Module 2 Installing and Maintaining ISA Server Overview

Module 2: Installing and Maintaining ISA Server

Overview n Installing ISA Server n Installing and Configuring ISA Server Clients n Maintaining ISA Server

n Whether you deploy Microsoft® Internet Security and Acceleration (ISA) Server 2000 as a dedicated firewall, a Web cache server, or an integrated solution, you must plan carefully to ensure that you have the required hardware and software. After you perform an ISA Server installation, you must configure client computers. Depending on the client operating systems and your specific requirements to control Internet access, you can choose to use the transparent Secure. NAT technology or deploy the ISA Firewall Client software. You can also configure computers as Web proxy clients to improve browser performance. n In addition, it is important to properly maintain ISA Server to ensure that all client computers have fast and secure access to the Internet.

After completing this module, you will be able to: n Install ISA Server on a computer running Microsoft Windows® 2000 Server. n Configure computers as Web proxy, Firewall, or Secure. NAT clients for ISA Server. n Perform administrative tasks for maintaining ISA Server.

u. Installing ISA Server n Identifying Hardware and Software Requirements n Identifying Pre-Installation Tasks n Selecting an Installation Mode n Specifying the Initial Cache Size n Configuring the LAT n Upgrading from Microsoft Proxy Server 2. 0 n Troubleshooting ISA Server Installation

n Before you install ISA Server, you must set up the hardware and configure the software for the ISA Server computer. To help identify the choices that you will make during installation, review the pre-installation checklist before performing the installation. If you encounter problems during a new installation or an upgrade from Microsoft Proxy Server 2. 0, see the Troubleshooting ISA Server Installation section. n Note: You also can automate the installation of ISA Server. For more information about performing an unattended setup, see "Unattended setup" in ISA Server Help.

In this lesson you will learn about the following topics: n Identifying hardware and software requirements n Identifying pre-installation tasks n Selecting an installation mode n Specifying the initial cache size n Configuring the LAT n Upgrading from Microsoft Proxy Server 2. 0 n Troubleshooting ISA Server installation

Identifying Hardware and Software Requirements RAM Windows 2000 Server, Windows 2000 Advanced Server, or Windows Datacenter CPU 256 MB 300 MHz or higher Internal Adapter Hard Disk Space 20 MB External Adapter Active Directory Hard Disk Format NTFS Arrays

Identifying hardware and software requirements n ISA Server requirements n Note: The Active Directory™ directory service for Windows 2000 must be installed on your network to implement the array feature.

Forward Caching Requirements n The following table lists the hardware configurations of a single ISA Server computer for the expected number of users who gain access to objects on the Internet. n If the number of users exceeds 1, 000 users, consider better-performing hardware for the ISA Server computer or add more ISA Server computers.

Reverse Caching Requirements n The following table lists the hardware configurations of a single ISA Server computer for the expected number of requests from Internet, or external, users. The exact RAM requirements depend on the content that you are publishing. Ideally, all cacheable content should fit into memory.

Firewall Requirements n The following table lists the hardware configurations for the expected rate of data transfer for Firewall and Secure. NAT clients that gain access to objects on the Internet. n Note: Although it is important to have the required hardware configuration, the rate of data transfer is highly dependent on the speed of your connection to the Internet.

Identifying Pre-Installation Tasks Locate CD Key Select an Installation Option Select an Array to Join, If Applicable Select an Installation Mode Configure a Drive to Use for the Cache Configure Address Ranges for the LAT

n Before installing ISA Server, test your network connectivity to minimize the need for troubleshooting connection problems after installation is complete. n Important: Before installing ISA Server, ensure that the Windows 2000 routing table on the ISA Server computer is configured correctly. The internal adapter of the ISA Server computer must be able to route packets to all internal network destinations, and the external network adapter must be able to route packets to the Internet. To ensure proper routing, add explicit routes for all internal network destinations, and configure a default gateway on only the external network adapter.

When you install ISA Server, you must provide the following information: n CD Key. This is the 10 -digit number located on back of the CD-ROM case. n Installation options. As part of the installation process, you can install options from the following ISA Server components: l ISA Services. Controls access of network services for the traffic between networks. This component is required for the installation. l Add-In Services. Includes the Microsoft H. 323 Gatekeeper service, which allows Microsoft Net. Meeting® or other H. 323 -compliant applications to reach users inside your network. The H. 323 protocol is a set of standards that enable real-time multimedia conferencing and communications over packet-based networks. Also includes the Message Screener, which performs content filtering on incoming Simple Mail Transfer Protocol (SMTP) traffic. Both of these add-in services are optional. l Administration Tools. Includes the ISA Server administration tools, which are required for the installation, and the H. 323 Gatekeeper administration tools, which are optional.

n Note: You can also install the administration tools separately on a computer running Windows 2000 Server or Microsoft Windows 2000 Professional to remotely administer a stand-alone ISA Server computer or one or more arrays of ISA Server computers.

n When you install ISA Server, you must provide the following information:

n Array selection. If you previously modified the Active Directory schema to initialize the enterprise, you can either select to create an enterprise array or can select an array to join. If you did not initialize the enterprise, ISA Server is installed in a stand-alone array, which contains only a single ISA Server computer.

n Installation Mode. You can select to install ISA Server in Firewall mode, Cache mode, or Integrated mode.

n Cache configuration. If you install ISA Server in Integrated or Cache mode, you must configure the drives to use for the cache.

n Local Address Table (LAT) configuration. If you install ISA Server in Integrated or Firewall mode, you must configure the address ranges to include in the LAT. The LAT is a table containing all of the internal Internet Protocol (IP) address ranges that the network behind the ISA Server computer uses. n Important: You must install Windows 2000 Service Pack 1 or later before you install ISA Server.

