When you install ISA Server, basic network services are enabled. After installation, ISA Server can access name resolution servers and time synchronization services on the Internal network.

If the network services are available on a different network, you should modify the applicable configuration group sources to apply to the specific network. For example, suppose the DHCP server is not located on the Internal network, but on a perimeter network. Modify the source for the DHCP configuration group to apply to that perimeter network.

You can modify the system policy, so that only particular computers on the Internal network can be accessed. Alternatively, you can add additional networks, if the services are found elsewhere.

The following table shows the system policy rules that apply to network services.

DHCP Services

One of the fundamental capabilities of ISA Server is the ability to apply a firewall policy to specific users. To authenticate users, however, ISA Server must be able to communicate with the authentication servers. For this reason, by default, ISA Server can communicate with Active Directory servers (for Windows authentication) and with RADIUS servers located on the Internal network.

The following table shows the system policy rules that apply to authentication services.

DCOM

Windows and RADIUS Authentication Services

RSA SecurID Authentication Services

CRL Authentication Services

Often, you will manage ISA Server from a remote computer. Carefully determine which remote computers are allowed to manage and monitor ISA Server. The following table shows the system policy rules that should be configured.

By default, the system policy rules allowing remote management of ISA Server are enabled. ISA Server can be managed by running a remote Microsoft Management Console (MMC) snap-in, or by using Terminal Services.

By default, these rules apply to the built-in Remote Management Computers computer set. When you install ISA Server, this empty computer set is created. Add to this empty computer set all computers that will remotely manage ISA Server. Until you do so, remote management is effectively not available from any computer.

Note:
Limit remote management to specific computers by configuring the system policy rules to apply only to specific IP addresses.

To enable remote management, perform the following steps.

1. Click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
   
2. In the console tree of ISA Server Management, click Microsoft ISA Server 2004, click the server_name, and then click Firewall Policy.
   
3. On the Toolbox tab, click Network Objects.
   
   
4. On the toolbar beneath Network Objects, under Computer Sets, right-click Remote Management Computers and then click Properties.
   
   
5. Click Add and then click Computer.
   
6. In Name, type the name of the computer.
   
7. In Computer IP address, type the IP address of the computer that can remotely manage ISA Server.
   

Remote Monitoring and Logging

Enabling Remote Logging and Monitoring

If you installed the Firewall Client Share component when you installed ISA Server, the Firewall Client Installation Share configuration group is enabled, by default. All computers on the Internal network can access the shared folder. The following table shows the system policy configuration group (and rule) that is enabled.

If you did not install the Firewall Client Share component, this configuration group is not enabled.

By default, the system policy rules allowing access to diagnostics services are enabled, with the following permissions:

• ICMP. This is allowed to all networks. This service is important for determining connectivity to other computers.
  
• Windows networking. This allows NetBIOS communication, by default to computers on the Internal network.
  
• Microsoft error reporting. This allows HTTP access to the Microsoft Error Reporting sites URL set, to allow reporting of error information. By default, this URL set includes specific Microsoft sites.
  
• Connectivity verifiers. This allows the ISA Server computer to use HTTP and HTTPS protocols to check whether a specific computer is responsive.
  

The following table shows the system policy configuration groups that are enabled by default.

In addition, the following diagnostic service is not enabled by default: HTTP Connectivity Verifiers.

When you create a connectivity verifier, the HTTP Connectivity Verifiers configuration group is enabled, allowing the Local Host network to use HTTP or HTTPS to access computers on any other network. The following table describes the HTTP Connectivity Verifiers configuration group.

We recommend that you limit this access to the specific computers whose connectivity you want to verify. To limit this access, perform the following steps.

1. Click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
   
2. In the console tree of ISA Server Management, click Microsoft ISA Server 2004, click the server_name, and then click Firewall Policy.
   
3. On the Tasks tab, click Edit System Policy.
   
4. In the System Policy Editor, in the Configuration Groups tree, click HTTP Connectivity Verifiers.
   
   
5. On the To tab, click All Networks (and Local Host) and then click Remove.
   
6. Click Add and then select the network entities whose connectivity you want to verify. All HTTP traffic will be allowed from the Local Host network (the ISA Server computer) to network entities listed on the To tab.
   

By default, the SMTP configuration group is enabled, allowing SMTP communication from ISA Server to computers on the Internal network. This is required, for example, when you want to send alert information in an e-mail message. The following table describes the SMTP configuration group.

By default, the scheduled download jobs feature is disabled. The following table describes the Scheduled Download Jobs configuration group.

When you create a content download job, you will be prompted to enable this system policy rule. ISA Server will be able to access the sites specified in the content download job.

The default system policy allows HTTP and HTTPS access from the Local Host network (that is, the ISA Server computer) to the microsoft.com Web site. This is required for a few reasons:

• Error reporting (as described in the Diagnostic Services section)
  
• Access to useful documentation on the ISA Server Web site and on other related Web sites
  

By default, the Allowed Sites configuration group is enabled, allowing ISA Server to access content on specific sites that belong to the System Policy Allowed Sites domain name set. The following table describes the Allowed Sites configuration group.

This URL set includes various Microsoft Web sites, by default. You can modify the domain name set to include additional Web sites, which ISA Server will be allowed to access.

To modify the URL set to include additional Web sites, perform the following steps.

1. Click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
   
2. In the console tree of ISA Server Management, click Microsoft ISA Server 2004, click the server_name, and then click Firewall Policy.
   
3. On the Toolbox tab, click Network Objects.
   
   
4. Under Domain Name Sets, right-click System Policy Allowed Sites and then click Properties.
   
5. On the General tab, click New and then type the URL for the specific Web site.
   
   

HTTP and HTTPS access will be allowed to the specified Web sites.

For information about Microsoft ISA Server, see the Microsoft ISA Server Web site.

The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, places, or events is intended or should be inferred.