site at 10.1.1.22 is no longer responding to Web requests.
with the Web server on 10.1.1.22.
Perform the following steps on the Istanbul computer.
17. On the Istanbul computer, a. On the Istanbul computer, switch to one of the Internet Explorer
attempt to refresh the content of windows that currently displays the web.asp page from 10.1.1.22 (Server2).
the Web page that was from b. On the toolbar, click the Refresh button to refresh the content of the
10.1.1.22 (Server2). Web page.
Internet Explorer displays an error message: Bad request (invalid
hostname).
c. Wait 20 seconds, and then on the toolbar, click the Refresh button
again.
Internet Explorer displays the web.asp page from 10.1.1.21
(Server1). ISA Server has forwarded the Web request to the remaining Web
server in the farm.
Perform the following steps on the Denver computer.
18. On the Denver computer, a. On the Denver computer, in the IIS Manager console, right-click
start the Server2 Web Site. Server2 Web Site, and then click Start.
The Web site at 10.1.1.22 is available again.
b. Close the IIS Manager console.
Perform the following steps on the Istanbul computer.
19. On the Istanbul computer, a. On the Istanbul computer, switch to the Internet Explorer window that
attempt to refresh the content of currently displays the web.asp page from 10.1.1.21 (Server1).
the Web page that was from b. On the toolbar, click the Refresh button to refresh the content of the
10.1.1.21 (Server1). Web page.
ISA Server may still forward the Web request to 10.1.1.21.
After an average of 20 seconds, the connectivity verifier on ISA
Server detects that Web server 10.1.1.22 is available again.
c. Wait 20 seconds, and then on the toolbar, click the Refresh button
again.
Internet Explorer displays the web.asp page from 10.1.1.22
(Server2).
Note: With cookie-based load balancing, ISA Server continues to
forward requests to the same Web server, after the original Web server is
available again - called client stickiness.
With source-IP based load balancing, ISA Server falls back to forwarding Web
request to the original Web server. There is no client stickiness.
d. Close all Internet Explorer windows.
Note: The following tasks are needed to avoid conflicts with other lab exercises.
20. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
delete the Sales Web Site rule, and Firewall Policy.
delete the Shop Web Servers b. In the right pane, right-click the Sales Web Site rule, and then click
farm. Delete.
c. Click Yes to confirm that you want to delete Sales Web Site.
Module A: Introduction to ISA Server 51
Exercise 6
Publishing Multiple Terminal Servers
In this exercise, you will configure ISA Server to publish a terminal server (remote desktop)
on the Internal network and publish a terminal server on the ISA Server computer.
1. On the Denver computer, a. On the Denver computer, on the Start menu, click Control Panel, and
use System properties to enable then click System.
remote desktop. b. In the System Properties dialog box, on the Remote tab, enable
Enable Remote Desktop on this computer.
c. Click OK to acknowledge that remote connection accounts must have
passwords, and that the correct port must be open for remote connections.
Note: Terminal Services (Remote Desktop) uses TCP port 3389.
d. Click OK to close the System Properties dialog box.
Perform the following steps on the Paris computer.
2. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
create a server publishing rule: Firewall Policy.
b. In the right pane, select the first rule, or select Default rule if no other
Name: rule exists, to indicate where the new rule is added to the rule list.
Publish RDP (on Denver)
c. In the task pane, on the Tasks tab, click
Publish Non-Web Server Protocols.
Server: 10.1.1.5
The New Server Publishing Rule Wizard opens.
Protocols: RDP (Terminal d. In the New Server Publishing Rule Wizard dialog box, in the
Services) Server Server publishing rule name text box, type Publish RDP (on Denver), and
then click Next.
e. On the Select Server page, in the Server IP address text box, type
10.1.1.5, and then click Next.
f. On the Select Protocol page, in the Selected protocol drop-down list
box, select RDP (Terminal Services) Server, and then click Next.
g. On the Network Listener IP Addresses page, select External, and then
click Next.
h. On the Completing the New Server Publishing Rule Wizard page, click
Finish.
A new server publishing rule is created that publishes RDP
(TCP port 3389) on 10.1.1.5 (Denver) on the External network.
i. Click Apply to apply the new rule, and then click OK.
3. Use the a. Open a Command Prompt window.
C:\Tools\fwengmon /C command b. At the command prompt, type netstat -ano | find ":3389", and then
to examine the active creation press Enter.
objects.
The output of the command shows that currently no process has
registered with the TCP driver to listen on port 3389.
Notice that creating a Server Publishing rule does NOT cause the
TCP driver or UDP driver to listen on the specific port. Only the ISA Server
Module A: Introduction to ISA Server 53
kernel-mode firewall engine listens to the port. This makes it very easy to
publish services that run on the ISA Server itself.
Note: Creating a Web Publishing rule does cause the TCP driver to
listen on the Web listener port (for example port 80).
c. Type cd \tools, and then press Enter.
d. Type fwengmon /?, and then press Enter.
The Firewall Kernel Mode Tool (fwengmon.exe) is a tool you can
use to analyze and troubleshoot firewall connectivity by monitoring the ISA
Server kernel-mode firewall engine.
You can download the tool from
www.microsoft.com/isaserver/downloads.
e. Type fwengmon /C, and then press Enter.
The output lists the table of active creation objects in the firewall
engine. A creation object represents acceptable network traffic that causes ISA
Server to create a new connection.
The creation object with Destination 39.1.1.1:3389 is created by
the Publish RDP (on Denver) server publishing rule. In other words, not the
TCP driver, but the kernel-mode firewall engine listens on TCP port 3389.
f. Do not close the Command Prompt window.
Perform the following steps on the Istanbul computer.
4. On the Istanbul computer, a. On the Istanbul computer, on the Start menu, click All Programs, click
create a remote desktop connection Accessories, click Communications, and then right-click
to 39.1.1.1 (Paris) Remote Desktop Connection, and click Pin to Start menu.
Remote Desktop Connection on Istanbul is used multiple times in
this exercise. For ease of use, Remote Desktop Connection is now added to the
main Start menu list.
b. On the Start menu, click Remote Desktop Connection.
c. In the Remote Desktop Connection dialog box, in the Computer text
box, type 39.1.1.1, and then click Connect.
39.1.1.1 is the external IP address of Paris.
The Log On dialog box of Denver appears.
d. In the Log On to Windows dialog box, complete the following
information:
User name: Administrator
Password: password
and then click OK.
You can successfully log on to Denver through a remote desktop
connection.
5. Use the netstat command a. In the remote desktop connection to Denver, open a Command Prompt
to examine the client IP address of window.
the remote desktop connection. b. At the command prompt, type netstat -ano | find ":3389", and then
press Enter.
The output shows that Istanbul (39.1.1.7) has established remote
desktop connection to Denver (10.1.1.5).
c. Close the Command Prompt window.
6. Log off the remote desktop a. In the remote desktop connection to Denver, on the Start menu, click
connection. Log Off.
b. Click Log Off to confirm that you are sure you want to log off.
The remote desktop connection is reset. The Istanbul desktop
appears again.
54 Module A: Introduction to ISA Server
7. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
change the Firewall Policy.
Publish RDP (on Denver) rule. b. In the right pane, right-click Publish RDP (on Denver), and then click
Properties.
Requests appear to come from:
c. In the Publish RDP (on Denver) Properties dialog box, on the To tab,
ISA Server computer
select Requests appear to come from the ISA Server computer.
For each Web Publishing rule (default: appear to come from the
ISA Server computer), and Server Publishing rule (default: appear to come
from the original client), you can specify how ISA Server forwards requests to
published servers.
Specifying how requests are forwarded to published servers is
especially important in network load balancing (NLB) scenarios where return
network traffic must go back through the same ISA Server.
d. Click OK to close the Publish RDP (on Denver) Properties dialog box.
e. Click Apply to save the changes, and then click OK.
Perform the following steps on the Istanbul computer.
8. On the Istanbul computer, a. On the Istanbul computer, on the Start menu, click
create a remote desktop connection Remote Desktop Connection.
to 39.1.1.1 (Paris) b. In the Remote Desktop Connection dialog box, in the Computer text
box, type 39.1.1.1, and then click Connect.
The Log On dialog box of Denver appears.
c. In the Log On to Windows dialog box, complete the following
information:
User name: Administrator
Password: password
and then click OK.
9. Use the netstat command a. In the remote desktop connection to Denver, open a Command Prompt
to examine the client IP address of window.
the remote desktop connection. b. At the command prompt, type netstat -ano | find ":3389", and then
press Enter.
The output shows that the remote desktop connection to Denver
(10.1.1.5) is now coming from IP address 10.1.1.1 (Internal network address of
Paris).
c. Close the Command Prompt window.
10. Log off the remote desktop a. In the remote desktop connection to Denver, on the Start menu, click
connection. Log Off.
b. Click Log Off to confirm that you are sure you want to log off.
The remote desktop connection is reset. The Istanbul desktop
appears again.
Perform the following steps on the Paris computer.
11. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
change the Firewall Policy.
Publish RDP (on Denver) rule. b. In the right pane, right-click Publish RDP (on Denver), and then click
Properties.
Publish on port: 3390
c. In the Publish RDP (on Denver) Properties dialog box, on the Traffic
tab, click Ports.
d. In the Ports dialog box, complete the following information:
Publish on this port instead of the default port: 3390
and then click OK.
Both Web Publishing rules and Server Publishing rules can
Module A: Introduction to ISA Server 55
redirect traffic from one port number to another port number on the published
server.
e. Click OK to close the Publish RDP (on Denver) Properties dialog box.
The server publishing rule now redirects RDP network traffic on
39.1.1.1 port 3390 to 10.1.1.5 port 3389.
f. Click Apply to save the changes, and then click OK.
12. Use the a. In a Command Prompt window in the C:\Tools folder, type
C:\Tools\fwengmon /C command fwengmon /C, and then press Enter.
to examine the active creation The firewall engine listens on IP address 39.1.1.1 port 3390.
objects.
Perform the following steps on the Istanbul computer.
13. On the Istanbul computer, a. On the Istanbul computer, on the Start menu, click
create a remote desktop connection Remote Desktop Connection.
to 39.1.1.1:3390 (Paris) b. In the Remote Desktop Connection dialog box, in the Computer text
box, type 39.1.1.1:3390, and then click Connect.
The Log On dialog box of Denver appears.
This result confirms that you successfully published the remote
desktop of Denver port 3389 on the External network of Paris port 3390.
c. Click Cancel to close the Log On to Windows dialog box.
The Istanbul desktop appears again.
d. Click Close to close the Remote Desktop Connection dialog box.
Perform the following steps on the Paris computer.
14. On the Paris computer, use a. On the Paris computer, on the Start menu, click Control Panel, and
System properties to enable remote then click System.
desktop. b. In the System Properties dialog box, on the Remote tab, enable
Enable Remote Desktop on this computer.
c. Click OK to acknowledge that remote connection accounts must have
passwords, and that the correct port must be open for remote connections.
d. Click OK to close the System Properties dialog box.
15. Use the netstat command, a. In a Command Prompt window, type netstat -ano | find ":3389", and
and the C:\Tools\fwengmon /C then press Enter.
command to examine the effect of The output of the command shows that the process with
enabling remote desktop. process ID nnnn (last column) on Paris listens on all IP addresses (indicated
by 0.0.0.0) on port 3389.
b. At the command prompt, type tasklist /svc | find "nnnn", and then
press Enter. (Replace nnnn with the actual process ID displayed in the output
of the previous step.)
The output of the command shows that the process with
process ID nnnn has image name svchost.exe, and host the Terminal Services
service (TermService).
Note: By default Terminal Services service listens on all IP
addresses on port 3389. This includes the external IP address on Paris
(39.1.1.1). However, this does not mean that the firewall engine currently
allows incoming network traffic on the External network on port 3389.
c. At the command prompt, in the C:\Tools folder, type fwengmon /C,
and then press Enter.
The firewall engine does not listen on IP address 39.1.1.1 port
3389.
16. Create a server publishing a. In the ISA Server console, in the left pane, select Firewall Policy.
rule: b. In the right pane, select the first rule to indicate where the new rule is
added to the rule list.
Name:
56 Module A: Introduction to ISA Server
18. On the Istanbul computer, a. On the Istanbul computer, on the Start menu, click
create a remote desktop connection Remote Desktop Connection.
to 39.1.1.1 (Paris) b. In the Remote Desktop Connection dialog box, in the Computer text
box, type 39.1.1.1, and then click Connect.
The Log On dialog box of Paris appears.
This result confirms that you successfully published the remote
desktop of Paris the External network of Paris.
c. Click Cancel to close the Log On to Windows dialog box.
The Istanbul desktop appears again.
d. Click Close to close the Remote Desktop Connection dialog box.
Note: The following tasks are needed to avoid conflicts with other lab exercises.
19. On the Denver computer, a. On the Denver computer, on the Start menu, click Control Panel, and
use System properties to disable then click System.
remote desktop. b. In the System Properties dialog box, on the Remote tab, in the
Module A: Introduction to ISA Server 57
20. On the Paris computer, use a. On the Paris computer, on the Start menu, click Control Panel, and
System properties to disable then click System.
remote desktop. b. In the System Properties dialog box, on the Remote tab, in the
Remote Desktop box, clear Enable Remote Desktop to this computer.
c. Click OK to close the System Properties dialog box.
58 Module A: Introduction to ISA Server
1. On the Denver computer, a. On the Denver computer, use Windows Explorer (or My Computer) to
import the denver.contoso.com open the C:\Tools\Certs folder.
Web server certificate from the The Certs folder contains a Web server certificate for
C:\Tools\Certs folder. denver.contoso.com, and a script to import the certificate and private key in the
local machine store.
b. In the Certs folder, right-click denver-certload.vbs, and then click
Open.
c. Click Yes to confirm that you want to import the certificate.
d. Click OK to acknowledge that the import of the certificate is complete.
e. Close the Certs folder.
2. Configure IIS to use the a. On the Start menu, click Administrative Tools, and then click
denver.contoso.com Web server Internet Information Services (IIS) Manager.
certificate. The IIS Manager console opens.
b. In the IIS Manager console, expand DENVER (local computer),
expand Web Sites, right-click Default Web Site, and then click Properties.
c. In the Default Web Site Properties dialog box, on the
Directory Security tab, click Server Certificate.
d. In the Welcome to the Web Server Certificate Wizard dialog box, click
Next.
e. On the Server Certificate page, select Assign an existing certificate,
and then click Next.
f. On the Available Certificates page, select the certificate for
denver.contoso.com that has the intended purpose of Server Authentication
(do not select a certificate with another intended purpose), and then click Next.
Module A: Introduction to ISA Server 59
g. On the SSL Port page, in the SSL port this web site should use text
box, type 443, and then click Next.
h. On the Certificate Summary page, click Next.
i. On the Completing the Web Server Certificate Wizard page, click
Finish.
The Default Web Site on Denver can now use the
denver.contoso.com Web server certificate for HTTPS connections.
j. Click OK to close the Default Web Site Properties dialog box.
k. Close the IIS Manager console.
Perform the following steps on the Paris computer.
3. On the Paris computer, a. On the Paris computer, use Windows Explorer (or My Computer) to
import the mail.contoso.com open the C:\Tools\Certs folder.
Web server certificate from the The Certs folder contains a Web server certificate for
C:\Tools\Certs folder. mail.contoso.com, and a script to import the certificate and private key in the
local machine store.
b. In the Certs folder, right-click mail-certload.vbs, and then click Open.
c. Click Yes to confirm that you want to import the certificate.
d. Click OK to acknowledge that the import of the certificate is complete.
4. For demonstration a. In the Certs folder, open the Invalid folder.
purposes, import invalid The Invalid folder contains certificates that demonstrate a few
certificates from the common mistakes with using certificates on ISA Server, and a script to import
C:\Tools\Certs\Invalid folder. the certificates.
b. In the Invalid folder, right-click certload-invalid-Paris.vbs, and then
click Open.
c. Click Yes to confirm that you want to import the certificates.
d. Click OK to acknowledge that the import of the certificates is complete.
Later in this exercise, you will see how ISA Server helps identify the
invalid certificates.
e. Close the Invalid folder.
Note: On ISA Server 2006 Enterprise Edition, when you configure a Server Authentication certificate to create
SSL connections, the same certificate (same name) must be installed on all array members.
5. Create a new Web listener. a. On the Start menu, click All Programs, click Microsoft ISA Server,
and then click ISA Server Management.
Name: External Web 443 The ISA Server console opens.
b. In the ISA Server console, expand Paris, and then select
SSL: enable
Firewall Policy.
Network: External c. In the task pane, on the Toolbox tab, in the Network Objects section,
Compression: disable right-click Web Listeners, and then click New Web Listener.
d. In the New Web Listener Definition Wizard dialog box, in the
Certificate: Web listener name text box, type External Web 443, and then click Next.
mail.contoso.com e. On the Client Connection Security page, select
Require SSL secured connections with clients, and then click Next.
Authentication:
HTTP Authentication f. On the Web Listener IP Addresses page, complete the following
- Basic information:
Listen on network: External
ISA Server will compress content: disable
and then click Next.
g. On the Listener SSL Certificates page, click Select Certificate.
By default, the Select Certificate dialog box only shows the Web
server certificates that are installed correctly.
h. In the Select Certificate dialog box, disable
60 Module A: Introduction to ISA Server
Show only valid certificates.
To help you troubleshoot common certificate mistakes, ISA Server
lists imported certificates that are not valid. The certificates named
cert2.contoso.com to cert5.contoso.com are the invalid certificates that you
imported earlier in the exercise.
i. In the certificates list, select each of the certificates cert2.contoso.com
to cert5.contoso.com to see the problem with the certificate.
ISA Server can identify the following problems with certificates:
cert2.contoso.com - The certificate is installed in the current user store,
instead of the local machine store.
cert3.contoso.com - The certificate is installed without private key.
cert4.contoso.com - The certificate has expired.
cert5.contoso.com - The certificate is not yet valid.
On ISA Server 2006 Enterprise Edition, there is one more
certificate problem that is identified:
The certificate is not imported on all array members.
j. In the certificates list, select mail.contoso.com, and then click Select.
k. On the Listener SSL Certificates page, click Next.
l. On the Authentication Settings page, complete the following
information:
Authentication method: HTTP Authentication (is default)
Basic: enable
Digest: disable (is default)
Integrated: disable (is default)
and then click Next.
m. On the Single Sign On Settings page, click Next.
n. On the Completing the New Web Listener Wizard page, click Finish.
A new Web listener (port 443 on the IP address on the adapter on
the External network) with the name External Web 443 is created.
6. Create an OWA mail server a. In the right pane, select the first rule, or select Default rule if no other
publishing rule: rule exists, to indicate where the new rule is added to the rule list.
b. In the task pane, on the Tasks tab, click
Name: Publish mail (OWA) Publish Exchange Web Client Access.
c. In the New Exchange Publishing Rule Wizard dialog box, in the
Version:
Exchange Publishing rule name text box, type Publish mail (OWA), and
Exchange Server 2003
then click Next.
Internal site name: d. On the Select Services page, complete the following information:
denver.contoso.com Exchange version: Exchange Server 2003 (is default)
Outlook Web Access: enable (is default)
Public name: Leave the other check boxes disabled (is default)
mail.contoso.com and then click Next.
e. On the Publishing Type page, select Publish a single Web site, and then
Web listener: click Next.
External Web 443
f. On the Server Connection Security page, select
Use SSL to connect to the published Web server, and then click Next.
Delegation:
Basic Authentication g. On the Internal Publishing Details page, in the Internal site name text
box, type denver.contoso.com, and then click Next.
The specified name of the Web mail server must match exactly the
name in the certificate on the Denver Web server. Otherwise Internet Explorer
on the client computers fails to connect, and displays an error message (500
Internal Server Error - The target principal name is incorrect).
h. On the Public Name Details page, complete the following information:
Accept requests for: This domain name (type below):
Public name: mail.contoso.com
and then click Next.
Module A: Introduction to ISA Server 61
The specified public name must match exactly the name in the
certificate on Paris. Otherwise the connecting client computers will display a
security alert message (The name on the security certificate is invalid.).
i. On the Select Web Listener page, in the Web listener drop-down list
box, select External Web 443, and then click Next.
j. On the Authentication Delegation page, select Basic Authentication,
and then click Next.
k. On the User Sets page, click Next.
l. On the Completing the New Exchange Publishing Rule Wizard page,
click Finish.
A new Web publishing rule is created, which publishes the three
OWA virtual directories on the Web site denver.contoso.com as
mail.contoso.com on the External network.
7. Examine the new OWA a. In the right pane, right-click Publish mail (OWA), and then click
mail server publishing rule named Properties.
Publish mail (OWA). b. In the Publish mail (OWA) Properties dialog box, select the To tab.
OWA requires that the original host headers
(https://mail.contoso.com) are forwarded to the published server (Denver).
c. Select the Traffic tab.
The OWA publishing rule only allows HTTPS access, not HTTP
access.
d. Select the Paths tab.
The OWA publishing rule only allows access to the three virtual
directories needed for OWA (/public, /exchweb and /exchange).
e. Select the Listener tab.
The certificate name (mail.contoso.com) exactly matches the name
on the Public Name tab.
f. Select the Bridging tab.
ISA Server redirects incoming requests to the SSL port. It will
create a new SSL connection from the ISA Server to Denver. The name on the
To tab exactly matches the name in the certificate on Denver.
g. Click Cancel to close the Publish mail (OWA) Properties dialog box.
8. Apply the new rule. h. Click Apply to apply the new rule, and then click OK.
The new Publish mail (OWA) rule is applied.
Perform the following steps on the Denver computer.
9. On the Denver computer, a. On the Denver computer, on the Start menu, click
configure IIS to require SSL on the Administrative Tools, and then click
virtual directories used by OWA: Internet Information Services (IIS) Manager.
The IIS Manager console opens.
/Exchange
b. In the IIS Manager console, expand Default Web Site, right-click
/ExchWeb
Exchange, and then click Properties.
/Public
/Exchange, /ExchWeb and /Public are the three virtual directories
used by Outlook Web Access (OWA).
c. In the Exchange Properties dialog, on the Directory Security tab, in the
Secure communications box, click Edit.
d. In the Secure Communications box, enable
Require secure channel (SSL), and then click OK.
Now that IIS has a Web server certificate configured, only secure
access (HTTPS) to the OWA virtual directories should be allowed.
e. Click OK to close the Exchange Properties dialog box.
Repeat the same configuration step for the /ExchWeb virtual
directory.
62 Module A: Introduction to ISA Server
10. On the Istanbul computer, a. On the Istanbul computer, open Internet Explorer. In the Address box,
use Internet Explorer to securely type https://mail.contoso.com/exchange, and then press Enter.
connect to An authentication dialog box for mail.contoso.com appears.
https://mail.contoso.com
Note: On Istanbul, mail.contoso.com resolves to 39.1.1.1 (Paris).
/exchange
b. In the Connect to mail.contoso.com dialog box, complete the following
Send an e-mail to Administrator information:
to test the secure OWA connection User name: Administrator
to ISA Server. Password: password
Remember my password: disable (is default)
and then click OK.
Internet Explorer displays the Outlook Web Access Inbox of the
Administrator. The yellow lock icon at the bottom of the screen indicates that
the connection uses SSL.
Note: The root certificate of Denver CA is already installed as
trusted root certificate on Istanbul.
c. On the OWA toolbar, click New.
d. In the new message window, complete the following information:
To: Administrator
Subject: Test mail through Secure OWA - 1
(Message): Publish Exchange using Secure OWA
and then click Send.
Internet Explorer sends the message.
After a few moments a new message appears in the Inbox. This
result shows that Internet Explorer successfully connected to the Exchange
Server on Denver, by using a secure OWA connection to ISA Server.
e. After a few moments, in the left pane, click Inbox to refresh the display
of the Inbox contents.
f. Close Internet Explorer.
Note: In the following steps, HTML Form Authentication is configured. The advantage of using HTML Form
Authentication is that the authentication credentials are not cached on the client computer. This is especially
important when users are connecting from public computers. The credential information is kept in a (temporary)
session-cookie while the OWA connection is open.
Perform the following steps on the Paris computer.
11. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
configure the External Web 443 Firewall Policy
Web listener to use HTML Form b. In the task pane, on the Toolbox tab, in the Network Objects section,
Authentication.
Module A: Introduction to ISA Server 63
expand Web Listeners, right-click External Web 443, and then click
Properties.
c. In the External Web 443 Properties dialog box, on the Authentication
tab, in the Client Authentication Method drop-down list box, select HTML
Form Authentication.
d. On the Forms tab, click Advanced.
The HTML Form Authentication allows you to specify idle session
timeout values for client browsers on public computers and client browsers on
private computers.
e. Click Cancel to close the Advanced Form Options dialog box.
f. Click OK to close the External Web 443 Properties dialog box.