Selecting an Installation Mode Microsoft ISA Server Status Select the mode for this server: Firewall mode Select this option to install enterprise firewall functionality. Cache mode Select this option to install cache and Web hosting functionality. Cache mode installation is recommended only for computers that are not directly connected to the Internet. If this computer is directly connected to the Internet, install ISA Server in integrated mode. Integrated mode Select this option to install integrated enterprise firewall, cache, and Web hosting functionality. Continue Exit Setup Help Microsoft Internet Security and Acceleration Server Setup has stopped your IIS publishing service (W 3 SVC). After Setup is complete, uninstall IIS or reconfigure all IIS sites not to use ports 80 and 8080. OK Help

n Before you can select an installation mode, you must launch the ISA Server installation program and enter the information described in the pre-installation checklist. As part of the setup process, you select the mode for ISA Server: Firewall, Cache, or Integrated. After you select the server mode, if you have Internet Information Services (IIS) installed and configured to use port 80 or port 8080, ISA Server Setup informs you that it will stop the IIS Web service.

To start the ISA Server installation: 1. Insert the compact disc into the CD-ROM drive, or if you copied the contents of the ISA Server compact disc to a network location, open a command prompt window, and then run the ISAautorun. exe file. 2. In the Microsoft ISA Server Setup window, select Install ISA Server, and then click Continue. 3. Type the CD Key, and then click OK twice. 4. Read the licensing agreement, and then if you agree, click I Agree.

5. Click one of the following installations, and then click OK: l Typical Installation. Includes the most commonly used components. l Full Installation. Includes all ISA Server components and extensions. l Custom Installation. Includes the ISA Server components and extensions that you specify. 6. If you are installing ISA Server Enterprise Edition and the computer is not part of a Windows 2000 domain, click Yes to install ISA Server as a stand-alone server. 7. Click Firewall mode, Cache mode, or Integrated mode, and then click Continue.

8. When the Setup Information message prompts you to stop the IIS service, click OK. After the ISA Server installation is complete, uninstall IIS or configure all Web sites on the server to use a port other than port 80 or port 8080. n Important: Setup stops the IIS Web service because its default listening port is 80, which ISA Server also uses. Because ISA Server listens on port 8080 and may listen on port 80, you must modify the listening port settings for IIS because two different services cannot bind to the same port.

Specifying the Initial Cache Size Microsoft Internet Security and Acceleration Server Setup Specify the NTFS drives on which caches should be located and the maximum size of each cache. OK Cancel Initial cache size is 100 MB. Add 0. 5 MB for each Web Proxy client. Drive [File System] C: [NTFS] Maximum Size (MB) 100 Drive: C: [NTFS] Available space (MB) 28722 Cache size (MB): 100 Total cache size (MB): 100 MB Set Help

n If you install ISA Server in Cache mode or in Integrated mode, the Setup program prompts you to select the drive for the cache location and the initial cache size. Select an NTFS-formatted hard disk of sufficient size to make the cache as large as possible. For optimal performance, select a hard disk that you use exclusively for caching. You can increase cache size later by allocating more empty disk space or by adding more disk volumes.

n n Consider the following settings when specifying the size of the cache: l Default cache size. 100 MB if at least 150 MB of free disk space is available. l Minimum cache size. Allocate at least one drive and 5 MB on that drive. l Recommended cache size. Allocate at least 100 MB and add 0. 5 MB for each Web Proxy client, rounded up to the nearest full megabyte. Note: Although Windows 2000 allows you to format a drive without assigning a drive letter, you cannot use a drive without a drive letter for ISA Server caching.

Configuring the LAT 1 Click Construct Table to Microsoft Internet Security and Acceleration Server Setup Enter the IP address ranges that span the internal network address space. Internal IP ranges: Edit From To Add-> To OK private IP address ranges or routing table entries. Cancel Construct Table… Enter the IP address ranges that span the internal network address space. Internal IP ranges: Edit From To 192. 168. 1. 200 168 1 200 168 255 To Local Address Table Select the address ranges (based on the Windows 2000 routing table) for inclusion in the local address table (LAT). The LAT should include all the addresses in you internal network. Help Microsoft Internet Security and Acceleration Server Setup 192 2 Select options to add Remove-> To construct a local address table, click Construct Table. 192 construct a local address table. 192. 168. 255 Add the following private ranges: 10. xxx, 192. 168. xx and 172. 16. xx 173. 31. xx and 169. 254. xx. . Add address ranges based on the Windows 2000 Routing Table Select the address ranges that are associated with the following internal network adapters: Card MS Loop. Back Driver 3 Com Ether. Link PCI (Micros… IP Addresses 169. 254. 25. 129 192. 168. 1. 200 Add-> Remove-> To construct a local address table, click Construct Table. OK Cancel Help OK Cancel 3 Verify the IP addresses Construct Table… that display in the local address table. Help

n The LAT is a table of all internal IP addresses. If you install ISA Server in Firewall mode or Integrated mode, you can configure the LAT during Setup. ISA Server uses the LAT to determine which IP addresses are inside an organization's network and assumes that all other IP addresses are external. ISA Server uses the LAT to control how computers on the internal network communicate with external networks. In addition, Firewall clients automatically download LAT updates from the ISA Server computer. Firewall clients use the LAT updates to determine which IP addresses they can directly connect to and which requests they need to forward to the ISA Server computer.

