This section will walk you through the two methods for upgrading ISA Server 2004 Standard Edition while maintaining existing settings and configuration:
With an in-place upgrade, you can upgrade your existing ISA Server 2004 computer to ISA Server 2006 on the existing equipment. The ISA Server 2006 installation process detects a valid version of ISA Server 2004 and performs an upgrade installation.
This section provides step-by-step instructions about how to perform an in-place upgrade to ISA Server 2006 Standard Edition:
Back Up the Existing ISA Server 2004 Configuration
.gif) Important: |
|---|
|
We recommend that you back up your configuration, log files, and cache files before making any major changes to ISA Server 2004. This enables you to restore to your current configuration and import the exported configuration file if there is a problem with the upgrade.
|
The following procedure describes how to back up your ISA Server 2004 computer. Perform the following procedure on your existing ISA Server 2004 computer.
To back up your ISA Server 2004 configuration
-
In the console tree of ISA Server Management, expand Microsoft Internet Security and Acceleration Server 2004, and then click Server_Name.
-
On the Tasks tab, click Backup this ISA Server Configuration.
-
In Save in, specify the folder in which the export file will be saved.
-
In File name, type a name for the exported file, and then click Backup.
-
In Password and Confirm password, type a password that will be required.
Back Up ISA Server 2004 Log and Cache Files
During the upgrade process, existing log and cache files are erased. ISA Server 2004 log files are not compatible with ISA Server 2006. However, ISA Server 2004 cache files are compatible with ISA Server 2006.
Log files
To back up ISA Server 2004 log files, copy the files to an alternate location. The default location for log files is C:\Program Files\Microsoft ISA Server\ISALogs.
MSDE log format
MSDE is installed and configured as the default log storage format. You must first detach the database from the current server and then copy the files to an alternate location.
To detach a database from the server, enter the following lines at a command prompt.
To detach an MSDE database from a server enter the following
-
OSQL - S
computer_name
\MSFW - E
-
sp_detach_db
database_name
-
go
-
quit
| Note: |
|---|
|
database_name is the name of the .mdf and .ldf files without their extensions.
|
Now you can copy the .mdf and .ldf files to another location.
To reattach the database to the server, perform the following procedure.
To reattach an MSDE database to a server, type the following
-
OSQL -S computer_name\MSFW -E
-
sp_attach_dbs @dbname='database_name', @filename1='full_path_to_mdf_file', @filename2='full_path_to_ldf_file'
-
go
-
quit
Microsoft SQL Server log format
For instructions about how to back up a database in SQL Server, see the SQL Server product documentation.
File log format
To back up ISA Server log files that are configured in file format, copy the files to an alternate location. The default location for log files is C:\Program Files\Microsoft ISA Server\ISALogs.
Cache files
To back up ISA Server 2004 cache files, copy the files to an alternate location. The default location for cache files is <cache drive>\urlcache.
Run ISA Server 2006 Setup
When you run the ISA Server 2006 Setup program, it detects an existing valid version of ISA Server 2004 Standard Edition and performs the upgrade.
| Important: |
|---|
|
If SMTP Message Screener or Firewall Client Share is currently installed, it must be uninstalled before upgrading, because these components are no longer supported in ISA Server 2006.
|
Note the following:
-
During the upgrade, ISA Server services are not operational. We therefore recommend that you disconnect the ISA Server computer from the External network until the upgrade is complete.
-
During the upgrade, ISA Server services are not operational and users will experience an interruption of services until the upgrade is complete. We recommend that you notify users before the upgrade that ISA Server services will be unavailable during the upgrade process.
-
Monitoring applications, such as Microsoft Operations Manager (MOM) agent, use ISA Server files and may interfere with ISA Server setup and removal. To avoid issues, stop these applications before running Setup.
The following procedure describes how to run ISA Server 2006 Setup. Perform the following procedure on the existing ISA Server 2004 computer.
To run ISA Server 2006 Setup
-
Insert the ISA Server 2006 Standard Edition CD into the CD drive, or run ISAAutorun.exe from the shared network drive.
-
In Microsoft ISA Server Setup, click Install ISA Server 2006 and follow the instructions in the wizard to upgrade to ISA Server 2006 as outlined in the following table
|
Page
|
Field or property
|
Setting
|
|---|
|
Welcome
|
None
|
Click Next.
|
|
License Agreement
|
License Agreement
|
Select I accept the terms in the license agreement, and click Next.
|
|
Customer Information
|
User Name
Organization
Product Serial Number
|
Enter user name.
