The Edge Firewall template configures the ISA Server 2004 firewall to have a network interface directly connected to the Internet and a second network interface connected to the Internal network. The network template allows you to quickly configure firewall policy Access Rules that control access between the Internal network and the Internet.

Table 1 shows the firewall policies available to you when using the Edge Firewall template. Each of these firewall policies has its own set of Access Rules that it creates, ranging from an all open access policy between the Internal network and Internet to a Block All policy that prevents all access between the Internal network and the Internet.

Table 1: Network Edge Firewall Template Firewall Policy Options

Perform the following steps to configure the firewall using the Edge Firewall Network Template:

1. In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name and then expand the Configuration node. Click the Networks node.
   
2. Click the Templates tab in the Task Pane. Click the Edge Firewall network template.
   
   
3. Click Next on the Welcome to the Network Template Wizard page.
   
   
4. On the Export the ISA Server Configuration page, you are offered the opportunity to export the current configuration. You can return the ISA Server 2004 firewall to the state it was in before using the Edge Firewall network template using this file. We have already backed up the system configuration, so we will not need to export the configuration at this time. Click Next.
   
   
5. On the Internal Network IP Addresses page, you define the Internal network addresses. The current Internal network address range is automatically included in the Address ranges list. You can use the Add, Add Adapter and Add Private button to expand this list of addresses. In our current example we will keep the current Internal network address range. Click Next.
   
   
6. On the Select a Firewall Policy page you can select a firewall policy and a collection of Access Rules. In this example, we want to allow Internal network clients access to all protocols to access all sites on the Internet. After you become more familiar with the ISA Server 2004 firewall, you should increase the level of security for outbound access control. But at this point, general Internet access is more important. Select the Allow unrestricted access policy from the list and click Next.
   
   
7. Review your settings and click Finish on the Completing the Network Template Wizard page.
   
8. Click Apply to save the changes and update firewall policy.
   
9. Click OK in the Apply New Configuration dialog box after you see the message Changes to the configuration were successfully applied.
   
   
10. Click the Firewall Policies node in the left pane of the console to view the policies created by the Edge Firewall network template. These two Access Rules allow Internet network and VPN clients full access to the Internet, and the VPN clients are allowed full access to the Internal network.
    
    

The 3-leg perimeter configuration creates network relationships and Access Rules to support an Internal network segment and a perimeter (DMZ) network segment. The perimeter network segment can host your publicly-accessible resources and infrastructure servers, such as a public DNS server or a caching-only DNS server.

Table 2: 3-Legged Perimeter Firewall Template Firewall Policy Options

Perform the following steps to use the 3-Leg Perimeter network template:

1. Open the Microsoft Internet Security and Acceleration Server 2004 management console and expand the server name. Expand the Configuration node and click the Networks node.
   
2. Click the Networks tab in the Details pane and then click the Templates tab in the Task pane. Click the 3-Leg Perimeter network template.
   
   
3. Click Next on the Welcome to the Network Template Wizard page.
   
4. On the Export the ISA Server Configuration page, you can choose to export your current configuration. This is useful if you find that you need to return the firewall to its current settings in the event that the template settings do not meet your needs. We have already backed up the configuration, so we will not need to export the configuration at this time. Click Next.
   
   
5. On the Internal Network IP Addresses page, you set the addresses that represent the Internal network. The addresses included in the current Internal network are automatically included in the Address ranges list. We will not add any addresses to the Internal network. Click Next.
   
   
6. You configure the addresses that comprise the perimeter network segment on the Perimeter Network IP Addresses page. The wizard does not make any assumptions regarding what addresses should be included in the perimeter network, so the Address ranges list is empty.
   
   
7. Click the Add Adapter button. In the Network adapter details dialog box, put a check mark in the DMZ check box. Note that the names that we previously set for network adapters appear in this list. Renaming network adapters helps you identify the network association of that adapter. Click OK.
   
   
8. The wizard automatically enters an address range to the Address ranges list based on the Windows routing table. Click Next.
   
   
9. On the Select a Firewall Policy page, you select a firewall policy that will create network relationships between the Internet, perimeter and Internal networks and also creates Access Rules. In this example, we want to allow the Internal network clients full access to the Internet and the perimeter network, and allow the perimeter network hosts access to the Internet. After you are more familiar with how to configure Access Policies on the ISA Server 2004 firewall, you will want to tighten the outbound access controls between the perimeter network segment and the Internet, and between the Internal network segment and the Internet. Select the Allow unrestricted access firewall policy and click Next.
   
   
10. Review the settings on the Completing the Network Template Wizard and click Finish.
    
11. Click Apply to save the changes and update firewall policy.
    
12. Click OK in the Apply New Configuration dialog box after you see the message Changes to the configuration were successfully applied.
    
    
13. Click the Firewall Policy node in the left pane of the Microsoft Internet Security and Acceleration Server 2004 management console to view the rules created by the 3-Leg Perimeter network template. These two rules allow hosts on the Internal network and in the VPN clients network full access to the Internet and to the perimeter network. In addition, the VPN Clients network is allowed full access to the Internal network.
    
    
14. Expand the Configuration node in the left pane of the Microsoft Internet Security and Acceleration Server 2004 management console. Click the Networks node. Here you see a list of networks, including the Perimeter network created by the template.
    
    
15. Click the Network Rules tab. Right-click the Perimeter Configuration Network Rule and click Properties.
    
    
16. In the Perimeter Configuration Properties dialog box, click the Source Networks tab. You can see in the This rule applies to traffic from these sources list the Internal, Quarantined VPN Clients and VPN Clients networks listed as source networks.
    
    
17. Click the Destination Networks tab. You see the Perimeter network in the This rule applies to traffic sent to these destinations list.
    
    
18. Click the Network Relationship tab. The default setting is Network Address Translation (NAT). This is a slightly higher security configuration because it hides the addresses of the Internal network clients that connect to perimeter network hosts. However, NAT relationships can complicate access for certain protocols as not all protocols support address translation. In our current example, select the Route relationship to improve on the level of protocol access at the cost of a slight reduction in overall security. Keep in mind that, at this point, there are no Access Rules that allow access to the Internal network from the perimeter network.
    
    
19. Click Apply and then click OK.
    
20. Click Apply to save the changes and update the firewall policy.
    
21. Click OK in the Apply New Configuration dialog box after you see the message Changes to the configuration were successfully applied.
    

In this ISA Server 2004 Configuration Guide chapter, we discussed how you can use the Edge Firewall and 3-Leg Perimeter network templates to simplify initial configuration of network addresses, Network Rules and Access Rules. In the next chapter of the ISA Server 2004 Configuration Guide, we will discuss the various ISA Server 2004 client types.