This procedure is performed on the ISA Server computer. If you installed a stand-alone root CA and did not automate the issuing of certificates, there are also actions that take place on the certification authority.
.gif) Note: |
|---|
|
The recommended configuration for Outlook Web Access publishing is to use SSL-encrypted communication (HTTPS) both from the external client to the ISA Server computer and from the ISA Server computer to the Outlook Web Access server. For this reason, you must install digital certificates on both the ISA Server computer and the Outlook Web Access server.
|
To install a digital certificate on the ISA Server computer, follow these steps:
-
Open Internet Explorer.
-
From the menu, select Tools, and then select Internet Options.
-
Select the Security tab, and in Select a Web content zone to specify its security settings, click Trusted sites.
-
Click the Sites button to open the Trusted sites dialog box.
-
In Add this Web site to the zone, provide the certificate server Web site name (http://IP address of certification authority server/certsrvname) and click Add.
-
Click Close to close the Trusted sites dialog box, and then click OK to close Internet Options.
-
Browse to: http://IP address of certification authority server/certsrv.
-
Request a certificate.
-
Select Advanced Certificate Request.
-
Select Create and submit a request to this CA (Windows Server 2003 CA), or Submit a certificate request to this CA using a form (Windows 2000 Server CA).
-
Complete the form and select Server Authentication Certificate from the Type drop-down list. To avoid the client receiving an error when trying to connect, it is critical that the common name you provide for the certificate matches the fully qualified host name or URL that external clients will type in their Web browser to access Outlook Web Access, for example www.adatum.com/mail.
| Note: |
|---|
|
For an explanation of the options available on the Advanced Certificate Request page, see one of the following articles for Windows Server 2003 or Windows 2000 Server:
|
-
Select Store Certificate in the local computer certificate store (Windows Server 2003 CA) or Use local machine store (Windows 2000 Server CA) and submit the request by clicking Submit. Review the warning dialog box that appears, and then click Yes.
-
If you installed a stand-alone root CA, and did not automate the issuing of certificates, perform the following steps on the certification authority computer. These steps are automated in an enterprise root CA:
-
Go to the Microsoft Management Console (MMC) Certification Authority snap-in. (Click Start, point to All Programs, point to Administrative tools, and then select Certification Authority.)
-
Expand the CAName certificates node, where CAName is the name of your certification authority.
-
Click the Pending requests node, right-click your request, select All Tasks, and then select Issue.
-
On the ISA Server computer, return to the Web page http://IP address of certification authority server/certsrv, and then click View status of a pending request.
-
Click your request and choose Install this certificate.
-
Verify that the server certificate was properly installed. On the ISA Server computer, open MMC, and go to the Certificates snap-in. Open Certificates (local computer), expand the Personal node, click Certificates, and double-click the new server certificate. On the General tab, there should be a note that says You have a private key that corresponds to this certificate. On the Certification Path tab, you should see a hierarchical relationship between your certificate and the root certificate, and a note that says This certificate is OK.
| Note: |
|---|
|
On an ISA Server 2004 computer, the server certificate obtained from a CA must be stored in the Personal Certificate store of the ISA Server computer. The root certificate for the Outlook Web Access server from which the connection will be established must be stored in the Trusted Root Certificate Authorities store of the ISA Server computer. Clients that connect to the ISA Server computer will also require a root certificate.
|
For a client computer to trust the server certificates that you have installed from a local CA, it must have installed the root certificate from the CA. In this scenario, the clients on the Internet are the clients, and each one must have the root certificate installed.
A root CA certificate can be distributed automatically in the following ways:
-
Add a root CA certificate to the Active Directory® directory service forest configuration so that it is deployed on every computer in the forest using group policies. (Multiple forest directories should add a root CA certificate to each forest.) Root certificate distribution through Active Directory enables a trust with the root CA at a forest level. Organizations that have deployed Active Directory should prefer this method of distributing the organization’s root certificates.
-
Add the CA to the domain security Group Policy. This is preferable if the Active Directory forest consists of several domains and the root trust should be limited to only a few domains. The drawback of this method is that additional management would be needed if the root certificate has to be added to multiple domains.
-
Deploy the root CA certificate as part of the Internet Explorer administration kit.
-
Deploy the root CA certificate with a script that writes the root certificate as a binary large object into the registry or uses CAPICOM.
