As you customize the browser and prepare for deployment, you should also prepare any servers that you will need to support your deployment of Microsoft Internet Explorer 5. This chapter covers preparing for proxy servers, roaming user profiles, Internet sign-up with the Internet Connection wizard, and Microsoft NetMeeting.
See Also
-
For more information about testing the deployment process before the final rollout, see Chapter 11, "Setting Up and Administering a Pilot Program."
-
For more information about preparing to use the Internet Explorer Administration Kit (IEAK), see Chapter 12, "Preparing for the IEAK."
-
For more information about building custom browser packages for installation, see Chapter 15, "Running the Internet Explorer Customization Wizard."
-
For more information about rolling out Internet Explorer to your users, see Chapter 19, "Deploying Microsoft Internet Explorer 5."
-
For more information about automatic configuration, see Chapter 21, "Using Automatic Configuration and Automatic Proxy."
-
For more information about updating programs after deployment, see Chapter 22, "Keeping Programs Updated."
Preparing Servers
Depending on your situation, you may need to set up servers as part of your deployment. When setting up servers, you should plan for your users' needs in terms of deployment, browser use, and updating of software. If you are an Internet service provider (ISP), you should also plan how users will sign up for your services.
If you distribute files over the Internet or an intranet, consult your Web server documentation for specific information about how to set up your servers. Regardless of your Web server type, consider the following issues that can impact how smoothly users are able to install your software:
-
Security—Certain security levels prevent files that are not digitally signed from being downloaded, and some security levels prompt the user with warning messages. For general information about digital certificates, see Chapter 6, "Digital Certificates." For information about preparing digital certificates for use with the Internet Explorer Customization wizard, see Chapter 12, "Preparing for the IEAK."
-
Bandwidth—Setting up servers in different locations or staggering rollouts might be necessary to avoid an overwhelming demand on a specific server. For example, you could schedule installation for different divisions or regions a few days or weeks apart, depending on the size of your organization and resources. For more information about deployment, see Chapter 19, "Deploying Microsoft Internet Explorer 5."
You can use the Customization wizard to specify up to 10 locations from which users can download and install Internet Explorer. This information is stored in the IE5Sites.dat file. If one server is down, an attempt is made to download files from the next site in the list. You can choose only one site, however, if you are installing Internet Explorer silently—that is, with no user interaction.
If you are a corporate administrator, you can help offset some of the load associated with Internet usage by specifying and setting up key user pages, such as the home, support, and search pages, on your intranet. You can preconfigure these pages before deployment on the Important URLs screen in Stage 4 of the Customization wizard.
If you are a corporate administrator and you don't have Internet access, you must set up these pages on your intranet.
If your deployment plan also includes software updates, you might want to schedule them during off-hours or stagger updates among groups of users to minimize server load. For more information about software updates, see Chapter 22, "Keeping Programs Updated."
In addition to general deployment issues, you may need to address additional server needs for your organization. This chapter covers the following specific server issues:
-
Automatic browser configuration servers and automatic detection of browser settings (corporate administrators)
-
Proxy servers
-
Automatic searching
-
Roaming user profiles (corporate administrators)
-
Internet sign-up servers (ISPs)
-
NetMeeting servers
Configuring Central Automatic Configuration Servers
Automatic configuration and automatic proxy enable you to change user settings from a central location after you deploy Internet Explorer. This can be useful if you expect the needs of your users or your organization to change frequently.
On the Connections tab in the Internet Options dialog box, you can specify that Internet Explorer should check periodically for changes to the automatic configuration files, and then refresh user settings as needed.
You can also set these options before deployment by using the Internet Explorer Customization wizard. The following illustration shows the Automatic Configuration screen of the wizard, where you can set automatic detection, automatic proxy, and automatic configuration settings.
