This appendix contains the following procedures used in the solutions provided in this document:
-
Installing the Configuration Storage Server
-
Creating an Enterprise Network
-
Installing the Configuration Storage Server and ISA Server Services on a Single Computer
-
Creating a VPN in ISA Server
-
Creating a Network Rule
-
Creating an ISA Server Array
-
Adding Servers to the ISA Server Array
-
Creating an Access Rule
-
Creating a Protocol Definition
-
Creating a Server Publishing Rule
-
Creating a New Computer Set
-
Establishing External Trust Between Two Domains
-
Creating and Restoring a Backup File
-
Creating Enterprise Policy for Branch Communication
Installing the Configuration Storage Server
The Configuration Storage server stores the configuration information for all of the arrays in the enterprise. This procedure describes how to install the Configuration Storage server. Perform this procedure on the computer that you have designated as a Configuration Storage server.
.gif) Note: |
|---|
|
The Configuration Storage server must be configured to use the internal (or associated) network adapter of the Microsoft Internet Security and Acceleration (ISA) Server computer (or the virtual Internet Protocol (IP) address of the ISA Server firewall array, if Network Load Balancing (NLB) is configured) as a default gateway.
|
To install a Configuration Storage server, follow these steps:
-
On the computer that the Configuration Storage server is to be installed, log on to the domain as an enterprise administrator.
-
Insert the ISA Server CD into the CD drive, or run ISAAutorun.exe from the shared network drive.
-
In Microsoft ISA Server Setup, click Install ISA Server.
-
After the setup program prompts that it has completed determining the system configuration, on the Welcome page, click Next.
-
If you accept the terms and conditions stated in the user license agreement, click I accept the terms in the license agreement, and then click Next.
-
Type your customer details, and then click Next.
-
On the Setup Scenarios page, select Install Configuration Storage Server, and then click Next.
-
On the Component Selection page, you can review the settings, and then click Next.
-
On the Enterprise Membership page, select Create a New Enterprise if you are creating a new enterprise, or Create a replica of the enterprise configuration if you are creating a replicate Configuration Storage server. Click Next. Do one of the following:
-
If you are creating a new enterprise, on the New Enterprise Warning page, click Next. This page warns you not to install more than one enterprise. Because you are creating a new enterprise, you can ignore the warning. On the Create a New Enterprise page, provide a name for the enterprise. Optional: provide a description of the enterprise. Click Next.
-
If you are creating a replica of the enterprise configuration, on the Locate Configuration Storage Server page, provide the fully qualified domain name of the Configuration Storage server that you want to replicate, or click Browse to locate the server on the network. Click Next.
-
If you are creating a replicate Configuration Storage server, the next wizard page will be the ISA Server Configuration Replicate Source page. This page provides options for the initial ISA Server replication, which may take a long time over a slow link. If you are replicating over a slow link, you may want to choose to replicate from a Windows backup file. For information about creating a backup file, see Creating and Restoring a Backup File in this document. Click Next.
-
On the Enterprise Deployment Environment page, you have the option of installing a digital certificate to enable encrypted communication between the Configuration Storage server and the ISA Server firewall computers. All communication between firewall computers and Configuration Storage servers in a single domain is encrypted. We recommend that you use this option when your ISA Server firewall computers are not in the same domain as your Configuration Storage server, or if the firewall computers are in a workgroup. Click Next.
| Note: |
|---|
|
If you want to create an ISA Server array in a workgroup and have it use the Configuration Storage server of the combined server, you must install a certificate on the combined server. The name on the server has to match the fully qualified domain name of the Configuration Storage server. The procedures for installing a certificate and configuring ISA Server to use the certificate are provided in the document ISA Server 2004 Enterprise Edition in a Workgroup, at the ISA Server 2004 Guidance Web site (http://www.microsoft.com).
|
-
On the Ready to Install the Program page, click Install to begin the installation.
-
After the installation is complete, click Finish.
After you have installed the Configuration Storage server, you may want to create an enterprise network. For instructions, see Creating an Enterprise Network in this document.