Enter organization name.
Enter product serial number.
|
|
Upgrade Checklist
|
Review the upgrade checklist.
|
Click Next.
|
|
Destination Folder
|
Shows the folder location.
|
Click Next to accept the default folder location.
|
|
Services Warning
|
Review services that will be stopped and services that will be disabled if you continue.
|
Click Next.
|
|
Ready to Install the Program
|
None
|
Click Install.
|
This scenario enables you to export your existing ISA Server 2004 configuration to a new computer, with a clean installation of ISA Server 2006, and then import the saved configuration. When the new ISA Server 2006 computer is fully configured, you can replace the existing ISA Server 2004 computer with the new ISA Server 2006 computer.
| Note: |
|---|
|
If needed, you can perform a migration on the existing ISA Server 2004 computer. In this scenario, you would export your existing ISA Server 2004 configuration, uninstall ISA Server 2004, install ISA Server 2006, and then import the saved configuration.
|
With a migration, you can:
-
Minimize the amount of downtime required to upgrade to ISA Server 2006.
-
Move ISA Server 2006 to new equipment.
-
Upgrade the ISA Server 2004 firewall that is currently running on an operating system that is not supported, such as Microsoft Windows® 2000 Server.
This section provides step-by-step instructions about how to migrate to ISA Server 2006 Standard Edition:
Information Collection
Before you begin the migration process, we recommend that you collect information about your existing ISA Server 2004 deployment.
This section describes the information that you should gather before beginning the migration process.
Networking
You should gather networking information about the ISA Server 2004 computer, as described in the following sections.
General information
Update the following table with information about the fully qualified domain name (FQDN).
|
Property
|
Value
|
|---|
|
FQDN
|
__________________
|
Internal network adapter
Update the following table with information about an internal network adapter.
|
Property
|
Value
|
Property
|
Value
|
|---|
|
IP address
|
___.___.___.___
|
Subnet mask
|
___.___.___.___
|
|
Default gateway
|
___.___.___.___
|
Not applicable
|
Not applicable
|
|
Preferred DNS server
|
___.___.___.___
|
Alternate DNS server
|
___.___.___.___
|
External network adapter (not required for a single adapter deployment)
Update the following table with information about an external network adapter.
|
Property
|
Value
|
Property
|
Value
|
|---|
|
IP address
|
___.___.___.___
|
Subnet mask
|
___.___.___.___
|
|
Default gateway
|
___.___.___.___
|
Not applicable
|
Not applicable
|
|
Preferred DNS server
|
___.___.___.___
|
Alternate DNS server
|
___.___.___.___
|
Perimeter network adapter (only required if additional network adapters are installed and configured)
Update the following table with information about a perimeter network adapter.
|
Property
|
Value
|
Property
|
Value
|
|---|
|
IP address
|
___.___.___.___
|
Subnet mask
|
___.___.___.___
|
|
Default gateway
|
___.___.___.___
|
Not applicable
|
Not applicable
|
|
Preferred DNS server
|
___.___.___.___
|
Alternate DNS server
|
___.___.___.___
|
ISA Server services
The following table lists additional tasks that might need to be taken on the ISA Server 2006 computer after migration, if the following ISA Server 2004 features are currently being used.
|
ISA Server 2004 function
|
Required actions
|
|---|
|
Web publishing listening for HTTPS traffic
|
Export the existing Secure Sockets Layer (SSL) certificate on the ISA Server 2004 computer and import the SSL certificate on the new ISA Server 2006 computer.
Note:
If a new SSL certificate is installed, you will need to modify the affected Web listener and select the new SSL certificate.
|
|
VPN tunnel encryption with server certificates:
-
Internet Protocol security (IPsec) tunnel mode
-
Layer Two Tunneling Protocol (L2TP) over IPsec
-
VPN client access using L2TP over IPsec
|
Install a new server certificate from the same internal certification authority (CA) that issued the server certificate for the ISA Server 2004 computer.
|
|
User account for:
-
L2TP over IPsec
-
Point-to-Point Tunneling Protocol (PPTP)
|
For a remote site to initiate a site-to-site connection, there must be a user account matching the remote network name. If the user account was created as a local user account on the ISA Server 2004 computer, you must create an account with the same user name and password on the ISA Server 2006 computer. The user account must be granted dial-in permissions.
|
For information about how to export and import digital certificates, see "Digital Certificates for ISA Server" at the Microsoft TechNet Web site.