Overview of the LAT n ISA Server can construct the LAT and add the following IP address ranges: l Private IP addresses. ISA Server can add IP addresses that are reserved by the Internet Assigned Numbers Authority (IANA) for internal use. Many organizations use these addresses for internal addresses. These addresses include 10. 0 to 10. 255, 192. 168. 0. 0 to 192. 168. 255, and 172. 16. 0. 0 to 172. 31. 255. Add private IP addresses to the LAT only if you use private IP addressing on your network. l Networks from the routing table. ISA Server adds all of the networks that your computer connects to by using one or more network adapters that you select. When adding entries from the routing table, ensure that the network adapter that is configured to connect to your internal network has the correct routing information for all network segments on your internal network.

n To configure the LAT during Setup: n Important: When configuring the LAT, addresses on the private network only. Do not add the external interface of the ISA Server computer or any external addresses. In addition, never configure a network adapter with both an external IP address and an IP address that is in the LATdoing so can cause ISA Server to incorrectly enforce security rules and can present a serious security risk.

1. In the Microsoft Internet Security and Acceleration Server 2000 Setup dialog box, click Table. 2. Choose from the following options, and then click OK twice: 3. l To add private IP address ranges, select the Add the following private ranges check box. l To add routing table entries, select the Add address ranges based on the Windows 2000 Routing Table check box, and then select the check box for the network adapter that is connected to your internal network. In the Internal IP ranges box, review the list of IP address ranges, make the following corrections if necessary, and then click OK: l To remove an address range, in the Internal IP Ranges box, click the range, and then click Remove. l To add an address range, in the Edit box, type the beginning and end addresses of the range, and then click Add.

n After configuring the LAT, Setup copies all of the required files and completes all configuration steps. Unless you specify a different location during an unattended setup, Setup installs ISA Server in the. C: Program FilesMicrosoft ISA Server folder.

Upgrading from Microsoft Proxy Server 2. 0 Upgrading from Microsoft Windows NT Publishing Comparing Proxy 2. 0 and Server. SOCKS Rules ISA Server Configurations Cache Content 2. 0 Winsock Proxy Client ISA Server 2000 Upgrade to Windows 2000 Proxy Server 2. 0 Secure. NAT Client 200 0 SOCKS Rules Proxy Server 2. 0 IPX Protocol Proxy Server 2. 0 ISA Server Client Requests Port 80 Upgrading Client Computers Proxy Server 2. 0 Winsock Proxy Clients and Firewall Clients ISA Server Port 8080

n ISA Server supports a full migration path for Microsoft Proxy Server 2. 0 users. Setup migrates most Proxy Server 2. 0 rules, network settings, monitoring configurations, and cache configurations to ISA Server when you perform an upgrade. n Before migrating from Proxy Server 2. 0, review "Pre. Migration. Considerations. htm" on the ISA Server compact disc and review the following sections in ISA Server Help: "Checklist: Migrating from Microsoft Proxy Server 2. 0" and "Migrating from Microsoft Proxy Server 2. 0. “ n Important: It is recommended that you perform a full backup of the current Proxy Server 2. 0 settings before the upgrade and that you disconnect the computer to be upgraded from the Internet during the installation.

n Upgrading from Microsoft Windows NT 4. 0 You can install ISA Server on only computers running Windows 2000 Server with Service Pack 1 installed. If you are currently running Proxy Server 2. 0 on Microsoft Windows NT® 4. 0, you must complete the following steps:

1. Stop and disable all Proxy Server services including: l Microsoft Winsock Proxy Service (wspsrv) l Microsoft Proxy Server Administration (mspadmin) l Proxy Alert Notification Service (mailalrt) l World Wide Web Publishing Service (w 3 svc) 2. If Proxy Server 2. 0 is installed as an array, remove the server running Proxy Server 2. 0 from the array. 3. Perform the upgrade to Windows 2000. During the upgrade to Windows 2000, you may receive a message indicating that Proxy Server 2. 0 will not work on a computer running Windows 2000. You can disregard this message and continue installing ISA Server. 4. Install Windows 2000 Service Pack 1. 5. Begin installing ISA Server.

Comparing Proxy Server 2. 0 and ISA Server Configurations n When you upgrade to ISA Server, most rules, network settings, monitoring configurations, and cache configurations in Proxy Server 2. 0 are migrated to ISA Server. The differences and exceptions between Proxy Server 2. 0 and ISA Server are listed as follows:

n Publishing. Proxy Server 2. 0 requires that you configure publishing servers as Winsock Proxy clients. ISA Server allows you to publish internal servers without requiring any special configuration or software installation on the publishing server. Instead, ISA Server recognizes the publishing servers as Secure. NAT clients.

n Cache. Proxy Server 2. 0 cache content is not migrated because of the vastly different cache storage engine in ISA Server Setup deletes Proxy Server 2. 0 cache content and initializes the new storage engine based on existing cache and drive settings.

n SOCKS. ISA Server policy does not support the migration of Proxy Server 2. 0 SOCKS rules. ISA Server includes the SOCKS applications filter, which allows client SOCKS applications to communicate with the network by using the applicable array or enterprise policy to determine if the client request is allowed.

n Internet Protocol Exchange (IPX) Protocol. ISA Server does not support the IPX protocol.

