You can use ISA Server 2006 with MDM as follows:
-
To publish the MDM Enrollment Server
-
As a proxy for clients that are enrolled in MDM.
-
As the target for source-based routing
-
As an internal firewall
-
As a multifunction device, such as one that performs multiple roles simultaneously
Publishing MDM Enrollment Server on ISA Server 2006
The following illustration shows how you can use ISA Server 2006 to publish the MDM Enrollment Server.
The detailed steps on how to configure ISA Server 2006 as a reverse proxy for the enrollment process are included in the “Guidance for Publishing MDM Enrollment Server on ISA Server 2006” section of this guide.
Using ISA Server as a Proxy for MDM Clients
This section is not intended to repeat information which has been extensively documented in the ISA Server 2006 library. For more information on planning, deploying and managing ISA Server 2006 please refer to the documents referenced in the planning resources section at the end of this guide, with particular attention to the sections on defining and implementing ISA Server 2006 as a proxy.
Pre-requisites
The ISA Server 2006 must meet the following criteria:
-
It must be installed and configured for outbound Internet access
-
It must be dual homed
-
Each interface must be located on a different IP subnet from within the perimeter network
Some customers may want to use ISA Server 2006 as the outbound proxy for MDM VPN clients. The following illustration shows an example of this scenario:
If the Managed devices are configured to use this proxy (see later in this section), or Source-based Routing is configured to use it as the default gateway for the VPN pool of IP addresses, then the following is true:
-
If the route to the target host is known by using the local routing tables in MDM Gateway Server, then all non-HTTP or HTTPS traffic is routed through the internal firewall.
-
If the proxy is defined, all HTTP and HTTPS traffic (including management traffic for enrolled devices) passes by way of the proxy. If it meets the policies as configured, it is granted authority to leave the company network and continue to its destination on the Internet. Any traffic that does not conform to policy is dropped, or access is denied. The user is notified of the reason for denial.
-
Because the MDM management traffic uses TCP 8443 by default, a value that the administrator can configure, you must modify most proxies to permit the traffic to pass correctly. The following steps show how you can modify the proxy:
-
Make sure that the proxy can resolve the DNS name for MDM Device Management Server, and that this server can be accessed from the proxy.
-
Configure the proxy server to tunnel HTTPS packets on port 8443. To allow tunneling of port 8443 with ISA Server 2006 as the proxy, use the AddTPRange.vbs script as described in “Managing Tunnel Port Ranges” at this Microsoft Web site: http://go.microsoft.com/fwlink/?LinkID=113972
You do not need to include the ISA Server 2006 firewall client when planning this since all MDM devices function in clientless mode very satisfactorily.
For clients to be directed to use this outbound proxy in MDM, one of the first group policies to create and send to a newly enrolled device should contain this information. To do this, you would create a new GPO that contains the name of the outgoing proxy for the MDM client to use.
The following steps show how to do perform this process:
-
Start GPMC and select the OU against which the group policy is to be applied. The settings for the Internet proxy are located under Computer Configuration / Administrative Templates / Windows Mobile Settings / Mobile VPN Settings
-
Double-click Corporate Proxy for Internet Access as follows.
-
Enter the address and port of the Proxy Gateway as follows:
Select Enabled then enter the address of the out-bound proxy. If the FQDN is used instead of the IP address then the format is the same: host:port. For example, proxy.contoso.com:8080.
-
Apply the GP before exiting. This new policy is automatically applied against all devices at the next scheduled connection.
Adding the Mobile VPN Subnet to the Routing Table
To add the Mobile VPN IP subnet range to ISA server
-
In the ISA Server management console, expand the array name, and then click the Configuration node.
-
In the Networks node, double click the Internal network object in the Task Pane.
-
In the Addresses tab, click Add Range and then type the IP subnet for managed devices (such as 172.30.25.0).
-
Click OK twice.
-
Click Apply to save changes and update the configuration.
Validate Internet Explorer Mobile Settings
In this procedure, you will validate the Internet Explorer Mobile settings for Windows Mobile Standard edition so that mobile Web browsing will work correctly.
-
On an MDM managed Windows Mobile device, click Start, point to Internet Explorer, and then choose Menu.
-
Select Tools, then Options, and then Connections.
-
Check Automatically detect settings.
For Windows Mobile 6.1 Professional edition, there is no option to force a specific connection for Internet Explorer Mobile. The behavior is to always automatically detect the connection to use.