Information about setting up your servers for this feature is contained in this chapter. Information about setting options in the browser and in the Customization wizard are contained in Chapter 21, "Using Automatic Configuration and Automatic Proxy. If you plan to use automatic configuration, you will need to configure servers on your intranet. To configure central management servers, you need to have the following:
-
Web-server software, such as Microsoft Internet Information Server (IIS)
-
Automatic configuration and automatic proxy files on the server at the URLs necessary for automatic browser configuration
The number of automatic browser configuration servers you require can vary according to the size and demands of your organization. If your organization is large, you might need to configure automatic browser configuration servers for each domain. For example, you could specify automatic browser configuration for user groups in domain 1 as follows:
http://domain1_server/autoconfig/<usergroup>.ins
http://domain1_server/autoconfig/proxy1.pac
You would install a Web server at http://domain1_server/ and then copy the <usergroup.ins and <usergroup>.cab files and proxy1.pac to the server at http://domain1_server/autoconfig/. When users in domain 1 start Internet Explorer, it reads the appropriate automatic configuration files and the auto-proxy file residing at http://domain1_server/autoconfig/.
Note Whenever you update and post an Internet settings (.ins) file to a server, you should also copy any cabinet (.cab) files that have also changed.
Automatic Detection of Browser Settings (Corporate Administrators)
You can configure your network so that Internet Explorer is customized automatically the first time it is started. This can help reduce administrative overhead and potentially reduce help desk calls about browser settings.
Automatic detection of browser settings, which is based on Web Proxy AutoDiscovery (WPAD), is supported by both Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS). With the appropriate settings, DHCP servers that support the DHCPINFORM message and DNS servers can automatically detect and configure a browser's settings.
Automatic detection of settings builds on existing automatic configuration technologies, in which a browser can be configured from a central location with an IEAK profile or a JavaScript proxy configuration (.js, .jvs, or .pac) file.
With automatic detection, the browser can now be automatically configured when it is started, even if the browser was not first customized by the administrator. For example, if a user were to download a noncustomized browser from the Internet, instead of installing a customized version from the corporate servers, automatic detection can automatically configure and customize the user's browser.
To specify in the IEAK that you want to set up automatic detection of browser settings, select Automatically detect settings on the Automatic Configuration screen of the Internet Explorer Customization wizard.
Automatic Detection of Browser Settings for DHCP and DNS
A DHCP server enables the administrator to centrally specify global and subnet-specific TCP/IP parameters and to define parameters for clients by using reserved addresses. When a client computer moves between subnets, it is automatically reconfigured for TCP/IP when the computer is started.
DNS is a set of protocols and services on a TCP/IP network that allow users to search for other computers by using hierarchical user-friendly names, often known as "hosts," instead of numeric IP addresses.
Using DHCP with automatic detection works best for local area network-based (LAN-based) clients, while DNS enables computers with both LAN-based and dial-up connections to detect their settings. Although DNS can handle network and dial-up connections, DHCP provides for faster access to LAN users and allows greater flexibility in specifying configuration files.
To enable automatic detection of browser settings, you need to configure specific settings on DNS servers, DHCP servers, or both.
Enabling Automatic Detection of Browser Settings on DHCP
To set up automatic detection of browser settings on a DHCP server, you need to create a new option type with a code number of 252. Your DHCP server must support the DHCPINFORM message.
Note Depending on your type of DHCP server, the option names may vary slightly.
To add a new DHCP option type
-
On the DHCP Options menu, click Defaults.
-
In the Option Class list, click the class for which you want to add a new option type, and then click New.
-
In the Name box, type a new option name.
-
In the Data Type list, click the String data type.
For the default value of the string, type the URL that points to your configuration file. This file can be a .pac, .jvs, .js, or .ins configuration file.
Examples:
http://www.microsoft.com/webproxy.pac
http://marketing/config.ins
http://###.#.###.#/account.pac
-
In the Identifier box, type the code number 252 to associate with this option type.
-
In the Comment box, type a description.
Enabling Automatic Detection on DNS
To enable automatic detection of browser settings on DNS, you need to configure either the host record or CNAME "alias" record in the DNS database file.
Host Record
A host record is used to statically associate host (computer) names to IP addresses within a zone. A host record contains entries for all hosts that require static mappings, such as work stations, name servers, and mail servers.
The syntax for a host record has this form:
<host name> IN A <ip address of host>
The following list shows some examples.
|
Host name
|
IN
|
A
|
Host IP address
|
|
corserv
|
IN
|
A
|
192.55.200.143
|
|
nameserver2
|
IN
|
A
|
192.55.200.2
|
|
mailserver1
|
IN
|
A
|
192.55.200.51
|
CNAME Record
These records are sometimes called "aliases" but are technically referred to as "canonical name" (CNAME) entries. These records allow you to use more than one name to point to a single host. Using canonical names makes it easy to do such things as host both an FTP server and a Web server on the same computer.