The Web listener is now configured to use HTML Form
Authentication.
g. Click Apply to save the changes, and then click OK.
Perform the following steps on the Istanbul computer.
12. On the Istanbul computer, a. On the Istanbul computer, open Internet Explorer. In the Address box,
use Internet Explorer to securely type https://mail.contoso.com/exchange, and then press Enter.
connect to The Office Outlook Web Access authentication Web page appears.
https://mail.contoso.com
b. In the Office Outlook Web Access page, complete the following
/exchange again.
information:
Security: This is a private computer
Use Outlook Web Access Light: disable (is default)
Domain\user name: contoso\administrator
Password: password
and then click Log On.
When using HTML Form Authentication, the user indicates whether
the client browser is on a public computer or on a private computer.
Internet Explorer displays the Outlook Web Access Inbox.
c. Close Internet Explorer.
Note: The following task is needed to avoid conflicts with other lab exercises.
13. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
configure the External Web 443 Firewall Policy.
Web listener to use Basic b. In the task pane, on the Toolbox tab, in the Network Objects section,
authentication. expand Web Listeners, right-click External Web 443, and then click
Properties.
c. In the External Web 443 Properties dialog box, on the Authentication
tab, complete the following information:
Client Authentication Method: HTTP Authentication
Basic: enable
Digest: disable (is default)
Integrated: disable (is default)
and then click OK to close the External Web 443 Properties dialog box.
The Web listener is now configured to use Basic HTTP
authentication.
d. Click Apply to save the changes, and then click OK.
64 Module A: Introduction to ISA Server
Exercise 2
Publishing an Exchange Server for SMTP and POP3
In this exercise, you will configure server publishing rules on the ISA Server to allow access
to the Exchange Server by using the SMTP and POP3 protocols.
1. On the Istanbul computer, a. On the Istanbul computer, on the Start menu, click All Programs, and
start Outlook Express, and then then click Outlook Express.
attempt to connect to the Exchange b. In Outlook Express, on the toolbar, click Send/Recv.
Server (POP3) by clicking
c. In the Logon - Contoso mail dialog box, complete the following
Send/Recv.
information:
User Name: Administrator
Password: password
and then click OK.
Outlook Express attempts to connect to the server at IP address
39.1.1.1 (ISA Server) by using the POP3 protocol. ISA Server blocks the
connection. After a few moments, Outlook Express displays an error message
that the connection to the server has failed.
d. Click Hide to close the error message box.
Perform the following steps on the Paris computer.
2. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
create a mail server publishing Firewall Policy.
rule: b. In the right pane, select the first rule, or select Default rule if no other
rule exists, to indicate where the new rule is added to the rule list.
Name: Publish mail
c. In the task pane, on the Tasks tab, click Publish Mail Servers.
Protocols: SMTP, POP3 The New Mail Server Publishing Rule Wizard opens. This is a
specialized version of the general New Server Publishing Rule Wizard and New
Server: 10.1.1.5 Web Publishing Rule Wizard.
d. In the New Mail Server Publishing Rule Wizard dialog box, in the
Mail Server Publishing rule name text box, type Publish mail, and then click
Next.
e. On the Select Access Type page, select
Client access: RPC, IMAP, POP3, SMTP, and then click Next.
f. On the Select Services page, complete the following information:
POP3 (standard port): enable
SMTP (standard port): enable
Leave all other check boxes disabled
and then click Next.
g. On the Select Server page, in the Server IP address text box, type
10.1.1.5, and then click Next.
h. On the Network Listener IP Addresses page, select External, and then
click Next.
i. On the Completing the New Mail Server Publishing Rule Wizard page,
click Finish.
Module A: Introduction to ISA Server 65
Two new server publishing rules are created: Publish mail SMTP
Server, and Publish mail POP3 Server.
3. Apply the changes. a. Click Apply to apply the new rules, and then click OK.
Perform the following steps on the Istanbul computer.
4. On the Istanbul computer, a. On the Istanbul computer, in Outlook Express, on the toolbar, click
in Outlook Express, connect to Send/Recv.
the Exchange Server, by clicking b. If the Logon - Contoso mail dialog box appears, complete the following
Send/Recv. information:
User Name: Administrator
Send an e-mail to administrator Password: password
@contoso.com to test the SMTP and then click OK.
and POP3 connections to
ISA Server. Outlook Express is able to connect with the POP3 protocol to the
Exchange Server (10.1.1.5) published by ISA Server on its external interface
(39.1.1.1).
c. On the toolbar, click Create Mail.
d. In the New Message window, complete the following information:
To: [email protected]
Subject: Test mail through SMTP/POP3 - 2
(Message): Publish Exchange using SMTP/POP3
and then click Send.
Outlook Express immediately sends the e-mail message.
Notice that a new message does not show up in the Inbox. Unlike
some of the other methods (OWA, RPC) that can be used to connect to the
Exchange Server, the SMTP/POP3 connection does not support New Mail
Notification.
e. On the toolbar, click Send/Recv.
A new message appears in the Inbox. This result shows that
Outlook Express successfully connected to the Exchange Server on Denver, by
using SMTP/POP3 connections to ISA Server.
f. Close Outlook Express.
66 Module A: Introduction to ISA Server
Exercise 3
Publishing an Exchange Server for Outlook (RPC)
In this exercise, you will publish the Exchange Server (Denver) for Remote Procedure Call
(RPC) access by Microsoft Outlook clients. This allows the full functionality of Outlook.
1. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
create a mail server publishing Firewall Policy.
rule: b. In the right pane, select the first rule, or select Default rule if no other
rule exists, to indicate where the new rule is added to the rule list.
Name: Publish mail
c. In the task pane, on the Tasks tab, click Publish Mail Servers.
Protocols: Outlook (RPC) d. In the New Mail Server Publishing Rule Wizard dialog box, in the
Mail Server Publishing rule name text box, type Publish mail, and then click
Server: 10.1.1.5 Next.
e. On the Select Access Type page, select
Client access: RPC, IMAP, POP3, SMTP, and then click Next.
f. On the Select Services page, complete the following information:
Outlook (RPC) (standard port): enable
Leave all other check boxes disabled
and then click Next.
g. On the Select Server page, in the Server IP address text box, type
10.1.1.5, and then click Next.
h. On the Network Listener IP Addresses page, select External, and then
click Next.
i. On the Completing the New Mail Server Publishing Rule Wizard page,
click Finish.
A new server publishing rule named Publish mail Exchange RPC
Server is created.
2. Examine the RPC Filter a. In the left pane, expand Configuration, and then select Add-ins.
application filter. b. In the right pane, on the Application Filters tab, select RPC Filter.
When a firewall policy rule uses a RPC protocol, the RPC Filter
listens to requests from client computers on TCP port 135. Client computers
are then redirected to higher port numbers on the ISA Server. The RPC Filter
will dynamically open these ports. It is not necessary to open these higher ports
statically on the firewall.
3. Examine the new mail a. In the left pane, select Firewall Policy.
server publishing rule named b. In the right-pane, select Publish mail Exchange RPC Server, and then
Publish mail in the task pane, on the Tasks tabs, click Edit Selected Rule.
Exchange RPC Server.
c. In the Publish mail Exchange RPC Server Properties dialog box, select
the Traffic tab.
The new mail server publishing rule allows traffic for the
Exchange RPC Server protocol. This is a specialized version of the
RPC Server protocol. The RPC Filter will dynamically open ports for RPC
requests that are related to Exchange Server only.
d. On the Traffic tab, click Properties.
e. In the Exchange RPC Server Properties dialog box, select the Interfaces
Module A: Introduction to ISA Server 67
tab.
A service can register itself with the RPC Service, using its
Universal Unique Identifier (UUID). Client computers include the UUID in the
RPC requests, to indicate which service they want to connect to. The default
Exchange RPC Server protocol definition in ISA Server 2006 supports 17
different RPC UUIDs related to Exchange services. These are all published on
a dynamically assigned port, if a connection request is received.
f. Click Cancel to close the Exchange RPC Server Properties dialog box.
g. Click Cancel to close the Publish mail Exchange RPC Server Properties
dialog box.
4. Apply the new rule. a. In the right pane, click Apply to apply the new rule, and then click OK.
The new Publish mail Exchange RPC Server rule is applied.
Perform the following steps on the Istanbul computer.
5. On the Istanbul computer, a. On the Istanbul computer, open a Command Prompt window.
start Outlook 2003, and then b. At the command prompt, type netstat -ano | find "EST", and then
examine the network connections. press Enter.
The output of the command displays zero or more established
Use: netstat -ano
TCP/IP network connections from the Istanbul computer, before Outlook is
started.
Use: Connection Status
You can use the netstat -ano command, without the find part, to
see a complete list of current network connections.
c. On the Start menu, click All Programs, click Microsoft Office, and
then click Microsoft Office Outlook 2003.
Outlook 2003 starts and displays the Inbox of the Administrator.
d. Switch to the Command Prompt window.
e. At the command prompt, type netstat -ano | find "EST", and then
press Enter.
The output of the command displays four (or less) established
connections from Istanbul (39.1.1.7) to the ISA Server (39.1.1.1). Outlook
initially set up an RPC connection to TCP port 135, and was then redirected to
a dynamically opened higher port on the ISA Server.
f. Close the Command Prompt window.
g. Press the Ctrl-key, and then click the Outlook icon in the system tray
area.
When the Ctrl-key is not pressed, the Connection Status option
does not appear on the context menu of the system tray Outlook icon.
h. In the context menu of the system tray Outlook icon, click
Connection Status.
The Exchange Server Connection Status window lists four
connections from Outlook to Denver.contoso.com. The term TCP/IP in the
Conn column indicates that RPC connections are used.
In the next exercise, Outlook will use RPC over HTTP connections
to the Exchange Server.
i. Click Close to close the Exchange Server Connection Status window.
6. Send an e-mail to a. In Outlook, on the toolbar, click New.
Administrator to test the RPC b. In the new message window, complete the following information:
connection to ISA Server. To: Administrator
Subject: Test mail through RPC - 3
(Message): Publish Exchange using RPC
and then click Send.
After a few moments Outlook sends the message from the Outbox. It
will then appear in the Inbox. This result shows that Outlook successfully
connected to the Exchange Server on Denver, by using RPC connections to the
68 Module A: Introduction to ISA Server
ISA Server.
c. In the Inbox, select the new message.
d. Close Outlook.
Module A: Introduction to ISA Server 69
Exercise 4
Publishing an Exchange Server for RPC over HTTP
In this exercise, you want to provide Microsoft Outlook clients with the full functionality of
Outlook when they connect to the Exchange Server. However, in this exercise, directly
publishing Exchange Server through the Remote Procedure Call (RPC) protocol is not
possible. You will configure ISA Server to tunnel RPC traffic inside HTTP (HTTPS) traffic.
This uses the RPC over HTTP protocol.
Note: This exercise uses the same Web server authentication certificates (mail.contoso.com
and denver.contoso.com) that you used in the Outlook Web Access (OWA) exercise earlier. If
you have completed that exercise, you can skip the first three tasks in this exercise.
1. On the Paris computer, a. On the Paris computer, use Windows Explorer (or My Computer) to
import the mail.contoso.com open the C:\Tools\Certs folder.
Web server certificate from the The Certs folder contains a Web server certificate for
C:\Tools\Certs folder. mail.contoso.com, and a script to import the certificate and private key in the
local machine store.
b. In the Certs folder, right-click mail-certload.vbs, and then click Open.
c. Click Yes to confirm that you want to import the certificate.
d. Click OK to acknowledge that the import of the certificate is complete.
e. Close the Certs folder.
Perform the following steps on the Denver computer.
2. On the Denver computer, a. On the Denver computer, use Windows Explorer (or My Computer) to
import the denver.contoso.com open the C:\Tools\Certs folder.
Web server certificate from the The Certs folder contains a Web server certificate for
C:\Tools\Certs folder. denver.contoso.com, and a script to import the certificate and private key in the
local machine store.
b. In the Certs folder, right-click denver-certload.vbs, and then click
Open.
c. Click Yes to confirm that you want to import the certificate.
d. Click OK to acknowledge that the import of the certificate is complete.
e. Close the Certs folder.
3. Configure IIS to use the a. On the Start menu, click Administrative Tools, and then click
denver.contoso.com Web server Internet Information Services (IIS) Manager.
certificate. The IIS Manager console opens.
b. In the IIS Manager console, expand DENVER (local computer),
expand Web Sites, right-click Default Web Site, and then click Properties.
c. In the Default Web Site Properties dialog box, on the
Directory Security tab, click Server Certificate.
d. In the Welcome to the Web Server Certificate Wizard dialog box, click
Next.
70 Module A: Introduction to ISA Server
e. In the IIS Manager warning message box, click Yes to confirm that you
want to continue.
Basic authentication results in password being transmitted over the
network without encryption. You will configure the virtual directory to require
SSL on the RPC over HTTP connection, to protect the credential information.
f. In the Authentication Methods dialog box, complete the following
information:
Enable anonymous access: disable
Integrated Windows authentication: disable (is default)
Basic authentication: enable (done in previous step)
and then click OK.
Basic authentication is now the only enabled authentication method
on the /Rpc virtual directory.
g. On the Directory Security tab, in the Secure communications box,
click Edit.
h. In the Secure communications box, enable
Require secure channel (SSL), and then click OK.
To secure the basic authentication passwords used by RPC over
HTTP, SSL is required on the /Rpc virtual directory.
Effectively this makes it RPC over HTTPS.
i. On the Directory Security tab, click View Certificate.
The Default Web Site on Denver uses a Web server certificate
named denver.contoso.com. ISA Server will publish
https://denver.contoso.com/rpc to allow access to the Exchange Server.
j. Click OK to close the Certificate dialog box.
k. Click OK to close the Rpc Properties dialog box.
l. Close the IIS Manager console.
7. Configure the RPC Proxy a. Open a Command Prompt window.
network service to communicate b. At the command prompt, type cd \tools\reskit, and then press Enter.
with the Exchange Server and
The Reskit folder contains a configuration tool (rpccfg.exe) from
Global Catalog server
the Windows Server 2003 Resource Kit.
(denver.contoso.com) on the
following ports: At each of the steps below, press Enter after the command.
c. Type rpccfg /hd.
6001, 6002 and 6004 The output of the command displays which ports on which
computer the RPC Proxy service is allowed to create an RPC connection to.
The default setting is: Denver 100-5000.
d. Type rpccfg /hr Denver.
This removes the current port range settings for Denver.
The next commands add the required port ranges for both the
NetBIOS name, and the fully qualified domain name (FQDN) of the (back-end)
Exchange Server and Global Catalog server.
The RPC connections to the Exchange Server are done at port 6001 (Store),
6002 (DSReferral) and 6004 (DSProxy).
e. Type rpccfg /ha Denver 6001 6002 6004.
f. Type rpccfg /ha denver.contoso.com 6001 6002 6004.
g. Type rpccfg /hd.
The RPC Proxy service can now create RPC connections to the
Exchange Server (6001 and 6004) and Global Catalog server (6002) on the
required ports.
Instead of using the rpccfg.exe tool, you can also directly edit the
ValidPorts value in the registry. The next command shows the current value of
the ValidPorts setting.
h. Type reg.exe query HKLM\Software\Microsoft\Rpc\RpcProxy.
Note: Earlier Exchange Server 2003 documentation described that
72 Module A: Introduction to ISA Server
you must also add port 593. This port is used for DCOM access. However,
when unpatched, a vulnerability in the DCOM RCP interface allows an
attacker to run code with Local System privileges on the affected system. The
W32/Blaster worm exploited this vulnerability. This is described in Microsoft
Knowledge Base article 826382, and Microsoft security bulletin MS03-26.
Outlook does not require the use of TCP port 593 when connecting to the
Exchange Server using RPC over HTTP, so do not include that port number in
the configuration of the RPC Proxy service.
i. Close the Command Prompt window.
Note: When you deploy Exchange in a front-end/back-end scenario, and have Exchange Server 2003 SP1 or
higher installed on the front-end server, you do not need to configure the ValidPorts setting manually. In that
case, the front-end Exchange Server automatically manages the ValidPorts value.
8. Configure the Global a. On the Start menu, click Run.
Catalog server (Denver) to use port b. In the Run dialog box, type regedit.exe, and then click OK.
6004 for RPC over HTTP
c. In the Registry Editor window, select the
connections.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\NTDS\Parameters key.
d. Right-click the Parameters key, click New, and then click
Multi-String Value.
e. In the New Value #1 text box, replace the text by typing
NSPI interface protocol sequences, and then press Enter.
A new REG_MULTI_SZ value named
NSPI interface protocol sequences is created.
f. Right-click the NSPI interface protocol sequences value, and then
click Modify.
g. In the Edit Multi-String dialog box, type ncacn_http:6004, and then
click OK.
The Global Catalog server will listen on TCP port 6004 for
RPC connections from the RPC Proxy network service.
The server computer needs to restart, before this setting is active.
h. Close the Registry Editor window.
9. Restart the Denver a. On the Start menu, click Shut Down.
computer. In the next step, ensure that you RESTART Denver, instead of
Shut down Denver.
b. In the Shut Down Windows dialog box, complete the following
information:
What do you want the computer to do: Restart
Option: Other (Planned) (is default)
Comment: Changed RPC Proxy settings
and then click OK.
The Denver computer restarts. This will take a few minutes.
10. Log on to the computer: a. After the restart, at the Welcome to Windows dialog box, press
<right>Alt-Del (instead of Ctrl-Alt-Del).
User name: Administrator b. In the Log On to Windows dialog box, complete the following
Password: password information:
Log on to: CONTOSO User name: Administrator
Password: password
Domain: CONTOSO
and then click OK to log on.
Perform the following steps on the Paris computer.
11. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
disable the existing rule that Firewall Policy.
publishes the Exchange Server by b. In the right pane, right-click Publish mail Exchange RPC Server, and
Module A: Introduction to ISA Server 73
16. On the Istanbul computer, a. On the Istanbul computer, open Internet Explorer. In the Address box,
use Internet Explorer to verify type https://mail.contoso.com/rpc, and then press Enter.
the configuration of the secure b. In the Connect to mail.contoso.com dialog box, complete the following
Web publishing rule, by information:
connecting to User name: Administrator
https://mail.contoso.com Password: password
/rpc.
Remember my password: disable (is default)
and then click OK.
The expected error code is 401.3
(Access denied due to an ACL). Because the /Rpc virtual directory does not allow direct access,
Internet Explorer displays the Connect to mail.contoso.com dialog box two
more times.
c. In the Connect to mail.contoso.com dialog box, type Administrator and
password for the second time, and then click OK.
d. In the Connect to mail.contoso.com dialog box, type Administrator and
password for the third time, and then click OK.
Internet Explorer displays an error Web page (HTTP Error 401.3 -
Unauthorized: Access is denied due to an ACL).
This is the expected result.
Using Internet Explorer to connect to the /Rpc virtual directory has
no functional meaning in the context of the RPC over HTTP protocol.
However, this is a quick way to verify that the Web listener, the Secure Web
publishing rule and the Web server certificates on both the ISA Server and the
RPC Proxy server (Denver) are configured correctly.
Module A: Introduction to ISA Server 75
21. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
configure the External Web 443 Firewall Policy.
Web listener to use Form b. In the task pane, on the Toolbox tab, in the Network Objects section,
Authentication. expand Web Listeners, right-click External Web 443, and then click
Properties.
c. In the External Web 443 Properties dialog box, on the Authentication
tab, complete the following information:
Client Authentication Method: HTML Form Authentication
and then click OK to close the External Web 443 Properties dialog box.
The Web listener is now configured to use HTML Form
authentication.
d. Click Apply to save the changes, and then click OK.
Perform the following steps on the Istanbul computer.
22. Use Internet Explorer to a. Open Internet Explorer. In the Address box, type
connect to https://mail.contoso.com/exchange, and then press Enter.
https://mail.contoso.com The Office Outlook Web Access authentication Web page appears,
/exchange because the Web listener is configured to use HTML Form authentication.
again.
b. In the Office Outlook Web Access page, complete the following
information:
Security: This is a private computer
Use Outlook Web Access Light: disable (is default)
Domain\user name: contoso\administrator
Password: password
and then click Log On.
Internet Explorer displays the Outlook Web Access Inbox.
c. Close Internet Explorer.
23. Start Outlook 2003. a. On the Start menu, click All Programs, click Microsoft Office, and
then click Microsoft Office Outlook 2003.
b. In the Connecting to Denver.contoso.com dialog box, complete the
following information:
User name: contoso\administrator
Password: password
and then click OK.
Outlook 2003 starts and displays the Inbox of the Administrator.
c. Switch to the Command Prompt window.
d. Press the Ctrl-key, and then click the Outlook icon in the system tray
area.
e. In the context menu of the system tray Outlook icon, click
Connection Status.
The Exchange Server Connection Status window lists four
RPC over HTTPS connections from Outlook to Denver.contoso.com.
f. Click Close to close the Exchange Server Connection Status window.
The Web listener on ISA Server is configured to use HTML Form
78 Module A: Introduction to ISA Server
1. On the Paris computer, a. On the Paris computer, on the Start menu, click Administrative Tools,
examine the status of the and then click Routing and Remote Access.
Routing and Remote Access b. In the Routing and Remote Access console, select PARIS (local).
service.
The Routing and Remote Access service is not started yet, and the
service is not configured. ISA Server uses the Routing and Remote Access
service to handle VPN connections, after the VPN connection is approved.
Note: All VPN configuration (except Remote Access dial-in
permission for users and groups) is done through the ISA Server console.
2. Use the ISA Server console a. On the Start menu, click All Programs, click Microsoft ISA Server,
to configure VPN address ranges. and then click, ISA Server Management.
b. In the ISA Server console, expand Paris, and then select
IP address ranges: Virtual Private Networks (VPN).
- 10.3.1.1 - 10.3.1.120
c. In the right pane, ensure that the VPN Clients tab is selected.
ISA Server supports two types of VPN connections:
Remote access VPN - Client computers on the Internet create a VPN
connection to the ISA Server. This is configured on the VPN Clients tab.
Site-to-site VPN - Two private networks, or branch offices, are connected by
a VPN connection. This is configured on the Remote Sites tab.
d. In the task pane, on the Tasks tab, click Define Address Assignments.
e. In the Virtual Private Networks (VPN) Properties dialog box, on the
Address Assignment tab, select Static address pool, and then click Add.
f. In the Server IP Address Range Properties dialog box, complete the
following information:
Start address: 10.3.1.1
End address: 10.3.1.120
and then click OK.
This IP address range allows for maximum:
1 destination VPN IP address on Paris (10.3.1.1)
119 VPN client addresses (10.3.1.2-10.3.1.120).
g. Click OK to close the Virtual Private Networks (VPN) Properties dialog
box.
3. Enable and configure VPN a. On the Tasks tab, click Enable VPN Client Access.
client access. This step enables VPN access to the ISA server. A system policy
80 Module A: Introduction to ISA Server
rule is enabled, and after the changes are saved the Routing and Remote
- Maximum clients: 100 Access service is configured.
b. On the Tasks tab, click Configure VPN Client Access.
- Protocols: PPTP
c. In the VPN Client Properties dialog box, on the General tab, in the
Maximum number of VPN clients allowed text box, leave the default value
100.
The maximum number of VPN clients that can connect at the same
time, depends on the capacity of the ISA Server, and the number of available IP
addresses.
d. On the Protocols tab, ensure that only Enable PPTP is selected.
In this exercise, only the PPTP protocol is used.
e. Click OK to close the VPN Clients Properties dialog box.
Note that the VPN configuration is not applied yet.
4. Examine the VPN a. In the left pane, right-click Virtual Private Networks (VPN), and then
connection settings. click Properties.
You can also access the four tabs of the Virtual Private Networks
Access networks: (VPN) Properties dialog box from the task pane.
External
b. In the Virtual Private Networks (VPN) Properties dialog box, select the
Access Networks tab.
Authentication: MS-CHAPv2
ISA Server is currently configured to only accept incoming VPN
connections from the External network.
c. Select the Authentication tab.
ISA Server is currently configured to allow only MS CHAPv2
authentication for incoming VPN connections.
d. Click OK to close the Virtual Private Networks (VPN) Properties dialog
box.
5. Examine the VPN access a. In the left pane, select Firewall Policy.
rule: b. In the task pane, on the Tasks tab, click Show System Policy Rules.
c. In the right pane, select the Allow VPN client traffic to ISA Server
System policy rule:
system policy rule (rule 13).
Allow VPN client traffic to ISA
Server (rule 13). This system policy rule allows the PPTP protocol from the External
network to the Local Host network (ISA Server).
If the L2TP/IPSec VPN protocol is enabled as well for VPN client
access, then this rule is extended with the required L2TP/IPSec protocols (IKE,
IPSec, L2TP).
