MCSA/MCSE Training kit 70-350 Implementing Microsoft Internet Security and Acceleration (ISA) Server 2004

1094 Pages·2016·13.76 MB·English

PUBLISHED BY
Microsoft Press
A Division of Microsoft Corporation
One Microsoft Way
Redmond, Washington 98052-6399
Copyright © 2005 by Microsoft Corporation
All rights reserved. No part of the contents of this book may be reproduced or transmitted in any form or
by any means without the written permission of the publisher.
Library of Congress Control Number 2004118212
Printed and bound in the United States of America.
1 2 3 4 5 6 7 8 9 QWT 9 8 7 6 5
Distributed in Canada by H.B. Fenn and Company Ltd.
A CIP catalogue record for this book is available from the British Library.
Microsoft Press books are available through booksellers and distributors worldwide. For further
information about international editions, contact your local Microsoft Corporation office or contact
Microsoft Press International directly at fax [phone]. Visit our Web site at
www.microsoft.com/learning/. Send comments to [email protected].
Microsoft, Active Directory, ActiveSync, FrontPage, Microsoft Press, MSDN, MSN, Outlook,
PowerPoint, SharePoint, Visual Basic, Visual Studio, Win32, Windows, Windows Mobile, Windows
NT, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the
United States and/or other countries.
The example companies, organizations, products, domain names, e-mail addresses, logos, people, places,
and events depicted herein are fictitious. No association with any real company, organization, product,
domain name, e-mail address, logo, person, place, or event is intended or should be inferred.
Product Planner: Martin DelRe
Content Development Manager: Lori Kane
Project Manager: Julie Pickering
Project Editor: Susan McClung
Technical Editor: Kurt Dillard
Technologist: Colin Lyth
Copy Editor: Peter Tietjen
Proofreaders: Jan Cocker, Cindy Gearhart, and Kiren Valjee
Indexer: Jack Lewis
Body Part No. X11-10416
As always, I dedicate this book to the three wonderful women in my life:
my wife, Rhonda, and my daughters, Angela and Amanda.
Stan Reimer
To my beautiful and lovely wife, Oksana, and my fantastic son, Rooslan.
You make this all possible.
Orin Thomas

About the Authors
Stan Reimer, Microsoft Certified System Engineer (MCSE), and
Microsoft Certified Trainer (MCT), is the president of SR Tech-
nical Services based in Winnipeg, Manitoba. Stan works as a
consultant and trainer specializing in Microsoft ISA Server,
Microsoft Exchange Server, and Active Directory design and
implementation. Stan has worked as a consultant with some of
the largest corporations in Canada, as well as some of the
smallest. He is the co-author of Active Directory for Microsoft
Windows Server 2003 Technical Reference, published by
Microsoft Press, and also authors courseware and security clin-
ics for Microsoft Learning. In the summer, Stan finds hitting the
road on his motorcycle or hitting golf balls on a golf course to be excellent therapy. In
the winter, he just works, because it is too cold in Winnipeg to do anything else.
Orin Thomas is a writer, editor, trainer, and systems adminis-
trator who works for the certification advice Web site Cert-
tutor.net. His work in IT has been varied: he has done
everything from providing first-level networking support to a
university department to managing mission-critical servers for
one of Australia’s largest companies. He has co-authored sev-
eral MCSA/MCSE self-paced training kits for Microsoft Learn-
ing. He holds a variety of certifications, a bachelor’s degree in
science with honors from the University of Melbourne, and is
currently working toward the completion of a Ph.D in Philos-
ophy of Science.

