During Setup of ISA Server 2004 on a computer with a single network adapter, specify all IP address ranges for the Internal network, excluding the following:

• 0.0.0.0
  
• 255.255.255.255
  
• 224.0.0.0-254.255.255.255 (multicast)
  
• 127.0.0.0-127.255.255.255
  

ISA Server includes a number of predefined network templates that respond to common network topologies. When you install ISA Server on a computer with one network adapter, we recommend that you configure the ISA Server Single Network Adapter network template. To do this, use the Network Template Wizard, as follows.

To apply the Single Network Adapter template

1. In ISA Server Management, expand the Configuration node, and then click Networks.
   
2. On the Templates tab, click the Single Network Adapter template.
   
3. On the Welcome page of the Network Template Wizard, click Next.
   
4. On the Export the ISA Server Configuration page, click Export to export your current configuration before applying the Single Network Adapter template. Then click Next.
   

   Caution:
   When you apply a network template, the new template overwrites all current rules (except system policy rules) and network configuration settings.

5. On the Internal Network IP Addresses page, specify settings for the Internal network. Then click Next.
   

   Note:
   The default configuration proposed for the Internal network IP address range is:

   • 0.0.0.1 to 126.255.255.255 and 128.0.0.0 to 255.255.255.254.
     
   • This includes all IP addresses except 0.0.0.0, 255.255.255.255, and the address ranges 127.0.0.0–127.255.255.255 (localhost).
     
   • We recommend that you also exclude 224.0.0.0-254.255.255.255 (multicast).
     
6. On the Select a Firewall Policy page, click Apply default Web proxying and caching configuration, and then click Next.
   

1. Check the settings for the new template, and click Finish to complete the wizard.
   
2. In ISA Server Management, click Apply to save the new settings.
   

After applying the Single Network Adapter network template, the following network and access rule settings are configured:

• Local Host network: 127.0.0.0–127.255.255.255.
  
• Internal network: equals everything else, where everything else is:
  
  • 0.0.0.1–126.255.255.255
    
  • 128.0.0.0–255.255.255.254
    
• Default access rule: denies access to all locations.
  

This is the set of addresses defined by RFC 791 and related RFC updates. Addresses outside this scope are not generally allocated for the Internet or for intranets.

0.0.0.1 - 126.255.255.255, 128.0.0.0 - 223.255.255.255.255, 255.0.0.0 - 255.255.255.254.

When ISA Server is installed on a computer with a single network adapter and configured with the Single Network Adapter template, you can deploy it as a forward proxy and caching server. In this configuration, ISA Server proxies requests from internal clients to remote networks such as the Internet, and can maintain a cache of frequently requested Internet objects to provide Web browser clients with optimized access. Note the following when configuring ISA Server with a single network adapter in a forward Web proxy and caching configuration:

• Only Web Proxy requests are supported.
  
• In a scenario where ISA Server is behind another edge firewall, Web Proxy clients send URL requests to the ISA Server computer. ISA Server checks whether the Web object can be served from the cache. If the page is not cached or has expired, ISA Server makes an Internet request through the edge firewall. The edge firewall handles the ISA Server request in accordance with its access settings, which may or may not allow the request. If allowed, the Web object is returned through the edge firewall to ISA Server, which places the object into its cache in accordance with cache settings, and forwards the cached object to the Web Proxy client.
  
• Rules allowing client access through the ISA Server computer should be configured with source addresses using only actual internal IP addresses. This is required because every IP address is considered part of the Internal network, except for the loop back address. The destination network should either use the Internal network, or a specific address as required.
  
• If Web pages include items requiring protocols other than HTTP and FTP (download), Web Proxy clients accessing the site through ISA Server with a single network adapter cannot access this traffic through ISA Server. You can configure direct access on network settings to allow this.
  
• To provide access to the Internet on the ISA Server computer itself, you must either modify system policies, or create access rules from Local Host to Internal. Even with the Single Network Adapter template applied, ISA Server still protects itself from the Internal network, and system policy or access rules are needed to control traffic between the two networks.
  

  Note:
  This behavior differs from ISA Server 2000 in cache-only mode, which did not filter traffic from any network.