Creating an Enterprise Network
As enterprise administrator, you should define enterprise networks. This will enable you to create access rules on the enterprise level. Referring to the enterprise networks will enable your array administrators to define array networks, to easily create rules for networks throughout the enterprise, and to assist spoof detection through the proper definition of networks.
The following procedure will create an enterprise network that will include all of the IP addresses of the main and branch Internal networks.
To create an enterprise network, follow these steps:
-
On the Configuration Storage server, expand the Enterprise node, and click Enterprise Networks.
-
In the task pane, on the Tasks tab, click Create a New Network to start the New Network Wizard.
-
In Network name, provide a name for the new network, such as Internal, and then click Next.
-
On the Network Addresses page, click AddRange to open the IP Address Range Properties dialog box. In Start address type the low end of the IP address range, and in End address type the high end of the IP address range. For example, if your main office Internal network includes the addresses 10.x.x.x, provide 10.1.0.0 as the low end, and 10.255.255.255 as the high end, and then click OK. Click Add Range again and repeat the process to add the address ranges of the Internal networks in your branch offices. On the Network Addresses page, click Next.
-
On the summary page, review the properties of the enterprise network you are creating, and then click Finish.
Installing the Configuration Storage Server and ISA Server Services on a Single Computer
You can install the Configuration Storage server and ISA Server services on a single computer. If you install the Configuration Storage server and ISA Server services simultaneously, the setup process will restart the Routing and Remote Access service. If your initial VPN connection was established using Routing and Remote Access, this will prevent completion of the Configuration Storage server installation. For this reason, we recommend that you first install just the Configuration Storage server. Then, run setup again, and on the Program Maintenance page, select Modify and follow the wizard instructions to install ISA Server services.
To install the Configuration Storage server and ISA Server services on a single computer, follow these steps:
-
On the target computer, log on to the domain as an enterprise administrator.
-
Insert the ISA Server CD into the CD drive, or run ISAAutorun.exe from the shared network drive.
-
In Microsoft ISA Server Setup, click Install ISA Server.
-
After the setup program prompts that it has completed determining the system configuration, on the Welcome page, click Next.
-
If you accept the terms and conditions stated in the user license agreement, click I accept the terms in the license agreement, and then click Next.
-
Type your customer details, and then click Next.
-
On the Setup Scenarios page, select Install both ISA Server services and Configuration Storage server, and then click Next.
-
On the Component Selection page, you can review the settings, and then click Next.
-
On the Enterprise Membership page, select Create a New Enterprise if you are creating a new enterprise, or Create a replica of the enterprise configuration if you are creating a replicate Configuration Storage server. Click Next. Do one of the following:
-
If you are creating a new enterprise, on the New Enterprise Warning page, click Next. This page warns you not to install more than one enterprise. Because you are creating a new enterprise, you can ignore the warning. On the Create a New Enterprise page, provide a name for the enterprise. Optional: provide a description of the enterprise. Click Next.
-
If you are creating a replica of the enterprise configuration, on the Locate Configuration Storage Server page, provide the fully qualified domain name of the Configuration Storage server that you want to replicate, or click Browse to locate the server on the network. Click Next.
-
If you are creating a replicate Configuration Storage server, the next wizard page will be the ISA Server Configuration Replicate Source page. This page provides options for the initial ISA Server replication, which may take a long time over a slow link. If you are replicating over a slow link, you may want to choose to replicate from a Windows backup file. For information about creating a backup file, see Creating and Restoring a Backup File in this document. Click Next.
-
On the Internal Network page, specify the IP address range that will constitute the Internal network for this array. Select Add, and then click Add Adapter to define the Internal network with the IP addresses associated with the internal network adapter. Click Next.
-
On the Firewall Client Connection Settings page, you can select which Firewall clients will be allowed to connect. Click Next.
-
On the Services Warning page, read the warning, and then click Next.
-
On the Ready to Install the Program page, click Install to begin the installation.
-
After the installation is complete, select Invoke ISA Server Management when the wizard closes, and then click Finish.