To configure a DNS database file for automatic detection of browser settings
-
In the DNS database file, enter a host record named wpad that points to the IP address of the Web server that contains the .pac, .jvs, .js, or .ins automatic configuration file.
-or-
Enter a CNAME alias named wpad that points to the name (the resolved name, not the IP address) of the server that contains the .pac, .jvs, .js, or .ins automatic configuration file.
Note After the record is added and the database file is propagated to the server, the DNS name wpad.domain.com should resolve to the same computer name as the server that contains the automatic configuration file.
When using DNS, Internet Explorer constructs a default URL template based on the host name wpad—for example:
http://wpad.domain.com/wpad.dat
Therefore, on the Web server wpad, you must set up a file or redirection point named wpad.dat, which delivers the contents of your automatic configuration file.
Working with Proxy Servers
A proxy server acts as an intermediary between your computer and the Internet. It is most frequently used when there is a corporate intranet and users are connected to a LAN. It can also work with a firewall to provide a security barrier between your internal network and the Internet. In addition, corporate administrators can balance proxy loads and block undesirable sites. Proxy servers are becoming more advanced in their ability to reduce network traffic by caching content that is frequently requested by the browsers they serve.
A key benefit of Internet Explorer 5 is that users can have multiple connection configurations. Proxy and other LAN settings can be altered for each connection configuration, and a friendly name can be assigned to each configuration—for example, "docking station."
The following section covers two key issues that you should consider if your organization uses proxy servers:
Proxy Configuration (Corporate Administrators and ISPs)
Corporate administrators and ISPs can preset proxy server settings by entering the settings in Stage 4 of the Internet Explorer Customization wizard. The following illustration shows the Proxy Settings screen.
These settings in the Customization wizard correspond to proxy settings in the browser. To see these settings in the browser, click the Tools menu, and then click Internet Options. Click the Connections tab, and then click LAN Settings. To see addresses of specific proxy servers, click Advanced.
Selecting the Use the same proxy server for all protocols check box in the browser or the Use the same proxy server for all addresses check box in the Customization wizard makes all the other entries unavailable and copies the proxy information in the HTTP setting into the other protocol settings. Selecting the check box also hides the information in the Socks setting.
The Secure
setting is for HTTPS requests based on the Secure Sockets Layer (SSL) technology.
Proxy locations that do not begin with a protocol (such as http:// or ftp://) are assumed to be a CERN-type HTTP proxy. For example, when the user types proxy, it's treated the same as if the user typed http://proxy. For FTP gateways, such as the TIS FTP gateway, the proxy should be listed with the ftp:// in front of the proxy name. For example, an FTP gateway for an FTP proxy would have this format:
When you enter proxy settings, use the following syntax, where <address> is the Web address of the proxy server and <port> is the port number assigned to the proxy server:
For example, if the address of the proxy server is proxy.example.microsoft.com and the port number is 80, the setting in the Proxy Server box for LAN settings in the Proxy Settings dialog box or the Proxy Settings screen of the Customization wizard should read as follows:
http://proxy.example.microsoft.com:80
Note If you are using the Internet Protocol (IP) address of your proxy server, make sure not to type leading zeros. For example, use 130.25.0.1 instead of 130.025.000.001.
Key proxy registry settings are as follows:
HKEY_CURRENT_USER \Software \Microsoft \Windows \CurrentVersion \
Internet Settings\
"ProxyEnable"="01 00 00 00"
"ProxyServer"="data"
"ProxyOverride"="local"
The proxy bypass list in the Exceptions area of the Proxy Settings dialog box allows users to specify addresses that will bypass the proxy server and be accessed directly.
Corporate administrators can also preset proxy settings or manage proxy settings by using an automatic proxy configuration file in .js, .jvs, or .pac format. For more information about automatic proxy configuration, see Chapter 21, "Using Automatic Configuration and Automatic Proxy."