Upgrading Client Computers After you install ISA Server, you may have to upgrade your client computers: n Winsock Proxy clients. Because both the Winsock Proxy Client that is included with Proxy Server 2. 0 and the Firewall Client that is included with ISA Server are compatible with both server products, you can upgrade client computers at any time after installing ISA Server and maintain a mixed environment during migration. n Web Proxy clients. Proxy Server 2. 0 uses port 80 for client Hypertext Transfer Protocol (HTTP) requests. By default, ISA Server uses port 8080. Therefore, you must configure all downstream chain members and browsers that connect to the ISA Server computer to connect to port 8080. Alternatively, you can configure ISA Server to use port 80 for client HTTP requests.

Troubleshooting ISA Server Installation Problems Err or LAT Contains Inaccurate Information After Installation Err or You Cannot Connect to Internet Resources After Installation Err or ISA Server Presents Error Messages During Installation Err or You Cannot Find Array to Join During Installation Err or Users Can Gain Access to Internet Without Defined Rules Err or Users Cannot Connect to Resources After Upgrading from Proxy Server 2. 0

n The following list includes common installation problems and solutions:

n The LAT that the Setup program generates is incorrect. Always double-check the LAT that the Setup program generates before you continue and make any required changes. The automatically generated LAT depends on a correct and complete configuration of your routing table.

n You are unable to connect to Internet resources immediately after installing ISA Server. This result is expected. Before you can fully test your configuration, you must configure access rules.

n ISA Server presented one or more error messages during installation. Review the event logs in Windows 2000 for more information about the errors. Remove ISA Server by using Add/Remove Programs in Control Panel, and then reinstall it. If you cannot remove ISA Server by using Add/Remove Programs, use the RMISA. exe program, which is located in the isai 386 folder on the ISA Server compact disc.

n You cannot join an array because the installation program cannot find the array. Ensure that the computer can communicate with the other array members and a domain controller for the current domain.

n Users can gain access to Internet sites even though you have not defined rules that allow access. Your LAT may not be configured correctly. Ensure that the LAT contains only internal IP addresses.

n After upgrading from Proxy Server 2. 0, client computers can no longer connect to Internet resources. Change the port that Web Proxy clients use to gain access to the ISA Server computer or configure automatic discovery for clients. ISA Server uses port 8080 for client connections, whereas Proxy Server 2. 0 uses port 80. n Tip: The "Troubleshooting" section of ISA Server Help contains information about solving other common problems.

u. Installing and Configuring ISA Server Clients n Client Overview n Configuring Web Proxy Clients n Configuring Secure. NAT Clients n Installing and Configuring Firewall Clients n Troubleshooting Client Installation

n Before you deploy or configure clients for ISA Server, you must consider the requirements of your organization. Some of the considerations include the level of access control required, the operating systems installed on client computers, the applications and services that your internal clients will use, and how you will publish servers on your internal network. If you encounter problems while installing or configuring clients, see the Troubleshooting Client Installation section.

In this lesson you will learn about the following topics: n Client overview n Configuring Web Proxy clients n Configuring Secure. NAT clients n Installing and Configuring Firewall Clients n Troubleshooting Client Installation

Client Overview Internet Secure. NAT Client ISA Server Web Proxy Client Improve the performance of Web requests for internal clients. Do not require you to deploy client software or configure client computers. Firewall Client Allow Internet access only for authenticated users.

n ISA Server supports three types of clients: Web Proxy clients, Secure. NAT clients, and Firewall clients.

u. Comparing ISA Server Clients n The following list describes the features of each type of ISA Server client: l Web Proxy clients l Secure. NAT clients l Firewall clients

n Web Proxy clients. Improve the performance of Web requests. A Web Proxy client sends requests directly to the ISA Server computer, but Internet access is limited to the browser. You can configure most Web browsers that support HTTP 1. 0 and HTTP 1. 1 clients as Web Proxy clients. Other applications, such as streaming media client applications, can also function as Web Proxy clients.

n Secure. NAT clients. Provide security and caching of HTTP requests, but do not allow for user-level authentication. Secure. NAT clients can support most Transmission Control Protocol/Internet Protocol (TCP/IP) protocols, including Internet Control Message Protocol (ICMP). To configure a Secure. NAT client, you configure the client computer to route all packets to the Internet through the ISA Server computer. You typically do this by setting the default gateway on the client computer to the IP address of the ISA Server computer. Because a Secure. NAT client requires no configuration other than changing the default gateway, any computer that uses the TCP/IP protocol can be a Secure. NAT client.

n Important: Some protocols and applications require secondary connections. For example, when you use the File Transfer Protocol (FTP) protocol, by default the client initiates a primary connection to the server, and the server then initiates a secondary connection to the client. ISA Server must use an application filter that edits the data stream to allow Secure. NAT clients to use such protocols and applications. ISA Server includes several application filters, such as an FTP filter and an H. 323 filter. If ISA Server does not contain the appropriate application filter for a protocol or application, Secure. NAT clients cannot use this protocol or application.

n Firewall clients. Restrict access on a per-user basis for outbound access for requests that use the TCP and User Datagram Protocol (UDP) protocols. To configure a Firewall client, you must install the Firewall Client software on each client computer. You can install the Firewall Client software on computers running Microsoft Windows Millennium Edition, Microsoft Windows 95 OSR 2, Microsoft Windows 98, Windows NT 4. 0, or Windows 2000 only. n Important: You can configure a computer to use multiple client types simultaneously. For example, you can configure a computer as a Web Proxy client for requests that are issued from within a browser, as a Firewall client to forward all requests from Winsock applications that use the TCP and UDP protocols, and as a Secure. NAT client for all other protocols, such as ICMP.

