To create a rule to publish IKE negotiation, follow these steps:

1. In the Microsoft ISA Server Management console tree, select Firewall Policy.

2. In the task pane, on the Tasks tab, select Create New Server Publishing Rule to start the New Server Publishing Rule Wizard.

3. On the Welcome page, type a name for the new server publishing rule. Use a descriptive name, such as Publish IKE for L2TP/IPSec, and then click Next.

4. On the Select Server page, provide the IP address of the server that you are publishing, and then click Next.

5. On the Select Protocol page, in Selected protocol, select IKE Server, and then click Next.

   

6. On the IP Addresses page, select the network IP addresses that will listen for requests intended for the published server. Because you are publishing the server to the Internet, select External. Click Next.

   Note:
   By default, ISA Server will listen on all external IP addresses for VPN connections. If there is more than one IP address on the external interface of the ISA Server computer, and you want to control which IP address is published for VPN access, click the Address button to open the External Network Listener IP Selection dialog box, where you can choose to listen on specific IP addresses.

7. Review the information on the wizard summary page, and then click Finish.

8. In the Firewall Policy details pane, click Apply to apply the new server publishing rule.

   Note:
   You can modify the properties of any rule by double-clicking the rule in the Firewall Policy details pane to open the rule properties dialog box.

To create a rule to publish NAT-T, follow these steps:

1. In the Microsoft ISA Server Management console tree, select Firewall Policy.

2. In the task pane, on the Tasks tab, select Create New Server Publishing Rule to start the New Server Publishing Rule Wizard.

3. On the Welcome page, type a name for the new server publishing rule. Use a descriptive name, such as NAT-T VPN Publishing for L2TP/IPSec, and then click Next.

4. On the Select Server page, provide the IP address of the server that you are publishing, and then click Next.

5. On the Select Protocol page, in Selected protocol, select IPSec NAT-T Server, and then click Next.

6. On the IP Addresses page, select the network IP addresses that will listen for requests intended for the published server. Because you are publishing the server to the Internet, select External. Click Next.

   Note:
   By default, ISA Server will listen on all external IP addresses for VPN connections. If there is more than one IP address on the external interface of the ISA Server computer, and you want to control which IP address is published for VPN access, click the Address button to open the External Network Listener IP Selection dialog box, where you can choose to listen on specific IP addresses.

7. Review the information on the wizard summary page, and then click Finish.

8. In the Firewall Policy details pane, click Apply to apply the new server publishing rule.

   Note:
   You can modify the properties of any rule by double-clicking the rule in the Firewall Policy details pane to open the rule properties dialog box.

To create a server publishing rule, follow these steps:

1. In the Microsoft ISA Server Management console tree, select Firewall Policy.

2. In the task pane, on the Tasks tab, select Create New Server Publishing Rule to start the New Server Publishing Rule Wizard.

3. On the Welcome page, type a name for the new server publishing rule. Use a descriptive name, such as L2TP VPN Publishing without IPSec, and then click Next.

4. On the Select Server page, provide the IP address of the server that you are publishing, and then click Next.

5. On the Select Protocol page, in Selected protocol, select L2TP Server, and then click Next.

   

6. On the IP Addresses page, select the network IP addresses that will listen for requests intended for the published server. Because you are publishing the server to the Internet, select External. Click Next.

   Note:
   By default, ISA Server will listen on all external IP addresses for VPN connections. If there is more than one IP address on the external interface of the ISA Server computer, and you want to control which IP address is published for VPN access, click the Address button to open the External Network Listener IP Selection dialog box, where you can choose to listen on specific IP addresses.

7. Review the information on the wizard summary page, and then click Finish.

   Note:
   You can modify the properties of any rule by double-clicking the rule in the Firewall Policy details pane to open the rule properties dialog box.

To create an access rule, use the following steps:

1. In the Microsoft ISA Server Management console tree, select Firewall Policy.

2. In the task pane, on the Tasks tab, select Create New Access Rule to start the New Access Rule Wizard.

3. On the Welcome page of the wizard, enter the name for the access rule. Use a descriptive name, such as Allow L2TP from L2TP VPN Server, and then click Next.

4. On the Rule Action page, select Allow, and then click Next.

5. On the Protocols page, in This rule applies to, select Selected protocols, and then use the Add button to open the Add Protocols dialog box.

   

6. In the Add Protocols dialog box, expand All Protocols, and select L2TP Client. Click Add, and then click Close to close the Add Protocols dialog box.

   

7. On the Protocols page, click Next.

   

8. On the Access Rule Sources page, click Add to open the Add Network Entities dialog box.  

9. In the Add Network Entities dialog box, click New, and then click Computer.

   

10. In the New Computer Rule Element dialog box, provide the name of the new computer, L2TP VPN Server and its IP address, and then click OK.  

    

11. In the Add Network Entities dialog box, expand Computers, select L2TP VPN Server, click Add, and then click Close. On the Access Rule Sources page, click Next.

12. On the Access Rule Destinations page, click Add to open the Add Network Entities dialog box, click Networks, select External, click Add, and then click Close. On the Access Rule Destinations page, click Next.

13. On the User Sets page, leave the default user set All Users in place, and then click Next.

14. Review the information on the wizard summary page, and then click Finish.

15. In the Firewall Policy details pane, click Apply to apply the new access rule and the server publishing rule you created previously.

Do you have comments about this document? Send feedback.