Contents at a Glance
Learn at Your Own Pace
Part 1
1 Introduction to ISA Server 2004 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-3
2 Installing ISA Server 2004 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-1
3 Securing and Maintaining ISA Server 2004 . . . . . . . . . . . . . . . . . . . . . .3-1
4 Installing and Managing ISA Server Clients . . . . . . . . . . . . . . . . . . . . . .4-1
5 Enabling Secure Internet Access with ISA Server 2004 . . . . . . . . . . . . .5-1
6 Implementing ISA Server Caching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-1
7 Configuring ISA Server as a Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-1
8 Implementing ISA Server Publishing . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-1
9 Integrating ISA Server 2004 and Exchange Server . . . . . . . . . . . . . . . . .9-1
10 Configuring Virtual Private Networks for Remote
Clients and Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10-1
11 Implementing Monitoring and Reporting . . . . . . . . . . . . . . . . . . . . . . .11-1
12 Implementing ISA Server 2004, Enterprise Edition . . . . . . . . . . . . . . .12-1
Prepare for the Exam
Part 2
13 Planning and Installing ISA Server 2004 (1.0) . . . . . . . . . . . . . . . . . . .13-3
14 Installing and Configuring Client Computers (2.0) . . . . . . . . . . . . . . . .14-1
15 Configuring and Managing ISA Server 2004 (3.0) . . . . . . . . . . . . . . . .15-1
16 Configuring Web Caching (4.0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16-1
17 Configuring Firewall Policy (5.0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .17-1
18 Configuring and Managing Remote Network Connectivity (6.0) . . . . . .18-1
19 Monitoring and Reporting ISA Server 2004
Activity (7.0) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19-1
vii
viii Contents at a Glance
Practices
Installing ISA Server 2004 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-29
Securing the Computer Running ISA Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-14
Securing ISA Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-24
Maintaining ISA Server 2004 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-34
Configuring SecureNAT and Web Proxy Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-25
Installing and Configuring Firewall Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-43
Configuring ISA Server as a Proxy Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-26
Configuring Access Rule Elements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-38
Configuring ISA Server Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-45
Configuring Access Rules for Internet Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-56
Configuring Caching and Cache Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-26
Configuring Content Download Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-36
Configuring Multiple Networking on ISA Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-20
Implementing Network Templates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-33
Configuring Intrusion Detection and IP Preferences . . . . . . . . . . . . . . . . . . . . . . . . . . .7-43
Configuring an HTTP Web Filter . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-61
Configuring DNS for Web and Server Publishing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-9
Configuring Web Publishing Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-29
Configuring Secure Web Publishing Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-42
Configuring Server Publishing Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-59
Configuring ISA Server Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-71
Configuring ISA Server to Secure SMTP Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9-19
Configuring ISA Server to Secure OWA Client Connections . . . . . . . . . . . . . . . . . . . . . .9-34
Configuring ISA Server to Secure Outlook Client Connections . . . . . . . . . . . . . . . . . . .9-47
Configuring Virtual Private Networking for Remote Clients . . . . . . . . . . . . . . . . . . . . 10-29
Configuring Virtual Private Networking for Remote Sites . . . . . . . . . . . . . . . . . . . . . 10-44
Configuring VPN Quarantine Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10-61
Configuring and Managing Alerts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-24
Configuring Session and Connectivity Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-36
Configuring ISA Server Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-54
Installing a Configuration Storage Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-48
Configuring Enterprise and Array Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-57
Installing ISA Server 2004, Enterprise Edition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12-62
Contents at a Glance ix
Tables
Table 1-1: New Features in ISA Server 2004 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-19
Table 1-2: ISA Server Monitoring Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1-36
Table 2-1: ISA Server 2004 Hardware Scalability . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-15
Table 2-2: Msisaund.ini Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2-26
Table 2-3: ISA Server Unattended Setup Parameters . . . . . . . . . . . . . . . . . . . . . . . . .2-28
Table 3-1: Services Required for ISA Server 2004 . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-8
Table 3-2: Optional Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-9