Configuration of forward Web proxy and caching consists of the following process:

• Configure client proxy settings. Configure Web Proxy settings on client browsers to point to ISA Server or use automatic configuration. For more information about automatic configuration, see Automatic Discovery for Web Proxy and Firewall Clients at the Microsoft TechNet Web site.
  
• Configure the Internal network to listen for Web Proxy client requests. The network must be configured to listen for requests from Web Proxy clients.
  
• Configure authentication on the Internal network. To ensure that Web Proxy client requests are authenticated, you can choose to configure authentication on the network, or on specific access rules. If you choose to set Require all users to authenticate on the Internal network properties, the following will occur:
  
  • All users must authenticate, and no anonymous requests will be allowed.
    
  • ISA Server will always ask for user credentials before checking access rules. If Require all users to authenticate is not enabled, client credentials are only requested if client authentication is required to validate an access rule match.
    
• Enable caching. If you want to enable caching for Web objects, enable caching on ISA Server by setting a cache size to greater than zero, and then configure cache rules to maintain frequently requested Web objects to be available from the cache for client requests.
  
• Configure cache rules. Set up cache rules to specify which objects are in the cache, and how they are served to clients. Before ISA Server makes a request to the Internet, it checks whether the requested object is available in the cache, and provides it to the user in accordance with cache rules.
  
• Configure access rules. After applying the Single Network Adapter template, there is a single access rule denying access to all networks. Although all IP addresses are considered part of the Internal network in a single network adapter scenario, client requests are denied by this default rule. Set up access rules to allow Web clients to use HTTP, and HTTPS and FTP if required. The source and destination networks for this rule should be set to Internal.
  

To configure client proxy settings (Internet Explorer)

1. Open Internet Explorer on the client computer.
   
2. Click the Tools menu, and then click Internet Options.
   
3. On the Connections tab, click LAN Settings.
   
4. To specify that a Web Proxy client should use the auto-detection feature to locate an ISA Server computer for Web requests, select Automatically detect settings. Web Proxy clients can use this feature to detect an ISA Server computer that they should use automatically, or you can manually specify an ISA Server computer.
   
5. To use a script for automatic configuration, select Use automatic configuration script, and specify the name of the script.
   

To configure the Internal network to listen for Web Proxy client requests

1. In ISA Server Management, click the Networks node.
   
2. In the details pane, click the Networks tab, and select Internal.
   
3. On the Tasks tab, click Edit Selected Network.
   
4. On the Web Proxy tab, ensure that Enable Web Proxy clients is selected.
   

To configure authentication on the Internal network

1. In ISA Server Management, click the Networks node.
   
2. In the details pane, click the Networks tab, and select Internal.
   
3. On the Tasks tab, click Edit Selected Network.
   
4. On the Web Proxy tab, click Authentication.
   
5. To allow requests only from Web Proxy users with validated credentials, select Require all users to authenticate. This blocks anonymous requests.
   
6. Select the type of authentication that should be used in the Method list.
   

To configure caching

1. In ISA Server Management, expand the Configuration node, and then click Cache.
   
2. In the details pane, click the Cache Drives tab, and select the drive you want to use for caching.
   
3. On the Tasks tab, click Define Cache Drives (enable caching).
   
4. In Maximum cache size (MB), type the amount of space on the selected drive to allocate for caching.
   

To configure cache rules

1. In ISA Server Management, expand the Configuration node, and then click Cache.
   
2. In the details pane, click the Cache Rules tab.
   
3. On the Tasks tab, click Create a Cache Rule.
   
4. On the Welcome page of the New Cache Rule Wizard, specify a descriptive name for the rule. Then click Next.
   
5. On the Cache Rule Destination page, select the network to which the rule applies. Click Add, expand Networks, and then click Internal. Click Add, and then click Close. Then click Next.
   
6. On the Content Retrieval page, specify how content should be retrieved from the cache, and then click Next:
   
   1. To specify that an object should be retrieved from the cache if it is valid, or otherwise route the request to the Internet Web server or upstream proxy server, click Only if a valid version of the object exists in the cache. If no valid version exists, route the request to the server.
      
   2. To specify that an object should be retrieved from the cache if it is available (regardless of whether it is valid), or otherwise route the request to the Internet Web server or upstream proxy server, click If any version of the object exists in the cache. If none exists, route the request to the server.
      