Export the Configuration of the Existing ISA Server 2004 Computer
The following procedure describes how to back up your ISA Server 2004 configuration. Perform the following procedure on your existing ISA Server 2004 computer.
To export the ISA Server 2004 configuration to a file
-
In the console tree of ISA Server Management, expand Microsoft Internet Security and Acceleration Server 2004, and then click Server_Name.
-
On the Tasks tab, click Backup this ISA Server Configuration.
-
In Save in, specify the folder in which the export file will be saved.
-
In File name, type a name for the exported file, and then click Backup.
-
In Password and Confirm password, type a password that will be required.
| Note: |
|---|
|
When exporting an ISA Server configuration that will be imported to an ISA Server 2006 firewall, you must have the Server_Name node selected when performing the export. ISA Server 2006 can only import an ISA Server 2004 exported file when the export was run from the Server_Name node.
|
Install ISA Server 2006 on New Equipment
Perform the following procedure to install ISA Server 2006 on the new computer.
To install ISA Server 2006
-
Install Microsoft Windows Server 2003 with SP1 or Windows Server 2003 R2.
| Note: |
|---|
|
The internal network adapter must be connected and enabled to install ISA Server 2006. If the ISA Server computer will be connected to the same network as the ISA Server 2004 computer, a different IP address must be assigned to the ISA Server 2006 computer internal network adapter during ISA Server 2006 setup.
|
-
Install ISA Server 2006 Standard Edition. For more information, see the ISA Server 2006 Standard Edition Installation Guide.
| Note: |
|---|
|
If you have third-party filters installed on the ISA Server 2004 computer, you need to install the filters on the ISA Server 2006 computer. For specific instructions regarding upgrades, refer to the third-party vendor documentation.
|
Export Clean ISA Server 2006 Configuration
Export the clean ISA Server 2006 configuration to a file. This enables you to restore to a clean ISA Server 2006 state, if any issues arise during the import of the ISA Server 2004 exported configuration file.
The following procedure describes how to export your ISA Server 2006 configuration. Perform the following procedure on your new ISA Server 2006 computer.
To export ISA Server 2006 configuration
-
In the console tree of ISA Server Management, select Microsoft Internet Security and Acceleration Server 2006, and then click Server_Name.
-
On the Tasks tab, click Export (Back Up) this ISA Server Configuration.
-
Follow the on-screen instructions.
| Important: |
|---|
|
Select the following Export Preferences: Export confidential information and Export user permission settings.
|
Import ISA Server 2004 Configuration
The following procedure describes how to import your ISA Server 2004 configuration. Perform this procedure on the new ISA Server 2006 computer.
To import ISA Server 2004 configuration file
-
Copy the export file from the ISA Server 2004 computer to the ISA Server 2006 computer.
-
In the console tree of ISA Server Management, select Microsoft Internet Security and Acceleration Server 2006, and then click Server_Name.
-
On the Tasks tab, click Import (Restore) this ISA Server Configuration.
-
Follow the on-screen instructions.
| Important: |
|---|
|
Make sure the following Import Preferences are selected: Import server-specific information and Import user permission settings.
|
-
Click the Apply button in the details pane to save the changes and update the configuration.
Swap the Servers
Perform the following procedure to replace your ISA Server 2004 firewall with your new ISA Server 2006 computer.
| Note: |
|---|
|
During the swap procedure, ISA Server services are not operational and users will experience an interruption of services until the swap has been completed. We recommend that you notify users before the migration that ISA Server services will be unavailable when the swap is in progress.
|
To replace an ISA Server 2004 computer with an ISA Server 2006 computer
-
Disconnect the ISA Server 2006 computer from all networks.
-
Make sure IP addresses on the ISA Server 2006 computer match the IP addresses on the ISA Server 2004 computer.
-
Turn off the ISA Server 2006 computer.
-
Mark the network cables on the ISA Server 2004 computer as External network, Internal network, and perimeter network.
-
Shut down and disconnect the ISA Server 2004 computer from the network.
-
Connect the ISA Server 2006 computer to the required networks and turn on the computer.
-
Check that functions and connectivity in ISA Server 2006 are working properly.