-
You will be prompted to restart the computer. Click Yes to restart the computer.
| Note: |
|---|
|
If you want to create an ISA Server array in a workgroup and have it use the Configuration Storage server of the combined server, you must install a certificate on the combined server. The name on the server has to match the fully qualified domain name of the Configuration Storage server. The procedures for installing a certificate and configuring ISA Server to use the certificate are provided in the document ISA Server 2004 Enterprise Edition in a Workgroup, at the ISA Server 2004 Guidance Web site (http://www.microsoft.com).
|
Creating a VPN in ISA Server
This procedure creates a VPN using the Point-to-Point Tunneling Protocol (PPTP). For information on creating a VPN using the Layer Two Tunneling Protocol or Internet Protocol security (IPsec) tunnel mode, see the document Site-to-Site VPN in ISA Server 2004 Enterprise Edition, at the ISA Server 2004 Guidance Web site (http://www.microsoft.com).
To create a virtual private network (VPN) in ISA Server using PPTP, follow these steps:
-
Click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
-
In the ISA Server Management console, expand the main array node, and select Virtual Private Networks (VPN).
-
In the details pane, select the Remote Sites tab.
-
In the task pane, on the Tasks tab, click Add Remote Site Network to start the New Network Wizard.
-
On the Welcome page, provide a name for the new network, and then click Next.
-
On the VPN Protocol page, select Point-to-Point Tunneling Protocol (PPTP), and then click Next.
-
On the Remote Site Gateway page, supply the name or IP address for the remote VPN server, and then click Next.
-
On the Remote Authentication page, you can select to allow outgoing connections from the local site to the remote site. If you enable this option, you must provide a user name, domain, and password for the connection. If you do not enable this option, you will not be able to establish outgoing connections to the remote VPN site, although you will be able to accept connections from that site. Click Next.
-
On the Network Addresses page, click AddRange and add the address ranges of the remote network, or click Add Network to select the enterprise networks included in the remote network. You can obtain this information from the administrator of the remote network. After you add the address ranges, on the Network Addresses page, click Next.
-
On the summary page, review the configuration, and then click Finish.
-
In the ISA Server details pane, click Apply to apply the changes to ISA Server.
After you create a VPN site-to-site network, you must create the appropriate firewall policy to allow and control access between the branch and main offices. For a description, see the document Site-to-Site VPN in ISA Server 2004 Enterprise Edition, at the ISA Server 2004 Guidance Web site (http://www.microsoft.com).
Creating a Network Rule
Network rules determine whether there is a relationship between two network entities, and what type of relationship is defined.
To create a new network rule, follow these steps:
-
Click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
-
In the ISA Server Management console, expand the array node, expand Configuration, and click Networks.
-
In the details pane, click the Network Rules tab. In the task pane, on the Tasks tab, click Create a New Network Rule to start the New Network Rule Wizard.
-
On the Welcome page of the wizard, enter the name for the network rule, and then click Next.
-
On the Network Traffic Sources page, click Add to open the Add Network Entities dialog box, expand Networks, select the specific source network, click Add, and then click Close. On the Network Traffic Sources page, click Next.
-
On the Network Traffic Destinations page, click Add to open the Add Network Entities dialog box, expand Networks, select the destination network, click Add, and then click Close. On the Network Traffic Destinations page, click Next.
-
On the Network Relationship page, select either a Network Address Translation (NAT) relationship, or a Route relationship, and then click Next.
-
Review the information on the wizard summary page, and then click Finish.
-
In the ISA Server details pane, click Apply to apply the new network rule.
Creating an ISA Server Array
You can configure an ISA Server array on the Configuration Storage server. This will be an empty array, for which you can configure enterprise policy. The enterprise or array administrator can then add servers to the array. Alternatively, the array can be created on the first array server, and other servers can then be added.
To create an ISA Server array, follow these steps:
-
On the Configuration Storage server, open ISA Server Management.
-
In the ISA Server Management console tree, click Arrays. In the task pane, on the Tasks tab, click Create New Array to start the New Array Wizard.
-
On the Welcome page, provide a name for the new array, such as Main, and then click Next.