Determining Which ISA Clients to Use n Use the following guidelines to determine which clients to deploy for ISA Server.

If you want to Improve the performance of Web requests for internal clients Avoid deploying client software or configuring client computers Improve Web performance in an environment with non. Microsoft operating systems Publish servers that are located on your internal network Then use Web Proxy clients Secure. NAT clients do not require any software or specific configuration Secure. NAT clients. Secure. NAT client requests are transparently passed to the Microsoft Firewall service and then to the caching service for caching Secure. NAT clients. You can publish internal servers to make them available to external users. When you publish internal servers, you configure the servers as Secure. NAT clients. Because the published servers are Secure. NAT clients, you do not need to configure settings on the published server. Microsoft does not recommend configuring published servers as Firewall clients Allow Internet access for only Firewall clients or Web Proxy clients. You can authenticated users configure user-based access policy rules for Firewall clients and Web Proxy clients

Configuring Web Proxy Clients Local Area Network (LAN) Settings Automatic configuration may override manual settings. To ensure the use of manual settings, disable automatic configuration. Automatically detect settings 2 Use automatic configuration script Type the IP address 1 Select the Use a proxy server check box. or name of the ISA Server computer in the Address box. Proxy Server 3 Use a proxy server Address: 192. 168. 1. 200 Port: 8080 Bypass proxy server for local addresses OK Type the port number in the Port box, and then click OK. Cancel

n You do not need to install any software to configure Web Proxy clients. However, you must configure the Web browser on the client computer to use the ISA Server computer as the proxy server. Other applications that use Web protocols may also be able to function as Web Proxy clients. Some of these applications can obtain their configuration settings from your Web browser. Others may require additional configuration steps. The exact configuration steps for configuring ISA Server depend on the Web browser that you use. n Important: Web browser helper applications that use protocols other than HTTP, such as Microsoft Windows Media™ Player, do not use ISA Server to connect to the Web. To allow helper applications to connect to the Web, you must use the Secure. NAT client or the Firewall client in addition to the Web Proxy client.

n To configure Microsoft Internet Explorer 5 or later to use the Microsoft Web Proxy service: 1. Open the Properties dialog box for Internet Explorer. On the Connections tab, click LAN Settings, and then in the Local Area Network (LAN) Settings dialog box, select the Use a proxy server check box. 2. In the Address box, type a valid path to the ISA Server computer. 3. In the Port box, type the port number that the ISA Server computer uses for Web Proxy client connections, which is 8080 by default, and then click OK twice.

n If you want your Web browser to bypass the ISA Server computer when connecting to local computers, you can also select the Bypass proxy server for local addresses check box. Bypassing the ISA Server computer for local computers may improve Web browser performance.

Configuring Secure. NAT Clients n Configuring Clients on Networks That Do Not Use Routers n Configuring Clients on Networks That Use Routers n Resolving Names for Secure. NAT Clients

n Although Secure. NAT clients do not require specific software, you must configure Secure. NAT clients to route all network traffic to the Internet through the ISA Server computer. How you configure the client computer depends on whether your network uses routers between the ISA Server computer and the Secure. NAT clients.

Configuring Clients on Networks That Do Not Use Routers n To configure Secure. NAT clients on a network without routers, set the Secure. NAT client's IP default gateway settings to the IP address of the ISA Server computer's internal network adapter by manually changing the default gateway setting or by using Dynamic Host Configuration Protocol (DHCP).

Configuring Clients on Networks That Use Routers n To configure Secure. NAT clients on a network with routers, set the default gateway settings to the router closest to the Secure. NAT client. Ensure that the router is configured to forward IP packets to the Internet so that all packets are routed through the ISA Server computer. Optimally, routers should use a default gateway that routes along the shortest path to the ISA Server computer. n In addition, do not configure routers to discard packets destined for addresses outside of the internal network. The ISA Server computer will determine how to route these packets.

Resolving Names for Secure. NAT Clients n To configure Secure. NAT clients on a network without routers, set the Secure. NAT client's IP default gateway settings to the IP address of the ISA Server computer's internal network adapter by manually changing the default gateway setting or by using Dynamic Host Configuration Protocol (DHCP). If clients request data from Then Internet and internal servers Use a DNS server on the internal network. Ensure that the internal server can resolve both internal and Internet addresses. Internet only Configure Secure. NAT clients to use a DNS server on the Internet.

Installing and Configuring Firewall Clients ISA Server Group Policy MSPClntSetup. exe Webinst/default. htm Client Computer

n You can install the Firewall Client software on client computers from a shared folder or from a Web location. You can also use Windows 2000 Group Policy to centrally distribute the Firewall Client software to client computers. For all installation methods, you must install the Firewall Client software from the installation point on the ISA Server computer so that the client computer receives all of the required configuration information. n Important: Do not install the Firewall Client software on the ISA Server computer. It is not recommended that you use this configuration because the operations of the Firewall client may interfere with the operations of ISA Server when both are running on the same computer.