If additional networks are enabled on the Access Networks tab of the Virtual
Private Networks (VPN) Properties dialog box, then this rule is extended with
those networks.
d. In the task pane, on the Tasks tab, click Hide System Policy Rules.
6. Apply the VPN a. In the ISA Server console, click Apply to apply the VPN configuration,
configuration. and then click OK.
This step will configure and enable VPN connections on ISA Server,
and configure and start the Routing and Remote Access service on the ISA
Server computer.
Wait 30 seconds for ISA Server to configure and start the Routing and Remote Access service, before you do
the next tasks.
7. Examine the configuration a. In the Routing and Remote Access console, in the left pane, right-click
of the Routing and Remote PARIS (local), and then click Refresh.
Access console. The user interface is updated to show that Routing and Remote
Access is configured and started.
b. Right-click PARIS (local), and then click Properties.
c. In the PARIS (local) Properties dialog box, select the IP tab.
ISA Server has configured the Routing and Remote Access service
Module A: Introduction to ISA Server 81
Exercise 2
Configuring a Client Computer to Establish a VPN Connection
In this exercise, you will configure a client computer on the Internet to establish a VPN
connection to the ISA Server computer.
1. On the Istanbul computer, a. On the Istanbul computer, open a Command Prompt window.
examine the current IP address b. At the command prompt, type ipconfig, and then press Enter.
configuration, and use the Ping
The output of the ipconfig command shows that Istanbul currently
command to test connectivity to
uses only the IP address 39.1.1.7.
the Internal network (10.1.1.5).
c. Type ping 39.1.1.1, and then press Enter.
The ping requests time out, because ISA Server (39.1.1.1) does not
allow incoming ping requests from computers on the External network
(Internet).
d. Type ping 10.1.1.5, and then press Enter.
The ping requests time out, because Istanbul cannot connect to
computers on the Internal network yet.
e. Close the Command Prompt window.
2. Create a new connection in a. On the Start menu, click Control Panel, right-click
the Network Connections Network Connections, and then click Open.
window. The Network Connections window opens.
b. In the Network Connections window, right-click
Type: VPN connection
New Connection Wizard, and then click New Connection.
Name: VPN to Contoso
VPN Server: 39.1.1.1 c. In the New Connection Wizard dialog box, click Next.
d. On the Network Connection Type page, select
Connect to the network at my workplace, and then click Next.
e. On the Network Connection page, select
Virtual Private Network connection, and then click Next.
f. On the Connection Name page, in the Company Name text box, type
VPN to Contoso, and then click Next.
g. On the VPN Server Selection page, in the Host name or IP address text
box, type 39.1.1.1, and then click Next.
h. On the Connection Availability page, select My use only, and then click
Next.
i. On the Completing the New Connection Wizard page, click Finish.
The wizard creates a new connection in the Network Connections
window, and displays the Connect VPN to Contoso dialog box, prompting you
to establish the connection.
3. Establish the VPN a. In the Connect VPN to Contoso dialog box, complete the following
connection named information:
VPN to Contoso. User name: Administrator
Password: password
User name: Administrator and then click Connect.
Password: password After creating the VPN connection to the ISA Server computer, an
Module A: Introduction to ISA Server 83
icon appears in the System tray, which represents the established connection.
4. Examine the current a. Open a Command Prompt window.
IP address configuration, and use b. At the command prompt, type ipconfig, and then press Enter.
the Ping command to test the
The output of the ipconfig command shows that Istanbul currently
connection to the Internal network
uses the IP address 39.1.1.7, and has received a new IP address 10.3.1.2 (or
(10.1.1.5), and the VPN tunnel
higher) for its VPN connection to the ISA Server computer. Notice that both
end-point (10.3.1.1).
connections list a default gateway setting.
c. Type route print, and then press Enter.
The output of the route command shows that Istanbul has two
default routes (the two Netmask 0.0.0.0 lines). However, the default route for
the VPN connection (10.3.1.2) has a lower metric (1) than the metric (21) for
the default gateway on the network adapter connection (39.1.1.1). The active
default gateway is using the VPN connection (10.3.1.2), as is shown by the
Default Gateway line at the end of the output.
d. Type ping 10.1.1.5, and then press Enter.
The ping requests (to Denver) time out. Even though Istanbul has
created a VPN connection to the ISA Server computer, it cannot connect to
computers on the Internal network yet.
Note: VPN client computers are not considered part of the Internal
network, but instead are considered to be in the special VPN Clients network,
when they create a VPN connection. They are subject to the firewall policy
access rules for the VPN Clients network. Furthermore, all access from the
VPN Clients network is logged in the Firewall log.
e. Type ping 10.3.1.1, and then press Enter.
The ping requests time out. The IP address 10.3.1.1 is the
destination VPN IP address on the ISA Server computer. Even the end-point of
the VPN tunnel cannot be reached without an access rule that allows this.
Perform the following steps on the Paris computer.
5. On the Paris computer, use a. On the Paris computer, open a Command Prompt window.
the Ping command to test the b. At the command prompt, type ping 10.3.1.2 (or the higher 10.3.1.x
connection to the VPN client IP address assigned to Istanbul), and then press Enter.
computer (10.3.1.2 or higher).
Four ping replies are returned from the Istanbul computer.
c. Close the Command Prompt window.
d. In the ISA Server console, select Firewall Policy.
e. In the task pane, on the Tasks tab, click Show System Policy Rules.
System policy rule 12 allows Ping from Local Host (the ISA Server
computer) to All Networks (including the VPN Clients network).
f. In the task pane, on the Tasks tab, click Hide System Policy Rules.
6. Create a new access rule. a. In the right pane, select the first rule., or select Default rule if no other
rule exists, to indicate where the new rule is added to the rule list.
Name: Allow Ping from VPN b. In the task pane, on the Tasks tab, click Create Access Rule.
clients
c. In the New Access Rule Wizard dialog box, in the Access rule name
text box, type Allow Ping from VPN clients, and then click Next.
Applies to: PING
d. On the Rule Action page, select Allow, and then click Next.
From network: VPN Clients e. On the Protocols page, in the This rule applies to list box, select
To network: Local Host Selected protocols, and then click Add.
f. In the Add Protocols dialog box,
click Common Protocols, click PING, and click Add,
and then click Close to close the Add Protocols dialog box.
g. On the Protocols page, click Next.
h. On the Access Rule Sources page, click Add.
i. In the Add Network Entities dialog box,
84 Module A: Introduction to ISA Server
7. On the Istanbul computer, a. On the Istanbul computer, at the command prompt, type ping 10.3.1.1,
use the Ping command again to test and then press Enter.
connectivity to the VPN tunnel Four (or three) ping replies are returned from the ISA Server
end-point at the ISA Server computer. The Allow Ping from VPN clients access rule allows access to
computer (10.3.1.1). 10.3.1.1.
This result confirms that the Istanbul computer is on the
VPN Clients network, while it has an active VPN connection to the ISA Server
computer.
b. Close the Command Prompt window.
In the next exercise, you will configure ISA Server to allow
VPN Clients network access to the Internal network.
Module A: Introduction to ISA Server 85
Exercise 3
Allowing Internal Network Access for VPN Clients
In this exercise, you will configure ISA Server so that client computers on the Internet, are
allowed access to the internal network, by establishing a VPN connection.
1. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane,
examine the network rule for expand Configuration, and then select Networks.
connectivity between the VPN b. In the right pane, on the Network Rules tab, select the rule that defined
Clients network and the Internal the connectivity between the VPN Clients network and the Internal network.
network.
In the default configuration for the 3-Leg Perimeter network
template, the network rule named VPN Clients to Internal Network (rule 2)
indicates that ISA Server will Route network traffic between the VPN Clients
network and the Internal network.
2. Create a new access rule: a. In the ISA Server console, in the left pane, select Firewall Policy.
b. In the right pane, select the first rule to indicate where the new rule is
Name: Allow access from VPN added to the rule list.
clients to Internal
c. In the task pane, on the Tasks tab, click Create Access Rule.
Applies to: PING, d. In the New Access Rule Wizard dialog box, in the Access rule name
Microsoft CIFS (TCP) text box, type Allow access from VPN clients to Internal, and then click
Next.
From network: VPN Clients e. On the Rule Action page, select Allow, and then click Next.
To network: Internal f. On the Protocols page, in the This rule applies to list box, select
Selected protocols, and then click Add.
g. In the Add Protocols dialog box,
click Common Protocols, click PING, and click Add,
click All protocols, click Microsoft CIFS (TCP), and click Add,
and then click Close to close the Add Protocols dialog box.
The Microsoft CIFS (TCP) protocol is also known as Server
Message Blocks (SMB) - TCP port 445. It is used to access file shares and
printer shares.
h. On the Protocols page, click Next.
i. On the Access Rule Sources page, click Add.
j. In the Add Network Entities dialog box,
click Networks, click VPN Clients, and click Add,
and then click Close to close the Add Network Entities dialog box.
k. On the Access Rule Sources page, click Next.
l. On the Access Rule Destinations page, click Add.
m. In the Add Network Entities dialog box,
click Networks, click Internal, and click Add,
and then click Close to close the Add Network Entities dialog box.
n. On the Access Rule Destinations page, click Next.
o. On the User Sets page, click Next.
p. On the Completing the New Access Rule Wizard page, click Finish.
86 Module A: Introduction to ISA Server
A new firewall policy rule is created that allows the Ping and CIFS
protocols from the VPN Clients network to the Internal network.
q. Click Apply to apply the new rule, and then click OK.
Perform the following steps on the Istanbul computer.
3. On the Istanbul computer, a. On the Istanbul computer, if the VPN to Contoso connection is
reconnect the VPN to Contoso disconnected, then in the Network Connections window, right-click
connection, if it was disconnected. VPN to Contoso, and then click Connect. In the Connect VPN to Contoso
dialog box, complete the following information:
User name: Administrator
Password: password
and then click Connect.
The VPN connection to the ISA Server computer is established
again.
4. Use the Ping command to a. Open a Command Prompt window.
test connectivity to the Internal b. At the command prompt, type ping 10.1.1.5, and then press Enter.
network (10.1.1.5), and use the
Four (or three) ping replies are returned from the Denver computer
Run dialog box to connect to
(10.1.1.5). Istanbul can now access the Internal network.
\\10.1.1.5.
c. Close the Command Prompt window.
d. On the Start menu, click Run.
e. In the Run dialog box, type \\10.1.1.5, and then click OK.
A Windows Explorer window opens for \\10.1.1.5. This shows that
ISA Server allows VPN client computers access to file shares on computers on
the Internal network.
f. Close the \\10.1.1.5 window.
5. Disconnect the a. In the System tray, right-click the connection icon, and click
VPN to Contoso connection, and Disconnect.
close the Network Connections The VPN to Contoso connection is disconnected.
window.
b. Close the Network Connections window.
Module A: Introduction to ISA Server 87
Exercise 4
Configuring VPN Quarantine on ISA Server
In this exercise, you will configure ISA Server so that it can allow phased network access to
VPN clients. Only client computers whose security configuration meets the security policy
are allowed full access to the network.
1. On the Paris computer, in a. On the Paris computer, use Windows Explorer (or My Computer) to
the C:\Tools folder, examine the open the C:\Tools folder.
RQScript.vbs script file that is The RQScript.vbs script file in the Tools folder is the script that this
used to check the security lab uses to check the security configuration of the VPN client computer.
configuration of the VPN client
b. Right-click the RQScript.vbs file, and then click Edit (do not click
computer.
Open).
c. Maximize the RQScript.vbs - Notepad, if that is not done already.
The RQScript.vbs script file checks whether Internet Connection
Firewall (ICF) or Windows Firewall is enabled on the network connections of
the VPN client computer. If this is the case, it passes the script identifier
(RQScript_ID) RQVersion3 back to the remote access server (ISA Server),
which will remove the quarantine restrictions.
Note: The same script can be used for either Windows Server 2003
Remote Access Quarantine, or ISA Server 2006 VPN Quarantine.
d. Close Notepad.
e. Close the Tools folder.
2. Install the Remote Access a. On the Start menu, click Control Panel, and then click
Quarantine Agent service Add or Remove Programs.
(RQS.exe). Note: Since Windows Server 2003 SP1, Remote Access Quarantine
Agent service (RQS.exe) is part of the operating system. Before SP1, the service
was installed from the Windows Server 2003 Resource Kit tools.
b. In the Add or Remove Programs window, click
Add/Remove Windows Components.
c. On the Windows Components page, select the Networking Services
88 Module A: Introduction to ISA Server
component (do NOT select the check box), and then click Details.
d. In the Networking Services dialog box, select the
Remote Access Quarantine Service check box, and then click OK.
e. On the Windows Components page, click Next.
Please wait while Setup installs the Remote Access Quarantine
Service network service.
f. On the Completing the Windows Components Wizard page, click
Finish.
Setup does not completely configure the RQS.exe service for use
with ISA Server 2006. You still need to define acceptable script identifiers
(version strings) in the registry, configure the service for use with ISA Server,
and then start the service.
g. Close the Add or Remove Programs window.
3. Configure the RQS.exe a. On the Start menu, click Run.
service: b. In the Run dialog box, type regedit.exe, and then click OK.
c. In the Registry Editor window, select the
AllowedSet: RQVersion3
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\rqs key.
Authenticator: vpnplgin.dll
d. In the right pane, right-click the AllowedSet value, and then click
Modify.
e. In the Edit Multi-String dialog box, delete the current value, and then
type RQVersion3, and click OK.
RQVersion3 is the identifier of the script (RQScript.vbs) that this
lab uses to check the security configuration of the client computer.
f. Right-click the rqs key, click New, and then click String Value.
g. In the New Value #1 text box, replace the text by typing Authenticator,
and then press Enter.
A new REG_SZ value named Authenticator is created.
h. Right-click the Authenticator value, and then click Modify.
Note: Ensure that you do not make a typing mistake in the file name
below. The RQS.exe service will stop if it cannot find the file specified in the
Authenticator registry value.
i. In the Edit String dialog box, type
C:\Program Files\Microsoft ISA Server\vpnplgin.dll, and then click OK.
After the RQC.exe application on the client computer notifies the
RQS.exe service on the server, by default the RQS.exe service calls %windir
%\System32\mprapi.dll (Remote Access service) to remove the quarantine
restrictions. When ISA Server provides the quarantine restrictions, then the
RQS.exe service must call vpnplgin.dll in the ISA Server folder instead.
j. Close the Registry Editor window.
k. On the Start menu, click Administrative Tools, and then click
Services.
l. In the Services console, in the right pane, right-click
Remote Access Quarantine Agent, and then click Properties.
By default, the Startup type of the RQS.exe service is Manual. You
will start the service later in this lab.
m. Click Cancel to close the Remote Access Quarantine Agent Properties
dialog box.
n. Close the Services console.
4. Create a new protocol a. In the ISA Server console, in the left pane, select Firewall Policy.
definition: When the security configuration of the VPN client computer meets
the security policy, the RQC.exe application on the client computer notifies the
Name: RQS - Network RQS.exe service on the ISA Server, that the quarantine restrictions can be
Quarantine removed. This requires an access rule to allow communication (using
Module A: Introduction to ISA Server 89
Exercise 5
Creating and Distributing a Connection Manager Profile
In this exercise, you will create and distribute a Connection Manager profile, for use with
network access quarantine. The profile is made available through an extranet distribution
point.
1. On the Paris computer, a. On the Paris computer, on the Start menu, click Control Panel, and
install the Connection Manager then click Add or Remove Programs.
Administration Kit (CMAK). b. In the Add or Remove Programs window, click
Add/Remove Windows Components.
c. On the Windows Components page, select the
Management and Monitoring Tools component (do NOT clear or select the
check box), and then click Details.
d. In the Management and Monitoring Tools dialog box, select the
Connection Manager Administration Kit check box, and then click OK.
e. On the Windows Components page, click Next.
Please wait while Setup installs the Connection Manager
Administration Kit (CMAK).
f. On the Completing the Windows Components Wizard page, click
Finish.
g. Close the Add or Remove Programs window.
2. Use CMAK to create a new a. On the Start menu, click Administrative Tools, and then click
Connection Manager profile. Connection Manager Administration Kit.
b. On the Welcome to the Connection Manager Administration Kit Wizard
- Service name: VPN to Contoso page, click Next.
(CM)
Note: The CMAK wizard consists of 20 steps. Only two steps
- File name: VPN_RQ
(Custom action and Additional files) are related to the use of network access
VPN server: 39.1.1.1
quarantine.
- Custom post-connect action: c. On the Service Profile Selection page, select New profile, and then click
C:\Tools\RQScript.vbs Next.
%TunnelRasEntry% d. On the Service and File Names page, complete the following
%Domain% information:
%UserName% Service name: VPN to Contoso (CM)
File name: VPN_RQ
- Additional files: and then click Next.
C:\Program Files\
e. On the Realm Name page, select
cmak\support\rqc.exe
Do not add a realm name to the user name, and then click Next.
f. On the Merging Profile Information page, click Next.
g. On the VPN Support page, complete the following information:
Phone book from this profile: enable
92 Module A: Introduction to ISA Server
4. Configure the default Web a. On the Start menu, click Administrative Tools, and then click
site to use port 81, and then start Internet Information Services (IIS) Manager.
the Web site. The IIS Manager console opens.
b. In the IIS Manager console, expand PARIS (local computer), expand
(If this is not done already).
Web Sites, right-click Default Web Site, and then click Properties.
c. In the Default Web Site Properties dialog box, on the Web Site tab,
ensure that the TCP port text box is set to 81, and then click OK.
The default HTTP TCP port is 80. Because ISA Server uses port 80
for publishing Web sites (and publishing automatic discovery information for
Web clients), the Web site on the ISA Server computer must be changed to
another port.
d. If the Default Web Site is not started, then right-click
Default Web Site (Stopped), and then click Start.
The default Web site is started. The Web site listens on port 81.
5. Create a new virtual a. In the IIS Manager console, in the left pane, expand Default Web Site.
directory for the default Web site: b. Right-click Default Web Site, click New, and then click
Virtual Directory.
Alias: extranet
c. In the Virtual Directory Creation Wizard dialog box, click Next.
Path: C:\Inetpub\Extranet d. On the Virtual Directory Alias page, in the Alias text box, type
extranet, and then click Next.
Permissions: e. On the Web Site Content Directory page, in the Path text box, type
Read and Browse. C:\Inetpub\Extranet, and then click Next.
f. On the Virtual Directory Access Permissions page, complete the
following information:
Read: enable (is default)
Run scripts: disable (is default)
Execute: disable (is default)
Write: disable (is default)
Browse: ENABLE
and then click Next.
The Browse permission is required, because the Extranet folder
does not contain an HTML document to display. It only contains the
94 Module A: Introduction to ISA Server
6. Create a new Web listener. a. In the ISA Server console, in the left pane, select Firewall Policy.
b. In the task pane, on the Toolbox tab, in the Network Objects section,
Name: External Web 80 expand Web Listeners (if possible).
Note: If a Web Listener named External Web 80 is already created
SSL: disable
in an earlier exercise, then you can skip the rest of this task.
Network: External c. If a Web listener named External Web 80 does not exist, then
Compression: disable right-click Web Listeners, and then click New Web Listener.
d. In the New Web Listener Definition Wizard dialog box, in the
Authentication: none Web listener name text box, type External Web 80, and then click Next.
e. On the Client Connection Security page, select
(If this is not done already) Do not require SSL secured connections with clients, and then click Next.
f. On the Web Listener IP Addresses page, complete the following
information:
Listen on network: External
ISA Server will compress content: disable
and then click Next.
g. On the Authentication Settings page, in the drop-down list box, select
No Authentication, and then click Next.
h. On the Single Sign On Settings page, click Next.
i. On the Completing the New Web Listener Wizard page, click Finish.
A new Web listener (port 80 on the IP address on the adapter on
the External network) with the name External Web 80 is created.
7. Create a Web publishing a. In the left pane, select Firewall Policy.
rule. b. In the right pane, select the first rule to indicate where the new rule is
added to the rule list.
Name: Extranet Web Site
c. In the task pane, on the Tasks tab, click Publish Web Sites.
Publishing type: d. In the New Web Publishing Rule Wizard dialog box, in the
single Web site Web publishing rule name text box, type Extranet Web Site, and then click
Next.
Internal site name: Paris e. On the Select Rule Action page, select Allow, and then click Next.
IP address: 10.1.1.1 f. On the Publishing Type page, select Publish a single Web site, and then
Path: /extranet click Next.
Port: 81
g. On the Server Connection Security page, select Use non-secured
Public name: connections to connect to the published Web server, and then click Next.
www.contoso.com h. On the Internal Publishing Details page, complete the following
/extranet information:
Internal site name: Paris
Web listener: Use a computer name or IP address: enable
External Web 80 Computer name or IP address: 10.1.1.1
and then click Next.
Delegation: none Note: After completing the wizard, the destination TCP port of the
rule can be set to 81.
Module A: Introduction to ISA Server 95
8. On the Istanbul computer, a. On the Istanbul computer, open Internet Explorer. In the Address box,
connect to type http://www.contoso.com/extranet, and then press Enter.
http://www.contoso.com The content of the C:\Inetpub\Extranet folder is displayed. The
/extranet folder only contains the Connection Manager profile VPN_RQ.exe.
and install the VPN_RQ.exe
If Internet Explorer shows HTTP Error 403 - Forbidden, then the
Connection Manager profile.
properties of the extranet virtual directory in IIS on Paris are not set to allow
Directory browsing, or do not allow anonymous access.
b. In the extranet folder, right-click VPN_RQ.exe, and then click Open.
c. In the File Download - Security Warning message box, click Run.
d. In the Internet Explorer - Security Warning message box, click Run to
confirm that you want to run this software (without a valid signature to verify
the publisher).
e. In the VPN to Contoso (CM) message box, click Yes to confirm that you
want to install the Connection Manager profile.
f. In the next VPN to Contoso (CM) dialog box, select My use only, and
then click OK.
The Connection Manager profile is installed on the Istanbul
96 Module A: Introduction to ISA Server
computer.
After the installation is completed, the Network Connections
window opens, and the VPN to Contoso (CM) connection dialog box is shown.
g. Click Cancel to close the VPN to Contoso (CM) connection dialog box.
h. Close the Network Connections window.
i. Close Internet Explorer.
Note: Besides making the Connection Manager profile available through a published extranet solution, as is
done in the scenario in this exercise, you can also allow (portable) client computers to install the Connection
Manager profile from a shared folder on the internal network, at a time when the client computers are on the
internal network.
Module A: Introduction to ISA Server 97
Exercise 6
Using VPN Quarantine on the Client Computer
In this exercise, you will use the network access quarantine by creating a VPN connection
from the VPN client to the ISA Server.
1. On the Istanbul computer, a. On the Istanbul computer, on the Start menu, click Control Panel,
use the VPN to Contoso (CM) right-click Network Connections, and then click Open.
connection, to establish a VPN b. In the Network Connections window, under Connection Manager,
connection to the ISA Server. right-click VPN to Contoso (CM), and then click Connect.
c. In the VPN to Contoso (CM) connection dialog box, complete the
User name: Administrator
following information:
Password: password
Domain: (empty) User name: Administrator
Password: password
Logon domain: (leave empty)
Save password: ENABLE
Connect automatically: disable (is default)
and then click Connect.
A yellow balloon dialog box in the system tray area shows that the
VPN is now connected.
The quarantine script displays a message box to indicate that the
security configuration of the client computer does not meet the security policy
(ICF is not enabled on the network connections.)
The connection stays in quarantine mode and is dropped after 60 seconds.
d. Click OK to close the Remote Access Quarantine message box.
e. Open a Command Prompt window.
f. At the command prompt, type ipconfig, and then press Enter.
The output of the ipconfig command shows that Istanbul currently
has a VPN connection to Paris using IP address 10.3.1.2 (or higher).
Note: If the connection drops before you can complete the next ping
command, just click Yes in the Reconnect message box, and then click Connect
to re-establish the VPN connection.
g. At the command prompt, type ping 10.3.1.1, and then press Enter.
The ping requests time out. The IP address of the end-point of the
VPN tunnel on the ISA Server computer (10.3.1.1) cannot be reached without
an access rule that allows this from the Quarantined VPN Clients network.
Perform the following steps on the Paris computer.
2. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
create a new access rule. Firewall Policy.
b. In the right pane, select the first rule to indicate where the new rule is
Name: Allow Ping from added to the rule list.
Quarantined VPN clients
c. In the task pane, on the Tasks tab, click Create Access Rule.
