To configure ISA Server to work behind an SSL accelerator, you must perform the following steps:

• Create a Web listener that listens only for traffic from the SSL accelerator on a separate network.
  
• Configure the SSL accelerator port on the Web listener.
  
• Disable HTTPS listening on the Web listener.
  

Create a Web Listener

Configure the SSL Accelerator Port

Option Explicit

'Define the constant needed
const Error_FileNotFound = &H80070002

Main(WScript.Arguments)

Sub Main(args)
    If(args.Count = 1) Then
        SetSslAcceleratorPort args(0)
    Else
        Usage()
    End If
End Sub

Sub SetSslAcceleratorPort(wlName)

    ' Create the root object.
    Dim root  ' The FPCLib.FPC root object
    Set root = CreateObject("FPC.Root")

    ' Declare the other objects needed.
    Dim isaArray        ' An FPCArray object
    Dim webListener     ' An FPCWebListener object
    Dim text            ' A String
    Dim input           ' A String

    ' Get a reference to the local array object.
    Set isaArray = root.GetContainingArray()

    ' Get a reference to the Web listener specified.
    On Error Resume Next
    Set webListener = isaArray.RuleElements.WebListeners.Item(wlName)
    If Err.Number = Error_FileNotFound Then
        WScript.Echo "The Web listener specified could not be found."
    Else
        Err.Clear
        On Error GoTo 0
        With webListener.Properties
            If .SSLAcceleratorPort = 0 Then
                text = "No SSL accelerator port is configured." & VbCrLf _
                       & "You can enter a nonzero value to enable" & VbCrLf _
                       & "an SSL accelerator port."
            Else
                text = "Current SSL accelerator port: " & .SSLAcceleratorPort _
                       & VbCrLf _
                       & "You can change this value, or enter 0" & VbCrLf _
                       & "to disable the SSL accelerator port."
            End If
            input = InputBox(text,"SSL Accelerator Port", "443")
        End With
        If CInt(input) <> webListener.Properties.SSLAcceleratorPort Then
            WScript.Echo "Changing the SSL accelerator port to " & CInt(input) _
                         & "..."
            webListener.Properties.SSLAcceleratorPort = CInt(input)
        End If
        If webListener.Properties.SSLAcceleratorPort <> 0 Then
            WScript.Echo "Ensuring that the SSL port is set to 0..."
            webListener.Properties.SSLPort = 0
        End If
        isaArray.Save
    End If

End Sub

Sub Usage()
    WScript.Echo "Usage:" & VbCrLf _
        & "  CScript " & WScript.ScriptName & " WebListener" & VbCrLf _
        & "" & VbCrLf _
        & "    WebListener - Name of the Web listener" 
    WScript.Quit
End Sub

In this section, you will create a computer object for the SSL accelerator. This object will be used when creating the access rule, allowing you to limit the access to the computer object.

Perform the following procedure to create a computer object.

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server_Name, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array_Name, and then click Firewall Policy.
     

2. On the Toolbox tab, click Network Objects, click New, and then select Computer.

3. Type a name for the computer object, such as SSL Accelerator, in the Name field and type the device's IP address in the Computer IP Address field. If you do not know the IP address, you can use the Browse button to locate the device.

In this section, you will create a protocol definition for the SSL accelerator. This object will be used when creating the access rule, allowing you to limit the access to the computer object.

Perform the following procedure to create a protocol definition.

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server_Name, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array_Name, and then click Firewall Policy.
     

2. On the Toolbox tab, click Protocols, click New, and then select Protocol.

3. On the Welcome page, type a name for the protocol, such as SSL Accelerator Protocol, in the Name field, and the click Next.

4. On the Primary Connection Information page, click New, and in the New/Edit Protocol Connection dialog box, provide the protocol definition information, including the port number provided in the SSL accelerator documentation. Click OK to close the dialog box, and then click Next.

5. On the Secondary Connections page, leave the default setting, No, and then click Next.

6. On the summary page, review the protocol definition, and then click Finish.

Perform the following procedure to create an access rule.

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server_Name, and then click Firewall Policy.
     
   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array_Name, and then click Firewall Policy.
     

2. On the Tasks tab, click Create Access Rule. Use the wizard to create the rule as outlined in the following table.

   Page	Field or property	Setting
   Welcome	Access rule name	Type a name for the rule, such as SSL Accelerator Access.
   Rule Action	Action to take when rule conditions are met	Select Allow.
   Protocols	This rule applies to Protocols	Select Selected Protocols. Add the SSL Accelerator Protocol you previously defined to the list. To add the protocol to the list, click Add to open the Add Protocols dialog box. In the Add Protocols dialog box, expand User-Defined, and select SSL Accelerator Protocol. Click Add, and then click Close to close the Add Protocols dialog box.
   Access Rule Sources	This rule applies to traffic from these sources	Add the Local Host network to the list. To add the Local Host network, click Add to open the Add Network Entities dialog box. In the Add Network Entities dialog box, expand Networks, and then select Local Host. Click Add, and then click Close to close the Add Network Entities dialog box.
   Access Rule Destinations	This rule applies to traffic sent to these destinations	Add the computer object created in the previous section. For example, add SSL Accelerator. To add a computer object, click Add to open the Add Network Entities dialog box. In the Add Network Entities dialog box, expand Computers, and then select the correct computer object. Click Add, and then click Close to close the Add Network Entities dialog box.
   User Sets	This rule applies to requests from the following user sets	Leave the default of All Users.
   Completing the New Access Rule Wizard	Completing the New Access Rule Wizard	Review your settings, and then click Back to make changes and Finish to complete the wizard.

3. Click the Apply button in the details pane to save the changes and update the configuration. It may take a few minutes for the rule to be applied.

Note   Remember that access rules are ordered, so if a deny rule matching requests exists ahead of this allow rule, access will be denied.