Installing from a Shared Folder n When you run the ISA Server Setup program, it automatically creates a folder named Program FilesMicrosoft ISA ServerClients, copies the client installation files to this location, and then shares that folder as MSPClnt. By default, the Firewall Client Setup program installs the Firewall Client in the C: Program FilesMicrosoft Firewall Client folder. You can select a different folder during Setup. n To install the Firewall Client software from the shared folder: 1. Use Windows Explorer to connect to \serverMSPClnt (where server is the name of the ISA Server computer). 2. Run Setup. exe from that location, and then follow the on-screen instructions.

Installing from a Web Location n To install the Firewall Client software from a Web location: 1. Copy the Default. htm and Setup. bat files from the Program FilesMicrosoft ISA ServerClientsWEBINST folder to a Web server. 2. Use a Web browser to connect to the Web server, and then display Default. htm. 3. Start the Setup program by doing one of the following: n l If you are using Internet Explorer, click the Firewall Client software link. l If you are using Netscape Navigator, follow the instructions to save Setup. bat to your hard drive, and then run Setup. bat from a command prompt. Note: For most Winsock applications, the default Firewall client configuration works with no further modification. However, in some cases, you may have to modify the client configuration information. For more information about configuring Firewall client settings, see "Advanced Firewall client configuration" in ISA Server Help.

Installing by Using Group Policy n To install the Firewall Client software by using a group policy, assign the Windows Installer package MS_FWC. msi in the shared folder \isa_serverMspclnt to the users that require the Firewall client.

Using the Firewall Client n The Firewall client is transparent to applications and users. By default, an icon on the taskbar appears when a user has the Firewall Client software installed, and the appearance of this icon indicates the status of the connection to the ISA Server computer. n You can use Firewall Client in Control Panel to disable the Firewall client, control whether the taskbar icon appears, and update Firewall configuration information from the ISA Server computer. n Tip: The Firewall client automatically detects when there is no connection to the ISA Server computer. When the Firewall client detects that there is no connection, it automatically disables itself so that the client computer connects to Internet resources directly. This action allows users to move a computer, without having to reconfigure the Firewall client, between an office location that uses ISA Server and a home location in which ISA Server is not installed.

Troubleshooting Client Installation Err or Cannot Connect to Internet After Installing Firewall Client Software Err or Cannot Connect to Internet After Configuring Web Proxy Client Err or Cannot Gain Access to Internet Sites From a Client Computer

n Common client installation problems and possible solutions are as follows: l You can no longer connect to Internet resources immediately after installing the Firewall Client software l You can no longer connect to Internet resources immediately after configuring the Web Proxy client l You cannot gain access to Internet sites from a client computer

n You can no longer connect to Internet resources immediately after installing the Firewall Client software. Before attempting other methods of troubleshooting, update the Firewall client by using the most recent ISA Server configuration. To update the client, in Control Panel, click Update Now in the Firewall Client program.

n You can no longer connect to Internet resources immediately after configuring the Web Proxy client. Ensure that your computer can communicate with the ISA Server computer and that your access rules allow you to gain access to the Internet.

n You cannot gain access to Internet sites from a client computer. Attempt to isolate the problem by answering the following questions: l Can you gain access to internal resources? l Can you gain access to external Web-based resources? l Can you gain access to external resources by using Winsock-based applications? l Can you gain access to external resources by using Secure. NAT?

l n The most important part of troubleshooting client connection problems is isolating the problem, which includes identifying which client component is involved. For example, if you can gain access to Web-based resources but Winsock-based applications do not work, you may need to reconfigure application settings for the Firewall client. If you cannot gain access to either internal or external resources, the problem may be unrelated to ISA Server and you will have to examine your network configuration. Note: For more information on troubleshooting client connection problems, see "Troubleshooting client connections" in ISA Server Help.

Lab A: Installing ISA Server and Configuring Clients

Objectives After completing this lab, you will be able to: n Install ISA Server. n Install the ISA Server administration tools. n Configure a Web Proxy client. n Configure a Secure. NAT client.

Prerequisites Before working on this lab, you must have: n Experience using Microsoft Management Console (MMC). n Knowledge about how to configure network settings in Windows 2000. n Knowledge about the characteristics of the different ISA Server clients.

Scenario n Northwind Traders wants to secure all Internet access for internal users by using ISA Server. To accomplish this, you must install ISA Server and configure client computers as Web proxy, Firewall, and Secure. NAT clients.

Exercise 1: Installing ISA Server n In this exercise, ISA Server will be installed in Integrated mode.

Scenario n The security policy of Northwind Traders requires that the internal network be separated from the Internet by using a firewall. Also, because they anticipate an increase in outgoing Internet traffic in the future, they decide to use Web caching to increase the amount of network traffic that the Internet connection can process. To improve security and performance, ISA Server will be installed. Installing ISA Server

Exercise 2: Installing ISA Server Administration Tools n In this exercise, ISA Server administration tools will be installed.

Scenario n Now that ISA Server is installed, it is decided to remotely administer the ISA Server computer. To do this, ISA Management and the H. 323 Gatekeeper Administration tool will be installed on another computer in the network. Installing ISA Server Administration Tools

Exercise 3: Configuring a Web Proxy Client n In this exercise, Internet Explorer will be configured as a Web Proxy client that is configured to use the ISA Server computer for Internet requests. This configuration will then be tested.

