Configuring ISA Server 2000: Building Firewalls for Windows 2000

by Syngress

Overview

Microsoft's flagship ISA Server delivers the Internet to your customers!
As the demand for Internet connectivity reaches a fever pitch, system administrators are being challenged to connect more and more systems to the Internet without compromising security or network performance. ISA Server 2000 provides system administrators with a revolutionary management infrastructure that addresses the two greatest needs of Enterprise-wide Internet connectivity: Security and speed.

Written by best-selling author of several MCSE 2000 study guides, this book will provide the system administrators with an in depth understanding of all the critiacl features of Microsoft's flag ship Internet Server. Configuring ISA Server 2000 shows network administrators how to connect a network to the Internet, maintain the connection, and troubleshoot remote users' hardware and software configuration problems.

Product Details

ISBN-13:	9781928994299
Publisher:	Elsevier Science
Publication date:	06/10/2001
Edition description:	BK&CD-ROM
Pages:	512
Product dimensions:	6.00(w) x 9.00(h) x (d)

About the Author

Thomas W. Shinder, M.D. (MCSE, MCP+I, MCT) is a technology trainer and consultant in the Dallas-Ft. Worth metroplex. Dr. Shinder has consulted with major firms, including Xerox, Lucent Technologies, and FINA Oil, assisting in the development and implementation of IP-based communications strategies. Dr. Shinder attended medical school at the University of Illinois in Chicago, and trained in neurology at the Oregon Health Sciences Center in Portland, Oregon. His fascination with interneuronal communication ultimately melded with his interest in internetworking and led him to focus on systems engineering.

Debra Littlejohn Shinder (MCSE, MCP+I, MCT) is an instructor in the AATP program at Eastfield College, Dallas County Community College District, where she has taught since 1992.She and her husband, Dr. Thomas W. Shinder, provide consulting and technical support services to Dallas area organizations. Deb has been a writer for most her life, and has published numerous articles in both technical and nontechnical fields.

Read an Excerpt

Chapter 1

Introduction to Microsoft ISA Server

Solutions in this chapter:

• What Is ISA Server
• ISA Server Features Overview
• Who This Book Is For and What It Covers

What Is ISA Server?

The information technology (IT) world is full of acronyms; insiders refer to this vast maelstrom of initials as "alphabet soup." Sometimes it seems that there are so many acronyms—representing so many different concepts, products, components and protocols—that we've used up all the possible letter combinations and now we've started over. As you learn about this world, you'll find many instances in which the same acronym you had previously used in one context is now being used to describe something entirely different.

Hence, in this book, ISA has nothing to do with the Industry Standard Architecture (ISA) bus that long-time PC aficionados know and love (or at least know). Nor does it have anything to do with the Instrumentation, Systems, and Automation Society, an organization devoted to measurement and control technologies. Rather, ISA is yet another new server product from Microsoft (or more accurately, as you'll see, a new name for an improved version of a not-so-new product). This book will acquaint you with ISA Server's features and functionality.

In conjunction with the release of Microsoft's new business-oriented operating system, Windows 2000, the software company announced that it would be developing several new server products that would either provide new functionality in Windows 2000-based networks or provide enhancements to the functionality to add-on server products that were originally designed to run on Windows NT 4.0.

New versions of old standbys, such as Exchange 2000 and SQL Server 2000, were developed, with improved features and the ability to integrate with Active Directory. Brand-new products, such as the Microsoft Mobile Information 2001 Server and the Microsoft Application Center 2000 Server, were planned to take advantage of the latest trends in PC computing, such as wireless networking and the application service provider (ASP) explosion. Some of Microsoft's existing servers, such as SNA and Site Server, received new monikers like Host Integration Server and Commerce Server to reflect their updated features.

Another product that got a new name was Microsoft's Web-caching, filtering, and connection-sharing software package, Proxy Server. The Windows 2000-compatible version was code-named Comet in the development stages, but the final release was called Microsoft Internet Security and Acceleration Server 2000, or more simply, ISA Server...

Why "Security and Acceleration" Server?