-
Deploy the root CA certificate through a file. This might be an acceptable method for clients that are not Active Directory-aware. With administrator permissions, the root CA certificate can be manually added to the local root CA certificate store. Heterogeneous environments might consider this method of deploying root CA certificates.
You can also distribute certificates manually. Where certificates are distributed manually, the certificate user must decide if a root certificate is trustworthy or not. When a certificate that chains to an untrusted root is used, the user receives a warning that lets the user decide whether to trust the root certificate. When the root certificate is distributed automatically, the administrator is responsible for thinking about and determining trust levels.
Based on default permissions, a user can only add a root CA certificate into the user’s certificate store. Root trust is then limited to this user’s account. However, administrators can add root CA certificates into a computer’s certificate store, which is then inherited by all users.
For more information, see the document Best Practices for Implementing a Microsoft Windows Server 2003 Public Key Infrastructure (http://www.microsoft.com).
Two options for installing the root certificate are described:
-
Root trust using Group Policy
-
Manual installation of root certificates on each client computer
Note that there are other means of installing the root certificate, or of creating root trust. For example, you can transfer the root certificate on a medium such as a disk, and then install it on the appropriate computer.
Using Group Policy
To establish a trusted root certification authority using Group Policy, the Group Policy object (GPO) that you create must have access to the root certificate. This requires that you import a copy of the root certification authority certificate. For a root certification authority certificate to be imported, the root certificate must be in a PKCS #12 file, in a PKCS #7 file, or in a binary-encoded X.509 v3 certificate file. For more information about using these file formats, see Importing and Exporting Certificates (www.microsoft.com).
Follow this procedure to establish a trusted root certification using Group Policy:
-
Open the Group Policy object (GPO) that you want to edit.
-
In the console tree, click Trusted Root Certification Authorities.
-
On the Action menu, point to All Tasks, and then click Import.
This starts the Certificate Import Wizard, which guides you through the process of importing a root certificate and installing it as a trusted root certification authority (CA) for this GPO.
Notes
-
To perform this procedure you must be a member of the Domain Admins group or Enterprise Admins group in Active Directory, or you must have been delegated the proper authority. As a security best practice, consider using Run as to perform this procedure.
-
To open a GPO, see Group Policy (http://www.microsoft.com).
-
This procedure does not apply to Local Policy objects.
Manual installation on each client computer
Follow this procedure on each client computer:
-
Open Internet Explorer.
-
From the menu, select Tools, and then select Internet Options.
-
Select the Security tab, and click Custom Level to open the Security Settings dialog box. Set the value in the Reset custom settings drop-down list box to Medium, click OK to close the Security Settings dialog box, and then click OK to close the Internet Options dialog box.
| Note: |
|---|
|
Certificate installation through the CA Web site is not possible when the security setting is set to High.
|
-
Browse to: http://IP address of certification authority server/certsrv.
-
Click Download a CA Certificate, Certificate Chain, or CRL (the text used by Windows Server 2003) or Retrieve the CA certificate or certificate revocation list (the text used by Windows 2000 Server). On the next page, click Download CA Certificate. This is the trusted root certificate that must be installed on the ISA Server computer. In the File Download dialog box, click Open.
-
On the Certificate dialog box, click Install Certificate to start the Certificate Import Wizard.
-
On the Welcome page, click Next. On the Certificate Store page, select Place all certificates in the following store and click Browse. In the Select Certificate Store dialog box, select Show Physical Stores. Expand Trusted Root Certification Authorities, select Local Computer, and then click OK. On the Certificate Store page, click Next.
-
On the summary page, review the details and click Finish.
-
Optional. Verify that the root certificate was properly installed. Open MMC, and go to the Certificates snap-in. Open Certificates (local computer), expand the Trusted Root Certification Authorities node, click Certificates, and verify that the root certificate is in place.
| Note: |
|---|
|
You can also install certificates on a computer from the MMC Certificates (Local Computer) snap-in. This only provides access to CAs on the same domain.
|
This step is only for the Enterprise Edition.
You may want to publish Outlook Web Access using Network Load Balancing (NLB) in your ISA Server array. We recommend that you enable NLB on the Outlook Web Access server’s network, and on the External network (the network on which ISA Server will listen for Outlook Web Access requests). For the most effective use of NLB, your Web listener should listen on the NLB virtual IP address for the External network. If you configure your Web listener to listen on all of the IP addresses for the network adapters, it will listen on the virtual IP address, which will distribute requests using NLB, and on the dedicated IP addresses of the network adapters, which will not make use of NLB. The procedure for selecting the virtual IP address in a Web listener is described in Creating a mail server publishing rule in this document.