Applies to: PING d. In the New Access Rule Wizard dialog box, in the Access rule name
text box, type Allow Ping from Quarantined VPN clients, and then click
98 Module A: Introduction to ISA Server
3. On the Istanbul computer, a. On the Istanbul computer, in the Reconnect message box, click Yes.
use the Ping command to test the b. In the VPN to Contoso (CM) connection dialog box, ensure that the
connection to the VPN tunnel end- User name and Password information is still present, and then click Connect.
point (10.3.1.1) and the Internal
c. Click OK to close the Remote Access Quarantine message box.
network (10.1.1.5).
d. At the command prompt, type ping 10.3.1.1, and then press Enter.
Four (or three) ping replies are returned from the ISA Server
computer. The Allow Ping from Quarantined VPN clients access rule allows
access to 10.3.1.1.
This result confirms that the Istanbul computer is on the
Quarantined VPN Clients network, as long as the security configuration of the
client computer does not meet the security requirements.
e. At the command prompt, type ping 10.1.1.5, and then press Enter.
The ping requests (to Denver) time out. There is currently no access
rule that allows communication from the Quarantined VPN Clients network to
the Internal network.
f. If the Reconnect message box appears, click No to close the message
box.
4. Enable Windows Firewall. a. On the Start menu, click Control Panel, and then click
Windows Firewall.
b. In the Windows Firewall message box, click Yes to confirm that you
want to start the Windows Firewall/ICS service.
The Windows Firewall/ICS service must be running, before you can
configure Windows Firewall.
c. After the Windows Firewall/ICS service has started, in the Windows
Firewall dialog box, on the General tab, select On, and then click OK.
Windows Firewall is enabled on all network connections. This
configuration meets the RQScript.vbs script file requirement, which verifies
whether Windows Firewall is enabled on all non-VPN connections.
Module A: Introduction to ISA Server 99
6. On the Paris computer, start a. On the Paris computer, on the Start menu, click Administrative Tools,
the Remote Access Quarantine and then click Services.
Agent (RQS.exe) service. b. In the Services console, in the right pane, right-click
Remote Access Quarantine Agent, and then click Start.
The Remote Access Quarantine Agent (RQS.exe) is now started,
and listens on TCP port 7250.
You have already created an access rule (Allow RQS network
quarantine notification) that allows RQS traffic from the Quarantined VPN
Clients network to the Local Host (ISA Server).
c. Close the Services console.
Perform the following steps on the Istanbul computer.
7. On the Istanbul computer, a. On the Istanbul computer, in the Reconnect message box, click Yes.
use the VPN to Contoso (CM) b. In the VPN to Contoso (CM) connection dialog box, ensure that the
connection, to establish a VPN User name and Password information is still present, and then click Connect.
connection to the ISA Server
The quarantine script successfully notified the RQS.exe service.
again.
ISA Server removed the quarantine restrictions by moving the VPN client
computer from the Quarantined VPN Clients network to the VPN Clients
Test the connection:
network.
- Ping 10.1.1.5
- Run \\10.1.1.5 c. Click OK to close the Remote Access Quarantine message box.
d. At the command prompt, type ping 10.1.1.5, and then press Enter.
Disconnect the VPN connection Four ping replies are returned from the Denver computer (10.1.1.5)
again. on the Internal network. The access rule (Allow access from VPN clients to
Internal) that you created in an earlier exercise, allows the communication.
e. Close the Command Prompt window.
f. On the Start menu, click Run.
g. In the Run dialog box, type \\10.1.1.5, and then click OK.
A Windows Explorer window opens for \\10.1.1.5. These results
show that the VPN client computer can now connect to resources on the
Internal network.
h. Close the \\10.1.1.5 window.
Now that ISA Server has removed the quarantine restrictions, the
VPN connection is no longer disconnected after 60 seconds.
i. Right-click the connection icon in the system tray area, and then click
Disconnect.
8. Use the VPN to Contoso a. In the Network Connections window, under Virtual Private Network
connection (not the (not under Connection Manager), right-click VPN to Contoso, and then click
Connection Manager), to establish Connect.
a VPN connection to the ISA b. In the Connect VPN to Contoso dialog box, complete the following
Server. information:
100 Module A: Introduction to ISA Server
9. Disable Windows Firewall. a. On the Start menu, click Control Panel, and then click
Windows Firewall.
b. In the Windows Firewall dialog box, on the General tab, select Off, and
then click OK.
Windows Firewall is no longer enabled on any network connection.
c. Close the Network Connections window.
Perform the following steps on the Paris computer.
10. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
disable VPN client access. Virtual Private Networks (VPN).
b. In the task pane, on the Tasks tab, click Disable VPN Client Access.
This step disables VPN access to ISA server:
System policy rule 13 is disabled
The Routing and Remote Access configuration is removed
The Routing and Remote Access service is stopped.
c. Click Apply to save the changes, and then click OK.
Module A: Introduction to ISA Server 101
1. On the Istanbul computer, a. On the Istanbul computer, on the Start menu, click
examine the uncompressed file Administrative Tools, and then click
size of content.htm in the Default Internet Information Services (IIS) Manager.
Web Site. The IIS Manager console opens.
b. In the IIS Manager console, expand ISTANBUL (local computer),
expand Web Sites, and then select Default Web Site.
The Default Web Site contains a file named content.htm.
c. Right-click Default Web Site, and then click Open.
The c:\inetpub\wwwroot folder opens.
Notice that the uncompressed size of the content.htm file is 91 KB.
You will request this file in compressed form later in the exercise.
d. Close the c:\inetpub\wwwroot window.
e. Close the IIS Manager console.
2. Open the C:\Tools\ a. Use Windows Explorer (or My Computer) to open the C:\Tools folder.
Perfmon-sent.msc console. b. In the Tools folder, right-click Perfmon-sent.msc, and then click Open.
Perfmon-sent.msc is a saved MMC console containing a
preconfigured System Monitor Control. It shows the Bytes Sent/sec counter for
the network adapter.
You will use the results in this console later in the exercise.
c. Close the C:\Tools folder.
Perform the following steps on the Paris computer.
3. On the Paris computer, a. On the Paris computer, on the Start menu, click All Programs, click
create a new access rule. Microsoft ISA Server, and then click ISA Server Management.
The ISA Server console opens.
Name: Allow Web access
b. In the left pane, expand Paris, and then select Firewall Policy.
(Branch)
c. In the right pane, select the first rule, or select Default rule if no other
Applies to: HTTP rule exists, to indicate where the new rule is added to the rule list.
102 Module A: Introduction to ISA Server
5. On the Denver computer, a. On the Denver computer, use Windows Explorer (or My Computer) to
open the C:\Tools\ open the C:\Tools folder.
Perfmon-received.msc console. b. In the Tools folder, right-click Perfmon-received.msc, and then click
Open.
Perfmon-received.msc is a saved MMC console containing a
preconfigured System Monitor Control. It shows the Bytes Received/sec
counter for the network adapter.
c. Close the C:\Tools folder.
6. Use Internet Explorer to a. Open Internet Explorer. In the Address box, type
connect to http:// http://istanbul.fabrikam.com/content.htm, and then press Enter.
istanbul.fabrikam.com/ Internet Explorer connects to ISA Server and retrieves the
content.htm content.htm Web page from Istanbul.
The content.htm Web page contains 90 KB of text.
7. Examine the peak bytes a. Switch to the Performance - Bytes Received console.
received per second in the Notice that the network adapter on Denver has a peak bytes
Performance console. received per second of approximately 90 KB.
This result confirms that the content.htm Web page is currently not
compressed when delivered from the ISA Server to Denver.
Perform the following steps on the Istanbul computer.
8. On the Istanbul computer, a. On the Istanbul computer, switch to the Performance - Bytes Sent
examine the peak bytes sent per console.
second in the Performance The network adapter on Istanbul has a peak bytes sent per second
console. of approximately 90 KB.
This result confirms that the content.htm Web page is currently not
Module A: Introduction to ISA Server 103
compressed when delivered from the Web server (Istanbul) to the ISA Server.
Perform the following steps on the Paris computer.
9. On the Paris computer, a. On the Paris computer, in the ISA Server console, under Paris, expand
examine the two Web filters for Configuration, and then select Add-ins.
HTTP compression. b. In the right pane, select the Web Filters tab.
ISA Server 2006 installs two Web Filters that provide
HTTP compression functionality:
Compression Filter - Compresses and decompresses HTTP responses.
Caching Compressed Content Filter - Stores and retrieves compressed
content in the cache.
Note: Do not move the Compression Filter lower in the list of Web
Filters. Decompression must take place before any other Web filter inspects the
content. Other Web filters cannot inspect compressed content.
10. Configure HTTP a. In the left pane, under Configuration, select General.
Compression. HTTP Compression is a global HTTP Policy setting. This means
that is applies to all HTTP traffic that passes through ISA Server to or from a
Return Compressed Data: specified network or computer set. HTTP Compression is not a per-rule setting.
Internal
b. In the right pane, click Define HTTP Compression Preferences.
Content types: c. In the HTTP Compression dialog box, on the Return Compressed Data
- Documents tab, click the top Add button.
- HTML Documents By default HTTP compression is enabled, but no network elements
- Macro Documents are configured to use compression.
- Text Note: It is possible that you already added one or more Web
Listeners to the Return Compressed Data list, while creating new Web
Publishing rules in earlier exercises.
d. In the Add Network Entities dialog box,
click Networks, click Internal, and click Add,
and then click Close to close the Add Network Entities dialog box.
You configured compression of HTTP responses when requested by
clients on the Internal network.
Note: Do not confuse the two compression settings per network
element:
Return Compressed Data - ISA Server returns compressed content in HTTP
response packets when clients from the specified network request compression.
Request Compressed Data - ISA Server asks for compressed content in
HTTP request packets when sending requests to servers on the specified
network.
e. On the Return Compressed Data tab, click Content Types.
The Content Types dialog box lists all defined Content Types on
ISA Server. Some content types, for example Audio, Video and Compressed
Files, are already compressed at the application level. Do not enable HTTP
compression for these content types.
f. In the Content Types dialog box, complete the following information:
Compress the selected content types only: enable (is default)
Documents: enable
HTML Documents: enable (is default)
Macro Documents: enable
Text: enable (is default)
All other check boxes: disable.
and then click OK to close the Content Types dialog box.
Branch office functionality:
When branch offices connect to ISA Servers at the main office to access
HTTP content from the Internet or from Web servers at the main office, you
should add the branch office networks to the Return Compressed Data list to
104 Module A: Introduction to ISA Server
11. On the Denver computer, a. On the Denver computer, in Internet Explorer, on the Tools menu, click
configure Internet Explorer to use Internet Options.
HTTP 1.1 when connection b. In the Internet Options dialog box, on the Connections tab, click
through a proxy server. LAN Settings.
Notice that Denver is currently configured to use a proxy server at
IP address 10.1.1.1.
c. Click Cancel to close the Local Area Network (LAN) Setting dialog
box.
d. On the Advanced tab, in the Settings list box, scroll to the
HTTP 1.1 settings section.
By default, Internet Explorer uses HTTP 1.1, except when
connecting through a proxy server.
HTTP compression requires HTTP 1.1.
e. Enable the Use HTTP 1.1 through proxy connections check box, and
then click OK.
12. Refresh the content of the a. In Internet Explorer, ensure that the
Web page at http:// http://istanbul.fabrikam.com/content.htm Web page is opened.
istanbul.fabrikam.com/ b. Hold the Ctrl-key, and then click the Refresh button on the toolbar, to
content.htm, by pressing Ctrl-F5 refresh the content of the Web page.
or Ctrl-Refresh.
Internet Explorer connects to the ISA Server and retrieves the
content.htm Web page from Istanbul again.
Note: The use of the Ctrl-key to refresh the Web page ensures that
Internet Explorer does not use its caching mechanism.
13. Examine the peak bytes a. Switch to the Performance - Bytes Received console.
received per second in the The network adapter on Denver has a peak bytes received per
Performance console. second of approximately 35 KB.
This result confirms that the content.htm Web page, which has a file
size of 91 KB, is compressed when delivered from the ISA Server to Denver.
Note: When Internet Explorer uses HTTP 1.1, it will always include the HTTP request header
Accept-Encoding: gzip, deflate, to request compressed content from a Web server.
The response packet will include the HTTP response header Content-Encoding: gzip to indicate that the
content is compressed.
If you want to examine the network traffic in more detail in the lab environment, then you can use Network
Monitor. The Microsoft Network Monitor 5.2 is installed in each virtual machine.
Perform the following steps on the Istanbul computer.
14. On the Istanbul computer, a. On the Istanbul computer, switch to the Performance - Bytes Sent
examine the peak bytes sent per console.
second in the Performance The network adapter on Istanbul has a peak bytes sent per second
console. of approximately 90 KB.
Currently, ISA Server receives the content.htm Web page
uncompressed from Istanbul, and then compresses the content when sending to
Denver.
15. Configure IIS to enable a. On the Start menu, click Administrative Tools, and then click
HTTP compression. Internet Information Services (IIS) Manager.
The IIS Manager console opens.
Application files: yes
b. In the IIS Manager console, expand, ISTANBUL (local computer),
Static files: yes
right-click Web Sites, and then click Properties.
Module A: Introduction to ISA Server 105
18. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
configure HTTP Compression. General.
b. In the right pane, click Define HTTP Compression Preferences.
Request Compressed Data:
c. In the HTTP Compression dialog box, on the
External
Request Compressed Data tab, click the top Add button.
d. In the Add Network Entities dialog box,
click Networks, click External, and click Add
and then click Close to close the Add Network Entities dialog box.
ISA Server will include the HTTP request header
Accept-Encoding: gzip when requesting Web content from servers on the
External network, to indicate that it can accept compressed traffic.
Branch office functionality:
When ISA Servers in branch offices connect to the main office or directly to
the Internet to access HTTP content, you should add the main office network or
External network to the Request Compressed Data list to reduce bandwidth
usage for the response traffic.
e. Click OK to close the HTTP Compression dialog box.
f. Click Apply to apply the changes, and then click OK.
Perform the following steps on the Denver computer.
19. On the Denver computer, a. On the Denver computer, in Internet Explorer, ensure that the
refresh the content of the Web http://istanbul.fabrikam.com/content.htm Web page is opened.
page at http:// b. Hold the Ctrl-key, and then click the Refresh button on the toolbar, to
istanbul.fabrikam.com/ refresh the content of the Web page.
content.htm, by pressing Ctrl-F5
c. Wait five seconds, and then hold the Ctrl-key, and click the Refresh
or Ctrl-Refresh twice.
button on the toolbar again.
Internet Explorer connects to the ISA Server and retrieves the
106 Module A: Introduction to ISA Server
21. On the Istanbul computer, a. On the Istanbul computer, switch to the Performance - Bytes Sent
examine the peak bytes sent per console.
second in the Performance The network adapter on Istanbul first has a peak bytes sent per
console. second of approximately 90 KB, followed by a peak of approximately 30 KB.
On the first request for content.htm, IIS sends the uncompressed
content immediately, and compresses the file for subsequent requests. On the
second request, IIS sends the compressed content.
b. Close the Performance - Bytes Sent console.
22. Examine the IIS a. Switch to the IIS Temporary Compressed Files folder.
Temporary Compressed Files IIS has stored the compressed version of content.htm in this folder.
folder. The file size is 29 KB.
b. Close the IIS Temporary Compressed Files folder.
Note: By default, ISA Server is configured to inspect the content of compressed HTTP response packets. This
means that ISA Server performs the following steps when receiving the response from Istanbul:
1) - The Compression Filter uncompressed the content.
2) - The HTTP Filter and other Web filters inspect the uncompressed HTTP content.
3) - The Cached Compressed Content Filter caches the uncompressed content.
and then when sending the response to Denver:
4) - The Compression Filter compresses the content again.
It is possible to disable inspection of compressed content. In that case, ISA Server does not uncompress the
HTTP content, and the Cached Compressed Content Filter caches the compressed version of the content.
Note: The following tasks are needed to avoid conflicts with other lab exercises.
23. Configure IIS to disable a. On the Start menu, click Administrative Tools, and then click
HTTP compression. Internet Information Services (IIS) Manager.
The IIS Manager console opens.
Application files: no
b. In the IIS Manager console, expand, ISTANBUL (local computer),
Static files: no
right-click Web Sites, and then click Properties.
c. In the Web Sites Properties dialog box, on the Service tab, complete the
following information:
Compress application files: disable
Compress static files: disable
and then click OK.
HTTP compression is disabled.
24. Restart IIS. a. In the IIS Manager console, in the left pane, right-click
ISTANBUL (local computer), click All Tasks, and then click Restart IIS.
b. In the Stop/Start/Restart dialog box, in the drop-down list box, select
Restart Internet Services on ISTANBUL, and then click OK.
The IIS services restart.
c. Close the IIS Manager console.
Perform the following steps on the Paris computer.
25. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
disable HTTP Compression. General.
b. In the right pane, click Define HTTP Compression Preferences.
Module A: Introduction to ISA Server 107
26. Close the Performance a. Close the Performance - Bytes Received console.
console and close Internet b. Close Internet Explorer.
Explorer.
108 Module A: Introduction to ISA Server
Exercise 2
Configuring ISA Server to Cache BITS Content
In this exercise, you will configure ISA Server to cache Background Intelligent Transfer
Service (BITS) content, and request ranges from cached files.
1. On the Paris computer, a. On the Paris computer, in the ISA Server console, under Configuration,
define a cache drive. select Cache.
By default, caching is disabled on ISA Server.
Cache size: 10 MB
b. In the right pane, select the Cache Drives tab.
c. In the task pane, on the Tasks tab, click
Define Cache Drives (Enable Caching).
d. In the Define Cache Drives dialog box, in the
Maximum cache size (MB) text box, type 10, and then click Set.
For demonstrative purposes, a very small disk cache file of 10 MB
is created. Normally you would configure a much bigger cache file.
e. Click OK to close the Define Cache Drives dialog box.
2. Apply the changes and a. Click Apply to apply the changes.
restart the Firewall service. b. In the ISA Server Warning dialog box, CHANGE the current selection,
and select Save the changes and restart the services, and then click OK.
c. Click OK to close the Saving Configuration Changes dialog box.
3. Open a Command Prompt a. Open a Command Prompt window.
window to verify the existence of b. At the command prompt, type cd \urlcache, and then press Enter.
the disk cache file.
c. Type dir, and then press Enter.
File: c:\urlcache\Dir1.cdat The Dir1.cdat file is the disk cache file that ISA Server uses. The
file size is 10 MB.
You will use the Dir1.cdat file later in the exercise.
4. Examine the BITS caching a. In the ISA Server console, in the left pane, select Cache.
setting for the Default rule. b. In the right pane, select the Cache Rules tab.
ISA Server 2006 has two predefined cache rules: the Microsoft
Update Cache Rule and the Default rule.
You cannot change or delete the Default rule.
c. Right-click Default rule, and then click Properties.
d. In the Default rule Properties dialog box, select the Advanced tab.
Notice that the built-in Default rule does not enable caching of
Background Intelligent Transfer Service (BITS) content.
e. Click Cancel to close the Default rule Properties dialog box.
5. Examine the BITS caching a. In the right pane, right-click Microsoft Update Cache Rule, and then
setting for the Microsoft Update click Properties.
Cache Rule. b. In the Microsoft Update Cache Rule Properties dialog box, select the
Advanced tab.
BITS caching is enabled in the Microsoft Update Cache Rule.
Module A: Introduction to ISA Server 109
9. On the Denver computer, a. On the Denver computer, on the Start menu, click
examine the BITS service. Administrative Tools, and then click Services.
The Services console opens.
110 Module A: Introduction to ISA Server
12. On the Paris computer, use a. On the Paris computer, in the Command Prompt window, in the
the find command to verify the C:\urlcache folder, type find /i "content2.htm" dir1.cdat, and then press
presence of the content2.htm Enter.
content in the disk cache file. You can use the find command to search for text in the disk cache
file.
The find command displays multiple entries for content2.htm,
indicating the URL of cached content. The entries ending with a semicolon
followed by two numbers, are 32 KB cached BITS chunks of the content2.htm
file.
b. After a few seconds, press Ctrl-C to interrupt the find command, and to
avoid searching the entire 10 MB disk cache file.
c. Close the Command Prompt window.
Perform the following steps on the Istanbul computer.
13. On the Istanbul computer, a. On the Istanbul computer, on the Start menu, click Control Panel, and
disable the then right-click Network Connections, and click Open.
Local Area Connection network The Network Connections window opens.
adapter.
b. In the Network Connections window, right-click
Local Area Connection, and then click Disable.
The network adapter is disabled. This helps demonstrate that ISA
Server does not obtain the content2.htm file from Istanbul, but responds to
subsequent file range requests from its cache.
Module A: Introduction to ISA Server 111
14. On the Denver computer, a. On the Denver computer, in the Command Prompt window, in the
for demonstrative purposes, C:\Tools folder, type
request the 11 bytes starting at bitsclient http://istanbul.fabrikam.com/content2.htm 749:11, and then
position 749 in the content2.htm press Enter.
file. Note: You can use the up-arrow key to easily recall the previous
command at the command prompt.
For demonstrative purposes, the 11 bytes starting at position 749 in
the content2.htm file are requested. The BITS service connects to ISA Server,
and requests bytes 749-759 in the content2.htm file. ISA Server obtains this file
range from the cache, and sends the 11 bytes to Denver, which saves the data
in the bits-job1.txt file.
b. Type type bits-job1.txt, and then press Enter.
The 11 bytes at that position in the file happen to spell
"Lorem ipsum".
This result verifies that ISA Server responded to the BITS file range
requests from its cache. ISA Server did not connect to Istanbul, whose network
adapter is disabled.
c. Close the Command Prompt window.
Note: The following tasks are needed to avoid conflicts with other lab exercises.
15. On the Istanbul computer, a. On the Istanbul computer, in the Network Connections window, right-
enable the click Local Area Connection, and then click Enable.
Local Area Connection network The network adapter is enabled.
adapter.
b. Close the Network Connections window.
Perform the following steps on the Paris computer.
16. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
disable caching. Cache.
b. In the right pane, select the Cache Drives tab.
c. In the task pane, on the Tasks tab, click Disable Caching.
d. Click Yes to confirm that you want to disable caching.
Caching is disabled.
17. Apply the changes and a. Click Apply to apply the changes.
restart the Firewall service. b. In the ISA Server Warning dialog box, CHANGE the current selection,
and select Save the changes and restart the services, and then click OK.
c. Click OK to close the Saving Configuration Changes dialog box.
112 Module A: Introduction to ISA Server
Exercise 3
Configuring DiffServ Settings to Prioritize Network Traffic
In this exercise, you will configure ISA Server to use Differentiated Services (DiffServ)
tagging of HTTP and HTTPS network packets.
1. On the Paris computer, a. On the Paris computer, in the ISA Server console, under Paris, expand
enable the Web filter for DiffServ Configuration, and then select Add-ins.
tagging. b. In the right pane, select the Web Filters tabs.
ISA Server 2006 installs one new Web Filter that provides tagging
of network packets, by using the Differentiated Services (DiffServ) model:
DiffServ Filter - Enables DiffServ tagging of Web traffic.
c. In the right pane, select DiffServ Filter, and then in the task pane, on the
Tasks tab, click Enable Selected Filters.
The DiffServ Filter is enabled.
Note: Do not move the DiffServ Filter lower in the list of Web
Filters. The filter assigns the packet priority to network packets based on
several properties, including the size of the network packet on the network. For
an accurate assessment of packet sizes, it has to inspect the traffic as close to
the network adapter as possible.
d. Click Apply to apply the changes, and then click OK.
2. Define new DiffServ a. In the left pane, select General.
priorities. DiffServ configuration is a global HTTP Policy setting. This means
that it applies to all HTTP and HTTPS traffic that passes through ISA Server to
Name: High priority a specified URL, domain or network. DiffServ tagging is not a per-rule setting.
DiffServ bits: 100110
b. In the right pane, click Specify DiffServ Preferences.
Size limit: 700 bytes
c. In the HTTP DiffServ dialog box, on the General tab, select
Name: Medium priority Enable network traffic prioritization.
DiffServ bits: 110110 d. On the Priorities tab, click Add.
Size limit: None ISA Server tags network packets by setting a few bits in the
Type of Service (TOS) field of the IP header of the network packet. These are
called the DiffServ bits, and form a specific value called DiffServ Codepoint
(DS codepoint).
Note: ISA Server does not have any notion of the actual
prioritization of certain DS codepoint values over other DS codepoint values.
Routers on the network must handle that. ISA Server only assigns the DS
codepoint value.
e. In the Add Priority dialog box, complete the following information:
Priority name: High priority
DiffServ bits: 100110
Apply a size limit to this priority: enable
Size limit: 700
and then click OK.
The size limit specifies a maximum size in bytes of network packets
that can use this priority.
Module A: Introduction to ISA Server 113
firewall rule. In the right pane, notice the Allow Web access (Branch) firewall
rule. This rule allows HTTP access from the Internal network to the External
network. You created the rule in an earlier exercise.
Perform the following steps on the Denver computer.
