This scenario demonstrates how you can add Internet-based client management to an existing Configuration Manager site in the intranet, without having to add new site system servers in the perimeter network. Because this configuration bridges the security boundary of the perimeter network into the intranet, it is not a security best practice. However, as in this scenario, it does offer an efficient way to quickly test the Internet-based client management feature without having to install and configure additional servers. It also disables certificate revocation checking on clients, to save the additional configuration that would be required on a production network to publish a certificate revocation list that is accessible from the Internet.
The administrators at Trey Research are interested in implementing Internet-based client management to supplement their computer management strategy for their existing Configuration Manager hierarchy. They have had problems keeping laptops up-to-date with important security software updates and application updates when staff spends extended time away from their offices to attend worldwide conferences. However, Trey Research does not currently have a PKI in place, which is a requirement for Internet-based client management. Before management will agree to resource this project, they require confirmation that Internet-based client management works and will provide the business benefits that they require.
The Configuration Manager administrator, Terry Adams, takes the course of action described in the following table.
|
Process
|
Reference
|
|---|
|
For testing purposes, Terry uses a nonproduction Active Directory forest on an isolated section of the intranet that also has access to the Internet.
The Internet namespace for the company is treyresearch.net, and the internal Active Directory namespace on the test network is testnet.treyresearch.net.
|
Internal process.
|
|
For rapid deployment and with limited testing equipment, Terry decides to use just one server for all his Configuration Manager site systems that will host the following site system roles:
-
Site server
-
Management point
-
Distribution point
-
Software update point
Terry decides not to deploy a fallback status point for this proof of concept, because although it would be useful for identifying client communication issues, it is not needed to test basic site operation.
After reading through the server placement options for Internet-based site systems, Terry realizes that a single site system can support intranet clients and Internet-based clients. Although this is not a security best practice, the advantages for Terry are that he needs to install and configure fewer servers. This strategy allows Terry to test the Internet-based client management feature more quickly than if he had to install and configure multiple servers. The security risks of hosting multiple site system roles on a single server and of accepting Internet traffic into the intranet are mitigated by the test network's isolation from the production network.
|
About the Fallback Status Point in Configuration Manager
Determine Server Placement for Internet-Based Client Management
|
|
Terry installs a new server running Windows Server 2003 Service Pack 1 (which he names IBCMServer) and joins it to the domain. This server will be his single site system server. On it, he also installs IIS and all other prerequisites for Configuration Manager 2007.
He then extends the Active Directory schema for Configuration Manager 2007 and enables publishing by creating the System Management container and configuring the permissions on it for the IBCMServer computer.
Terry then installs a laptop computer running Windows Vista and joins it to the domain.
|
Prerequisites for Installing Configuration Manager
How to Extend the Active Directory Schema for Configuration Manager
|
|
Terry next discusses his proof of concept design with the networking team that manages the company's Internet connectivity requirements. After reading the external dependencies for Internet-based client management, Terry realizes that he will need their help with the following:
-
The front-end firewall must be configured to allow traffic for Internet-based client management.
-
The company Internet DNS servers must be configured with a public host entry for the test Internet-based site system.
They decide to use the same host name of IBCMServer, so the Internet FQDN is IBCMServer.treyresearch.net.
-
The back-end Microsoft ISA Server must publish the Internet-based site systems to the intranet.
|
Prerequisites for Internet-Based Client Management
|
|
The networking team requires acceptance from the security team before they can make changes to the existing Internet infrastructure.
The security team reviews the plan and raises concerns about the server being in the intranet and exposed to traffic from the Internet.
Terry explains that this design is only for a proof of concept on an isolated network and shows them the different supported designs for production networks. In these, the site server is never exposed to Internet traffic, and although the Internet-based site systems can support Internet connections and intranet connections, there are other designs that offer stronger security.
The security team agrees to the design of the proof of concept on the understanding that Terry works with them for a more extensive review of the final design if the project is approved.
|
Supported Scenarios for Internet-Based Client Management
|
|
Terry confirms that his member server has automatically registered the computer name of IBCMServer in his internal Active Directory DNS zone of testnet.treyresearch.net.