Follow this procedure to configure NLB for an array. NLB will be automatically configured in unicast mode and single affinity. Single affinity ensures that all network traffic from a particular client be directed to the same host. This procedure takes place on a computer in an ISA Server array. You must be logged on as an array or enterprise administrator.
To configure NLB on an ISA Server array, follow these steps:
-
On one of the ISA Server array members, expand Arrays, expand the array node, expand Configuration, and click Networks.
-
In the details pane, verify that the Networks tab is selected.
-
In the task pane, on the Tasks tab, click Enable Network Load Balancing Integration to start the Network Load Balancing Integration Wizard. On the Welcome page, click Next.
-
On the Select Load Balanced Networks page, select the networks for which NLB will be enabled. We recommend that you enable NLB on the Outlook Web Access servers network, and on the External network. Select those networks. Do not click Next.
-
Before you click Next, you must set the virtual IP address for each network. To set the virtual IP address, after you select the network, click Set Virtual IP. In the Set Virtual IP Address dialog box, provide the IP address and subnet mask for the virtual IP address you will use. Note that this IP address must be a valid static IP address (that cannot be assigned by your DHCP server), and must belong to the network you are configuring. Click OK, and then click Next.
-
On the summary page, click Finish.
-
In the details pane, click Apply.
Creating a mail server publishing rule
Create a new mail publishing rule using the New Mail Server Publishing Rule Wizard:
-
Expand Microsoft ISA Server Management and click Firewall Policy.
-
In the Firewall Policy task pane, on the Tasks tab, select Publish a Mail Server to start the New Mail Server Publishing Rule Wizard.
-
On the Welcome page of the wizard, provide a name for the rule, and then click Next.
-
On the Select Access Type page, select Web client access: Outlook Web Access (OWA), Outlook Mobile Access, Exchange Server ActiveSync, and then click Next.
-
On the Select Services page, select Outlook Web Access. You may also select Outlook Mobile Access and Exchange ActiveSync. Click Next.
-
On the Bridging Mode page, select which parts of the communication path will be secured by digital certificates and therefore take place using the HTTPS protocol. This can be the communication from the client to the ISA Server computer, the communication from the ISA Server computer to the Outlook Web Access server, both types of communication, or neither. We recommend that you select the default Secure connection to clients and mail server, so that both portions of the communications pathway are secured by digital certificates. This will require that a digital certificate be installed on the Outlook Web Access server and on the ISA Server computer. Click Next.
-
On the Specify the Web Mail Server page, enter the name or IP address of the Outlook Web Access server. This name must match the name on the Outlook Web Access server digital certificate. Click Next.
-
On the Public Name Details page, provide information regarding what requests will be received by the ISA Server computer and forwarded to the Outlook Web Access server. In Accept requests for, if you select Any domain name, any request that is resolved to the IP address of the external Web listener of the ISA Server computer will be forwarded to your Outlook Web Access server. If you select This domain name and provide a specific domain name, such as mail.fabrikam.com, then, assuming that domain is resolved to the IP address of the external Web listener of the ISA Server computer, only requests for https://mail.fabrikam.com will be forwarded to the Outlook Web Access server. Click Next.
-
On the Select Web Listener page, specify the Web listener that will listen for Web page requests that should be redirected to your Web server, and then click Next. If you have not defined a Web listener, click New and follow these steps to create a new listener:
-
On the Welcome page of the New Web Listener Wizard, type the name of the new listener, such as Listener on External network for Outlook Web Access publishing, and then click Next.
-
On the IP Addresses page, select the network that will listen for Web requests. Because you want ISA Server to receive requests from the External network (the Internet), the listener should be one or more IP addresses on the External network adapter of ISA Server. For Enterprise Edition, see the next step. In Standard Edition, you can select External, and then click Next.