Scenario n ISA Server has been installed in your organization to improve the efficiency and security of all Internet access. Before users can use Internet Explorer to gain access to Web sites, Internet Explorer must be configured as a Web Proxy client on all of the users' computers. Configuring a Web Proxy Client

Exercise 4: Installing the Firewall Client n In this exercise, the Firewall Client will be installed. This configuration will then be tested.

Scenario n Northwind Traders wants to control Internet use by employees by using ISA Server. Components of the access policy require that access be controlled based on user accounts. To accomplish this task, the Firewall client must be installed on all computers running Windows 2000. Installing the Firewall Client

Exercise 5: Configuring a Secure. NAT Client n In this exercise, a client computer will be configured as a Secure. NAT client.

Scenario n The network at Northwind Traders contains client computers that are running different operating systems. It must be ensured that all client computers can gain access to the Internet through the ISA Server computer. To accomplish this task, all client computers will be configured as Secure. NAT clients. Configuring a. Secure. NAT Client

u. Maintaining an ISA Server Array n Using the ISA Management n Maintaining the LAT and LDT n Maintaining Configuration Information n Managing Services

n ISA Server contains administrative and management tools to help you configure and maintain ISA Server as a standalone server or an array. ISA Server uses the LAT and the local domain table (LDT) to manage internal and external connections. You can add IP address and domain information manually to both server and client computers. After you configure ISA Server, you can use the backup feature to save configuration data. When you restore the ISA Server configuration, all ISA Server services are stopped. Therefore, it is important to know the services that are associated with ISA Server and how to manage those services.

In this lesson you will learn about the following topics: n Using ISA Management n Maintaining the LAT and LDT n Maintaining Configuration Information n Managing Services

Using ISA Management Action View Large Icons Tree Small Icons List Detail Taskpad Advanced Customize… Getting Started Welcome Select policy elements Configure Schedules Configure Client Sets Configure Protocol Rules Configure Destination Sets Configure Site and Content Rules Secure Server Configure Firewall Protection Configure Dial-Up Entries Configure Routing for Firewall and Secure. NAT Clients Configure Routing for Web Browser Applications Configure Cache Policy Welcome to the Microsoft Internet Security and Acceleration (ISA) Server Getting Started Wizard. This wizard will assist you in finishing the setup process and help you to define and configure initial ISA Server policies, to connect and protect your internal network. To navigate through the wizard, click Next. To quit the wizard, click Finish. Click the Help button for more information on specific tasks. Exit the Getting Started Wizard Help Management with tasks Next Finish

Using ISA Management n ISA Management is an MMC snap-in that you use to administer ISA Server. ISA Management includes graphical taskpads and wizards that help simplify navigation and configuration of common tasks. ISA Management also includes the Getting Started Wizard to help you configure policies after installation.

u. Using the Getting Started Wizard n You can run the Getting Started Wizard when you first start ISA Server after installation. The Getting Started Wizard guides you through the steps of defining and configuring initial enterprise and array policies.

u. Using Taskpads and Advanced Views n You can run ISA Management in Taskpad view or in Advanced view. Taskpads contain shortcuts for performing the most common configuration tasks in the details pane of ISA Management. Taskpad view is the default view in ISA Management and simplifies many common configuration steps. However, you can complete some less commonly performed tasks in Advanced view only. l n To use Advanced view, on the View menu of ISA Management, click Advanced. To change back to Taskpad view, click Taskpad. Important: The taskpads and wizards in ISA Server are powerful tools that enable you to configure settings quickly and easily. Before performing any configuration changes, ensure that you understand the implications of the action that you are about to perform, including the functionality of protocols that you may want to set.

Maintaining the LAT and LDT 192. 168. 100. 200 192. 168. 100. 300 Msplat. txt Internet 192. 168. 100. 225 ISA Server 192. 168. 100. 200 192. 168. 100. 300 Clients Msplat. txt

n ISA Server uses the LAT and the LDT to determine if an IP address or computer name is on the internal network. The LAT contains IP address ranges that define your internal network address space. The LDT lists all of the domain names in the internal network that are served by the ISA Server computer. You can add entries to both the LAT and LDT in ISA Management. On the Firewall client, the Msplat. txt file contains a copy of the LAT. Firewall clients update the Msplat. txt file with the current settings from the ISA Server computer at startup and then every six hours thereafter.

u. Adding IP Addresses to the LAT n The LAT created during Setup may not contain all of your organization's IP addresses. In addition, your network address configuration may change after you install ISA Server. After Setup, you can add these addresses manually, if necessary. ISA Server stores the LAT information in the file C: Program FilesMicrosoft ISA ServerClientsMsplat. txt. Clients copy the LAT to the folder in which the Firewall Client software is installed. n Caution: Never add IP addresses to the LAT that are not on your internal network. Adding addresses to the LAT that are not on your internal network may cause connection problems for client computers and could compromise the security of your network.