9. On the Denver computer, a. On the Denver computer, open Internet Explorer. In the Address box,
use Internet Explorer to connect to type http://istanbul.fabrikam.com/default.htm, and then press Enter.
http:// Internet Explorer displays the home page from Istanbul.
istanbul.fabrikam.com/
b. Close Internet Explorer.
default.htm
Perform the following steps on the Paris computer.
10. On the Paris computer, stop a. On the Paris computer, in the ISA Server console, in the left pane, select
the log viewer. Monitoring.
b. In the right pane, select the Logging tab.
c. In the task pane, on the Tasks tab, click Stop Query.
ISA Server displays information about all the network connections
since you started the log viewer.
11. Add the Filter Information a. In the right pane, right-click the Log Time column header (or another
column to the list of displayed column header), and then click Add/Remove Columns.
columns. b. In the Add/Remove Columns dialog box, in the Available columns list
box, select Filter Information, and then click Add.
The Filter Information log field is moved from the Available
columns list to the Displayed columns list.
c. In the Displayed columns list, select Filter Information, and then click
Move Up, so that the new column is not last in the list.
d. Click OK to close the Add/Remove Columns dialog box.
12. Examine the contents of the a. In the right pane, scroll the list of log field columns, so that you can see
Filter Information log field. the Filter Information column near the end of the list.
b. In the column headers, double-click the small line between the
Filter Information column, and the next column.
The width of the Filter Information column is changed to display
the longest value in the Filter Information log field.
c. Scroll the list of log entries until you see text in the Filter Information
field.
The log entry represents the connection from 10.1.1.5 (Denver) to
39.1.1.7 (Istanbul) on TCP port 80.
The Filter Information field shows the used DiffServ priority for the
request to the server, and the response to the client (Client/Server) for the first
packet (First:0/Medium), and the remaining packets (Last:0/Medium). You did
not enable DiffServ on the Internal network, so ISA Server does not use
DiffServ tagging in the response to the client (Denver). The rest of the Filter
Information field contains HTTP Compression information.
Module A: Introduction to ISA Server 115
1. On the Florence computer, a. On the Florence computer, on the Start menu, click All Programs, click
in the ISA Server console, examine Microsoft ISA Server, and then click ISA Server Management.
the Enterprise nodes, Arrays The ISA Server console opens.
node and Servers node.
Note: The ISA Server console for ISA Server 2006 Enterprise
Edition is not the same as the console for ISA Server 2006 Standard Edition.
b. In the ISA Server console, in the left pane, expand Enterprise.
The ISA Server console for ISA Server 2006 Enterprise Edition has
two main areas of configuration:
Enterprise node - This node allows you to define enterprise policies,
enterprise networks, enterprise rule elements and enterprise add-ins.
Arrays node - This nodes contains a listing of all the arrays managed within
the same enterprise. An array is a group of ISA Server computers that share the
same configuration and are managed together.
All configuration that is done at the enterprise-level, can be applied
at the array-level.
c. Expand Enterprise Policies, and then select Default Policy.
The ISA enterprise administrator can create one or more enterprise
policies. The predefined Default Policy enterprise policy cannot be modified.
d. In the left pane, select Arrays
An enterprise policy is assigned to each array.
The effective firewall policy is the combination of the firewall
policy rules in the enterprise policy and the firewall policy rules at the array-
level.
e. Expand Arrays, expand ITALY, expand Configuration, and then select
Servers.
The ITALY array contains two ISA Server computers, Firenze and
Florence.
When you install ISA Server 2006 Enterprise Edition, ISA Server is
always in an array.
2. Examine the Configuration a. In the left pane, select Arrays.
116 Module A: Introduction to ISA Server
Storage server (CSS) settings. b. Scroll the right pane, so that you can see the Configuration Server
column.
All array configuration information (and enterprise configuration
information) is stored in one or more replicating Configuration Storage
servers (CSS). A CSS is a computer running Active Directory Application Mode
(ADAM). You install ADAM from the ISA Server product CD-ROM.
Compare:
ISA Server 2006 Enterprise Edition - All configuration information is
stored in one or more servers running ADAM. You cannot store the ISA Server
2006 configuration in Active Directory.
ISA Server 2006 Standard Edition - All configuration information is only
stored in the local registry. There is no central database for ISA Server 2006
Standard Edition.
In this lab, the Florence computer is the CSS.
c. Right-click ITALY, and then click Properties.
d. In the ITALY Properties dialog box, select the Configuration Storage
tab.
When you make enterprise or array configuration changes in the
ISA Server console, and then click Apply, the changes are saved to the CSS. By
default every 15 seconds each ISA Server computer checks the CSS for updates
and applies those changes.
e. Click Cancel to close the ITALY Properties dialog box.
Note: All domain and workgroup installation combinations are
possible:
ISA Server array members can be installed on servers in a domain, or on
servers in a workgroup.
CSS can be installed on servers in a domain, or on servers in a workgroup.
CSS can be installed on an ISA Server computer.
In this lab, Florence and Firenze are ISA Server array members in
a workgroup. CSS is installed only on Florence.
f. In the left pane, expand PORTUGAL, expand Configuration, and then
select Servers.
The PORTUGAL array contains two servers, Lisboa and Lisbon.
Note: The ISA Server 2006 Enterprise Edition console always
connects to a particular CSS. It does not connect directly to the ISA Server
computers to make changes. This means that you can apply changes to arrays
centrally without having to connect to the individual ISA Server array
members.
In the right pane, the text in the gray header indicates that currently
the Lisboa and Lisbon computers are not available.
3. Examine the four a. In the left pane, expand Arrays, expand ITALY, and then select
components of the firewall policy Firewall Policy (ITALY).
rule list: The firewall policy rules that you create for an array can be in
three locations:
- System policy rules Enterprise Policy Rules (before) - Rules are processed before the array-
- Enterprise rules (before) level firewall policy rules.
- Array-level rules Firewall Policy Rules (array) - Array-level rules.
- Enterprise rules (after)
Enterprise Policy Rules (after) - Rules are processed after the array-level
firewall policy rules.
Only the Firewall Policy Rules (array) are created and managed at
the array level. The Enterprise Policy Rules (before and after) are created and
managed at the enterprise level in an Enterprise Policy, which is assigned to
the array.
b. In the task pane, on the Tasks tab, click Show System Policy Rules.
In the right pane, 34 predefined access rules to or from the
Module A: Introduction to ISA Server 117
7. Assign Company a. In the left pane, right-click ITALY, and then click Properties.
Enterprise Policy to the ITALY b. In the ITALY Properties dialog box, select the Policy Settings tab.
array.
Currently the Default Policy enterprise policy is assign to the
ITALY array.
c. in the Enterprise policy list box, select Company Enterprise Policy.
The Company Enterprise Policy is assigned to the ITALY array.
Notice that you can specify what types of rules the array
administrator can create for the array firewall policy.
d. Click OK to close the ITALY Properties dialog box.
8. Assign Company a. In the left pane, right-click PORTUGAL, and then click Properties.
Enterprise Policy to the b. In the PORTUGAL Properties dialog box, select the Policy Settings tab.
PORTUGAL array.
Currently the Default Policy enterprise policy is assigned to the
PORTUGAL array.
c. in the Enterprise policy list box, select Company Enterprise Policy.
The Company Enterprise Policy is assigned to the PORTUGAL
array.
d. Click OK to close the PORTUGAL Properties dialog box.
9. Examine the firewall policy a. In the left pane, select Firewall Policy (PORTUGAL).
of the PORTUGAL array. b. In the right pane, right-click the Baseline - Allow HTTP traffic to
Internet rule, and then click Properties.
c. In the access rule properties dialog box, select the Action tab.
Notice that you cannot modify enterprise firewall policy rules at the
array level.
d. Click Cancel to close the access rule properties dialog box.
10. Collapse the PORTUGAL a. In the left pane, collapse the PORTUGAL node.
node. The PORTUGAL node is not used in later exercises.
11. Create a new enterprise a. In the left pane, select Enterprise Policies.
protocol definition: b. In the task pane, on the Toolbox tab, in the Protocols section, on the
New menu, click Protocol.
Name: Attack Ports
c. In the New Protocol Definition Wizard dialog box, in the
Protocol definition name text box, type Attack Ports, and then click Next.
Protocols:
- TCP 12345 (outbound) You will use the Attack Ports protocol definition in a new enterprise
- TCP 31337 (outbound) access rule.
d. On the Primary Connection Information page, click New.
e. In the New/Edit Protocol Connection dialog box, complete the following
information:
Protocol type: TCP
Direction: Outbound
From: 12345
To: 12345
and then click OK.
TCP port 12345 is used by many Trojan horse applications.
f. On the Primary Connection Information page, click New.
g. In the New/Edit Protocol Connection dialog box, complete the following
information:
Protocol type: TCP
Direction: Outbound
From: 31337
To: 31337
and then click OK.
TCP port 31337 is also used by Trojan horse applications.
h. On the Primary Connection Information page, click Next.
120 Module A: Introduction to ISA Server
c. In the Enterprise policy text box, select Default Policy, and then click
OK.
The Default Policy enterprise policy is assigned to the ITALY
array.
d. In the left pane, select Firewall Policy (ITALY).
Notice that the firewall policy no longer contains the two enterprise
access rules from the Company Enterprise Policy.
Note: The following task is needed to avoid conflicts with other lab exercises.
15. Discard the changes. a. In the right pane, click Discard to discard all the changes made in this
exercise.
b. Click Yes to confirm that you want to discard the changes.
If you clicked Apply during this exercise, Company Enterprise
Policy may be assigned to the ITALY array. To change this, assign
Default Policy to the ITALY array, and then click Apply and OK again.
122 Module A: Introduction to ISA Server
Exercise 2
Remote Management and Role-based Administration
In this exercise, you will configure ISA Server to allow remote management.
You can connect remotely to manage ISA Server using the ISA Server console, or using a
Remote Desktop connection.
1. On the Florence computer, a. On the Florence computer, in the ISA Server console, in the left pane,
add the Denver computer expand Enterprise, and then select Enterprise Policies.
(10.1.1.5) to the Enterprise b. In the task pane, on the Toolbox tab, in the Network Objects section,
Remote Management Computers expand Computer Sets.
computer set.
The Enterprise Remote Management Computers computer set,
contains all the computer accounts from which you can manage all the arrays
in the enterprise.
c. Right-click Enterprise Remote Management Computers, and then
click Properties.
d. In the Enterprise Remote Management Computers Properties dialog box,
click Add, and then click Computer.
e. In the New Computer Rule Element dialog box, complete the following
information:
Name: Denver
Computer IP Address: 10.1.1.5
and then click OK.
Denver (10.1.1.5) is added to the Enterprise Remote Management
Computers computer set, so that you can manage the ISA Server array
configuration from the Denver computer.
f. Click OK to close the Enterprise Remote Management Computers
Properties dialog box.
2. For the ITALY array, a. In the left pane, select Firewall Policy (ITALY).
examine the Remote b. In the task pane, on the Toolbox tab, in the Network Objects section,
Management Computers expand Computer Sets.
computer set.
c. Right-click Enterprise Remote Management Computers, and then
click Properties.
Notice that you cannot modify the enterprise-level policy elements,
at the array-level. The Add, Edit and Delete button are grayed out.
d. Click Cancel to close the Enterprise Remote Management Computers
Properties dialog box.
e. Right-click Remote Management Computers, and then click
Properties.
The array-level Remote Management Computers computer set,
contains all the computer accounts from which you can manage this array
(ITALY). Each array has its own Remote Management Computers computer
set.
You can manage an array from the computers in the Enterprise
Module A: Introduction to ISA Server 123
Remote Management Computers computer set, and from the computer in the
Remote Management Computers computer set.
f. Click Cancel to close the Remote Management Computers Properties
dialog box.
3. Examine the system policy a. In the task pane, on the Tasks tab, click Show System Policy Rules.
rules that are used by the remote The array-level system policy rules are displayed. There are no
management computers: enterprise-level system policy rules.
b. In the System Policy Rules list, select system policy rule 2.
System policy rules:
2 - 3 - 4 - 11 - 20 - 32 A total of six system policy rules allow access from the Remote
Management Computers and the Enterprise Remote Management Computers to
Local Host (ISA Server):
Rule 2 - Allows access from the ISA Server console (MMC) to the ISA
Server. This is NOT the rule that allows you to configure ISA Server, because
that is done by connecting to the Configuration Storage Server (CSS). This rule
only allows access to the information in Monitoring node.
Rule 3 - Allows access to the ISA Server computer with a Remote Desktop
(Terminal Services) connection.
Rule 4 - Allows access to the ISA Server computer from a Web application.
This applies to ISA Server 2006 appliances.
Rule 11 - Allows you to ping the ISA Server computer.
Rule 20 - Allows access to the Performance Monitor information on the ISA
Server computer. The rule is disabled by default.
Rule 32 - Allows access to the CSS to configure the array. This rule only
applies when CSS is installed on ISA Server. In this lab, CSS is installed on
Florence.
c. In the task pane, on the Tasks tab, click Hide System Policy Rules.
4. Use System properties to a. On the Start menu, click Control Panel, and then click System.
enable remote desktop. Before Denver can connect using Remote Desktop (using system
policy rule 3), remote desktop must be enabled on Florence.
b. In the System Properties dialog box, on the Remote tab, in the
Remote Desktop box, select Enable Remote Desktop on this computer.
c. Click OK to acknowledge that remote connection accounts must have
passwords, and that the correct port must be open for remote connections.
d. Click OK to close the System Properties dialog box.
5. Create a new user account. a. On the Start menu, click Administrative Tools, and then click
Computer Management.
Name: David b. In the Computer Management console, in the left pane, expand
Local Users and Groups, and then select Users.
Password: Password2
Note: The (Enterprise) Remote Management Computers computer
Change password at next logon:
sets allows you to specify which computers can connect to ISA Server for
disable
remote management. However, whether you connect remotely or administer
ISA Server locally, you always need to authenticate with a user account that is
Member of:
assigned a monitoring role or an administration role on ISA Server.
Remote Desktop Users
Florence and Firenze are in a workgroup. This means that they do
not share user account information. To allow remote monitoring and
administration of both Florence and Firenze, you have to create a mirrored
user account on Florence and Firenze. A mirrored user account is a local user
account with the same user name and password.
For arrays with array members in a domain you can use domain
accounts, instead of mirrored local accounts.
c. Right-click Users, and then click New User.
d. In the New User dialog box, complete the following information:
User name: David
Password: Password2
Confirm password: Password2
124 Module A: Introduction to ISA Server
6. On the Firenze computer, a. On the Firenze computer, on the Start menu, click
create a new (mirrored) user Administrative Tools, and then click Computer Management.
account. b. In the Computer Management console, in the left pane, expand
Local Users and Groups, and then select Users.
Name: David
c. Right-click Users, and then click New User.
Password: Password2 d. In the New User dialog box, complete the following information:
Change password at next logon: User name: David
disable Password: Password2
Confirm password: Password2
User must change password at next logon: disable
and then click Create.
e. Click Close to close the New User dialog box.
You will assign David permission to monitor the Firenze ISA
Server.
f. Close the Computer Management console.
Note: If you want to connect to Firenze using a remote desktop
connection, then you must enable remote desktop on Firenze, and add David to
the Remote Desktop Users group.
Perform the following steps on the Florence computer.
7. On the Florence computer, a. On the Florence computer, in the ISA Server console, in the left pane,
assign array administrative roles: right-click ITALY, and then click Properties.
b. In the ITALY Properties dialog box, on the Assign Roles tab, click the
Array Administrator: top Add button.
FLORENCE\David
You use role-based administration to organize ISA Server
administration into predefined roles. The roles represent functions in an
Mirrored monitor account:
organization that may be assigned to administer ISA Server. When you assign a
David
role to a user or a group, only the permissions needed for the tasks associated
with that role are granted.
ISA Server has three array-level administrative roles.
c. In the Administration Delegation dialog box, complete the following
information:
Group or User: FLORENCE\David
Role: ISA Server Array Administrator
and then click OK.
The David account on Florence is granted full control on the
ITALY array configuration in CSS, and read-only permission on the enterprise
Module A: Introduction to ISA Server 125
configuration.
d. Click OK to acknowledge that you must assign this role to the mirrored
account.
e. Click the bottom Add button.
f. In the Administration Delegation dialog box, complete the following
information:
Group or User: David
Role: ISA Server Array Administrator
and then click OK.
The David accounts on Florence and on Firenze are granted
permission to monitor the ISA Server.
g. Click OK to close the ITALY Properties dialog box.
8. Examine the enterprise a. In the left pane, right-click Enterprise, and then click Properties.
administrative roles. b. In the Enterprise Properties dialog box, select the Assign Roles tab.
You can assign administrative roles at three levels in ISA Server:
Enterprise-level: Allows administrative control over all the enterprise and
the all array configuration.
Enterprise policy-level: (Per enterprise policy) Allows creation of enterprise
policy rules for a single enterprise policy
Array-level: (Per array) Allows administrative control over the array
configuration of a single array.
c. Click Cancel to close the Enterprise Properties dialog box.
9. Start the Array Status a. Use Windows Explorer (or My Computer) to open the C:\Tools\Status
Monitor to quickly see the current folder.
CSS status. b. In the Status folder, right-click ArrayStatus.hta, and then click Open.
Array Status Monitor is an HTML application for use with this lab.
File:
It continually displays the CSS synchronization status and the NLB status of the
C:\Tools\Status\
array.
ArrayStatus.hta
This is the same information that is displayed in the ISA Server
console at the Monitoring node on the Configuration tab (CSS Status) and on
the Services tab (NLB Status).
c. Close the Status folder.
10. Apply the changes. a. Click Apply to save the changes, and then click OK. Use the Array
Status Monitor to wait until the CSS status is Synced.
Perform the following steps on the Denver computer.
11. On the Denver computer, a. On the Denver computer, on the Start menu, click All Programs, click
use ISA Server console to connect Microsoft ISA Server, and then click ISA Server Management.
to ITALY. Note: Denver does not run ISA Server. Only the ISA Server console
is installed.
CSS: Florence
b. In the ISA Server console, in the left pane, select Microsoft Internet
Security and Acceleration Server 2006, and then in the task pane, on the
CSS credentials:
Tasks tab, click Connect to Configuration Storage Server.
David / Password2
c. In the Configuration Storage Server Connection Wizard dialog box,
Monitor credentials: click Next.
David / Password2 d. On the Configuration Storage Server Location page, in the
On remote computer (remote management) text box, type Florence, and
then click Next.
e. On the Configuration Storage Server Credentials page, complete the
following information:
Credentials of the following user: enable
User name: David
Password: Password2
and then click Next.
126 Module A: Introduction to ISA Server
18. On the Florence computer, a. On the Florence computer, on the Start menu, click Control Panel, and
use System properties to disable then click System.
remote desktop. b. In the System Properties dialog box, on the Remote tab, in the
Remote Desktop box, CLEAR the Enable Remote Desktop on this computer
check box.
c. Click OK to close the System Properties dialog box.
128 Module A: Introduction to ISA Server
Exercise 3
Working with Configuration Storage Servers (Optional)
In this exercise, you will examine details on how ISA Server uses a Configuration Storage
server (CSS) to save configuration data.
1. On the Florence computer, a. On the Florence computer, in the ISA Server console, in the left pane,
examine the Configuration right-click ITALY, and then click Properties.
Storage server (CSS) settings. b. In the ITALY Properties dialog box, select the Configuration Storage
tab.
When you make enterprise or array configuration changes in the
ISA Server console, and then click Apply, the changes are saved to the
Configuration Storage server (CSS).
Periodically each ISA Server computer checks the CSS for updates,
and applies those changes. Each ISA Server keeps a local copy of the array
configuration, and synchronizes the local copy with the updates from the CSS.
c. Open the Check the Configuration Storage server for updates every
list box.
You can change how often the ISA Servers in the array contact the
CSS to check for updates. The default is every 15 seconds. The minimum is
every 3 seconds.
Note: This poll rate is stored in the array configuration data as
well. In the lab environment, do not change this to 10 minutes or 60 minutes,
and apply changes, because it will then take 10 minutes or 60 minutes, before
ISA Server checks to change it back again.
d. Close the Check the Configuration Storage server for updates every
list box.
The Configuration Storage server text box shows that the ITALY
array uses Florence as (primary) CSS. This means that CSS is installed on an
array member. You can also install CSS on a separate server. The server can
be in a workgroup, or in a domain.
ISA Server only contacts the Alternate Configuration Storage
server, after the primary CSS has been unavailable for more than 30 minutes.
After using the alternate CSS for 6 hours, ISA Server switches back to the
primary CSS if it is available again.
e. Click Cancel to close the ITALY Properties dialog box.
2. In the ISA Server a. Open a Command Prompt window.
installation folder, examine the b. At the command prompt, type
ChangeStorageServer.vbs script. cd \Program Files\Microsoft ISA Server, and then press Enter.
c. Type cscript.exe ChangeStorageServer.vbs /?, and then press Enter.
ISA Server obtains the address of the primary CSS and alternate
CSS from the local copy of the array configuration data. However, when those
CSS computers become unavailable, ISA Server is not able to connect to a CSS
and update its local copy to use a new CSS.
To solve this problem, you can use the ChangeStorageServer.vbs
script in the ISA Server installation folder to change the CSS address in the
Module A: Introduction to ISA Server 129
CSS.
b. In the Ldp window, on the Connection menu, click Connect.
c. In the Connect dialog box, complete the following information:
Server: Florence
Port: 2172
Connectionless: disable (is default)
SSL: enable
and then click OK.
When a Web server certificate with the correct name is installed,
ldp shows the contents of the ADAM RootDSE information. Otherwise a
connection error is shown.
d. Close the Ldp window.
10. Use the dsmgmt tool to a. At the command prompt, type dsmgmt, and then press Enter.
examine the CSS ADAM naming The dsmgmt.exe tool provides management facilities for the ADAM
contexts. directory service.
b. At the dsmgmt: prompt, type partition management, and then press
Enter.
c. At the partition management: prompt, type connections, and then press
Enter.
d. At the server connections: prompt, type
connect to server Florence:2171, and then press Enter.
The dsmgmt tool creates a connection to the CSS ADAM directory
service, using LDAP.
e. At the server connections: prompt, type quit, and then press Enter.
f. At the partition management: prompt, type list, and then press Enter.
The CSS ADAM directory service uses three naming contexts:
Configuration, Schema, and FPC2.
The Schema contains class definition for all the ISA Server
configuration data. The Configuration naming context contains data about
ADAM sites, and replication. The FPC2 naming context contains all enterprise
and array configuration data.
g. At the partition management: prompt, type quit, and then press Enter.
h. At the dsmgmt: prompt, type quit, and then press Enter.
i. Close the ADAM Tools Command Prompt window.
11. Use the ADAM ADSI Edit a. On the Start menu, click All Programs, click ADAM, and then click
console to examine the ADAM site ADAM ADSI Edit.
replication configuration. The ADAM ADSI Edit console allows you to view and modify
ADAM objects in the directory service database.
Connections to [Florence:2171]:
b. In the ADAM-adsiedit window, on the Action menu, click Connect to.
- Configuration
and c. In the Connection Settings dialog box, complete the following
- CN=FPC2 information:
Connection name: Configuration
Server name: Florence
Port: 2171
Well-known naming context: Configuration
and then click OK.
The Configuration [Florence:2171] connection is added to the
console.
Note: ADAM ADSI Edit does not support LDAP over SSL
connections. You must use the ldp.exe tool to check LDAP over SSL
connectivity to the ADAM directory service.
d. On the Action menu, click Connect to again.
e. In the Connection Settings dialog box, complete the following
information:
132 Module A: Introduction to ISA Server
Note: The default background wallpaper on the Denver computer and the Istanbul computer,
only displays a single ISA Server (Paris). If needed, on those two computers you can select a
different background wallpaper which displays the two ISA Servers (Florence and Firenze)
that are used in this module.
1. On the Florence computer, a. On the Florence computer, on the Start menu, click Control Panel,
examine the current configuration click Network Connections, right-click Internal Connection, and then click
of the Internal Connection Properties.
network adapter, before NLB is In the Internal Connection Properties dialog box, notice that
enabled. Network Load Balancing is not enabled yet on this network adapter.
Note: Do not enable Network Load Balancing (NLB) in this dialog
box. You enable and configure NLB from the ISA Server console.
b. Click Cancel to close the Internal Connection Properties dialog box.
2. In the ISA Server console, a. On the Start menu, click All Programs, click Microsoft ISA Server,
enable NLB integration, and and then click ISA Server Management.
enable NLB on the Internal b. In the ISA Server console, expand Arrays, expand ITALY, expand
network. Configuration, and then in the left pane, select Networks.
c. In the right pane, select the Networks tab.