-
This step applies to Enterprise Edition, where NLB is being used. Before you click Next on the IP Addresses page, select specific addresses on which you will listen. Click the Address button. The default selection is to listen on all IP addresses on the network. This will include both dedicated IP addresses and virtual IP addresses on the External network, where NLB is enabled. We recommend that you select Default IP address(es) for network adapter(s) on this network. This will select the default virtual IP address if NLB is enabled, and will select the default IP addresses on the network adapters of the ISA Server array if NLB is not enabled. If you have enabled NLB, and have created more than one virtual IP address, you should select Specified IP addresses on the ISA Server computer in the selected network, and then select the specific virtual IP address in the Available IP Addresses list. Click OK, and on the IP Addresses page, click Next.
-
On the Port Specification page, because you plan to listen only for SSL requests (as recommended), you should clear Enable HTTP, and select Enable SSL. Make sure the SSL port is set to 443 (default setting), and provide the certificate name in the Certificate field. For more information about SSL, see Digital Certificates for ISA Server 2004(http://www.microsoft.com). Click Next.
| Important: |
|---|
|
For secure Outlook Web Access publication, we recommend that you listen only for SSL requests. Use only the standard port numbers, which are the default settings, for Outlook Web Access publishing.
|
-
On the Completing the New Web Listener Wizard page, review the settings, and click Finish.
-
On the Select Web Listener page, click Next.
| Note: |
|---|
|
For security purposes, you should consider using forms-based authentication and limiting attachment access from public computers. These features are part of the listener used in the mail server publishing rule, and can be configured in the listener properties after completing the New Web Listener Wizard. For more information, see Secure Outlook Web Access through the Listener in this document.
|
-
On the User Sets page, the default, All Users, is displayed. This will allow any authenticated user in the External network to access the Outlook Web Access server. To restrict the access to specific users, use the Remove button to remove All Users, and the Add button to access the Add Users dialog box, from which you can add the user set to which the rule applies. The Add Users dialog box also provides access to the New User Sets Wizard through the New menu item. When you have completed the user set selection, click Next.
-
On the Completing the New Mail Server Publishing Rule Wizard page, scroll through the rule configuration to make sure that you have configured the rule correctly, and then click Finish.
-
In the ISA Server details pane, click Apply to apply the changes you have made. It will take a few moments for the changes to be applied.
When you use ISA Server forms-based authentication as recommended, no objects are cached from the Outlook Web Access server. To take advantage of the ISA Server caching feature, you can create a cache rule to enable caching of the images served by Outlook Web Access. Do not enable caching of other objects, because this can lead to unexpected logging off of users.
The cache rule will refer to a URL set containing your Outlook Web Access servers.
To create a URL set:
-
Expand Microsoft ISA Server Management, expand the node of the ISA Server computer or array, and click Firewall Policy.
-
In the task pane, on the Toolbox tab, select Network Objects. Click New, and from the drop-down menu, select URL Set.
-
Provide a name for the URL set, such as Outlook Web Access servers.
-
Click New, and provide the URL for the Outlook Web Access server, such as http://nameofowaserver/exchweb/img/*. If you have more than one Outlook Web Access server, repeat this step for the URL of each server. When you are done, click OK.
Ensure that caching is enabled on the ISA Server.
To enable caching:
-
Expand Microsoft ISA Server Management, expand the node of the ISA Server computer or array, expand Configuration and click Cache.
-
In the details pane, click the Cache Drives tab and select the applicable drive.
-
On the Tasks tab, click Define Cache Drives (enable caching).
-
Select one of the drives listed.
-
In Maximum cache size (MB), type the amount of space on the selected drive to allocate for caching.
-
Click OK.
To create a cache rule:
-
In ISA Server Management, expand Configuration and click Cache.
-
In the details pane, select the Cache Rules tab.
-
In the task pane, on the Tasks tab, select Create a Cache Rule to start the New Cache Rule Wizard.
-
On the Welcome page of the wizard, provide a name for the rule, and then click Next.
-
On the Cache Rule Destination page, click Add to open the Add Network Entities dialog box, select the URL set you created, click Add, and then click Close. On the Access Rule Destination page, click Next.
-
On the Content Retrieval page, leave the default selection Only if a valid version of the object exists in the cache, and then click Next.
-
On the Cache Content page, select If source and request headers indicate to cache and Content requiring user authentication for retrieval. Click Next. You will receive a warning, which you should review before clicking Yes.
-
You can use the default selections on the remaining wizard pages. Information about cache rule properties is provided in ISA Server Help. Review the information on the wizard summary page, and then click Finish.
-
In the details pane, click Apply to apply your changes.