Apply the principle of least privilege, where a user has the minimum privileges necessary to perform a specific task. This helps ensure that, if a user account is compromised, the impact is minimized by the limited privileges held by that user.

Keep the Administrators group and other user groups as small as possible. A user who belongs to the Administrators group on the ISA Server computer, for example, can perform any task on the ISA Server computer.

In Standard Edition, users in the Administrators group are implicitly assigned the role of ISA Server Full Administrator. They have full rights to configure and monitor ISA Server. For more information about roles, see the Administrative Roles section.

In Enterprise Edition, users who belong to the Administrators group on the Configuration Storage server can control the enterprise configuration. They can directly modify any data on the Configuration Storage server.

When you log on to the ISA Server computer, log on with the least privileged account necessary to do the task. For example, to configure a rule, you should log on as an ISA Server administrator. However, if you only want to view a report, log on with lesser privileges.

In general, use an account with restrictive permissions to perform routine tasks that are unrelated to administration, and use an account with broader permissions only when performing specific administrative tasks.

We recommend that you do not enable the Guest account on the ISA Server computer.

When a user logs on to the ISA Server computer, the operating system checks whether the credentials match a known user. If the credentials do not match a known user, the user is logged on as Guest, with the same privileges allowed to the Guest account.

ISA Server recognizes the Guest account as the default All Authenticated Users user set.

With a new installation, ISA Server discretionary access control lists (DACLs) are appropriately configured. In addition, ISA Server reconfigures DACLs appropriately when you modify administrative roles (for more information, see the Administrative Roles section) and when the ISA Server Control Service (isactrl) is restarted.

Caution:
Because ISA Server periodically reconfigures DACLs, you should not use the Security and Configuration Analysis tool to configure the per-file DACLs on the ISA Server objects. Otherwise, there may be a conflict between the DACLs set by Group Policy and the DACLs that ISA Server tries to configure.

Do not modify the DACLs set by ISA Server. Note that ISA Server does not set DACLs for the objects in the following list. You should set DACLs for the objects in the following list carefully, giving permissions only to trusted, specific users:

• Folder for reports (when you select to publish the reports).
  
• Configuration files created when exporting or backing up the configuration.
  
• Log files that are backed up to a different location.
  

Be sure to carefully set DACLs, giving permissions only to trusted users and groups. Also, be sure to create strict DACLs on objects that are indirectly used by ISA Server. For example, when creating an Open Database Connectivity (ODBC) connection that will be used by ISA Server, be sure to keep the data source name (DSN) secure.

Configure strict DACLs for all applications running on the ISA Server computer. Be sure to configure strict DACLs for associated data in the file system and in the registry.

If you customize the SecurID HTML or error message templates, be sure to configure appropriate DACLs. The recommended DACL is "Inherit permission from parent."

Tip:
We recommend that you do not save critical data (such as executable files and log files) to FAT32 partitions. This is because DACLs cannot be configured for FAT32 partitions.

When you revoke administrative permissions for an ISA Server administrator, be sure to also perform the following:

• On the ISA Server computer, delete the user's account.
  
• On the Configuration Storage server (for ISA Server Enterprise Edition), review the ADAM objects.
  
• Modify the ownership of objects that belong to the revoked account.
  

VPN client access is disabled by default. This means that the relevant system policy rule, named Allow VPN client traffic to ISA Server, is also disabled. The default network rule, named VPN Clients to Internal Network, is enabled, even when VPN client access is disabled. If VPN client access had been previously enabled, you can disable it, if it is not required.

1. In the console tree of ISA Server Management, click Virtual Private Networks (VPN):

   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array_Name, and then click Virtual Private Networks (VPN).
     
   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server_Name, and then click Virtual Private Networks (VPN).
     

2. In the details pane, click the VPN Clients tab, and then click Verify that VPN Client Access is Enabled.

3. On the General tab, verify that Enable VPN client access is not selected.

Caching is disabled by default. This means that all relevant caching features, including scheduled content download, are disabled. If caching was previously enabled for ISA Server, you can disable it.

1. In the console tree of ISA Server Management, click Cache:

   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array_Name, expand Configuration, and then click Cache.
     
   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server_Name, expand Configuration, and then click Cache.
     

2. In the details pane, for Enterprise Edition, click the Cache Drives tab. For Standard Edition, click the Cache Rules tab.

3. On the Tasks tab, click Disable caching.

Note:
If caching is disabled, you will not see the option.

Web proxy is enabled by default and is one of the central deployment scenarios of ISA Server 2006. We recommend that you disable Web proxy in scenarios when Web proxy is not used.

The following is a listing of scenarios when ISA Server does not use the Web proxy service:

• ISA Server is used only for VPN connections.
  