Table 3-3: ISA Server Default Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-15
Table 3-4: System Policy Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-18
Table 3-5: ISA Server Roles and Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .3-22
Table 4-1: Comparing the ISA Server Clients . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-9
Table 4-2: Guidelines for Choosing ISA Server Clients . . . . . . . . . . . . . . . . . . . . . . . . . .4-9
Table 4-3: Configuring Network Settings for SecureNAT Clients . . . . . . . . . . . . . . . . .4-13
Table 4-4: ISA Server Firewall Configuration Settings . . . . . . . . . . . . . . . . . . . . . . . . .4-34
Table 4-5: Application.ini File Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4-41
Table 5-1: ISA Server Internet Access Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-8
Table 5-2: Configuring Dial-Up Preferences . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-25
Table 5-3: Access Rule Element Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-29
Table 5-4: Protocol Element Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . . . .5-31
Table 5-5: Network Object Access Rule Elements . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-36
Table 5-6: Authentication Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-45
Table 5-7: Access Rule Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .5-49
Table 6-1: ISA Server Caching Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-8
Table 6-2: Advanced Caching Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . . .6-16
Table 6-3: Cache Rule Options and the Default Cache Rule . . . . . . . . . . . . . . . . . . . .6-18
Table 6-4: Configuring Content Retrieval Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-20
Table 6-5: Configuring Content Caching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-21
Table 6-7: Configuring HTTP Caching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-23
Table 6-8: Configuring FTP Caching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-23
Table 6-9: Configuring Download Frequency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .6-32
Table 6-10: Configuring Content Download Job Details . . . . . . . . . . . . . . . . . . . . . . . .6-34
Table 6-11: Configure Content Download Job Caching . . . . . . . . . . . . . . . . . . . . . . . .6-35
Table 7-1: ISA Server Default Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-15
x Contents at a Glance
Table 7-2: ISA Server Default Network Rules . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-18
Table 7-3: Firewall Policies Applied by the Internet-Edge Template . . . . . . . . . . . . . . .7-29
Table 7-4: ISA Server Intrusion-Detection Options . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-37
Table 7-5: Configuring HTTP Policy General Properties . . . . . . . . . . . . . . . . . . . . . . . .7-51
Table 7-6: HTTP 1.1 Methods . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-52
Table 7-7: How ISA Server Evaluates Extensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . .7-54
Table 7-8: Application Signatures for Common Applications . . . . . . . . . . . . . . . . . . . .7-60
Table 8-1: Web Publishing Rule Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . .8-13
Table 8-2: Web Site Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-24
Table 8-3: Server Publishing Rule Configuration Options . . . . . . . . . . . . . . . . . . . . . . .8-48
Table 8-4: Port Override Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .8-51
Table 9-1: Supported SMTP Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9-8
Table 9-2: Configuring the SMTP Message Screener . . . . . . . . . . . . . . . . . . . . . . . . . .9-13
Table 9-3: RPC over HTTP Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9-44
Table 10-1: Comparing PPTP and L2TP/IPSEC . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .10-8
Table 10-2: Site-to-Site VPN Configuration Components . . . . . . . . . . . . . . . . . . . . . 10-33
Table 10-3: Comparing Site-to-Site Tunneling Protocols . . . . . . . . . . . . . . . . . . . . . . 10-35
Table 10-4: Remote-Site VPN Gateway Configuration Components . . . . . . . . . . . . . 10-43
Table 11-1: ISA Server Monitoring Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .11-4
Table 11-2: ISA Server Management Console Dashboard Nodes . . . . . . . . . . . . . . . . .11-6
Table 11-3: ISA Server Performance Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-10
Table 11-4: Alert Event Configuration Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-19
Table 11-5: Configuring an Alert Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-21
Table 11-6: Session Filtering Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-32
Table 11-7: Connectivity Monitoring Configuration Options . . . . . . . . . . . . . . . . . . . 11-35
Table 11-8: ISA Server Log Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11-42
Table 11-9: Configuring the ISA Server Log Summaries . . . . . . . . . . . . . . . . . . . . . . 11-49
Table 12-1: ISA Server Enterprise Edition Unattended Installation Files . . . . . . . . . 12-62
Troubleshooting Labs
Troubleshooting Lab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3-39
Troubleshooting Lab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-62
Troubleshooting Lab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5-71
Troubleshooting Lab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7-66
Troubleshooting Lab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8-76
Troubleshooting Lab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9-50