-
On the Array DNS Name page, provide the Domain Name System (DNS) name of the array. This is the name that Firewall clients and Web client will use to connect to the array. Click Next.
-
On the Assign Enterprise Policy page, from the drop-down menu, select the enterprise policy that will be applied to the new array, and then click Next.
-
On the Array Policy Rule Types page, select the types of rules that the array administrator is allowed to make, and then click Next.
-
On the summary page, review the array configuration, and then click Finish. When the progress bar indicates that the array has been created, click OK.
-
After the array has been created, you can assign array administrator privileges to the main array. In ISA Server Management, right-click the name of the array and select Properties.
-
On the Assign Roles tab, click Add. Add the appropriate user or group. From the drop-down Role menu, select ISA Server Array Administrator, and then click OK.
-
Click OK to close the properties page.
-
In the details pane, click Apply to apply the changes.
Adding Servers to the ISA Server Array
Now that you have created an array, you can add ISA Server computers to the array. Perform this procedure for each computer you want to add to the array.
To add servers to the ISA Server array, follow these steps:
-
Log on to the domain using the credentials of the array administrator.
-
Insert the ISA Server CD into the CD drive, or run ISAAutorun.exe from the shared network drive.
-
In Microsoft ISA Server Setup, click Install ISA Server.
-
After the setup program prompts that it has completed determining the system configuration, on the Welcome page, click Next.
-
If you accept the terms and conditions stated in the user license agreement, click I accept the terms in the license agreement, and then click Next.
-
Type your customer details, and then click Next.
-
On the Setup Scenarios page, select Firewall Server Components, and then click Next.
-
On the Component Selection page, you can review the settings, and then click Next.
-
On the Locate Configuration Storage Server page, specify the Configuration Storage server to which this computer will connect. You can click Browse to locate the Configuration Storage server. Note that the name you use to refer to the Configuration Storage server is its name on the network, and not the enterprise name. On this page, you must provide the credentials of an enterprise or array administrator, to connect to the Configuration Storage server. This user must be recognized by the Configuration Storage server, either as a domain user, or a local user on the Configuration Storage server. Click Next.
-
On the Array Membership page, select Join an Existing Array, and then click Next.
-
On the Join an Existing Array page, provide the name of the array. You can also click Browse to open the Arrays to join dialog box, and select the array from the list. Click Next.
-
On the Configuration Storage Server Authentication Options page, select the authentication type that will be used for connections between the ISA Server computer and the Configuration Storage server. Because the firewall array and the Configuration Storage server are in the same domain in this scenario, select Windows authentication, and then click Next.
-
This step will only take place on the first server you install in the array. On the Internal Network page, specify the IP address range that will constitute the Internal network for this array. You can map your Internal network to an enterprise network:
-
Click Add to open the Addresses dialog box.
-
Click Add Network to open the Select Enterprise Networks dialog box.
-
Select the internal enterprise network, and then click OK.
-
In the Addresses dialog box, click OK.
-
On the Internal Network page, click Next.
Alternatively, you can select Add Adapter and define the Internal network with the IP addresses associated with the internal network adapter, rather than mapping to an enterprise network.
-
On the Services Warning page, review the list of services that will be stopped or disabled during installation of ISA Server. To continue the installation, click Next.
| Note: |
|---|
|
If the domain of your server is outside the IP address range that you specified for the Internal network (the IP address range of the Internal enterprise network), you will receive a notice that the system policy of ISA Server will be configured to allow the needed Active Directory directory service connectivity. Click Next to continue the installation.
|
-
Click Install.
-
After the installation is complete, click Finish.
-
You will be prompted to restart the computer. Click Yes to restart the computer.
Repeat this procedure for the other servers that must be installed.
Creating an Access Rule
Access rules determine how clients on a source network can access resources on a destination network. This procedure describes the New Access Rule Wizard in general terms.
To create a new access rule, follow these steps:
-
In the Microsoft ISA Server Management console tree, select Firewall Policy.
-
In the task pane, on the Tasks tab, click Create Array Access Rule to start the New Access Rule Wizard.