   3. To specify that an object should be retrieved from the cache if it is available (regardless or whether it is valid), or otherwise the request should be dropped, click If any version of the object exists in the cache. If none exists, drop the request (never route the request to the server).
      

      Note:
      A cache object is considered valid if its Time to Live (TTL) value has not expired. For HTTP objects, expiration is based on the TTL defined in the response header and TTL boundaries defined in the cache rule.

7. On the Cache Content page, specify how objects retrieved are stored in the cache, and then click Next:
   
   • To never cache Web objects, click Never, no content will ever be cached.
     
   • To cache objects if the Web server supplying the object indicates that it should be cached, click If source and request headers indicate to cache.
     
   • To cache all content even if it is not marked as cacheable (including content retrieved using a query that returned content that is accessible by using a URL with a question mark in it), click Dynamic content.
     
   • To cache content with 302 and 307 response codes, click Content for offline browsing (302, 307 responses).
     
   • To cache content that may require authentication for access, click Content requiring user authentication for retrieval.
     
8. On the Cache Advanced Configuration page, to specify a size limit for cached objects, click Do not cache objects larger than, and then specify a maximum size. To specify that SSL objects should be cached, click Cache SSL responses. Then click Next.
   

   Note:
   Caching SSL requests is only functional for Web-published content because Web Proxy client requests for SSL content is tunneled between the client and upstream server and thus not available to ISA Server for caching.

9. On the HTTP Caching page, consider the following options, and then click Next:
   
   • To specify that HTTP objects should be cached, click Enable HTTP caching.
     
   • To specify how long HTTP objects should remain in the cache as a percentage of content age, specify a value in Set TTL of objects (% of the content age).
     

   Note:
   The TTL of an HTTP object in the cache is set to a percentage of the age of the content (the amount of time that has passed since an object was created or modified). The higher percentage you specify, the less frequently the object is refreshed in the cache.

   • To specify how long HTTP objects should remain in the cache as a time value, type the minimum and maximum times in No less than and No more than.
     
   • To apply TTL settings to objects, even if the object source header specifies an expiration time, click Also apply these TTL boundaries to sources that specify expiration.
     
10. On the FTP Caching page, click Enable FTP caching to specify that downloaded FTP objects should be cached. In Time-To-Live for FTP objects, specify how long FTP objects should remain in the cache before they expire. Then click Next.
    
11. Check rule settings, and then click Finish to complete the wizard.
    
12. Click Apply to save the settings.
    

To configure access rules

1. In ISA Server Management, right-click the Firewall Policy node, point to New, and then click Access Rule.
   
2. In the Welcome page of the New Access Rule Wizard, type a descriptive name for the rule. Then click Next.
   
3. On the Rule Action page, click Allow. Then click Next.
   
4. On the Protocols page, select Selected protocols, and then click Add. Click to expand Web, and then select the protocols you want to allow Web Proxy clients to access. These include HTTP, and possibly HTTPS and FTP. Select each protocol, and then click Add. After you have selected the required protocols, click Close. Then click Next.
   
5. On the Access Rule Sources page, click Add. Expand Networks. Click Internal, and then click Add. Click Local Host, and then click Add. Click Close. Then click Next.
   

   Note:
   You can also create and use address range sets to further limit the clients that can use ISA Server as a Web proxy.

6. On the Access Rule Destinations page, click Add. Expand Networks. Click Internal, and then click Add. Click Close. Then click Next.
   
7. On the User Sets page, select how users authenticate with the rule, and then click Next:
   
   • To allow anonymous Web Proxy access, select All Users.
     
   • To force authentication for Web Proxy requests, click Add. In the Add Users dialog box, click All Authenticated Users. Click Close. In the User Sets page, select All Users, and then click Remove.
     

   Note:

   If a rule that matches the Web Proxy request requires authentication, client credentials will be requested and validated. If you specify that the rule applies to All Authenticated Users, any users failing authentication will be denied by the rule (even an allow rule). You can create a new user set that consists of Windows users and groups, RADIUS, or SecurID users. If you select RADIUS or SecurID, you can choose All Users in Namespace, or Specified User Name. If you specify All Users in Namespace, RADIUS or SecurID will allow any user that can be authenticated using Basic authentication (users not prompted for credentials).

