Problem: Organizations may have hundreds or thousands of computers on which Firewall Client must be installed. Going to each client computer on a corporate network to install Firewall Client is a time-consuming process. Administrators need a way to automate and enforce the installation of Firewall Client on user computers.

Cause: The installation of Firewall Client must be launched on each client computer.

Solution: If the user computers are members of an Active Directory directory service domain, use Group Policy to enforce the installation of Firewall Client. Because Firewall Client should not be installed on all computers in a domain (for example, Firewall Client should not be installed on domain controllers, published servers, and ISA Server computers), you should create a separate organizational unit for the computers on which Firewall Client is to be installed, move these computers from the Computers container to the new organizational unit, and then configure a Group Policy object to install Firewall Client on the computers belonging to this organizational unit.

To create the organizational unit, perform the following steps on a domain controller:

1. Open Active Directory Users and Computers.
   
2. Right-click the domain object for your domain, point to Add, and then click Organizational Unit.
   
3. In the Name text box, enter a name for the new organizational unit, and then click OK.
   
4. In the console tree, click the Computers container.
   
5. In the details pane, right-click the name of a computer on which Firewall Client is to be installed and click Move.
   
6. In the Move dialog box, click the name of the new organizational unit and click OK.
   
7. Repeat steps 5 and 6 for all the computers on which Firewall Client is to be installed.
   
8. In the console tree, right-click the name of the new organizational unit and click Properties.
   
9. Click the Group Policy tab, click New, select New Group Policy Object, and then click Edit.
   
10. In the console tree of the Group Policy Object Editor, expand Computer Configuration, expand Software Settings, and then click Software Installation.
    
11. Right-click Software Installation, point to New, and then click Package.
    
12. In the File name text box, type the path to the Microsoft installer package for Firewall Client (MS_FWC.MSI), including the NetBIOS name of the ISA Server computer where the installation files are located and the name of the shared folder (mspclnt), and then click Open.
    
13. In Deploy Software, select Assigned, and then click OK.
    

After you complete these steps, Firewall Client will be installed automatically on each computer in the new organizational unit when it is restarted.

Problem: Users can use the Firewall Client icon in the notification area (formerly called the system tray) to configure or disable Firewall Client. The setting TrayIconVisualState=1 hides the Firewall Client icon when the Firewall client is connected to an ISA Server computer. However, the icon reappears when the connection between the Firewall client and the ISA Server computer is lost. In addition, this setting cannot be communicated to Firewall clients by an ISA Server computer. This setting is modified by selecting or clearing the Hide icon in notification area when connected to ISA Server check box in the Microsoft Firewall Client for ISA Server 2004 dialog box on each client computer.

Cause: The TrayIconVisualState setting is local to each client computer and configurable per user in the TrayIcon section in the Management.ini file in the \Documents and Settings\user_name\Local Settings\Application Data\Microsoft\Firewall Client 2004 folder. Note also that this setting hides the icon only when the ISA Server computer is reachable.

Solution: Create a software restriction policy for the executable file that is launched from the Firewall Client icon (Fwcmgmt.exe) and then set the enforcement properties to apply this restriction policy to all users except local administrators. Note that this solution also removes the Firewall Client icon from the notification area.

Problem: Firewall clients contribute to the worm-induced flooding of an ISA Server computer with connection requests following a worm attack. This flooding can cause a denial of service (DoS).

Cause: When infected by a worm, a Firewall client starts generating many connection requests for specific ports that are intercepted by the Firewall Client LSP and sent to the Firewall service over the Firewall Client control channel (port 1745). The processing of these connection requests can consume a large amount of resources. Connection limits will not mitigate this issue because no new connections are actually being established.

Solution: Create new Firewall client application settings in which the application name is set to a wildcard character, an asterisk (*), select the keys DontRemoteOutboundTcpPorts and DontRemoteOutboundUdpPorts for these settings, and set their values to the ports to which the connection requests generated by the worm are being sent. The settings with the DontRemoteOutboundTcpPorts and DontRemoteOutboundUdpPorts keys instruct Firewall clients to connect to the specified ports locally and not through an ISA Server computer. Because the settings are named with the wildcard character *, they will apply to any application name that the worm supplies. The use of the * is necessary for worms that generate random application names.