• There is no requirement for the following additional ISA Server features:
  
• Caching
  
• HTTP compression
  
• Application-layer filtering
  
• There is another ISA Server computer providing Web proxy services.
  

To disable Web proxy on an ISA Server computer, you need to create a new protocol with TCP port 80 and verify that Web Proxy Filter is not selected for the new protocol. When you create an access rule to allow HTTP traffic with the new protocol, the following applies:

• Users must have a default gateway properly defined or use the Firewall Client.
  
• Name resolution must be properly defined.
  
• Web proxy settings must be cleared.
  

To re-enable Web proxy, use the original HTTP protocol that ISA Server creates during setup in any access rule.

When you install ISA Server, a suite of application filters and Web filters are also installed. You can subsequently install additional add-ins, provided by third-party vendors. Follow these security guidelines:

• Do not install application filters or Web filters that you do not require.
  
• Never install a filter from an untrusted source.
  
• Save the dynamic-link library (DLL) associated with the add-in in a protected library (for example, %ProgramFiles%\Microsoft ISA Server). Be sure to configure strict access control lists (ACLs) for this library.
  
• Disable application and Web filters that you do not require.
  

1. In the console tree of ISA Server Management, click Add-ins:

   • For ISA Server 2006 Enterprise Edition, for array-level add-ins, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array_Name, expand Configuration, and then click Add-ins.
     
   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server_Name, expand Configuration, and then click Add-ins.
     

2. On the details pane, select the applicable add-in.

3. On the Tasks tab, click Disable Selected Filters.

When you install ISA Server, basic network services are enabled. After installation, ISA Server can access name resolution servers and time synchronization services on the Internal network.

If the network services are available on a different network, you should modify the applicable configuration group sources to apply to the specific network. For example, suppose the Dynamic Host Configuration Protocol (DHCP) server is not located on the Internal network, but on a perimeter network. Modify the source for the DHCP configuration group to apply to that perimeter network.

You can modify the system policy so that only particular computers on the Internal network can be accessed. Alternatively, you can add additional networks, if the services are found elsewhere.

The following table shows the system policy rules that apply to network services.

If you require use of the DCOM protocol—for example, to remotely manage the ISA Server computer—be sure that you do not enable Enforce strict RPC compliance.

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array_Name, and then click Firewall Policy.
     
   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server_Name, and then click Firewall Policy.
     

2. On the Tasks tab, click Edit System Policy.

3. In System Policy Editor, in the Configuration Groups tree, click Active Directory.

4. Verify that Enforce strict RPC compliance is not selected.

Tip:
DCOM is often required for various services, including remote management and certificate auto-enrollment.

If you do not require Windows authentication or RADIUS authentication, you should perform the following steps to disable the applicable system policy configuration groups.

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array_Name, and then click Firewall Policy.
     
   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server_Name, and then click Firewall Policy.
     

2. On the Tasks tab, click Edit System Policy.

3. In System Policy Editor, in the Configuration Groups tree, click Active Directory.

4. On the General tab, verify that Enable this configuration group is not selected.

   Note:
   When you disable the Active Directory system policy configuration group, access to all LDAP protocols is no longer allowed. If you require the LDAP protocols, create an access rule allowing use of these protocols.

5. Repeat step 3 and step 4 for the RADIUS configuration group.

   Tip:
   If you require only Windows authentication, be sure to configure the system policy, disabling use of all other authentication mechanisms.

Communication with RSA SecurID authentication servers is not enabled by default. If your firewall policy requires RSA SecurID authentication, be sure to enable this configuration group.

Certificate revocation lists (CRLs) cannot be downloaded by default. This is because the CRL Download configuration group is not enabled by default.

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array_Name, and then click Firewall Policy.
     
   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server_Name, and then click Firewall Policy.
     

2. On the Tasks tab, click Edit System Policy.

3. In System Policy Editor, in the Configuration Groups tree, click CRL Download.

4. On the General tab, verify that Enable this configuration group is selected.

5. On the To tab, select the network entities from which CRLs can be downloaded.

Important:
The most common method to download the CRL is via HTTP. Therefore, when you enable CRL Download, all HTTP traffic will be allowed from the Local Host network (the ISA Server computer) to network entities listed on the To tab. If your certificates use another protocol to download the CRL, you need to create an access rule for these protocols.

Often, you will manage ISA Server from a remote computer. Carefully determine which remote computers are allowed to manage and monitor ISA Server. The following table shows the system policy rules that should be configured.

By default, the system policy rules allowing remote management of ISA Server are enabled except for the Web Management configuration group. ISA Server can be managed by running a remote Microsoft Management Console (MMC) snap-in, or by using Terminal Services.