The networking team manually adds a DNS A record for IBCMServer in the public DNS zone of treyresearch.net. Because ISA Server will be publishing this Internet-based site system, this record is configured with a public IP address that belongs to one of the external adapters on the ISA Server and that is not currently in use. This external IP address must be dedicated to Internet-based client management connections.
.gif) Note
If Terry had used more than one server for all his Internet-based site system roles, each internal site system that accepts connections over the Internet would require its own dedicated external IP address, even though all connections are through the same ISA Server computer.
|
Configuring DNS for Configuration Manager Site System Roles
|
|
Terry turns his attention to the PKI requirements and checks which certificates are needed for his test network. He references the documentation topics that cover the certificate requirements with guidance about how to install them.
Because of the limited scope of the testing environment, Terry needs only the following certificates:
-
Root certification authority
-
Site server signing certificate
-
Web server certificate (which must have both the intranet FQDN and Internet FQDN)
-
Client certificates
|
Certificate Requirements for Native Mode
Deploying the PKI Certificates Required for Native Mode
|
|
Terry realizes that the easiest way to deploy the required certificates is by using a Microsoft enterprise root certification authority, using the Enterprise Edition of Windows Server 2003. This solution provides the following benefits:
-
The root certification authority is automatically deployed to all computers in the Active Directory forest.
-
Web-based enrollment can be used to request custom certificates, with automatic approval.
-
Auto-enrollment is supported with Group Policy.
Terry confirms that his single Active Directory domain controller in the test network is running the Enterprise Edition of Windows Server 2003 and has Internet Information Services (IIS) installed.
Terry then installs on his domain controller Microsoft Certificate Services (with the subcomponents of Certificate Services CA and Certificate Services Web Enrollment Support) and configures an enterprise root certification authority.
After reading the topic about deploying the Web server certificate to site system servers, he realizes that he needs to enable support for the Subject Alternative Name (SAN) certificate attribute so that he can specify both the intranet FQDN and the Internet FQDN. He follows the procedure referenced in the article to enable SAN support on his root certification authority (CA), which, in his test environment, will also issue the certificates.
|
Determine If You Can Use Your Existing PKI (Native Mode)
Deploying the Web Server Certificates to Site System Servers
Information about how to add support for Subject Alternative Names with a Microsoft certification authority: http://go.microsoft.com/fwlink/?LinkId=93692
|
|
Terry has little PKI experience, so he references the step-by-step example deployment guide in the Configuration Manager library.
He follows the procedures exactly for the site server signing certificate and for deploying client certificates. However, he has to modify the procedure for specifying his Web server certificate for this Internet-based site system, because this requires both the intranet FQDN and the Internet FQDN in the Subject Alternative Name:
-
He uses the Web server certificate template without modification, confirming that the option Supplied in the request is enabled on the Subject Name tab.
-
He uses the Web enrollment method to request the Web server certificate from his member server, just as he did for the site server signing certificate.
-
In the certificate form, he specifies the intranet FQDN as the Subject Name, and in the Attributes box, he specifies both the intranet FQDN and the Internet FQDN as follows: san:dns=IBCMServer.testnet.research.net&dns=IBCMServer.research.net.
-
Terry submits the certificate, it is immediately approved, and Terry installs it on the default Web site.
-
Terry returns to the step-by-step example deployment guide for information about how to configure IIS to use the Web server certificate.
|
Step-By-Step Example Deployment of the PKI Certificates Required for Configuration Manager Native Mode: Windows Server 2003 Certification Authority
Information about how to add support for Subject Alternative Names with a Microsoft certification authority: http://go.microsoft.com/fwlink/?LinkId=93692
|
|
After checking the prerequisites for native mode, Terry realizes that because his issuing certification authority is on the intranet, clients on the Internet will not, by default, be able to access the certificate revocation list (CRL). An intranet CRL is published by default with his certification authority.