Primary Virtual IP address:
10.1.1.3 d. In the task pane, on the Tasks tab, click
Subnet mask: Enable Network Load Balancing Integration.
255.255.255.0 Enabling NLB integration results in the following two actions:
ISA Server controls the NLB driver and adds additional functionality, such
as alerting the NLB driver when any ISA Server service fails and support for
handling network traffic when NLB is enabled on multiple networks on the
array.
ISA Server manages the configuration of NLB, and overrides any manual
NLB changes you may make outside of ISA Server.
Note: It is possible to use NLB on ISA Server in non-integrated
mode. However, in this configuration you don't have the added functionality
provided by ISA Server's control of the NLB driver.
e. In the Network Load Balancing Wizard dialog box, click Next.
f. On the Select Load Balanced Networks page, select Internal, and then
Module A: Introduction to ISA Server 135
click Set Virtual IP.
g. In the Set Virtual IP Addresses dialog box, complete the following
information:
Primary VIP: 10.1.1.3
Subnet mask: 255.255.255.0
and then click OK.
The NLB virtual IP (VIP) address is used on both array members.
The address must be in the same IP subnet as the dedicated IP addresses
(DIPs) on Florence (10.1.1.1) and Firenze (10.1.1.2).
Later in this exercise, you will also enable NLB on the External
network.
h. On the Select Load Balanced Networks page, click Next.
i. On the Completing the Network Load Balancing Integration Wizard
page, click Finish.
A message box appears, explaining that the name you specify for
the Configuration Storage server (CSS) should resolve to the intra-array IP
address. This only applies if CSS is installed on an array member, and NLB is
enabled.
j. Click OK to close the message box.
k. In the left pane, right-click ITALY, and then click Properties.
l. In the ITALY Properties dialog box, select the Configuration Storage
tab.
The array uses the name Florence to specify the CSS on the
Florence computer. Both Florence and Firenze use a hosts file to resolve the
name Florence to the intra-array IP address of Florence (23.1.1.1). This means
that the array meets the requirement explained in the message box after you
enabled NLB integration.
m. Click Cancel to close the ITALY Properties dialog box.
3. Examine the NLB and a. In the left pane, select Networks, and in the right pane, on the Networks
CARP configuration on the tab, right-click Internal, and then click Properties.
Internal network. b. In the Internal Properties dialog box, select the NLB tab.
NLB is enabled on the Internal network. The Primary VIP is
10.1.1.3.
c. Select the CARP tab, and ensure that CARP is NOT enabled on this
network.
ISA Server supports the use of both CARP and NLB on the same
network, but in this exercise you will use only NLB.
d. Click OK to close the Internal Properties dialog box.
4. Examine the status of the a. In the left pane, select Monitoring, and then in the right pane, select the
Network Load Balancing service Services tab.
on the Monitoring/Services tab. When NLB integration is enabled, ISA Server displays the status of
the Network Load Balancing service on the Services tab. This is not a real
Windows service, but represents the NLB network driver.
Because you have not applied the configuration changes yet, the
current status of the Network Load Balancing service is Unavailable.
b. Do NOT click Apply yet to save the changes.
5. Start the Array Status a. Use Windows Explorer (or My Computer) to open the C:\Tools\Status
Monitor to quickly see the current folder.
CSS status and NLB status. b. In the Status folder, right-click ArrayStatus.hta, and then click Open.
Array Status Monitor is an HTML application for use with this lab.
File:
It continually displays the CSS synchronization status and the NLB status of the
C:\Tools\Status\
array.
ArrayStatus.hta
This is the same information that is displayed in the ISA Server
console at the Monitoring node on the Configuration tab (CSS Status) and on
136 Module A: Introduction to ISA Server
9. Create a new access rule. a. In the right pane, select the first rule in the Firewall Policy Rules list, or
select Default rule if no other rule exists, to indicate where the new rule is
Name: Allow Web access (NLB) added to the rule list.
b. In the task pane, on the Tasks tab, click Create Access Rule.
Applies to: HTTP
c. In the New Access Rule Wizard dialog box, in the Access rule name
text box, type Allow Web access (NLB), and then click Next.
From network: Internal
To network: External d. On the Rule Action page, select Allow, and then click Next.
e. On the Protocols page, in the This rule applies to list box, select
Selected protocols, and then click Add.
f. In the Add Protocols dialog box,
click Common Protocols, click HTTP, and click Add,
and then click Close to close the Add Protocols dialog box.
g. On the Protocols page, click Next.
h. On the Access Rule Sources page, click Add.
i. In the Add Network Entities dialog box,
click Networks, click Internal, click Add,
and then click Close to close the Add Network Entities dialog box.
j. On the Access Rule Sources page, click Next.
k. On the Access Rule Destinations page, click Add.
l. In the Add Network Entities dialog box,
click Networks, click External, click Add,
and then click Close to close the Add Network Entities dialog box.
m. On the Access Rule Destinations page, click Next.
n. On the User Sets page, click Next.
o. On the Completing the New Access Rule Wizard page, click Finish.
A new firewall policy rule is created that allows the HTTP protocol
from the Internal network to the External network.
10. After NLB integration is a. Before you apply the new rule, ensure that NLB integration is fully
fully enabled, apply the changes. enabled on the ISA Server array. Wait until the CSS status is Synced, and the
NLB status is Running.
b. Click Apply to apply the new rule, and then click OK. Wait until the
CSS status is Synced, and the NLB status is Running.
Perform the following steps on the Denver computer.
11. On the Denver computer, a. On the Denver computer, open Internet Explorer. In the Address box,
connect to type http://istanbul.fabrikam.com/web.asp, and then press Enter.
http:// The Web Server Info Demo Page on Istanbul appears. The Web
istanbul.fabrikam.com/ server reports that the Web request was sent through Florence (39.1.1.1).
web.asp.
b. On the Tools menu, click Internet Options.
Use proxy server address: c. In the Internet Options dialog box, on the Connections tab, click
10.1.1.1:8080 LAN Settings.
and Notice that currently Internet Explorer is still using IP address
10.1.1.3:8080 10.1.1.1 (Florence) as the proxy server address. This means that all Web proxy
traffic uses Florence.
After you have enabled NLB, you should ensure that all client
computers use the NLB virtual IP address as the proxy server address (for Web
Proxy clients and Firewall clients), or as default gateway (for SecureNAT
clients).
d. In the Local Area Network (LAN) Settings dialog box, complete the
following information:
Use a proxy server for your LAN: enable
Address: 10.1.1.3
Port: 8080
Bypass proxy server for local addresses: enable
138 Module A: Introduction to ISA Server
12. On the Firenze computer, a. On the Firenze computer, in a Command Prompt window, type
stop, wait 10 seconds, and start the net stop fwsrv, and then press Enter.
Microsoft Firewall service. The Microsoft Firewall service on Firenze is stopping. After
5 seconds, NLB on Florence will automatically reconfigure to handle all
connections through the array.
b. Wait 10 seconds, and then type net start fwsrv, and press Enter.
After the Microsoft Firewall service on Firenze is started, all
connections through the array are load balanced between Florence and
Firenze again.
c. Close the Command Prompt window.
Note: In the following tasks, you will enable NLB on the External network as well. This allows you to load
balance incoming connections to published servers on your network.
Perform the following steps on the Florence computer.
13. On the Florence computer, a. On the Florence computer, in the ISA Server console, in the left pane,
enable NLB on the External select Networks.
network. b. In the task pane, on the Tasks tab, click Configure Load Balanced
Networks.
Primary Virtual IP address:
c. In the Network Load Balancing Wizard dialog box, click Next.
39.1.1.3
Subnet mask: d. On the Select Load Balanced Networks page, select External, and then
255.255.255.0 click Set Virtual IP.
e. In the Set Virtual IP Addresses dialog box, complete the following
information:
Primary VIP: 39.1.1.3
Subnet mask: 255.255.255.0
and then click OK.
f. On the Select Load Balanced Networks page, click Next.
g. On the Completing the Load Balanced Networks Wizard page, click
Finish.
Currently NLB is enabled on both the Internal network (virtual IP
10.1.1.3) and the External network (virtual IP 39.1.1.3).
Note: When you use NLB on an ISA Server array, it is
recommended to enable NLB on all networks, except the network used for
intra-array communication (unless you use Windows Server 2003 Service
Pack 1).
h. Click Apply to apply the changes, and then click OK. Wait until the
CSS status is Synced, and the NLB status is Running.
Module A: Introduction to ISA Server 139
14. Refresh the ISA Server a. In the left pane, right-click Firewall Policy (ITALY), and then click
console, so that the new virtual IP Refresh.
address is shown in the user This step ensures that the ISA Server console rereads the IP
interface. addresses from the network adapters.
15. Create a new Web listener. a. In the left pane, select Firewall Policy (ITALY).
b. In the task pane, on the Toolbox tab, in the Network Objects section,
Name: right-click Web Listeners, and then click New Web Listener.
External Web 80 NLB
c. In the New Web Listener Definition Wizard dialog box, in the
Web listener name text box, type External Web 80 NLB, and then click Next.
SSL: disable
d. On the Client Connection Security page, select
Network: Do not require SSL secured connections with clients, and then click Next.
External - 39.1.1.3 e. On the Web Listener IP Addresses page, select the External check box,
Compression: disable and then click Select IP Addresses.
Instead of listening on dedicated IP addresses (39.1.1.1 and
Authentication: none 39.1.1.2), it is recommended to only listen on the virtual IP address.
Note: If you did not refresh the ISA Server console in the previous
task, it is possible that 39.1.1.3 is not listed as Virtual IP yet.
f. In the External Network Listener IP Selection dialog box, select the
Specified IP addresses option, and then in the Available IP Addresses list,
select 39.1.1.3, and click Add.
g. Click OK to close the External Network Listener IP Selection dialog
box.
The Web listener will only listen on IP address 39.1.1.3, on the
External network.
h. On the Web Listener IP Addresses page, clear
ISA Server will compress content, and then click Next.
i. On the Authentication Settings page, in the drop-down list box, select
No Authentication, and then click Next.
j. On the Single Sign On Settings page, click Next.
k. On the Completing the New Web Listener Wizard page, click Finish.
A new Web listener (port 80 on IP address 39.1.1.3) with the name
External Web 80 NLB is created.
16. Create a Web publishing a. In the right pane, select the first rule in the Firewall Policy Rules list to
rule. indicate where the new rule is added to the rule list.
b. In the task pane, on the Tasks tab, click Publish Web Sites.
Name:
c. In the New Web Publishing Rule Wizard dialog box, in the
Web Home Page NLB
Web publishing rule name text box, type Web Home Page NLB, and then
click Next.
Publishing type:
single Web site d. On the Select Rule Action page, select Allow, and then click Next.
e. On the Publishing Type page, select Publish a single Web site, and then
Internal site name: click Next.
denver.contoso.com f. On the Server Connection Security page, select Use non-secured
connections to connect to the published Web server, and then click Next.
Public name:
shop.contoso.com g. On the Internal Publishing Details page, complete the following
information:
Web listener: Internal site name: denver.contoso.com
External Web 80 NLB Use a computer name or IP address: disable (is default)
and then click Next.
Delegation: none h. On the next Internal Publishing Details page, complete the following
information:
Path: (leave empty)
Forward the original host header: disable (is default)
and then click Next.
i. On the Public Name Details page, complete the following information:
140 Module A: Introduction to ISA Server
17. On the Istanbul computer, a. On the Istanbul computer, open a Command Prompt window.
verify the IP address of b. At the command prompt, type ping shop.contoso.com, and the press
shop.contoso.com, and then Enter.
connect to
In the hosts file on Istanbul, shop.contoso.com is already defined as
http://shop.contoso.com/
39.1.1.3.
web.asp
Note: Depending on firewall policy rules that you may have created
in earlier exercises, you may or may not receive replies on the ping requests to
39.1.1.
c. Open Internet Explorer. In the Address box, type
http://shop.contoso.com/web.asp, and then press Enter.
The Web Server Info Demo page on Denver appears. The Web
server reports that the Web request was sent through Florence.
Apparently the NLB process assigns the Web connection from
Istanbul (39.1.1.7) to Florence.
Note: Because ISA Server blocks unsolicited network traffic on all
networks, the request and reply must go through the same ISA Server.
When ISA Server sends the Web request to Denver (10.1.1.5), it replaces the
client address (39.1.1.7) in the network packet with its own dedicated IP
address (10.1.1.1) on the Internal network. When Denver replies, it sends the
reply back to the client IP address (10.1.1.1), which is automatically the
correct ISA Server.
d. Close Internet Explorer.
Module A: Introduction to ISA Server 141
Exercise 2
Examining Details on NLB
In this exercise, you will examine details on how ISA Server configures and controls the NLB
driver to provide load balancing functionality for array members. You will also perform the
steps needed to disable NLB integration on an array.
1. On the Florence computer, a. On the Florence computer, in a Command Prompt window, type
use the nlb query command to nlb query, and then press Enter.
see the current convergence state The NLB utility shows which NLB hosts are currently part of the
of the NLB cluster. clusters for each network.
Note: Florence is host ID 2, and Firenze is host ID 3. WLBS is an
old name for NLB.
2. Use the nlb queryport a. At the command prompt, type nlb queryport 8080, and then press
command to see the number of Enter.
accepted and dropped network The NLB utility reports the number of accepted and dropped
packets. packets on Florence for the NLB port rule that applies to TCP or UDP port
8080.
Remember the number of accepted and dropped packets through
the 10.1.1.3 cluster (Internal network) for comparison in the next task.
Perform the following steps on the Firenze computer.
3. On the Firenze computer, a. On the Firenze computer, open a Command Prompt window.
use the nlb queryport command b. At the command prompt, type nlb queryport 8080, and then press
to see the number of accepted and Enter.
dropped network packets.
The NLB utility on Firenze reports exactly the opposite numbers of
accepted and dropped packets through the 10.1.1.3 cluster (if no additional
new network traffic occurred in the meantime).
Note: All TCP and UDP packets are sent to both NLB hosts. Each
hosts makes the exact same decision which hosts will handle a particular
network packet. For single affinity, this decision is based on the outcome of the
hash value of the source IP address.
Apparently the hash value of 10.1.1.5 results in NLB host Firenze.
c. Close the Command Prompt window.
Perform the following steps on the Florence computer.
4. On the Florence computer, a. On the Florence computer, on the Start menu, click Control Panel,
examine the configuration of the click Network Connections, right-click Internal Connection, and then click
Internal Connection network Properties.
adapter. Notice that ISA Server has enabled Network Load Balancing on
the network adapter.
b. In the Internal Connection Properties dialog box, select
Network Load Balancing (do NOT clear the check box), and then click
Properties.
142 Module A: Introduction to ISA Server
5. On the Firenze computer, a. On the Firenze computer, open a Command Prompt window.
examine the configuration of the b. At the command prompt, type ipconfig /all, and then press Enter.
Internal Connection network
The Internal Connection network adapter on Firenze uses the same
adapter.
cluster IP address (10.1.1.3), and the same MAC address
(02-BF-0A-01-01-03).
Florence and Firenze do no longer use the original MAC address
on the Internal Connection network adapter, but use the same new MAC
address. This is called unicast mode in NLB.
Note: When NLB integration is enabled, ISA Server always uses
unicast mode and single affinity.
c. Close the Command Prompt window.
Perform the following steps on the Florence computer.
6. On the Florence computer, a. On the Florence computer, in the ISA Server console, in left pane, select
create a new access rule. Firewall Policy.
b. In the right pane, select the first rule in the Firewall Policy Rules list, to
Name: Allow Ping to firewall indicate where the new rule is added to the rule list.
c. In the task pane, on the Tasks tab, click Create Access Rule.
Applies to: PING
d. In the New Access Rule Wizard dialog box, in the Access rule name
From network: Internal text box, type Allow Ping to firewall, and then click Next.
To network: Local Host e. On the Rule Action page, select Allow, and then click Next.
f. On the Protocols page, in the This rule applies to list box, select
Selected protocols, and then click Add.
g. In the Add Protocols dialog box,
click Common Protocols, click PING, and click Add,
and then click Close to close the Add Protocols dialog box.
h. On the Protocols page, click Next.
i. On the Access Rule Sources page, click Add.
j. In the Add Network Entities dialog box,
Module A: Introduction to ISA Server 143
7. On the Denver computer, a. On the Denver computer, open a Command Prompt window.
examine the MAC addresses used b. At the command prompt, type ping 10.1.1.1, and then press Enter.
by 10.1.1.1, 10.1.1.2, and 10.1.1.3.
Florence returns four replies on the ping requests.
c. Type ping 10.1.1.2, and then press Enter.
Firenze returns four replies on the ping requests.
d. Type ping 10.1.1.3, and then press Enter.
NLB does not load balancing ICMP traffic requests (ping). This
means that both Florence and Firenze return a reply to each ping request. The
ping application does not display the double responses.
e. Type arp -a, and then press Enter.
The command displays the MAC addresses used for each IP
address during the last 2 minutes. Because NLB is using unicast mode, all IP
addresses return the same MAC address (02-BF-0A-01-01-03).
f. Close the Command Prompt window.
8. Connect to a. Open Internet Explorer. In the Address box, type
http:// http://istanbul.fabrikam.com/web.asp, and then press Enter.
istanbul.fabrikam.com/ Denver is using Web proxy address 10.1.1.3. The Web server
web.asp. reports that the Web request was sent through Firenze (39.1.1.2)
b. On the Tools menu, click Internet Options.
Use proxy server address:
10.1.1.3:8080 c. In the Internet Options dialog box, on the Connections tab, click
and LAN Settings.
use default gateway: d. In the Local Area Network (LAN) Settings dialog box, complete the
10.1.1.1. following information:
Use a proxy server for your LAN: disable
and then click OK.
e. Click OK to close the Internet Options dialog box.
Internet Explorer is no longer configured to use a proxy server
(Web Proxy client). Instead, the default gateway (10.1.1.1) on Denver is now
used to connect to the ISA Server (SecureNAT client).
f. On the toolbar, click the Refresh button.
The Web page reports that the Web request was sent through
Firenze (39.1.1.2).
9. Change the default gateway a. In a Command Prompt window, type ipconfig, and then press Enter.
from 10.1.1.1 to 10.1.1.3. The default gateway is configured to 10.1.1.1.
Note: Unlike a Web Proxy client that uses proxy server 10.1.1.1
(Florence), network traffic from a SecureNAT client that uses default gateway
144 Module A: Introduction to ISA Server
10.1.1.1, is load balanced correctly and handled by the NLB host (Firenze)
based on the hash value of the source IP address.
The reason for this is that a Web Proxy client request is technically
from 10.1.1.5 to 10.1.1.1:8080 (with the HTTP headers indicating
istanbul.fabrikam.com), while a SecureNAT client request is from 10.1.1.5 to
39.1.1.7:80 (sent to the NLB cluster MAC address provided by 10.1.1.1).
Note: It is still important to change the default gateway setting on
SecureNAT client computers to the virtual IP address (10.1.1.3), to ensure that
traffic is handled correctly when the computer with IP address 10.1.1.1 is
temporarily unavailable.
b. On the Start menu, click Control Panel, click Network Connections,
right-click Local Area Connection, and then click Properties.
c. In the Local Area Connection Properties dialog box, select
Internet Protocol (TCP/IP) (do NOT clear the check box), and then click
Properties.
d. In the Internet Protocol (TCP/IP) Properties dialog box, complete the
following information:
Default gateway: 10.1.1.3
and then click OK.
e. Click Close to close the Local Area Connection Properties dialog box.
f. In the Command Prompt window, type ipconfig, and then press Enter.
The default gateway is changed to the virtual IP address (10.1.1.3).
g. Close the Command Prompt window.
10. Connect to a. In Internet Explorer, in the Address box, type
http:// http://istanbul.fabrikam.com/reload.asp, and then press Enter.
istanbul.fabrikam.com/ The reload.asp page automatically refreshes the Web page every
reload.asp. 2 seconds. The Web server reports that each Web request was sent through
Firenze (39.1.1.2).
Use default gateway:
b. Do not close Internet Explorer.
10.1.1.3.
Perform the following steps on the Florence computer.
11. On the Florence computer, a. On the Florence computer, in the ISA Server console, in the left pane,
use the ISA Server console to stop select Monitoring.
the Microsoft Firewall service on b. In the right pane, on the Services tab, select the Microsoft Firewall
Firenze. service for Firenze.
Note: Ensure that you select the Microsoft Firewall on Firenze, not
on Florence.
c. In the task pane, on the Tasks tab, click Stop Selected Service.
ISA Server stops the Firewall service on Firenze.
Perform the following steps on the Denver computer.
12. On the Denver computer, a. On the Denver computer, in Internet Explorer, wait until reload.asp is
wait until reload.asp is refreshed refreshed through Florence (39.1.1.1), instead of Firenze (39.1.1.2).
through Florence. When the Firewall service stops, the following happens:
ISA Server on Firenze notifies NLB that it should no longer be joined to the
NLB cluster.
NLB on Firenze stops sending its normal one-per-second heartbeat
broadcast messages.
After 5 missed heartbeat messages, NLB on Florence detects that NLB on
Firenze stopped functioning.
NLB on Florence converges to a NLB cluster with one host. It will now
respond to all network packets, and handle the Web request from Denver.
Note: The fact that NLB is notified when the Firewall service is not
running, is functionality that is only available when NLB integration is enabled.
Module A: Introduction to ISA Server 145
13. On the Florence computer, a. On the Florence computer, in the ISA Server console, on the Services
use the ISA Server console to start tab, select the Microsoft Firewall service for Firenze.
the Microsoft Firewall service on b. In the task pane, on the Tasks tab, click Start Selected Service.
Firenze.
ISA Server starts the Firewall service on Firenze.
c. Wait until the CSS status is Synced, and the NLB status is Running.
Perform the following steps on the Denver computer.
14. On the Denver computer, a. On the Denver computer, in Internet Explorer, notice that reload.asp
examine the continuing refresh of continues to be refreshed through Florence (39.1.1.1).
reload.asp. NLB actually uses two steps to decide which host handles a network
packets:
Close and reopen Internet 1) Each NLB host maintains a list of current TCP connections handled by the
Explorer, and connect to host. Existing TCP connections are not disconnected when the cluster
http:// converges to include more NLB hosts. This also applies to PPTP (GRE) and
istanbul.fabrikam.com/ IPSec connections. However, UDP, ICMP and other IP connections may move
reload.asp. to other NLB hosts after a cluster converges.
2) For new connections, NLB uses the hash value of the source IP address
(when using single affinity), to determine the NLB host.
b. Close Internet Explorer.
c. Open Internet Explorer again, and in the Address box, type
http://istanbul.fabrikam.com/reload.asp.
The new Web request to reload.asp is handled through Firenze
(39.1.1.2).
d. Close Internet Explorer.
Note: In the following tasks, you will explore how ISA Server controls the way NLB calculates its hash value,
so that network requests to published servers and the related network reply are always going through the same
ISA Server in an array. This is called bi-directional affinity (BDA).
Perform the following steps on the Istanbul computer.
15. On the Istanbul computer, a. On the Istanbul computer, open Internet Explorer. In the Address box,
connect to type http://shop.contoso.com/web.asp, and then press Enter.
http://shop.contoso.com/ The Web server reports that the Web request was sent through
web.asp. Florence.
When ISA Server sends the Web request to the published server
(Denver), it replaces the client address in the network packet with its own
dedicated IP address (10.1.1.1) on the Internal network. When Denver replies,
it sends the reply back to the client IP address (10.1.1.1), which is
automatically the correct ISA Server.
b. Do not close Internet Explorer.
Perform the following steps on the Florence computer.
16. On the Florence computer, a. On the Florence computer, in the ISA Server console, in the
change the Web Home Page NLB Firewall Policy Rules list, right-click Web Home Page NLB, and then click
rule. Properties.
b. In the Web Home Page NLB Properties dialog box, on the To tab, select
Requests appear to come from: Requests appear to come from the original client, and then click OK.
original client
For Web publishing rules, the default is that requests appear to
come from the ISA Server computer. For Server publishing rules, the default is
that requests appear to come from the original client. You can change this
setting for any Web publishing rule or Server publishing rule.
c. Click Apply to apply the new rule, and then click OK. Wait until the
CSS status is Synced, and the NLB status is Running.
146 Module A: Introduction to ISA Server
17. On the Istanbul computer, a. On the Istanbul computer, in Internet Explorer, on the toolbar, click the
refresh the connection to Refresh button.
http://shop.contoso.com/ The Web server reports that the Web request was sent through
web.asp. Florence. ISA Server did not replace the client address, so the network packet
that arrived at Denver contains the original client address (39.1.1.7).
How does Denver know which ISA Server the reply should go to?
Note: Denver does not inspect the Reverse-Via HTTP header in the Web
request, plus the same question applies to non-HTTP protocols, using Server
publishing rules, as well.