To add these settings, perform the following steps:

1. In ISA Server Management, expand the Configuration node, and then click General.
   
2. In the details pane, click Define Firewall Client Settings.
   
3. On the Application Settings tab, click New.
   
4. In Application, type *.
   
5. In Key, select DontRemoteOutboundTcpPorts.
   
6. In Value, set the value to the range of ports to which the connection requests generated by the worm are being sent. Then click OK.
   
7. Repeat steps 3 and 4.
   
8. In Key, select DontRemoteOutboundUdpPorts.
   
9. In Value, set the value to the range of ports to which the connection requests generated by the worm are being sent. Then click OK.
   

New settings are picked up by Firewall clients each time that Firewall Client is restarted, each time that Detect Now or Test Server is clicked on the General tab in the Microsoft Firewall Client for ISA Server 2004 dialog box, and every six hours after the previous refresh.

Problem: Services running on Firewall clients cannot communicate with remote computers through an ISA Server computer. Winsock function calls from services running on Firewall clients are not forwarded to an ISA Server computer by the Firewall Client LSP.

Cause: By default, the Firewall Client LSP intercepts and forwards Winsock function calls from services running on computers with Firewall Client for ISA Server 2004 installed and enabled only for services for which there is an application setting with the Disable or DisableEx key set to 0. If settings with both the Disable key and the DisableEx key are defined for the same service, the setting with the DisableEx key, which was introduced in ISA Server 2004, overrides the setting with the Disable key. Any executable file that runs under the Local System, Local Service, or Network Service account on computers running Windows Server 2003 or Windows XP, or under the LocalSystem or NetworkService account on computers running Windows 2000 Server, is treated as a service.

Note that in Firewall Client for ISA Server 2000, only services for which there is an application setting with the Disable key set to 1 are disabled. For example, by default, svchost is enabled for ISA Server 2004 Firewall clients, which use the application setting with DisableEx=0, and it is disabled for ISA Server 2000 Firewall clients, which use the application setting with Disable=1.

Solution: Globally enable Firewall Client for ISA Server 2004 to intercept Winsock function calls from a specific service on Firewall clients by adding an application setting for the service with the key DisableEx set to 0 in ISA Server Management on the ISA Server computer, or create user-specific local settings on Firewall clients.

To add an application setting with the DisableEx key for a service application, perform the following steps:

1. In ISA Server Management, expand the Configuration node, and then click General.
   
2. In the details pane, click Define Firewall Client Settings.
   
3. On the Application Settings tab, click New.
   
4. In Application, type the name of the executable file of the service without its file extension.
   
5. In Key, select DisableEx.
   
6. In Value, set the value to 0. Then click OK.
   

The new setting is picked up by Firewall clients each time that Firewall Client is restarted, each time that Detect Now or Test Server is clicked on the General tab in the Microsoft Firewall Client for ISA Server 2004 dialog box, and every six hours after the previous refresh.

To create a local setting, add the following lines to the Application.ini file in the \Documents and Settings\All Users\Application Data\Microsoft\Firewall Client 2004 folder on a Firewall client:

[service_name]

DisableEx=0

Here service_name is the name of the executable file of the service without its file extension.

Problem: When trying to configure Microsoft Office Outlook 2003 on a Firewall client for access to external POP3 (for incoming mail) and SMTP (outgoing mail) servers, you may not be able to communicate with the external mail servers through an ISA Server computer using RPC over HTTP.

Cause: The default Firewall Client settings that are created during the installation of ISA Server 2004 include an application setting that disables the interception and redirection of Winsock function calls from Outlook (for example, for remoted binding) by Firewall Client in both Standard Edition and Enterprise Edition. The default setting for Outlook is intended to ensure that remoted incoming secondary connections are not established when a remote procedure call (RPC) is used to communicate with Microsoft Exchange Server. However, this setting also prevents Outlook from connecting to external POP3 and SMTP servers.

Solution: Enable Firewall Client to intercept Winsock function calls from Outlook on Firewall clients by manually removing the Firewall Client setting for Outlook with the key Disable in ISA Server Management on the ISA Server computer, and then create new settings for Outlook that prevent the establishment of remoted incoming secondary connections (by configuring Firewall Client to bind all TCP and UDP port ranges locally for Outlook).