8. On the Finish page of the wizard, check settings, and then click Finish to complete the wizard.
   
9. Click Apply to save settings.
   

You can deploy ISA Server on a single network adapter computer in reverse proxy mode, enabling you to publish Web servers, and publish Exchange servers for Outlook Web Access connections. You can publish servers over HTTP or over HTTPS for a secure SSL connection. You can authenticate incoming requests, and chain requests to upstream proxies.

When you publish Outlook Web Access on a single network adapter computer, the following Outlook Web Access features are available:

• Standard Outlook Web Access features such as sending and receiving e-mail, calendars, and other features
  
• Exchange Outlook Mobile Access, ActiveSync, and Outlook RPC over HTTP
  
• Forms-based authentication
  
• HTTP and HTTPS
  

For example, publishing a Web server or Outlook Web Access over an SSL connection on a single network adapter computer consists of the following configuration process:

• Specify public DNS entry. The edge device protecting your organization from the Internet must be configured to forward requests for published servers, or Outlook Web Access requests, to the correct IP address on the ISA Server computer. For example, if an Internet user accesses Outlook Web Access at https://mail.fabrikam.com/exchange, there must be a public DNS entry for mail.fabrikam.com, and that entry must resolve to the external interface of the edge device that is configured to forward Outlook Web Access requests to ISA Server.
  
• Configure edge device to forward packets. The edge device should be configured to forward relevant requests to the ISA Server computer.
  
• Configure ISA Server network template. Ensure that ISA Server is installed and configured with the Single Network Adapter template.
  
• Request a server certificate on the Web server or Outlook Web Access server. For secure publishing, an HTTPS-to-HTTPS bridging configuration is recommended. This configuration provides an SSL connection from the client to the ISA Server computer, and from the ISA Server computer to the published Web server. Generally, you use a commercial certificate for SSL external publishing. You create a certificate request from a commercial certification authority (CA) (such as Verisign or Thawte) using the IIS Web Server Certificate Wizard. Because IIS is not typically installed on ISA Server, you request the certificate from the published Web server. Currently, there is no way to request a server certificate from ISA Server 2004 directly to the CA.
  
• Export the server certificate. After obtaining the certificate on the Web server, export it to a file, together with the private key.
  
• Import the server certificate. Import the certificate from the exported file to the computer’s Personal certificate store.
  

  Note:
  There are a number of best practice guidelines that should be followed when requesting and configuring certificates. For more information, see Troubleshooting SSL Certificates in ISA Server 2004 Publishing on the Microsoft TechNet Web site. For detailed procedures for obtaining server certificates, see Digital Certificates for ISA Server 2004 on the .

• Enable SSL on the published Web server. In a secure published scenario, configure IIS on the published server to support SSL-encrypted Basic authentication.
  
• Create a listener. In ISA Server Management, create a secure Web listener on the Internal network, to listen for requests for the published server.
  

  Note:

  For security purposes, consider using forms-based authentication, and limiting attachment access from public computers. You should configure these properties after creating the listener using the New Web Listener Wizard. In ISA Server 2004 Standard Edition, forms-based authentication could not be used with any other authentication method. In ISA Server 2004 Standard Edition Service Pack 1, and ISA Server 2004 Enterprise Edition, you can configure forms-based authentication together with RADIUS.

• Create a secure publishing rule. For Web publishing, create a rule using the Web Publishing Rule Wizard. For publishing Outlook Web Access, create a rule using the Mail Server Publishing Wizard. Note that you can also publish Outlook Mobile Access, RPC over HTTP, and Exchange ActiveSync using this wizard. To publish servers securely, use an HTTPS-to-HTTPS bridging configuration. In this scenario, users connect to ISA Server using SSL. ISA Server terminates the SSL connection at the ISA Server computer and inspects traffic. Packets are then forwarded to the published Web server over a new HTTPS connection.
  

  Note:

  For step-by-step instructions on publishing Web servers, see Publishing Web Servers using ISA Server 2004 at the Microsoft TechNet Web site. and Publishing Web Servers Using ISA Server 2004 Enterprise Edition at the Microsoft TechNet Web site. For step-by-step instructions on publishing Outlook Web Access, see Outlook Web Access Server Publishing in ISA Server 2004 at the , and Outlook Web Access Server Publishing in ISA Server 2004 Enterprise Edition at the .