-
On the Welcome page of the wizard, enter the name for the access rule. Use a descriptive name, such as Internet access for staff during work hours, and then click Next.
-
On the Rule Action page, select Allow if you are allowing access, or Deny if you are denying access, and then click Next.
-
On the Protocols page, the default setting of This rule applies to is Selected protocols. Use the Add button to add the specific protocols from the Add Protocols dialog box. Or, you can select All outbound traffic to apply the rule to all defined protocols. When you have made these selections, click Next.
-
On the Access Rule Sources page, click Add to open the Add Network Entities dialog box, click the category for which you are creating access, select the specific object, click Add (repeat to add additional network objects), and then click Close. On the Access Rule Sources page, click Next.
-
On the Access Rule Destinations page, click Add to open the Add Network Entities dialog box, click Networks, select the External network (representing the Internet), click Add, and then click Close. On the Access Rule Destinations page, click Next.
-
On the User Sets page, if your rule applies to all users, you can leave the user set All Users in place and proceed to the next page of the wizard. If the rule applies to specific users, select All Users and click Remove. Then, use the Add button to open the Add Users dialog box, from which you can add the user set to which the rule applies. The Add Users dialog box also provides access to the New User Sets Wizard through the New menu item. When you have completed the user set selection, click Next.
-
Review the information on the wizard summary page, and then click Finish.
-
In the Firewall Policy details pane, click Apply to apply the new access rule. It may take a few moments for the rule to be applied. Order your access rules to match your Internet access policy. If you change the order, you will need to click Apply to apply the changes.
Creating a Protocol Definition
If you want a rule to refer to a protocol that is not predefined in ISA Server, you must define that protocol. This procedure describes how to create a protocol definition.
To create a protocol definition, follow these steps:
-
Click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.
-
In the ISA Server Management console, select Firewall Policy.
-
In the task pane, on the Toolbox tab, click Protocols.
-
Under Protocols, click New, and then click Protocol to open the New Protocol Definition Wizard.
-
On the New Protocol Definition Wizard Welcome page, in the Protocol definition name box, provide a name, and then click Next.
-
On the Primary Connection Information page, click New.
-
In the New/Edit Protocol Connection dialog box, in the Protocol type list, select the protocol type. For LDAPS server, this is TCP.
-
In Direction, select the direction. For LDAPS server, this is Inbound.
-
In From and To, type the port range. For LDAPS server, both From and To are 2172 For LDAP, the port is 2171. These are ports that are specific to LDAPS and LDAP in ISA Server 2004 Enterprise Edition.
-
Click OK to close the New/Edit Protocol Connection dialog box.
-
On the Primary Connection Information page, click Next.
-
On the Secondary Connections page, in Do you want to use secondary connections, select No, and then click Next. If the protocol requires secondary connections, select Yes, and click New to define the secondary connection.
-
Click Finish to close the New Protocol Definition Wizard. Notice that the LDAPS server protocol definition is listed in the User-Defined folder under the Protocols menu.
Creating a Server Publishing Rule
ISA Server uses server publishing to process incoming requests to internal servers. Server publishing rules determine how server publishing functions, essentially filtering all incoming and outgoing requests through the ISA Server computer.
To create a server publishing rule, follow these steps:
-
In ISA Server Management, select Firewall Policy.
-
In the task pane, on the Tasks tab, click Create New Server Publishing Rule to open the New Server Publishing Rule Wizard.
-
On the New Server Publishing Rule Wizard Welcome page, provide a name for the rule, and then click Next.
-
On the Select Server page, in Server IP address, type the IP address of the computer that you want to publish, and then click Next.
-
On the Select Protocol page, from the Selected protocol drop-down list, select the protocol on which you want to publish the server, and then click Next.
-
On the IP Addresses page, under Listen for requests from these networks, select the networks on which you want to listen for requests.
| Note: |
|---|
|
You can select specific IP addresses that ISA Server will listen on. To do this, click the Address button, and then for the selected network, specify the IP addresses that ISA Server will listen on.
|
-
Click Next.