To remove the Outlook setting with the key Disable, perform the following steps:

1. In ISA Server Management, expand the Configuration node, and then click General.
   
2. In the details pane, click Define Firewall Client Settings.
   
3. On the Application Settings tab, select the outlook setting with the key Disable in the Settings list, and then click Delete.
   

To ensure that Firewall Client does not interfere with local mail server traffic and to prevent the establishment of remoted secondary connections for Outlook, add settings for Outlook with the keys LocalBindTcpPorts and LocalBindUdpPorts, and set their values to 0-65535. These entries will bind all TCP and UDP ports locally and ensure that remoted secondary connections cannot be established. To add these settings, perform the following steps:

1. In ISA Server Management, expand the Configuration node, and then click General.
   
2. In the details pane, click Define Firewall Client Settings.
   
3. On the Application Settings tab, click New.
   
4. In Application, type outlook.
   
5. In Key, select LocalBindTcpPorts.
   
6. In Value, set the value to 0-65535. Then click OK.
   
7. Repeat steps 3 and 4.
   
8. In Key, select LocalBindUdpPorts.
   
9. In Value, set the value to 0-65535. Then click OK.
   

Problem: Images embedded in Exchange e-mail messages are not downloaded when the messages are viewed in HTML format on Firewall clients with no Web proxy defined.

Cause: The default Firewall Client settings that are created during the installation of ISA Server 2004 include an application setting that disables the interception and redirection of Winsock function calls from Outlook (for example, for remoted binding) by Firewall Client in both Standard Edition and Enterprise Edition. The default settings are intended to ensure that remoted incoming secondary connections are not established when RPC is used to communicate with Exchange Server. However, this setting also prevents Outlook from downloading embedded images when messages are viewed in HTML format on Firewall clients with no Web proxy defined.

Solution: Enable Firewall Client to intercept Winsock function calls from Outlook on Firewall clients by modifying the existing Firewall Client setting for Outlook with the key Disable in ISA Server Management on the ISA Server computer.

To modify the existing Outlook setting with the key Disable, perform the following steps:

1. In ISA Server Management, expand the Configuration node, and then click General.
   
2. In the details pane, click Define Firewall Client Settings.
   
3. On the Application Settings tab, in the Settings list, select the outlook setting with the key Disable, and click Edit.
   
4. In Value, change the value of the Disable key to 0, and click OK.
   

Problem: Whenever ISA Server requires authentication for WSPAD automatic discovery requests (HTTP GET requests for http://address:port/wspad.dat), Firewall clients cannot react appropriately to the 401 Unauthorized response that ISA Server generates, and clients fail to retrieve the information in the Wspad.dat file.

This does not adversely affect Web browser requests for http://address:port/wpad.dat because Web browsers can generate an authentication dialog box in which the user can supply credentials.

Unfortunately, this prevents a valid Firewall client from obtaining configuration data from a Wspad.dat file stored on an ISA Server computer. This is an important fallback mechanism when the current Firewall Client data set references a nonexistent ISA Server computer (as happens when users travel between locations protected by ISA Server).

Cause: When the Require all users to authenticate check box is selected in the Web proxy authentication properties of a protected network, such as the Internal network, all HTTP GET requests, including WSPAD requests, from Firewall clients in the protected network will require authentication, regardless of their actual port assignment. However, Firewall Client does not support HTTP authentication, regardless of the authentication method selected (such as Basic authentication or Integrated Windows authentication). Therefore, when a Firewall client tries to retrieve the Wspad.dat file during automatic discovery, the ISA Server computer will not forward the request to the WPAD server.

Solution: For ISA Server 2004 Standard Edition, install the latest service pack, add the SkipAuthenticationForRoutingInformation registry value to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentContolSet\Services\W3Proxy\Parameters registry key, and set it to 1 or to a higher number. For detailed instructions about performing these tasks, see the Microsoft Knowledge Base article 885683, “You receive error messages if the Internet Security and Acceleration Server 2004 Firewall Client program is configured for auto-discovery or if you try to configure this program for auto-discovery.”

For ISA Server 2004 Enterprise Edition, copy the following Microsoft Visual Basic Scripting Edition (VBScript) code for setting the SkipAuthenticationForRoutingInformation property of the FPCWebProxy object to True in the local array to the Clipboard, paste it into a text editor such as Notepad, save it in a file with the .vbs extension, and run the script on an ISA Server computer (array member) as an ISA Server administrator with read/write permissions for accessing the array configuration on a Configuration Storage server by entering cscript file_name.vbs CCS UserName Domain Password at a command prompt.