Terry reads the planning topic on CRL checking and realizes that if clients on the Internet attempt to locate the CRL and this fails, connections to the Internet-based site system roles will fail.
Rather than publish a CRL on the Internet, which would be required for a production network, Terry decides to disable CRL checking on clients within his test environment so that he minimizes additional configuration requirements.
|
Prerequisites for Native Mode
Determine If You Need to Enable Certificate Revocation Checking (CRL) On Clients (Native Mode)
|
|
Terry then runs Configuration Manager 2007 Setup on the member server with the following selections:
-
Simple Setup
-
The same site code in the site server's signing certificate Subject Name.
-
Native mode, successfully browsing to the deployed site server signing certificate.
When setup is complete, Terry performs the following post setup tasks:
-
Configures an Active Directory boundary.
-
Configures the site system server with an intranet FQDN of IBCMServer.testnet.treyresearch.net and an Internet FQDN of IBCMServer.treyresearch.net.
-
Disables CRL checking on clients as a site property, to support the test network environment.
|
Simple Setup Overview
How to Deploy a Site Using Simple Setup
How to Configure Configuration Manager Boundaries
How to Configure the Intranet FQDN of Site Systems
How to Configure the Internet FQDN of Site Systems that Support Internet-Based Client Management
How to Enable or Disable Certificate Revocation Checking (CRL) on Clients
|
|
Terry now installs the Configuration Manager client on the laptop, configures software updates, and confirms standard Configuration Manager operation on the intranet.
|
Tasks for Installing Configuration Manager Clients
Software Updates in Configuration Manager
|
|
With intranet operation in native mode confirmed, Terry then configures the site system roles to allow intranet and Internet client connections.
He also confirms that the distribution point is configured to transfer content using BITS and HTTP.
|
How to Configure a Management Point for Internet-Based Client Connections
How to Configure a Software Update Point for Internet-Based Client Connections
How to Configure a Distribution Point for Internet-Based Client Connections
How to Configure a Distribution Point to Transfer Content Using BITS, HTTP, and HTTPS
|
|
On the laptop computer, Terry specifies IBCM.treyresearch.com as the Internet-based client management point on the Internet tab of Configuration Manager in Control Panel.
|
How to Assign Configuration Manager Client Computers to the Internet-Based Management Point
|
|
The networking team makes the final required configurations to allow the Internet traffic into both the perimeter network and the intranet:
-
The back-end Microsoft ISA Server is configured with a server publishing rule so that incoming HTTPS requests using port 443 to IBCMServer.treyresearch.net maps to HTTPS requests using port 443 to IBCMServer.testnet.treyresearch.net. This configuration uses SSL tunneling, which does not require additional certificates on the ISA Server.
-
The front-end firewall is confirmed as already configured to allow incoming traffic of port 443 to the ISA Server.
|
Determine the Ports Required for Internet-Based Client Management
Determine Requirements for Proxy Web Servers to Use With Internet-Based Client Management
|
|
Terry disconnects his test laptop from the test network and, using the software updates feature in Configuration Manager, creates a new optional software update deployment.
Terry then takes the test laptop home, connects to the Internet, manually initiates client policy, receives notification of the optional software update, and is able to successfully install it.
|
How to Initiate Policy Retrieval for a Configuration Manager Client
About the Software Updates End User Experience
Available Software Updates Dialog Box on Clients
|
After this initial successful test, Terry conducts further tests with automatic software updates and software distributions, and he confirms that hardware inventory and desired configuration management compliance information is still reported when the laptop is on the Internet. He also confirms that a content download can seamlessly continue when he moves the laptop from the Internet to the intranet and vice versa.
Terry documents his findings and two weeks later presents his findings to the management team. The successful conclusion convinces the management team that Internet-based client management offers a seamless user experience that provides an effective method of managing laptops even when they are away from the company network. In turn, this helps to keep the laptops secure, so the investment required in a PKI solution is seen to be cost justified.
The company does not have the internal resources or experience to implement an internal PKI, so the proof of concept provides the cost justification to outsource this project so that Internet-based client management can be implemented in the near future.