-
Click Finish to close the New Server Publishing Rule Wizard. Notice that in the ISA Server Management console, in the details pane, on the Firewall Policy tab, the new rule is listed.
-
In the details pane, click the Apply button to apply the publishing rule that is effective for the incoming traffic.
Creating a New Computer Set
Follow this procedure to create a new computer set:
-
In the console tree of ISA Server Management, click Enterprise Policies (for enterprise-level computer sets) or Firewall Policy (for array-level computer sets).
-
In the task pane, on the Toolbox tab, click Network Objects.
-
On the toolbar beneath Network Objects, click New, and then click Computer Set.
-
In the New Computer Set Rule Element dialog box, provide a name for the new computer set.
-
Click Add, and select either Computer, AddressRange, or Subnet, and add the appropriate computers, address ranges, or subnets included in the computer set.
-
If you click Computer, you can add a single computer.
-
If you click AddressRange, you can add a range of IP addresses, representing a group of computers.
-
If you click Subnet, you can add a subnet.
-
After you add the computers, address ranges, or subnets, click OK to close the New Computer Set Rule Element dialog box.
-
In the details pane, click Apply to apply the change.
Establishing External Trust Between Two Domains
To establish trust between two domains, follow these steps:
-
Open Active Directory Domains and Trusts. Click Start, point to All Programs, point to Administrative Tools, and click Active Directory Domains and Trusts.
-
In the console tree, right-click the domain node for the domain that you want to establish trust, and then click Properties.
-
On the Trusts tab, click New Trust, and then click Next.
-
On the Trust Name page, type the DNS name (or NetBIOS name) of the domain, and then click Next.
-
On the Trust Type page, click External trust, and then click Next.
-
On the Direction of Trust page, click Two-way.
-
Continue to follow the wizard.
| Note: |
|---|
|
To perform this procedure, you must be a member of the Domain Admins group or the Enterprise Admins group in Active Directory, or you must have been delegated the appropriate authority. As a security best practice, consider using Run as to perform this procedure.
|
-
To open Active Directory Domains and Trusts, you may have to click Start, click Control Panel, double-click Administrative Tools, and then double-click Active Directory Domains and Trusts.
-
If you have the appropriate administrative credentials for each domain, you can create both sides of an external trust at the same time by clicking both this domain and the specified domain on the Sides of Trust page. For more information, see Windows Help.
-
If you want to allow users from the specified domain to obtain access to all the resources in this domain, click Allow authentication for all resources in the local domain on the Outgoing Trust Properties page. This option should be used when both domains belong to the same organization.
-
If you want to restrict users in the specified domain from obtaining access to any of the resources in this domain, click Allow authentication only for selected resources in the local domain on the Outgoing Trust Properties page. This option should be used when each domain belongs to a separate organization.
Creating and Restoring a Backup File
The Configuration Storage server is based on Active Directory Application Mode (ADAM). These procedures walk you through the creation of a Windows backup file for ADAM data that can be used in the replication of a Configuration Storage server.
Backing up the ADAM data files
To back up the ADAM data files, on the Configuration Storage server from which you want to replicate, follow these steps:
-
Click Start, point to All Programs, point to Accessories, point to System Tools, and then click Backup.
-
If the Welcome page appears, click Advanced Mode.
-
On the Backup tab, select the ADAMData folder, located under the installation folder (by default, Program files\Microsoft ISA Server).
-
In Backup media or file name, type the name of the backup file (with a .bkf extension).
-
Click Start Backup. In the Backup Job Information dialog box, click Start Backup.
-
When the backup is complete, copy the backup files to the computer on which you want to replicate the Configuration Storage server.
Restoring the backup files
On the computer to which you want to replicate the Configuration Storage server, do the following:
-
Click Start, point to All Programs, point to Accessories, point to System Tools, and then click Backup.
-
If the Welcome page appears, click Advanced Mode.
-
On the Restore and Manage Media tab, right-click File, and then click Catalog file. Provide or browse to the backup file (.bkf) you copied to the local computer. Then click OK.
-
Expand the tree nodes to navigate to the ADAMData folder. Click to select the folder.