'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''

' Copyright (c) Microsoft Corporation. All rights reserved.

' THIS CODE IS MADE AVAILABLE AS IS, WITHOUT WARRANTY OF ANY KIND. THE ENTIRE

' RISK OF THE USE OR THE RESULTS FROM THE USE OF THIS CODE REMAINS WITH THE

' USER. USE AND REDISTRIBUTION OF THIS CODE, WITH OR WITHOUT MODIFICATION, IS

' HEREBY PERMITTED.

'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''

Main(WScript.Arguments)

Sub Main(args)

If (args.Count = 4) Then

SkipAuthenticationForRoutingRequests args(0), args(1), args(2), args(3)

Else

Usage()

End If

End Sub

Sub SkipAuthenticationForRoutingRequests(css, userName, domain, password)

' Declare the objects needed.

Dim root ' The FPCLib.FPC root object

Dim isaArray ' An FPCArray object

Dim webProxy ' An FPCWebProxy object

' Create the root object.

Set root = CreateObject("FPC.Root")

' Connect to the Configuration Storage server.

root.ConnectToConfigurationStorageServer css, userName, domain, password

' Get references to the array object

' and the Web proxy object.

Set isaArray = root.GetContainingArray()

Set webProxy = isaArray.ArrayPolicy.WebProxy

' Configure the Web proxy to skip the authentication process for

' requests for routing information.

webProxy.SkipAuthenticationForRoutingInformation = True

' Save the new setting with the fResetRequiredServices parameter set

' to True so that the Firewall service will be restarted and the change

' will take effect.

WScript.Echo "Saving the configuration..."

webProxy.Save True

WScript.Echo "Done!"

End Sub

Sub Usage()

WScript.Echo "Usage:" & VbCrLf _

& " " & WScript.ScriptName & " CCS UserName Domain Password " & VbCrLf _

& "" & VbCrLf _

& " CCS - Configuration Storage Server for the array" & VbCrLf _

& " UserName - User name of an ISA Server administrator" & VbCrLf _

& " Domain - Domain of the user specified in UserName" & VbCrLf _

& " Password - Password of the user specified in UserName"

WScript.Quit

End Sub

Problem: The Internet Explorer local area network (LAN) settings that are configured manually by users or automatically by Group Policy are overwritten when Firewall Client is installed on the computer. The Internet Explorer LAN settings that are overwritten include the list of exceptions of IP addresses of Web servers that are to be contacted directly and not through the proxy server. When the list of exceptions in the LAN settings is erased, it is not replaced by the list defined in the Directly access these servers or domains text box on the Web Browser tab on the properties page for the protected network (typically the Internal network) in ISA Server Management. Nevertheless, Firewall clients can contact the destinations defined in ISA Server Management directly, bypassing the ISA Server computer.

Cause: When the Automatically detect settings, Use automatic configuration script, and Use a Web proxy server check boxes are selected on the Firewall Client tab on the properties page for the protected network in ISA Server Management, Firewall clients will automatically detect the ISA Server computer and run the automatic configuration script, which overwrites the LAN settings in Internet Explorer. The automatic configuration script is executed on a Firewall client each time that Firewall Client is restarted, each time that Configure Now is clicked on the Web Browser tab in the Microsoft Firewall Client for ISA Server 2004 dialog box, and every six hours after the previous refresh.

Solution: Add the list of IP addresses or domain names of the Web servers that are to be contacted directly by Firewall clients to the Firewall Client configuration on the ISA Server computer. Note that these IP addresses will not appear in the list of exceptions in the LAN settings in Internet Explorer.

To add IP addresses or domain names of servers to the list of IP addresses and domain names of servers that are to be contacted directly by Firewall clients, perform the following steps:

1. In ISA Server Management, expand the Configuration node, and then click Networks.
   
2. In the details pane, on the Networks tab, right-click the name of the network where the Firewall clients reside (typically the Internal network), and then click Properties.
   
3. On the Web Browser tab, click Add, type an IP address range or domain name, and then click OK.
   
4. Repeat step 3 until the IP addresses and domain names of all the servers that are to be contacted directly by Firewall clients are included in the list.