The answer is: Denver (the published server) does not know which
ISA Server to reply to. Instead the server just sends a reply to the received
client address (39.1.1.7), which is sent to Denver's default gateway (10.1.1.3),
and NLB selects the correct ISA Server.
NLB on the Internal network works together with NLB on the
External network in a so-called bi-directional affinity (BDA) team. Bi-
directional affinity means that the hash value to determine the NLB host to use,
matches in both directions. On the Web request from Istanbul, NLB on the
External network uses the hash value of the source IP address (39.1.1.7). On
the reply, NLB on the Internal network uses the hash value of the
destination IP address (which is the same 39.1.1.7).
b. Close Internet Explorer.
Perform the following steps on the Florence computer.
18. On the Florence computer, a. On the Florence computer, in a Command Prompt window, type
use the nlb params command and nlb params 39.1.1.3, and the press Enter.
the C:\Tools\fwengmon /N The NLB utility displays the configuration parameters of the NLB
command to examine the NLB bi- cluster on the External network.
directional configuration.
Notice that BDATeaming (6th parameter from the bottom) is
enabled.
b. At the command prompt, type nlb params 10.1.1.3, and then press
Enter.
The NLB cluster on the Internal network, also has BDA teaming
enabled.
However, the setting to automatically use the hash value of the
destination IP address, instead of the source IP address (ReverseHash, 3rd
parameter from the bottom), is NOT enabled.
When NLB integration is enabled, ISA Server specifically tells NLB
for which connections reversing hashing needs to be used.
c. Type cd \tools, and then press Enter.
d. Type fwengmon /?, and then press Enter.
The Firewall Kernel Mode Tool (fwengmon.exe) is a tool you can
use to analyze and troubleshoot firewall connectivity by monitoring the ISA
Server kernel-mode firewall engine.
You can download the tool from
www.microsoft.com/isaserver/downloads.
e. Type fwengmon /N, and then press Enter.
The output lists all the NLB hook rules that the ISA Server firewall
engine has defined. Each NLB hook rule specifies whether to use the hash value
of the source IP address (forward), or the destination IP address (reverse), for
particular network connections.
To make it easier to read this list, you can save the output to a text
file.
f. Type fwengmon /N > nlbrules.txt, and then press Enter.
Module A: Introduction to ISA Server 147
19. On the Denver computer, a. On the Denver computer, open Internet Explorer.
connect to b. On the Tools menu, click Internet Options.
http://
c. In the Internet Options dialog box, on the Connections tab, click
istanbul.fabrikam.com
LAN Settings.
web.asp.
d. Ensure that Internet Explorer is not configured to use a proxy server.
Use default gateway Web requests will use the default gateway 10.1.1.3 (SecureNAT
10.1.1.3 client).
(Do not use a proxy server) e. Click OK to close the Local Area Network (LAN) Settings dialog box.
f. Click OK to close the Internet Options dialog box.
g. In the Address box, type http://istanbul.fabrikam.com/web.asp, and
then press Enter.
The Web page reports that the Web request was sent through
Florence (39.1.1.1).
Before the publishing rule to Denver was created, NLB used the
hash value of the source IP address (10.1.1.5) for connections from Denver,
which resulted in the use of NLB host Firenze. However, now that the firewall
engine has defined a reverse NLB hook rule for network traffic from 10.1.1.5 to
the External network, based on the new Web publishing rule, NLB uses the
hash value of the destination IP address (39.1.1.7 for this connection) for all
network traffic from Denver to the External network, including network traffic
that is not related to the Web publishing rule.
20. Connect again to a. On the Tools menu, click Internet Options.
http:// b. In the Internet Options dialog box, on the Connections tab, click
istanbul.fabrikam.com LAN Settings.
web.asp.
c. In the Local Area Network (LAN) Settings dialog box, complete the
following information:
Use a proxy server:
10.1.1.3:8080 Use a proxy server for your LAN: enable
Address: 10.1.1.3
Port: 8080
Bypass proxy server for local addresses: enable
and then click OK.
Web requests will use the proxy server at 10.1.1.3:8080 (Web Proxy
client).
d. Click OK to close the Internet Options dialog box.
e. On the toolbar, click the Refresh button.
The Web page reports that the Web request was sent through
Firenze (39.1.1.2).
148 Module A: Introduction to ISA Server
The firewall engine did not define a reverse NLB hook rule that
includes network traffic from 10.1.1.5 to the Internal network. For the
connection from 10.1.1.5 to 10.1.1.3, NLB uses the hash value of the
source IP address (10.1.1.5), which results in the use of NLB host Firenze.
Note: In the following tasks, you will disable NLB on the ISA Server array. This consists of four steps that
need to be done in the correct order.
Step 1 - Delete rules and rule elements that use any virtual IP address.
Step 2 - Disable NLB on all networks.
Step 3 - Apply the changes.
Step 4 - Disable NLB integration, and apply the changes.
Perform the following steps on the Florence computer.
21. On the Florence computer, a. On the Florence computer, in the ISA Server console, in the left pane,
examine the warning message select Networks, and in the right pane, select the Networks tab.
when attempting to disable NLB b. In the task pane, on the Tasks tab, click
integration. Disable Network Load Balancing Integration.
A warning message box appears. It explains that Windows NLB
will remain configured on the array computers (in a non-integrated mode),
when you disable NLB Integration in the ISA Server console.
To disable NLB completely, you have to perform several steps.
c. Click CANCEL to indicate that you do NOT yet want to disable NLB
integration.
22. Delete the firewall policy a. In the left pane, select Firewall Policy (ITALY).
rules and rule elements that use the The first step to disable NLB on an ISA Server array, is to
virtual IP addresses. reconfigure or to delete any rules and rule elements that use the virtual IP
addresses.
Firewall policy rule:
b. In the right pane, in the Firewall Policy Rules list, right-click
Web Home Page NLB
Web Home Page NLB, and then click Delete.
Web listener: c. Click Yes to confirm that you want to delete the Web Home Page NLB
External Web 80 NLB rule.
You must delete the Web publishing rule, before you can delete the
(Step 1) Web listener that uses the virtual IP address.
d. In the task pane, on the Toolbox tab, in the Network Objects section,
under Web Listeners, right-click External Web 80 NLB, and then click
Delete.
e. Click Yes to confirm that you want to delete the External Web 80 NLB
Web listener.
23. Disable NLB on all a. In the left pane, select Networks, and in the right pane, select the
networks. Networks tab.
The second step to disable NLB on an ISA Server array, is to
Networks: disable NLB on any network.
Internal
b. In the task pane, on the Tasks tab, click
External
Configure Load Balanced Networks.
(Step 2) c. In the Network Load Balancing Wizard dialog box, click Next.
d. On the Select Load Balanced Networks page, clear the check boxes of
all networks, and then click Next.
e. On the Completing the Load Balanced Networks Wizard page, click
Finish.
If NLB is still configured on a network, when you disable NLB
integration, NLB remains configured on the array in non-integrated mode.
24. Apply the changes. a. Click Apply to save the changes, and then click OK. Wait until the CSS
status is Synced, and the NLB status is Not configured.
(Step 3) The third step to disable NLB on an ISA Server array, is to apply
the current changes, so that NLB is disabled on the network adapters, before
Module A: Introduction to ISA Server 149
27. On the Denver computer, a. On the Denver computer, in Internet Explorer, on the Tools menu, click
configure Internet Explorer to use Internet Options.
proxy server 10.1.1.1:8080, and b. In the Internet Options dialog box, on the Connections tab, click
change the default gateway to LAN Settings.
10.1.1.1.
c. In the Local Area Network (LAN) Settings dialog box, complete the
following information:
Use a proxy server for your LAN: enable
Address: 10.1.1.1
Port: 8080
Bypass proxy server for local addresses: enable
and then click OK.
d. Click OK to close the Internet Options dialog box.
Internet Explorer now uses proxy server 10.1.1.1:8080.
e. Close Internet Explorer.
f. On the Start menu, click Control Panel, click Network Connections,
right-click Local Area Connection, and then click Properties.
g. In the Local Area Connection Properties dialog box, select
Internet Protocol (TCP/IP) (do NOT clear the check box), and then click
Properties.
h. In the Internet Protocol (TCP/IP) Properties dialog box, complete the
following information:
Default gateway: 10.1.1.1
150 Module A: Introduction to ISA Server
Exercise 3
Using CARP to Distribute Cache Content
In this exercise, you will configure ISA Server to use Cache Array Routing Protocol (CARP).
When you enable CARP, the cache drives on all servers are treated as a single logical cache
drive.
You will also explore the CARP algorithm in the automatic configuration script that is used
by Internet Explorer.
1. On the Florence computer, a. On the Florence computer, in the ISA Server console, in the left pane,
verify that ISA Server listens for select Networks.
Web Proxy client requests on the b. In the right pane, on the Networks tab, right-click Internal, and then
Internal network. click Properties.
c. In the Internal Properties dialog box, on the Web Proxy tab, ensure that
Enable Web Proxy client connections on this network is enabled, and that
HTTP port is 8080.
Cache Array Routing Protocol (CARP) does not require the
Internal network to listen for Web Proxy client requests, however in the next
tasks Web Proxy client requests are used to connect to ISA Server.
d. Select the CARP tab. (Do NOT enable CARP).
Notice that CARP is not enabled yet. This is the default setting in
ISA Server.
e. Click OK to close the Internal Properties dialog box.
2. Create a new access rule. a. In the left pane, select Firewall Policy (ITALY).
b. In the right pane, select the first rule in the Firewall Policy Rules list, or
Name: Allow Web access select Default rule if no other rule exists, to indicate where the new rule is
(CARP) added to the rule list.
c. In the task pane, on the Tasks tab, click Create Access Rule.
Applies to: HTTP
d. In the New Access Rule Wizard dialog box, in the Access rule name
From network: Internal text box, type Allow Web access (CARP), and then click Next.
To network: External e. On the Rule Action page, select Allow, and then click Next.
f. On the Protocols page, in the This rule applies to list box, select
Selected protocols, and then click Add.
g. In the Add Protocols dialog box,
click Common Protocols, click HTTP, and click Add,
and then click Close to close the Add Protocols dialog box.
h. On the Protocols page, click Next.
i. On the Access Rule Sources page, click Add.
j. In the Add Network Entities dialog box,
click Networks, click Internal, click Add,
and then click Close to close the Add Network Entities dialog box.
k. On the Access Rule Sources page, click Next.
l. On the Access Rule Destinations page, click Add.
152 Module A: Introduction to ISA Server
3. On the Denver computer, a. On the Denver computer, open Internet Explorer. In the Address box,
connect to type http://istanbul.fabrikam.com/web.asp, and then press Enter.
http:// The Web Server Info Demo Page on Istanbul appears. The Web
istanbul.fabrikam.com/ server reports that the Web request was sent through Florence (39.1.1.1).
web.asp
Note: Internet Explorer is currently configured to use proxy server
10.1.1.1:8080.
Use proxy server address:
10.1.1.1:8080 b. On the Tools menu, click Internet Options.
and c. In the Internet Options dialog box, on the Connections tab, click
10.1.1.2:8080 LAN Settings.
d. In the Local Area Network (LAN) Settings dialog box, complete the
following information:
Use a proxy server for your LAN: enable
Address: 10.1.1.2
Port: 8080
Bypass proxy server for local addresses: enable
and then click OK.
e. Click OK to close the Internet Options dialog box.
Internet Explorer now uses proxy server 10.1.1.2:8080.
f. On the toolbar, click the Refresh button.
The Web page reports that the Web request was sent through
Firenze (39.1.1.2).
Note: In the following tasks, you will enable CARP on the ISA Server array. This consists of four steps.
Step 1 - Enable caching and configure cache settings and rules.
Step 2 - Enable CARP on the Internal network.
Step 3 - Configure a CARP load factor for each array member.
Step 4 - Enable Web Proxy client requests on the intra-array communication network.
Perform the following steps on the Florence computer.
4. On the Florence computer, a. On the Florence computer, in the ISA Server console, in the left pane,
enable caching and configure select Cache.
cache settings and cache rules. In the right pane, on the Cache Drives tab, notice that the cache
size for both Florence and Firenze is 0 MB. This means that caching in
(Step 1) disabled. That is the default setting in ISA Server.
b. In the right pane, on the Cache Drives tab, select Florence.
c. In the task pane, on the Tasks tab, click
Define Cache Drives (Enable Caching).
In the Florence Properties dialog box, you can set the maximum
disk cache size, for each physical disk on the Florence computer.
Caching is enabled on Florence if the total cache size is not 0 MB.
d. Click Cancel to close the Florence Properties dialog box.
Note: To avoid possible conflicts with other lab exercises, caching
Module A: Introduction to ISA Server 153
is not enabled in this exercise. In a real environment, CARP only has any
function if caching is enabled.
e. Select the Cache Rules tab.
f. In the task pane, on the Tasks tab, click Configure Cache Settings.
g. In the Cache Settings dialog box, select the Advanced tab.
The Cache Settings dialog box allows you to specify general cache
settings (independent of the requested URL).
h. Click Cancel to close the Cache Settings dialog box.
i. In the right pane, right-click Default rule, and then click Properties.
Cache rules allow you to define cache settings that are specific to
requested URLs, or network destinations.
The Default rule applies to all network destinations, and is used
when possible custom cache rules do not apply to the requested URL.
j. Click Cancel to close the Default rule Properties dialog box.
5. Create a new domain name a. In the left pane, select Firewall Policy (ITALY).
set for CARP exceptions: b. In the task pane, on the Toolbox tab, in the Network Objects section,
right-click Domain Name Sets, and then click New Domain Name Set.
Name:
c. In the New Domain Name Set Policy Element dialog box, in the Name
CARP Exception Web Sites
text box, type CARP Exception Web Sites, and then click Add.
Computer: d. In the New Domain text box, replace the text by typing
download.contoso.com download.contoso.com, and then press Enter.
e. Click OK to close the New Domain Name Set Policy Element dialog
box.
A new domain name set named CARP Exception Web Sites is
created.
6. Enable CARP on the a. In the left pane, select Networks.
Internal network. b. In the right pane, on the Networks tab, right-click Internal, and then
click Properties.
Add the new domain name set as
c. In the Internal Properties dialog box, on the CARP tab, select
CARP exceptions.
Enable CARP on this network.
(Step 2) When CARP is enabled on the Internal network, Web requests
coming from client computers on the Internal network will be balanced across
the servers in the array.
Note: ISA Server 2006 (and ISA Server 2004 SP2) use a different
CARP distribution algorithm, than earlier ISA Server versions.
In ISA Server 2006, CARP distributes Web requests to URLs on
same host name (such as www.microsoft.com) to the same array member. This
means that the source IP address never changes during a session to that Web
site.
In ISA Server 2004 and earlier, CARP distributed Web requests from a client
computer to URLs on the same host name, equally across the array members.
d. In the CARP Exceptions box, click Add.
e. In the Add Domain Name Sets dialog box,
click CARP Exception Web Sites, and click Add,
and then click Close to close the Add Domain Name Sets dialog box.
In ISA Server 2006, for Web requests to URLs in the CARP
Exceptions Web Sites (such as download.microsoft.com), CARP selects the
array member based on the client computer IP address. This means that
requests from different client computers to the same URL are distributed across
the array members.
In ISA Server 2004 and earlier, CARP distributed Web requests on the CARP
Exceptions list from all client computers to URLs on the same host name to the
same array member.
f. Select the NLB tab.
154 Module A: Introduction to ISA Server
NLB is currently not enabled. However, you can enable both CARP
and NLB on the same network.
g. Click OK to close the Internal Properties dialog box.
Note: You cannot enable CARP for Web requests coming from
client computers on the External network. ISA Server does cache content from
published Web servers, but does not use CARP to distribute that cache content.
7. Configure a a. In the left pane, select Servers.
CARP load factor for each array b. In the right pane, right-click Florence, and then click Properties.
member.
c. In the Florence Properties tab, select the CARP tab.
(Step 3) The CARP load factor determines the relative number of Web
requests processed by this server compared to the other array servers. By
default all array servers use the same load factor of 100.
The load factors are relative numbers. This means that the sum of
the load factors always represents 100%. For example, if the load factors of
Florence and Firenze are changed to 80 and 240, then Florence processes 25%
(80 of 320) of the Web requests, and Firenze processes 75% (240 of 320) of the
Web requests.
Note: Do not change the load factors in this exercise. This ensures
that the behavior of CARP matches exactly the description and the steps in this
exercise.
8. Configure the network used a. In the Florence Properties dialog box, select the Communication tab.
for intra-array communication Florence (and Firenze) use the IP address on the Perimeter
(Perimeter) to listen for Web network (23.1.1.x) for communication between array members.
Proxy client requests.
b. Click Cancel to close the Florence Properties dialog box.
(Step 4) When using CARP, array members forward Web requests to each
other on the network that is configured for intra-array communication. This
requires that this network listens for Web Proxy client requests. Each ISA
Server computer is Web proxy client for the other ISA Server computer.
c. In the left pane, select Networks.
d. In the right pane, on the Networks tab, right-click Perimeter, and then
click Properties.
e. In the Perimeter Properties dialog box, on the Web Proxy tab, complete
the following information:
Enable Web Proxy clients: enable
Enable HTTP: enable (is default)
HTTP port: 8080 (is default)
Enable SSL: disable (is default)
and then click OK.
9. Apply the changes. a. Click Apply to apply the changes, and then click OK. Wait until the
CSS status is Synced.
Perform the following steps on the Denver computer.
10. On the Denver computer, a. On the Denver computer, in Internet Explorer, on the toolbar, click the
refresh the Web page Refresh button.
http:// The Web page reports that the Web request was sent through
istanbul.fabrikam.com/ Florence (39.1.1.1). However, Internet Explorer is currently configured to use
web.asp proxy server 10.1.1.2:8080, which is on Firenze.
The following steps happen:
Use proxy server address:
1) Denver sends the Web requests to Firenze (10.1.1.2).
10.1.1.2:8080
2) The CARP algorithm on Firenze determines that the URL
"http://istanbul.fabrikam.com/web.asp" must always be handled and cached by
Florence.
3) Firenze forwards the Web request to Florence (23.1.1.1).
4) Florence (39.1.1.1) sends the Web request to Istanbul (39.1.1.7).
Module A: Introduction to ISA Server 155
11. On the Florence computer, a. On the Florence computer, in the ISA Server console, in the left pane,
examine the URL of the CARP select Networks.
calculation script. b. In the right pane, on the Networks tab, right-click Internal, and then
click Properties.
c. In the Internal Properties dialog box, select the Firewall Client tab.
When you install the Firewall Client software on client computers,
the installation process can update the configuration of the Web browser as
well. This dialog box displays the URL of the CARP calculation script.
Note: In this lab environment, the name ITALY does not resolve to
an IP address, so to obtain the CARP calculation script you have to use the
ULR http://10.1.1.1:8080/array.dll?Get.Routing.Script
d. Select the Web Browser tab.
The Web Browser tab specifies additional settings in the
configuration script. Internet Explorer will not contact ISA Server for Web
servers on the Internal network, and if ISA Server is unavailable, Internet
Explorer will attempt to connect directly to the Internet.
e. Click Cancel to close the Internal Properties dialog box.
Perform the following steps on the Denver computer.
12. On the Denver computer, a. On the Denver computer, in Internet Explorer, on the Tools menu, click
configure Internet Explorer to use Internet Options.
an automatic configuration script. b. In the Internet Options dialog box, on the Connections tab, click
LAN Settings.
Address:
c. In the Local Area Network (LAN) Settings dialog box, in the
http://
Automatic configuration box, complete the following information:
10.1.1.1:8080/array.dll?
Get.Routing.Script Use automatic configuration script: enable
Address: http://10.1.1.1:8080/array.dll?Get.Routing.Script
and then click OK.
You do not need to disable the proxy server configuration
(10.1.1.2:8080) in this dialog box. Only if the configuration script is not found,
will Internet Explorer use the proxy server configuration.
Note: ISA Server generates the script on demand. The script and
array.dll do not exist as files on the ISA Server computer. This is just a URL
with a special meaning to ISA Server.
Also note that the configuration script URL is case-sensitive!
d. Click OK to close the Internet Options dialog box.
13. Refresh the Web page a. On the toolbar, click the Refresh button.
http:// Denver sends the Web request for URL
istanbul.fabrikam.com/ "http://istanbul.fabrikam.com/web.asp" to Florence. The CARP algorithm on
web.asp Florence concludes the same, and forwards the Web request to Istanbul.
b. In the Address box, type http://ankara.fabrikam.com/web.asp, and
and connect to
then press Enter.
http://
ankara.fabrikam.com/ Note: ankara.fabrikam.com is a different host name, but resolves to
156 Module A: Introduction to ISA Server
17. Configure Internet Explorer a. In Internet Explorer, on the Tools menu, click Internet Options.
to use a proxy server: b. In the Internet Options dialog box, on the Connections tab, click
LAN Settings.
Address: 10.1.1.1:8080
c. In the Local Area Network (LAN) Settings dialog box, complete the
following information:
Use automatic configuration script: disable
Use a proxy server for your LAN: enable
Address: 10.1.1.1
Port: 8080
Bypass proxy server for local addresses: enable
and then click OK.
d. Click OK to close the Internet Options dialog box.
Internet Explorer now uses proxy server 10.1.1.1:8080.
e. Close Internet Explorer.
Perform the following steps on the Florence computer.
18. On the Florence computer, a. On the Florence computer, in the ISA Server console, in the left pane,
disable CARP on the Internal select Networks.
network. b. In the right pane, on the Networks tab, right-click Internal, and then
click Properties.
c. In the Internal Properties dialog box, on the CARP tab, CLEAR the
Enable CARP on this network check box.
d. Click OK to close the Internal Properties dialog box.
CARP is disabled on the Internal network.
e. Click Apply to save the changes, and then click OK. Wait until the CSS
status is Synced.
158 Module A: Introduction to ISA Server
Exercise 4
Using CARP and Scheduled Content Download Jobs
In this exercise, you will configure ISA Server to use CARP and a content download job to
update cache content.
1. On the Florence computer, a. On the Florence computer, on the Start menu, click
examine the Microsoft ISA Administrative Tools, and then click Services.
Server Job Scheduler service. b. In the Services console, select the Microsoft ISA Server Job Scheduler
service (two services below Microsoft Firewall in the list)
Automatic cache content download jobs are run by the Microsoft
ISA Server Job Scheduler service on each array server.
To understand the configuration of content download jobs, it is
helpful to understand that conceptually there is no difference between the
following two methods to place objects in the ISA Server cache:
A Web Proxy client user on the Internal network, sending multiple requests
to Web sites on the Internet.
The ISA Server Job Scheduler service (running as Local System), on the
Local Host network, sending multiple requests to Web sites on the Internet,
based on URL information in a cache content download job.
For configuration on ISA Server, the main difference is that a user
connects from the Internal network, while the content download jobs are run
from the Local Host network.
c. Close the Services console.
2. Configure the Local Host a. In the ISA Server console, in the left pane, select Networks.
network to listen for b. In the right pane, on the Networks tab, right-click Local Host, and then
Web Proxy client requests. click Properties.
c. In the Local Host Properties dialog box, on the Web Proxy tab,
complete the following information:
Enable Web Proxy clients: enable
Enable HTTP: enable (is default)
HTTP port: 8080 (is default)
Enable SSL: disable (is default)
and then click OK.
The ISA Server Job Scheduler service connects as Web Proxy client
from the Local Host network.
Note: Do not enable CARP on the Local Host network yet.
3. Enable system policy a. In the left pane, select Firewall Policy (ITALY).
rule 29 to allow HTTP from the b. In the task pane, on the Tasks tab, click Show System Policy Rules.
Local Host network for content
c. In the right pane, right-click system policy rule 29, and then click
download jobs.
Properties.
System policy rule 29 is disabled by default. The rule allows HTTP
Module A: Introduction to ISA Server 159
from the Local Host network to All Networks for content download jobs.
d. Select the Users tab.
Note: The system policy rule applies to requests from the built-in
System account and the built-in Network Service account. It does not allow
unauthenticated access. This means that after this rule is enabled, ISA Server
blocks unauthenticated HTTP traffic from the Local Host network (ISA Server
computer).
If you do not want to block unauthenticated HTTP traffic from the
ISA Server computer, you must not enable system policy rule 29, but instead
create an access rule that allows HTTP access for the content download jobs,
and place this new access rule last in the Firewall Policy Rules list.
e. Click Cancel to close the system policy rule 29 dialog box.
f. Right-click system policy rule 29, and then click Edit System Policy.
g. In the System Policy Editor dialog box, in the Configuration Groups
list, ensure that Scheduled Download Jobs is selected, and then select the
Enable check box.
h. Click OK to close the System Policy Editor dialog box.
System policy rule 29 is now enabled.
i. In the task pane, on the Tasks tab, click Hide System Policy Rules.