By default, these rules apply to the built-in Remote Management Computers computer set. When you install ISA Server, this empty computer set is created. Add to this empty computer set all computers that will remotely manage ISA Server. Until you do so, remote management is effectively not available from any computer.

Tip:
Limit remote management to specific computers by configuring the Remote Management Computers computer set.

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array_Name, and then click Firewall Policy.
     
   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server_Name, and then click Firewall Policy.
     

2. On the Toolbox tab, click Network Objects.

3. Expand Computer Sets, right-click Remote Management Computers, and then click Properties.

4. Click Add, and then click Computer.

5. In Name, type the name of the computer.

6. In Computer IP Address, type the IP address of the computer that can remotely manage ISA Server.

Note:
When you create an array during the installation of ISA Server Firewall services, the Configuration Storage server is automatically added to the Remote Management Computers computer set. If you create the array before installing the ISA Server firewall, you will need to manually add the Configuration Storage server to the Remote Management Computers computer set.

By default, remote logging and monitoring are disabled. Only the SMTP configuration group is enabled by default, allowing Simple Mail Transfer Protocol (SMTP) communication from ISA Server to computers on the Internal network. This is required, for example, when you want to send alert information in an e-mail message. The following configuration groups are disabled by default:

• Remote Logging (NetBIOS)
  
• Remote Logging (SQL)
  
• Remote Performance Monitoring
  
• Microsoft Operations Manager
  

The following table provides a description of the configuration groups.

By default, the system policy rules allowing access to diagnostics services are enabled, except for the HTTP Connectivity verifiers group, with the following permissions:

• ICMP. This is allowed to All Networks (and Local Host). This service is important for determining connectivity to other computers.
  
• Windows Networking. This allows NetBIOS communication, by default to computers on the Internal network.
  
• Microsoft Error Reporting. This allows HTTP access to the Microsoft Error Reporting sites URL set, to allow reporting of error information. By default, this URL set includes specific Microsoft sites, and should not be modified.
  
• HTTP Connectivity verifiers. This allows the ISA Server computer to use HTTP and Secure HTTP (HTTPS) protocols to check whether a specific computer is responsive.
  

The following table shows the system policy configuration groups that are enabled by default.

In addition, the following diagnostic service is not enabled by default: HTTP Connectivity verifiers.

When you create a connectivity verifier, the HTTP Connectivity verifiers configuration group is enabled, allowing the Local Host network to use HTTP or HTTPS to access computers on any other network. The following table describes the HTTP Connectivity verifiers configuration group.

We recommend that you limit this access to the specific computers whose connectivity you want to verify.

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array_Name, and then click Firewall Policy.
     
   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server_Name, and then click Firewall Policy.
     

2. On the Tasks tab, click Edit System Policy.

3. In System Policy Editor, in the Configuration Groups tree, click HTTP Connectivity verifiers.

4. On the To tab, click All Networks (and Local Host) and then click Remove.

5. Click Add and then select the network entities whose connectivity you want to verify. All HTTP traffic will be allowed from the Local Host network (the ISA Server computer) to network entities listed on the To tab.

By default, the scheduled download jobs feature is disabled. The following table describes the Scheduled Download Jobs configuration group.

When you create a content download job, you will be prompted to enable this system policy rule. ISA Server will be able to access the sites specified in the content download job.

The default system policy allows HTTP and HTTPS access from the Local Host network (the ISA Server computer) to the Microsoft.com Web site. This is required for:

• Error reporting (as described in the Diagnostic services).
  
• Maintenance and management.
  

By default, the Allowed Sites configuration group is enabled, allowing ISA Server to access content on specific sites that belong to the System Policy Allowed Sites domain name set. The following table describes the Allowed Sites configuration group.

This URL set includes various Microsoft Web sites, by default. You cannot modify the System Policy Allowed Sites domain set, however you can create a new Domain Name Set and add it to Allowed Sites system policy group to include additional Web sites, which ISA Server will be allowed to access.

1. In the console tree of ISA Server Management, click Firewall Policy:

   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array_Name, and then click Firewall Policy.
     
   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server_Name, and then click Firewall Policy.
     

2. On the Tasks tab, click Edit System Policy.

3. In System Policy Editor, in the Configuration Groups tree, click Allowed Sites.

4. On the To tab, click Add, and then select the required domain name set.

HTTP and HTTPS access will be allowed to the specified Web sites.

The Configuration Storage server recognizes each ISA Server array member by a unique account, especially created for this purpose. This account is not subject to account lockout, thus preventing potential denial of service attacks.

The default password on this account, created when you install the array member, is a strong password. If you change this password, we recommend that you configure a strong password.