Create an ISA Server Access Rule for the Internet
If you have not already done so, you must create an ISA Server access rule that permits Web traffic for clients from the internal to external network. For more information on ISA Server 2006 access rules, see “Publishing Concepts in ISA Server 2006” at this Microsoft Web site: http://go.microsoft.com/fwlink/?LinkID=105968.
Test the Mobile Device Proxy
-
From Internet Explorer Mobile, navigate to mobile.live.com
The following screen will appear.
Using ISA as a Target for Source-based Routing
By default, a VPN client uses the same default gateway as the MDM Gateway Server unless directed otherwise. This may be impractical for some environments and consequently Source-based Routing has been implemented.
Source-based routing permits the MDM Gateway Server to make a routing decision based on the source address of the traffic. As an example, it handles traffic from itself in one fashion and directs VPN pool addresses differently. This gives the enterprise considerable flexibility and control.
The previous section showed how to use ISA Server 2006 as the out-going proxy for enforcing Corporate Policy on Web site access. To show how this is implemented in the context of MDM, this scenario uses the information from the Gateway Configuration screen which is managed from the Mobile Device Manager (MDM) Console.
For the purposes of this section, we will presume that the following has been defined on the MDM Gateway Server:
-
The VPN pool has an IP Address range of 10.10.0.0. with a subnet mask of 255.255.0.0.
-
VPN clients use a default gateway other than the one defined on the MDM Gateway Server. It uses ISA Server 2006 outbound proxy (192.168.99.3).
.gif) Note: |
|---|
|
This is given as an example of implementing ISA Server 2006 as the outbound proxy. If your organization will use an existing proxy for this task, you should direct MDM clients to this proxy instead.
|
The following screen shows the IP address range to be assigned to VPN clients:
There are two options for Routing Configuration:
-
Selecting the first option causes VPN clients to use the default gateway of the MDM Gateway Server. In this instance this is not desirable behavior.
-
Selecting the second option separates VPN pool traffic from that of the MDM Gateway Server.
In this scenario, we selected the second option and entered the target IP address of the ISA Proxy, 192.168.99.3. Therefore, all traffic destined for known networks will be directed according to the routing tables possessed locally by the MDM Gateway Server, but will use the VPN pool range as the source address rather than internal or external IP addresses of the MDM Gateway Server. All other traffic will be directed to the ISA Proxy.
Implementing ISA Server 2006 as an Internal Firewall
You can add a layer of defense by Implementing ISA Server 2006 as an Internal Firewall. Some enterprises may not have a perimeter network in which to place the MDM Gateway Server, and may instead have the MDM Gateway located in the same physical subnet as domain-joined servers. In this scenario, because the MDM Gateway Server is exposed to the Internet, it could be the target of attack. Although compromising this host would be difficult, you should not presume that it is impossible. We strongly recommend that you use a product such as ISA Server 2006 in this situation to add a layer of defense and provide additional protection to both the MDM Gateway Server and also all other internal resources.
The following illustration shows the MDM environment with an external firewall only.
Although the scenario of only an external firewall is supported, it is not recommended. A VPN client that terminates its session at the MDM Gateway Server could communicate in some fashion with every host on the internal network, not just the ones intended to be accessible as LoB hosts. This creates risk which may be unacceptable to some organizations. It also defeats the guiding principle as stated at the outset of this guide as most restrictive always being preferable and more secure.
To better protect your infrastructure, you may want to add an ISA Server to create a perimeter network to hold the dual-homed MDM Gateway Server. In this scenario, ISA Server 2006 acts as the internal firewall. The following illustration shows this scenario.
All guidance noted earlier in this document with regard to the Internal Firewall is applicable in this scenario.
Although it is easy to use ISA Server 2006 to configure a network-to-network relationship between the VPN pool of IP addresses and the internal subnet, this would go against the principle guidance of most restrictive being the preferred choice. Therefore, we highly recommend that you use filters to permit traffic between the VPN pool and the target LoB hosts and certification authority only on a case-by-case basis.
Using ISA Server 2006 as a Multifunction Device
In previous examples, ISA Server 2006 has been shown functioning in the role of the reverse proxy that more securely publishes the MDM Enrollment Server, as an outbound proxy, and as an internal firewall.
We do not recommend, however, that one you implement one ISA server in more than one role at any one time. This is undesirable because it creates a single point of failure and a single point of attack.