Internet Security and Acceleration. It sounds good, but what does it mean? Let's look at those two factors—security and acceleration—and the role each plays in ISA Server,

Table of Contents

Chapter 1 Introduction to Microsoft ISA Server

What Is ISA Server

Why “Security and Acceleration” Server

The History of ISA: Microsoft Proxy Server

ISA Server Options

The Microsoft.Net Family of Enterprise Servers

The Role of ISA Server in the Network Environment

An Overview of ISA Server Architecture

ISA Server Features Overview

Firewall Security Features

Web Caching Features

Internet Connection-Sharing Features

Unified Management Features

Extensible Platform Features

Who This Book Is For and What It Covers

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 2 ISA Server in the Enterprise

Introduction

Enterprise-Friendly Features

Reliability

Scalability

Multiprocessor Support

Network Load-Balancing Support

Clustering

Hierarchical and Distributed Caching

Total Cost of Ownership

Designing Enterprise Solutions

General Enterprise Design Principles

Planning Multiserver Arrays

Understanding Multiserver Management

Using Tiered Policy

Understanding ISA Server Licensing

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 3 Security Concepts and Security Policies

Introduction

Security Overview

Defining Basic Security Concepts

Knowledge Is Power

Think Like a Thief

Security Terminology

Addressing Security Objectives

Controlling Physical Access

Preventing Accidental Compromise of Data

Preventing Intentional Internal Security Breaches

Preventing Unauthorized External Intrusions and Attacks

Recognizing Network Security Threats

Understanding Intruder Motivations

Classifying Specific Types of Attacks

Categorizing Security Solutions

Hardware Security Solutions

Software Security Solutions

Designing a Comprehensive Security Plan

Evaluating Security Needs

Understanding Security Ratings

Legal Considerations

Designating Responsibility for Network Security

Designing the Corporate Security Policy

Educating Network Users on Security Issues

Incorporating ISA Server into Your Security Plan

ISA Server Intrusion Detection

Implementing a System-Hardening Plan with ISA

Using SSL Tunneling and Bridging

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 4 ISA Server Deployment Planning and Design

Introduction

ISA Deployment: Planning and Designing Issues

Assessing Network and Hardware

Requirements

System Requirements

Software Requirements

Processor Requirements

Active Directory Implementation

Mission-Critical Considerations

Hard Disk Fault Tolerance

Planning the Appropriate Installation Mode

Installing in Firewall Mode

Installing in Cache Mode

Installing in Integrated Mode

Planning for a Standalone or an Array Configuration

Planning ISA Client Configuration

Internet Connectivity and DNS Considerations

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 5 ISA Server Installation

Introduction

Installing ISA Server on a Windows 2000 Server

Putting Together Your Flight Plan

Performing the Installation

Installing ISA Server: A Walkthrough

Upgrading a Standalone Server to an Array Member: A Walkthrough

Changes Made After ISA Server Installation

Migrating from Microsoft Proxy Server 2.0

What Gets Migrated and What Doesn’t

Upgrading Proxy 2.0 on the Windows 2000 Platform

Upgrading a Proxy 2.0 Installation on Windows NT 4.0

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 6 Managing ISA Server

Introduction

Understanding Integrated Administration

The ISA Management Console

ISA Wizards

Performing Common Management Tasks

Configuring Object Permissions

Managing Array Membership

Using Monitoring, Alerting, Logging, and Reporting Functions

Creating, Configuring, and Monitoring Alerts

Monitoring Sessions

Using Logging

Generating Reports

Understanding Remote Administration

Installing the ISA Management Console

Using Terminal Services for Remote Management of ISA

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 7 ISA Architecture and Client Configuration

Introduction

Understanding ISA Server Architecture

The Web Proxy Service

The Firewall Service

The Network Address Translation Protocol Driver

The Scheduled Content Download Service

ISA Server Services Interactions

Configuration Changes and ISA Server Services Restarts

Installing and Configuring ISA Server Clients

The SecureNAT Client

The Firewall Client

The Web Proxy Client

Autodiscovery and Client Configuration

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 8 Configuring ISA Server for Outbound Access