ISA Server 2006 can help you detect and mitigate the virus outbreaks and subsequent flooding of connections that are a prevalent corporate reality. The ISA Server flood mitigation features include various functions, which you can configure and monitor to help ensure that your network stays protected from malicious attacks. By default, flood mitigation is enabled with default settings and is configured to log traffic blocked by the flood mitigation settings.

1. In the console tree of ISA Server Management, click General:

   • For ISA Server 2006 Enterprise Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Arrays, expand Array_Name, expand Configuration, and then click General.
     
   • For ISA Server 2006 Standard Edition, expand Microsoft Internet Security and Acceleration Server 2006, expand Server_Name, expand Configuration, and then click General.
     

2. In the details pane, click Configure Flood Mitigation Settings.

3. Click Edit to modify the values of the desired setting.

The most secure method of authentication is Extensible Authentication Protocol-Transport Level Security (EAP-TLS) when used in conjunction with smart cards. Despite the deployment challenges involved in using EAP-TLS and smart cards, which require a public key infrastructure (PKI), this is considered the most secure authentication method. Enable EAP-TLS, which is disabled by default on the profile of a remote access policy.

When you use the EAP-TLS authentication protocol, you must install a computer certificate on the Internet Authentication Service (IAS) server. For client and user authentication, you can install a certificate on the client computer, or you can use smart cards. Before you deploy certificates, you must design the certificate with the correct requirements.

If you use password-based authentication, enforce strong password policies on your network to make dictionary attacks more difficult.

Consider requiring your remote VPN clients to be authenticated with more secure authentication protocols, such as Microsoft Challenge Handshake Authentication Protocol version 2 (MS-CHAP v2) or Extensible Authentication Protocol (EAP), rather than allowing them to use protocols such as Password Authentication Protocol (PAP), Shiva Password Authentication Protocol (SPAP), and Challenge Handshake Authentication Protocol (CHAP).

We strongly recommend that PAP, SPAP, and CHAP be disabled. PAP, SPAP, and CHAP are disabled by default.

The use of certificates for authentication of site-to-site VPN connections is the recommended deployment scenario. The following security considerations need to be addressed when using certificates:

• You should use a dedicated internal certification authority (CA) to issue the required certificates for site-to-site VPN connections. This is due to the fact that IPsec does not match the name of the certificate to the name of the site. If the certificates come from the same CA, this is sufficient for authentication.
  
• Enforce certificate revocation list (CRL) checking. By default, IPsec will attempt to download the CRL from the issuing CA during the establishment of the VPN connection. If the CRL cannot be downloaded for any reason, IPsec still considers the certificate to be valid and allows the establishment of the VPN connection. If an array member is stolen, the system or the exported certificate could potentially be used to establish a site-to-site VPN connection with another array member even if the certificate has been revoked. To mitigate this risk, configure StrongCRLCheck checking on all array members. StrongCRLCheck checking forces the array member to check the validity of each certificate that is presented against the CRL. If the array member cannot download the CRL, the certificate is considered to be not valid and the connection will be refused.
  

1. Configure an additional CRL distribution point on the issuing CA. The host name used in the CRL distribution point should be resolvable on the Internet.

2. Reduce the validity period of a CRL. The validity period of a CRL is the period of time that the CRL is considered authoritative by a verifier of a certificate. As long as the verifier of a certificate has a valid CRL in its local cache, it will not attempt to retrieve another CRL from the CA. The validity period of a CRL is based upon the CRL publishing interval plus a maximum of 10 percent to allow for replication. The default CRL publishing interval is one week. For more information about CRL distribution points, CRL publishing, and certificate revocations, see Windows Server 2003 product Help.

3. Reissue all certificates already issued, to include the new CRL distribution point value in the certificate.

4. Publish the new CRL distribution point to the Internet using the ISA Server Web Publishing Wizard.

5. Specify that the VPN tunnel cannot be established unless the certificate has been checked against the CRL:

   • Set the StrongCRL value in the registry, under the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PolicyAgent\ key, add a new Oakley subkey, with a DWORD entry: StrongCRLCheck, and assign it a value of 2.    
     

6. Then restart the Policy Agent service and the Microsoft Firewall service.

   Note:
   When the Policy Agent is stopped and restarted, the IPsec site-to-site VPN connection no longer functions correctly. TCP SYN and UDP packets will leave ISA Server in plain text and any replies will be dropped by ISA Server because they are in plain text. To correct this issue, after restarting the Policy Agent, stop and start the Microsoft Firewall service or restart the server.

Note:
By default, IPsec will wait 10 seconds to complete the CRL retrieval process. If the CRL cannot be retrieved at that time, IPsec will cause the authentication to fail when StrongCRLCheck has been set to a value of 2. On a connection with slow links, this can cause a site-to-site VPN connection to fail.

For more information about IPsec, see "How IPSec Works" at the Microsoft TechNet Web site.