-
In Restore files to, select Alternate location.
-
In Alternate location, specify the folder to which you want to restore the backup data files.
| Note: |
|---|
|
The folder you specify must be on an NTFS drive, and located on a local computer, because a network location is not supported.
|
-
Click Start Restore.
-
In the Confirm Restore dialog box, click OK.
| Note: |
|---|
|
After running restore, do not rename the folder you have specified for the restore data or copy the contents of the folder to a different location.
|
Creating Enterprise Policy for Branch Communication
ISA Server provides system policy rules that allow appropriate access to computers running ISA Services that may also host a Configuration Storage server. This topic describes how to configure rules to allow access through computers running ISA Server services to computers that are running Configuration Storage server or ISA Server management.
Create access rules on the enterprise level to ensure that critical inter-branch communication is enabled. The properties of each rule are provided in the following sections. Instructions on how to create an access rule are provided in Creating an Access Rule in this document.
Allowing replication between Configuration Storage servers
There is a system policy rule that allows replication between Configuration Storage servers, but the rule is enabled only when the Configuration Storage server is installed on the same computer with ISA Server services. If you have one or more branches where the Configuration Storage server is installed on a computer that is not running ISA Server services, this rule will not apply.
To ensure that the replication can take place, perform the following steps:
-
Create an enterprise-level computer set containing the IP addresses of all of the Configuration Storage servers in the enterprise, following the procedure Creating a New Computer Set in this document. Refer to this as the Configuration Storage Servers computer set.
-
Following the procedure Creating an Access Rule in this document, create a post-array enterprise-level access rule allowing access from the Configuration Storage Servers computer set, to the Configuration Storage Servers computer set, using these protocols:
-
MS Firewall Storage Replication
-
RPC (all interfaces)
Allowing centralized remote management and monitoring
There is a system policy rule that allows centralized remote management and monitoring, but the rule is enabled only when the Configuration Storage server is installed on the same computer with ISA Server services. If you have one or more branches where the Configuration Storage server is installed on a computer that is not running ISA Server services, this rule will not apply.
To ensure that the replication can take place, perform the following steps:
-
Create an enterprise-level computer set containing the IP addresses of all of the static address pools used in VPNs in the enterprise, following the procedures in Creating a New Computer Set in this document. Refer to this as the Static Address Pools computer set.
-
Following the procedures in Creating an Access Rule in this document, create a post-array enterprise-level access rule allowing access from the Enterprise Remote Management Computers computer set, to the Enterprise Array Servers computer set and Static Address Pools computer set on these protocols:
-
Microsoft CIFS (TCP)
-
Microsoft CIFS (UDP)
-
MS Firewall Control
-
MS Firewall Storage
-
RDP (Terminal Services)
-
RPC (all interfaces)
Allowing authentication services from all branches to the main office
System policy that allows authentication access to the domain controller is designed for the scenario when the domain controller is behind the ISA Server array in the Internal network of the branch. However, you may not have a domain controller in each branch, in which case, authentication access is required from one branch to another, or to the main office.
To enable this communication, follow these steps:
-
If you have not done so, create an enterprise-level computer set containing the IP addresses of all of the static address pools used in VPNs in the enterprise, following the procedure Creating a New Computer Set in this document. Refer to this as the Static Address Pools computer set.
-
Following the procedure Creating a New Network Set in this document, create an enterprise-level network set containing all of the enterprise networks representing the branches (and the main office, in the hub and spoke topology). Refer to this as the Corporate Networks computer set.
-
Following the procedure Creating an Access Rule in this document, create a post-array enterprise-level access rule allowing access from the Corporate Networks computer set, the Static Address Pools computer set, and Local Host, to the Corporate Networks computer set, on these protocols:
-
DNS
-
Kerberos-Sec (TCP)
-
Kerberos-Sec (UDP)
-
LDAP (UDP)
-
LDAP GC (Global Catalog)
-
LDAP
-
LDAPS
-
LDAPS GC (Global Catalog)
-
Microsoft CIFS (TCP)
-
Microsoft CIFS (UDP)
-
RPC (all interfaces)