Introduction

Configuring the Server for Outbound Access

Configuring Listeners for Outbound Web Requests

Server Performance

Network Configuration Settings

Firewall Chaining: Routing SecureNAT and Firewall Client Requests

Routing Web Proxy Client Requests

Outbound PPTP Requests

The Local Address Table

Configuring the Local Domain Table

Creating Secure Outbound Access Policy

Creating and Configuring Policy Elements

Creating Rules Based on Policy Elements

Bandwidth Rules

Site and Content Rules

Protocol Rules

IP Packet Filters

Configuring Application Filters That Affect Outbound Access

FTP Access Filter

HTTP Redirector Filter

SOCKS Filter

Streaming Media Filter

Understanding and Configuring the Web Proxy Cache

Cache Configuration Elements

Scheduled Content Downloads

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 9 Configuring ISA Server for Inbound Access

Introduction

Configuring ISA Server Packet Filtering

How Packet Filtering Works

Enabling Packet Filtering

Creating Packet Filters

Managing Packet Filters

Supporting Applications on the ISA Server

Publishing Services on Perimeter Networks Using Packet Filters

Packet Filtering Options

Application Filters That Affect Inbound Access

DNS Intrusion Detection Filter

Configuring the H.323 Filter

POP Intrusion Detection Filter

RPC Filter

SMTP Filter

Configuring the SMTP Message Screener

Designing Perimeter Networks

Limitations of Perimeter Networks

Perimeter Network Configurations

Tri-homed ISA Server Perimeter Networks

Publishing Services on a Perimeter Network

Bastion Host Considerations

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 10 Publishing Services to the Internet

Introduction

Types of Publishing

Web Publishing

Server Publishing

Publishing Services on a Perimeter Network

Web Server Publishing

Preparing to Publish

Web Publishing Walkthrough—Basic Web Publishing

Publishing a Web Site on the ISA Server

Web Publishing through Protocol Redirection

Creative Publishing Using Destination Sets

Secure Web Site Publishing

Publishing Services

Limitations of Server Publishing Rules

Preparing for Server Publishing

Server Publishing Walkthrough—Basic Server Publishing

Publishing a Terminal Server

Publishing a Web Server Using Server Publishing

The H.323 Gatekeeper Service

Gatekeeper-to-Gatekeeper Calling

ILS Servers

NetMeeting Clients on the Internet

Configuring the Gatekeeper

Managing the Gatekeeper

Virtual Private Networking

Configuring VPN Client Access

Gateway-to-Gateway VPN Configuration

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 11 Optimizing, Customizing, Integrating, and Backing Up ISA Server

Introduction

Optimizing ISA Server Performance

Establishing a Baseline and Monitoring Performance

Addressing Common Performance Issues

Customizing ISA Server

Using the ISA Server Software Developer’s Kit

Using Third-Party Add-ons

Integrating ISA Server with Other Services

Understanding Interoperability with Active Directory

Understanding Interoperability with Routing and Remote Access Services

Understanding Interoperability with Internet Information Server

Understanding Interoperability with IPSecurity

Integrating an ISA Server into a Windows NT 4.0 Domain

Backing Up and Restoring the ISA Configuration

Backup Principles

Backing Up and Restoring Standalone Server Configurations

Backing Up and Restoring Array and Enterprise Configurations

Summary

Solutions Fast Track

Frequently Asked Questions

Chapter 12 Troubleshooting ISA Server

Introduction

Understanding Basic Troubleshooting Principles

Troubleshooting Guidelines

Troubleshooting ISA Server Installation and Configuration Problems

Hardware and Software Compatibility Problems

Initial Configuration Problems

Troubleshooting Authentication and Access Problems

Authentication Problems

Access Problems

Dial-up and VPN Problems

Troubleshooting ISA Client Problems

Client Performance Problems

Client Connection Problems

Troubleshooting Caching and Publishing Problems

Caching Problems

Publishing Problems

Summary

Solutions Fast Track

Frequently Asked Questions

Appendix ISA Server 2000 Fast Track

Index