To add IP addresses to the LAT: 1. In ISA Management, in the console tree, expand Network Configuration, right-click Local Address Table (LAT), point to New, and then click LAT Entry. 2. In the From box, type the first IP address in the range of addresses to add to the LAT, and then in the To box, type the last IP address in the range of addresses to add to the LAT. To add just one address, type the same IP address in the From box and the To box. 3. In the Description box, type a description of the LAT entry, and then click OK.

n Note: Because ISA Server overwrites the Msplat. txt file at regular intervals with a new version that is downloaded from the server, changes that you make on the client file are lost when the server updates the file. If the client must connect directly to locations that are not in the Msplat. txt file, create a custom client LAT file. To create a custom client LAT file, use a text editor to create a file named Locallat. txt, and place the file in the client Firewall Client folder. The Firewall Client then uses both Msplat. txt and Locallat. txt to determine which IP addresses are local. For more information about Locallat. txt, see "Firewall Client components" in ISA Server Help.

u. Adding Names to the LDT n Firewall clients use the LDT to determine whether to perform a name resolution request directly or through the ISA Server computer. If a name is in the LDT, the ISA Server client computer resolves the name resolution request directly by using a DNS server. If a name is not in the LDT, the client forwards the request to the ISA Server computer, which then resolves the name request by passing the request to a DNS server on the Internet. You can add entries to the LDT manually, if necessary.

To add entries to the LDT: 1. In ISA Management, in the console tree, expand Network Configuration, right-click Local Domain Table (LDT), point to New, and then click LDT Entry. 2. In the Name box, type the name of the local domain. 3. In the Description box, type a description of the LDT entry, and then click OK.

Maintaining Configuration Information ISA Management Action View Tree Internet Security and Acceleration Servers and Arrays H 323 Gate Disconnect Back Up… Restore… Promote… View Refresh Export List… Name Monitoring Computer Access Policy Publishing Bandwidth Rules Policy Elements Cache Configuration Monitoring Configuration Extensions Network Configuration Client Configuration Backup Array Store backup configuration in this location: Browse… Comment: Properties OK Restore Array Restore array configuration from the following backup (. BIF) file: Browse… OK Cancel

n ISA Server includes a backup and restore feature that enables you to save and restore most stand-alone server or array configuration information. You can back up the standalone server or array configuration data and store it locally in a file. You can save your configuration data to any folder on the local computer. n Although a backup of the ISA Server configuration allows you to quickly recover from configuration mistakes, the backup does not contain all of the configuration data for the ISA Server computer. To recover from a system failure, you must also have a backup of your entire computer configuration on tape or other storage medium. n Important: For maximum security, save the backup files to an NTFS disk partition and set the appropriate permissions to protect against unauthorized access.

u. Backing Up Configuration Information n When you perform a backup, you save configuration information to a file on the ISA Server computer. This information includes access policy rules, publishing rules, policy elements, the alert configuration, the cache configuration, and array properties.

To back up configuration information: 1. In ISA Management, in the console tree, right-click the stand-alone server or array that you want to back up, and then click Back Up. 2. In the Store backup configuration in this location box, type the directory and file name of the backup file in which to store the backup data, and then click OK. n Note: For more information about performing backups on an ISA Server computer, see "backup. htm" in the supportdocs folder on the ISA Server compact disc.

u. Restoring a Configuration n If you backed up the array configuration, you can restore the configuration. The restoration process reconstructs most of the configuration parameters of the stand-alone server or array.

To restore a stand-alone server or an array configuration: 1. In ISA Management, in the console tree, right-click the stand-alone server or array that you want to restore, and then click Restore. 2. Click Yes to acknowledge that the operation will replace the existing configuration. 3. In the Restore array configuration from the following backup (. BIF) file box, type the name of the directory in which the configuration backup file is located, and then click OK.

Managing Services ISA Server Control Service Firewall Service Web Proxy Service Scheduled Content Download H. 323 Gatekeeper Starts other ISA Server services. Supports requests from Firewall clients and Secure. NAT clients. Supports requests from Web browsers. Downloads cache content from Web servers, according to the configured jobs. Manages requests for applications that use audio, video, or application sharing.

n You can manage most of the services and settings associated with ISA Server from within ISA Server Management. However, to start or to stop the Microsoft ISA Server Control service, you must use Services on the Administrative Tools menu.

ISA Server includes the following services: n ISA Server Control service. Starts the other ISA services, generates alerts and running actions, synchronizes each member server's configuration with the array, updates the client configuration files, and deletes unused log files. n Firewall service. Supports requests from Firewall and Secure. NAT clients. n Web Proxy service. Supports requests from Web Proxy clients. n Microsoft Scheduled Cache Content Download service. Downloads cache content from Web servers, according to the jobs that you configure by using ISA Management. n H. 323 Gatekeeper service. Manages requests for applications that use audio, video, or application sharing, such as Net. Meeting.

u. Starting and Stopping ISA Services n When one of the ISA Server services is not functioning correctly, you may have to restart or shut down the service. In addition, ISA Server may stop a service because of an alert condition. You will have to restart the service after resolving the condition that caused the service to shut down.

u. Using ISA Management To start or stop an ISA Server service in ISA Management: 1. In ISA Management, in the console tree, expand Monitoring, and then click Services. 2. In the details pane, click the applicable service, and then click Start a Service or Stop a Service.

u. Using Services n You use Computer Management to start and stop the ISA Server Control service and the H. 323 Gatekeeper. n To start or stop an ISA Server service by using Services: 1. On the Administrative Tools menu, open Services. 2. In the details pane, right-click the applicable service, and then click Start or Stop. n Important: If you stop the ISA Server Control service, Windows 2000 also stops all of the other ISA Server services.

Lab B: Configuring ISA Server

Review n Installing ISA Server n Installing and Configuring ISA Server Clients n Maintaining ISA Server