4. Apply the changes. a. Click Apply to save the changes, and then click OK. Wait until the CSS
status is Synced.
5. Create a new content a. In the left pane, select Cache, and then in the right pane, select the
download job. Content Download Jobs tab.
b. In the task pane, on the Tasks tab, click Schedule a Content Download
Name: Job.
Fabrikam News Site
c. In the New Content Download Job Wizard dialog box, in the
Content Download Job name text box, type Fabrikam News Site, and then
Download frequency:
click Next.
Daily at 7:00 AM
d. On the Download Frequency page, select Daily, and then click Next.
URL: Note: The Download Frequency page mentions the use of CARP
http:// with content download jobs. You will enable CARP for this purpose, later in the
istanbul.fabrikam.com/ exercise.
news.htm e. On the Daily Frequency page, complete the following information:
Job start date: today's date (is default)
Job start time: 7:00 AM
Run the job one time every day: enable (is default)
and then click Next.
f. On the Content Download page, in the Download content from this
URL text box, type http://istanbul.fabrikam.com/news.htm and then click
Next.
The job scheduler will download news.htm, and recursively
download Web pages linked in news.htm.
g. On the Content Caching page, click Next.
Note: The content download job allows you to cache content, even
if the HTTP headers indicate that the content should not be cached. However,
the default is to cache content if the HTTP headers indicate to cache.
h. On the Completing the Scheduled Content Download Job Wizard page,
click Finish.
A new content download job named Fabrikam News Site is created.
6. Examine the configuration a. In the left pane, select Monitoring, and then in the right-pane, select the
status of the array servers. Configuration tab.
b. In the task pane, on the Tasks tab, click Refresh Now.
The configuration status of Florence and Firenze is Not synced.
When you create a content download job, the configuration is
160 Module A: Introduction to ISA Server
updated on the array servers immediately. You do not have to click Apply to
save the changes.
c. Wait until the configuration status is Synced.
7. Edit the log viewer filter: a. Select the Logging tab.
Note: You may (temporarily) need to close the task pane, to see the
Log Record Type: Logging tab.
Web Proxy Filter
b. In the task pane, on the Tasks tab, click Edit Filter.
Start the log viewer. c. In the Edit Filter dialog box, in the conditions list, select the existing
Log Record Type condition.
d. In the Value list box, select Web Proxy Filter, and then click Update.
e. Click Start Query to close the Edit Filter dialog box.
The log viewer will display current network activity based on the
Web Proxy log file.
8. Start the a. In the left pane, select Cache, and in the right-pane select the
Fabrikam News Site content Content Download Jobs tab.
download job now. b. In the right pane, select the Fabrikam News Site job.
c. Scroll the contents of the right pane to the right, so that you can see the
Status column.
The current job status is Idle.
d. In the task pane, on the Tasks tab, click Start Selected Jobs Now.
The job scheduler will run the Fabrikam News Site content
download job on both array servers now, instead of waiting until the scheduled
time (7:00 AM).
e. After a few seconds, on the Tasks tab, click Refresh Now.
The Fabrikam News Site is a very short job. After the refresh, the
job status in the Status column changes back from Running to Idle, and the
Stop Running Jobs task link changes back to Start Selected Jobs Now.
9. Stop the log viewer, and a. In the left pane, select Monitoring, and in the right pane select the
examine the Web Proxy log Logging tab.
entries. b. After a few seconds, in the task pane, on the Tasks tab, click
Stop Query.
The log viewer displays log entries from the Web Proxy log file.
You may need to scroll to the right to see the URL and Server Name columns.
Both Florence and Firenze first attempt an anonymous Web Proxy
connection (port 8080) to the Local Host network (127.0.0.1). System policy
rule 29 requires authentication. After that both array servers download
news.htm and economy.htm from 39.1.1.7.
The istanbul.fabrikam.com/news.htm Web page links to the
ankara.fabrikam.com/economy.htm Web page. Both host names resolve to
39.1.1.7.
Note: All files in the content download job (news.htm and
economy.htm) are downloaded and cached by both array servers. This is
because CARP is not enabled for content download jobs yet.
10. Enable CARP on the a. In the left pane, select Networks.
Local Host network. b. In the right pane, on the Networks tab, right-click Local Host, and then
click Properties.
c. In the Local Host Properties dialog box, on the CARP tab, select
Enable CARP on this network.
When CARP is enabled on the Local Host network, content
download jobs run only on a single array server. The downloaded Web pages
are distributed over the array servers, according to the CARP algorithm.
Note: Currently CARP is disabled on the Internal network. When
you use a content download job to distribute cache content according to the
CARP algorithm, you have to ensure that Web Proxy clients on the Internal
Module A: Introduction to ISA Server 161
11. On the Denver computer, a. On the Denver computer, in a Command Prompt window, in the
use C:\Tools\carpdemo.js to C:\Tools folder, type carpdemo istanbul.fabrikam.com/news.htm, and then
calculate the selected proxy server press Enter.
for: The content download job URL is handled on array server 10.1.1.1
(Florence). This means that the job scheduler on Florence will run the
istanbul.fabrikam.com/ Fabrikam News Site job.
news.htm
b. Click OK. Type carpdemo ankara.fabrikam.com/economy.htm, and
then press Enter.
and
The economy.htm Web page is downloaded and cached on array
ankara.fabrikam.com server 10.1.1.2 (Firenze).
economy.htm c. Close the Command Prompt window.
Perform the following steps on the Florence computer.
12. On the Florence computer, a. On the Florence computer, in the ISA Server console, in the left pane,
start the log viewer. select Monitoring, and in the right pane select the Logging tab.
b. In the task pane, on the Tasks tab, click Start Query.
The log viewer will display current network activity based on the
Web Proxy log file.
13. Start the a. In the left pane, select Cache, and in the right-pane select the
Fabrikam News Site content Content Download Jobs tab.
download job now. b. In the right pane, select the Fabrikam News Site job.
c. In the task pane, on the Tasks tab, click Start Selected Jobs Now.
The job scheduler will run the Fabrikam News Site content
download job now. Because CARP is enabled on the Local Host network,
CARP calculates that only the job scheduler on Florence runs the job.
d. After a few seconds, on the Tasks tab, click Refresh Now.
The Stop Running Jobs task link changes back to Start Selected
Jobs Now.
14. Stop the log viewer, and a. In the left pane, select Monitoring, and in the right pane select the
examine the Web Proxy log Logging tab.
entries. b. After a few seconds, in the task pane, on the Tasks tab, click
Stop Query.
Note: Because the log entries are collected from two array
members, and happen within the same second, they may not be in the correct
order.
The log entries show that Florence downloads and caches news.htm
from Istanbul (39.1.1.7). After that Florence forwards the request for
economy.htm to Firenze (23.1.1.2). Firenze downloads and caches
economy.htm from ankara.fabrikam.com (39.1.1.7).
Notice that all files in the content download job (news.htm and
economy.htm) are downloaded and cached only once, according to the CARP
distribution.
Note: The following tasks are needed to avoid conflicts with other lab exercises.
15. Edit the log viewer filter: a. In the left pane, select Monitoring, and then in the right-pane, select the
Logging tab.
Log Record Type: b. In the task pane, on the Tasks tab, click Edit Filter.
Firewall or Web Proxy Filter
162 Module A: Introduction to ISA Server
c. In the Edit Filter dialog box, in the conditions list, select the existing
Log Record Type condition.
d. In the Value list box, select Firewall or Web Proxy Filter, and then
click Update.
e. Click Start Query to close the Edit Filter dialog box.
The log viewer will display current network activity based on the
Firewall log file and the Web Proxy log file.
f. On the Tasks tab, click Stop Query.
16. Delete the a. In the left pane, select Cache.
Fabrikam News Site content b. In the right pane, on the Content Download Jobs tab, right-click the
download job. Fabrikam News Site job, and then click Delete.
c. Click Yes to confirm that you want to delete the Fabrikam News Site
job.
The change is updated on the array servers immediately. You do
not have to click Apply to save the changes.
d. Wait until the CSS status is Synced.
Note: You cannot disable Web Proxy clients on the Local Host
network, when a content download job exists.
17. Disable Web Proxy clients a. In the left pane, select Networks.
and CARP on the Local Host b. In the right pane, on the Networks tab, right-click Local Host, and then
network. click Properties.
c. In the Local Host Properties dialog box, on the Web Proxy tab, CLEAR
the Enable Web Proxy clients check box.
d. On the CARP tab, CLEAR the Enable CARP on this network check
box.
e. Click OK to close the Local Host Properties dialog box.
Web Proxy clients and CARP are disabled on the Local Host
network.
18. Disable Web Proxy clients a. On the Networks tab, right-click Perimeter, and then click Properties.
on the network used for intra-array b. In the Perimeter Properties dialog box, on the Web Proxy tab, CLEAR
communication (Perimeter). the Enable Web Proxy clients check box.
c. Click OK to close the Perimeter Properties dialog box.
Web Proxy clients is disabled on the Perimeter network.
19. Disable system policy a. In the left pane, select Firewall Policy (ITALY).
rule 29. b. In the task pane, on the Tasks tab, click Show System Policy Rules.
c. In the right pane, right-click system policy rule 29, and then click
Edit System Policy.
d. In the System Policy Editor dialog box, in the Configuration Groups
list, ensure that Scheduled Download Jobs is selected, and then CLEAR the
Enable check box.
e. Click OK to close the System Policy Editor dialog box.
System policy rule 29 is now disabled.
f. In the task pane, on the Tasks tab, click Hide System Policy Rules.
20. Apply the changes. a. Click Apply to save the changes, and then click OK. Wait until the CSS
status is Synced.
Module A: Introduction to ISA Server 163
1. On the Paris computer, a. On the Paris computer, on the Start menu, click All Programs, click
examine the alert definition for the Microsoft ISA Server, and then click, ISA Server Management.
Service Shutdown event. b. In the ISA Server console, in the left pane, expand Paris, and then select
Monitoring.
c. In the right pane, select the Dashboard tab.
The Monitoring node has multiple tabs that allow you to monitor,
control, investigate, troubleshoot and plan firewall operations.
On the first tab (Dashboard), five of the other tabs are represented
by a summary box providing a quick summary of the detailed information on
those other tabs. Whenever you need to investigate a particular event or
reported issue in more detail, you switch from the Dashboard to the other tabs.
d. Select the Alerts tab.
The Alerts tab lists events at the ISA Server that are significant
enough to alert you.
e. In the task pane, on the Tasks tab, click Configure Alert Definitions.
f. In the Alert Properties dialog box, select the Service Shutdown line (do
not clear the check box for Service Shutdown), and then click Edit.
On the General tab, in the Severity drop-down list box, notice that
ISA Server considers a Service Shutdown an Information alert.
g. In the Service Shutdown Properties dialog box, select the Events tab.
On the Events tab you specify the threshold to trigger an alert when
the event occurs. In this example, the event is a shutdown of any ISA Server
service
h. Select the Actions tab.
On the Actions tab you specify the action, besides listing it on the
Alerts tab, that should happen when an alert for this event is triggered. In this
example, the only action is to report the alert in the Windows event log
(Application log).
i. Click Cancel to close the Service Shutdown Properties dialog box.
j. Click Cancel to close the Alerts Properties dialog box.
Notice that the current status of the ISA Server services is
164 Module A: Introduction to ISA Server
considered so significant that there is also a special tab (Services) that will
specifically display the status of the services.
2. Use the Services console to a. On the Start menu, click Administrative Tools, and then click
stop the Microsoft ISA Server Services.
Job Scheduler service to simulate b. In the Services console, in the right pane, right-click
an unexpected shutdown of the Microsoft ISA Server Job Scheduler service, and then click Stop.
service.
The ISA Server Job Scheduler service is stopped. This simulates an
unexpected shutdown of one of the ISA Server services.
c. Close the Services console.
3. Examine how an alert a. In the ISA Server console, on the Alerts tab, wait for 30 seconds for the
shows up on the Alerts tab, and new alert (Service Shutdown) to show up, or in the task pane, on the Tasks
the Dashboard tab. tab, click Refresh Now.
A new Information alert (Service Shutdown) appears.
b. Select the Dashboard tab. Wait for 30 seconds, or in the task pane, on
the Tasks tab, click Refresh Now.
In the Alerts summary box, the Service Shutdown Information alert
is displayed as well. Notice the column that lists the number of New (not
acknowledged yet) alerts.
The icon in the top left corner of each summary box, indicates the
highest severity or status of the information in that summary box. You may click
the circle with the two up-arrows to roll-up the summary box.
4. Investigate the a. On the Dashboard tab, click the heading of the Alerts summary box to
Service Shutdown alert and return to the Alerts tab.
resolve the issue by starting the b. On the Alerts tab, select the Service Shutdown alert, and then expand
ISA Server Job Scheduler service the Service Shutdown alert.
on the Services tab.
The Messages area shows a general description of the event. (The
service was stopped gracefully.)
c. Select the second Service Shutdown alert line.
The Messages area shows a more specific description of the event.
(The ISA Server Job Scheduled service was stopped gracefully.)
When multiple similar alerts occur, they are grouped with a
common general description.
d. In the task pane, on the Tasks tab, click Acknowledge Selected Alerts.
The Status of the Service Shutdown alert changes from New to
Acknowledged to indicate that you have seen this alert.
Acknowledged alerts are removed from the Alerts summary box on
the Dashboard tab as well.
e. Select the Services tab, and then in the task pane, on the Tasks tab, click
Refresh Now.
f. In the right pane, select Microsoft ISA Server Job Schedule, and then
in the task pane, on the Tasks tab, click Start Selected Service.
The ISA Server Job Scheduler service is started again.
g. On the Alerts tab, select the second acknowledged Service Shutdown
alert line.
h. In the task pane, on the Tasks tab, click Reset Selected Alerts.
i. Click Yes to confirm that you want to reset Service Shutdown.
The Service Shutdown alert is removed from the Alerts tab to
indicate that you have resolved this alert. The alert will still be in the Windows
Event Application log.
Note: The particular event (Service Shutdown) is used as an
example in this exercise. You would normally investigate a Service Shutdown
alert on the ISA Server computer more extensively, than just start up the service
again.
Module A: Introduction to ISA Server 165
5. Examine the intrusion a. In the ISA Server console, in the left pane, expand Configuration, and
detection options. then select General.
b. In the right pane, click Enable Intrusion Detection and DNS Attack
Detection.
In the dialog box, you can enable detection of well-known intrusion
attempts. Detected attempts trigger an intrusion detection alert.
Notice that intrusion detection is enabled by default.
c. Click Cancel to close the dialog box.
6. Examine the performance a. On the Start menu, click All Programs, click Microsoft ISA Server,
monitoring options. and then click ISA Server Performance Monitor.
A pre-configured System Monitor console for ISA Server appears.
ISA Server 260 defines five System Monitor objects and
approximately 170 performance counters to monitor the performance of the
ISA Server.
b. Close the ISA Server Performance Monitor console.
c. If a message box appears, click No to confirm that you do not want to
save console settings to msisaprf.msc.
166 Module A: Introduction to ISA Server
Exercise 2
Checking Connectivity from the ISA Server
In this exercise, you will explore the connectivity checking functions of ISA Server.
1. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
create two new connectivity Monitoring.
verifiers: b. In the right pane, select the Connectivity Verifiers tab.
The Connectivity Verifiers tab allows you to define
Name: Istanbul (ping)
Connectivity Verifiers. A connectivity verifier periodically connects from the
Server: 39.1.1.7
ISA Server to other computers that you specify, to test current connectivity.
Method: Ping
This helps with troubleshooting server connectivity problems.
Name: Istanbul (http) ISA Server automatically defines the required System policy rules
Server: 39.1.1.7 to allow the network traffic to check the connectivity to the other computers.
Method: HTTP "GET" The connectivity verifiers are not intended to check the ISA Server
configuration, or the Firewall policy rules, but instead are intended to check
the network connectivity from the ISA Server computer to the specified
computers.
c. In the task pane, on the Tasks tab, click
Create New Connectivity Verifier.
d. In the New Connectivity Verifier Wizard dialog box, in the
Connectivity Verifier name text box, type Istanbul (ping), and then click
Next.
e. On the Connectivity Verification Details, complete the following
information:
Monitor connectivity to this server or URL: 39.1.1.7
Group type used to categorize: Web (Internet)
Verification method: Send a Ping request
and then click Next.
f. On the Completing the Connectivity Verifier Wizard page, click Finish.
A new connectivity verifier is added. ISA Server will ping 39.1.1.7
(Istanbul) every 30 seconds and compare the response time with the timeout
response threshold of 5000 msec.
g. In the task pane, on the Tasks tab, click
Create New Connectivity Verifier.
h. In the New Connectivity Verifier Wizard dialog box, in the
Connectivity Verifier name text box, type Istanbul (http), and then click
Next.
i. On the Connectivity Verification Details, complete the following
information:
Monitor connectivity to this server or URL: 39.1.1.7
Group type used to categorize: Web (Internet)
Verification method: Send an HTTP "GET" request
and then click Next.
j. On the Completing the Connectivity Verifier Wizard page, click Finish.
k. If the Enable HTTP Connectivity Verification message box appears,
Module A: Introduction to ISA Server 167
5. On the Istanbul computer, a. On the Istanbul computer, on the Start menu, click
stop the Default Web Site to Administrative Tools, and then click
simulate a failure of the Web Internet Information Services (IIS) Manager.
server. b. In the IIS Manager console, expand ISTANBUL (local computer),
expand Web Sites, right-click Default Web Site, and then click Stop.
The Web site is stopped. Istanbul will no longer respond to HTTP
requests. This simulates a failure of the Web server.
Perform the following steps on the Paris computer.
6. On the Paris computer, wait a. On the Paris computer, on the Connectivity Verifiers tab, wait one
for the failure state of the minute, and then in the task pane, on the Tasks tab, click Refresh Now.
Istanbul (http) connectivity In the Verifier Name column, a red error icon appears for the
verifier. Istanbul (http) connectivity verifier. The red error icon indicates that the
connectivity verifier did not receive a response from Istanbul to its HTTP
request.
Notice that the Istanbul (ping) connectivity verifier does not report
an error.
Perform the following steps on the Istanbul computer.
7. On the Istanbul computer, a. On the Istanbul computer, in the IIS Manager console, right-click
start the Default Web Site again. Default Web Site (Stopped), and then click Start.
The Web server is started again.
b. Close the IIS Manager console.
Perform the following steps on the Paris computer.
8. On the Paris computer, wait a. On the Paris computer, on the Connectivity Verifiers tab, wait one
for the success state of the minute, and then in the task pane, on the Tasks tab, click Refresh Now.
168 Module A: Introduction to ISA Server
Istanbul (http) connectivity A green checkmark icon appears again for the Istanbul (http)
verifier. connectivity verifier. ISA Server has successfully received a response to its
HTTP request to Istanbul.
9. Delete the two connectivity a. Right-click the Istanbul (http) connectivity verifier, and then click
verifiers for Istanbul. Delete.
b. Click Yes to confirm that you want to delete the connectivity verifier.
c. Right-click the Istanbul (ping) connectivity verifier, and then click
Delete.
d. Click Yes to confirm that you want to delete the connectivity verifier.
Both connectivity verifiers are removed.
e. Click Apply to save the changes, and then click OK.
Note: The connectivity verifiers in this exercise check connectivity to the Istanbul computer on the Internet.
Other examples for using connectivity verifiers are checking DNS connectivity (TCP port 53) to DNS servers
on the Internet, and checking service connectivity to published servers in the perimeter network.
Module A: Introduction to ISA Server 169
Exercise 3
Logging Client Computer Access
In this exercise, you will explore the logging functions of ISA Server.
1. On the Paris computer, find a. On the Paris computer, in the ISA Server console, in the left pane, select
the location of the ISA Server log Monitoring, and then select the Logging tab.
files. Note: You may (temporarily) need to close the task pane in order to
see the Logging tab.
b. In the task pane, on the Tasks tab, click Configure Firewall Logging.
c. In the Firewall Logging Properties dialog box, on the Log tab, click
Options.
The Options dialog box shows that ISA Server saves the Firewall
service log files in the ISALogs folder in the ISA Server installation folder
(C:\Program Files\Microsoft ISA Server).
d. Click Cancel to close the Options dialog box.
The Firewall Logging Properties dialog box shows that the log file
names are in the form ISALOG_yyyymmdd_FWS_nnn.mdf.
e. Click Cancel to close the Firewall Logging Properties dialog box.
The Web Proxy log files (ISALOG_yyyymmdd_WEB_nnn.mdf) are
also saved in the ISALogs folder.
2. Start a new online log a. On the Logging tab, click Start Query.
query. Start Query starts a new online log query of the ISA Server log
files. When a successful of failed connection is made through ISA Server, the
records of log file are displayed on the screen.
3. Create a new access rule. a. In the ISA Server console, in the left pane, select Firewall Policy.
b. In the right pane, select the first rule, or select Default rule if no other
Name: Allow Web access rule exists, to indicate where the new rule is added to the rule list.
(logging test)
c. In the task pane, on the Tasks tab, click Create Access Rule.
Applies to: HTTP d. In the New Access Rule Wizard dialog box, in the Access rule name
text box, type Allow Web access (logging test), and then click Next.
From network: Internal e. On the Rule Action page, select Allow, and then click Next.
To network: External f. On the Protocols page, in the This rule applies to list box, select
Selected protocols, and then click Add.
g. In the Add Protocols dialog box,
click Common Protocols, click HTTP, and click Add,
and then click Close to close the Add Protocols dialog box.
h. On the Protocols page, click Next.
i. On the Access Rule Sources page, click Add.
j. In the Add Network Entities dialog box,
click Networks, click Internal, and click Add,
and then click Close to close the Add Network Entities dialog box.
k. On the Access Rule Sources page, click Next.
l. On the Access Rule Destinations page, click Add.
170 Module A: Introduction to ISA Server
4. On the Denver computer, a. On the Denver computer, open Internet Explorer. In the Address box,
use Internet Explorer to connect to type http://istanbul.fabrikam.com, and then press Enter.
http:// Internet Explorer displays the Istanbul Web site.
istanbul.fabrikam.com.
Perform the following steps on the Paris computer.
5. On the Paris computer, a. On the Paris computer, in the ISA Server console, in the left pane, select
create a filter definition for online Monitoring, and then select the Logging tab.
mode logging. ISA Server lists all Firewall service log file and Web Proxy log file
records on the screen, since the Start Query command. This may include
Filter by: several of the same denied NetBIOS Name Service and NetBIOS Datagram
Destination IP requests. The HTTP request to Istanbul (39.1.1.7) is also in this list. You can
Condition: Equals filter the on-screen display, by creating a filter definition.
Value: 39.1.1.7
b. In the task pane, on the Tasks tab, click Edit Filter.
c. In the Edit Filter dialog box, complete the following information:
Filter by: Destination IP
Condition: Equals
Value: 39.1.1.7
and then click Add To List to add the filter definition.
d. Click Start Query to close the Edit Filter dialog box.
The on-screen display is cleared, and the new filter definition
(Destination IP equals 39.1.1.7) is in effect.
Perform the following steps on the Denver computer.
6. On the Denver computer, a. On the Denver computer, in Internet Explorer, ensure that the
refresh the content of the Web http://istanbul.fabrikam.com Web page is opened.
page at http:// b. Hold the Ctrl-key, and click the Refresh button on the toolbar, to
istanbul.fabrikam.com twice. refresh the content of the Web page, regardless of any changes.
c. Wait a few seconds, and then click the Refresh button on the toolbar
- First press Ctrl-F5
(without the Ctrl-key) to refresh the content of the Web page when it has
(Ctrl-Refresh).
changed.
- then press F5 (Refresh)
Internet Explorer displays the same Istanbul Web page after each
refresh.
7. Attempt to open the a. In Internet Explorer, in the Address box, type
non-existing Web page at http:// http://istanbul.fabrikam.com/test.htm, and then press Enter.
istanbul.fabrikam.com/ Internet Explorer cannot find the test.htm page (HTTP Error 404).
test.htm
b. Close Internet Explorer.
Perform the following steps on the Paris computer.
8. On the Paris computer, a. On the Paris computer, on the Logging tab, wait a few moments for the
view the online mode logging log file entries for destination IP 39.1.1.7 to appear on the screen.
records for destination IP 39.1.1.7. A total of three or more log file records will appear for
Module A: Introduction to ISA Server 171
9. Remove the online filter a. In the task pane, on the Tasks tab, click Edit Filter.
definition, and stop the query. b. In the Edit Filter dialog box, select the Destination IP - Equals -
39.1.1.7 expression, and then click Remove.
c. Click Start Query to close the Edit Filter dialog box.
d. In the task pane, on the Tasks tab, click Stop Query.
The online log query of the Firewall Server log files is stopped.
e. Click Apply to save the changes, and then click OK.