Using the Proxy Bypass List
Some network requests need to bypass the proxy. The most common reason to bypass the proxy is for local (intranet) addresses. Generally, these addresses do not contain periods in them. By selecting the Bypass proxy server for local (intranet) addresses check box, all addresses without a period (for example, http://compserv) will bypass the proxy and be resolved directly.
To bypass more complex addresses, you can set up exceptions for specific addresses or wildcards. If you are configuring settings by using the Customization wizard, enter the addresses into the Do not use proxy server for addresses beginning with check box in the Exceptions area of the Proxy Settings dialog box. If you are configuring proxy settings on a user's computer after deployment, click the Tools menu, and then click Internet Options. Click the Connections tab, click LAN Settings, and then click Advanced. Enter the addresses into the Do not use proxy server for addresses beginning with check box in the Exceptions area. Use a semicolon (;) between entries in the Customization wizard and in the browser.
A proxy bypass entry may begin with a protocol type: http://, https://, ftp://, or gopher://. If a protocol type is used, the exception entry applies only to requests for that protocol. Note that the protocol value is case insensitive. Multiple entries should be separated by semicolons.
If no protocol is specified, any request using the address will be bypassed. If a protocol is specified, requests with the address will be bypassed only if they are of the indicated protocol type. As with the protocol type, address entries are case insensitive. If a port number is given, the request is processed only if all previous requirements are met and the request uses the specified port number.
The Exceptions area of the Proxy Settings dialog box allows a wildcard (*) to be used in the place of zero or more characters. The following list contains examples showing how to use wildcards:
-
To bypass servers, enter a wildcard at the beginning of an Internet address, IP address, or domain name with a common ending. For example, use *.example.com to bypass any entries ending in .example.com (such as some.example.com and www.example.com).
-
To bypass servers, enter a wildcard in the middle of an Internet address, IP address, or domain name with a common beginning and ending. For example, the entry www.*.com matches any entry that starts with www and ends with com.
-
To bypass servers, enter a wildcard at the ending of an Internet address, IP address, or domain name with a common beginning. For example, use www.microsoft.* to bypass any entries that begin with www.microsoft. (such as www.microsoft.com, www.microsoft.org, and www.microsoftcorporation.com).
-
To bypass addresses with similar patterns, use multiple wildcards. For example, use 123.1*.66.* to bypass addresses such as 123.144.66.12, 123.133.66.15, and 123.187.66.13.
Although wildcards are powerful, they must be used carefully. For example, the entry www.*.com causes Internet Explorer to bypass the proxy for most Web sites.
If you need to bypass the proxy for a local domain, try using *.domain.com. This will not use the proxy for any computer name ending in .domain.com. You can use the wildcard for any part of the name.
Using FTP with CERN-Compliant Proxy Servers
Users can access FTP sites through a CERN-compliant proxy server. To access an FTP site, users would type the Internet address (URL) for the FTP site they want to connect to, as shown in the following example:
ftp://ftp.microsoft.com
If the site requires a user name and password, users also need to include that information in the address:
ftp://username:password@ftp.microsoft.com
If your system uses a CERN proxy server, users can only download files from and view files at FTP sites. To enable users to perform other services, such as uploading files, you need to provide another proxy solution.
Working with Automatic Search
You can customize automatic search, which enables users to type a conversational word into the Address bar to search for frequently used pages. Users do not need to remember the URLs for the pages that you specify, so key information is easier to find.
For example, you could enable a Web page about invoices to appear when a user types the term "invoice" into the Address bar, even if the URL of the page doesn't contain this term. If you are a corporate administrator, the following topic shows you how you can customize automatic searching. If you are an ICP or ISP, send e-mail to autosrch@microsoft.com for more information.
This feature is already enabled for the Internet. For example, typing certain distinct, popular terms into the Address bar causes a Web site associated with that term to appear. When a Web site cannot distinctly be associated with that term—for example, if there are several apparent matches—then a Web page showing top search results is displayed.
The Web site that appears does not necessarily contain the exact search term in its URL. If a Web site whose domain is the same as the term is not the best match for the search term (for example, if the search term is the same as the URL without www. and .com), then the user is redirected to the site that is the best match for that term. By default, the user is prompted when a redirection occurs.
The Automatic Search URL is configurable by using two parameters denoted by a percent (%) sign. These two values must be part of the URL itself. The value %1 represents what the user typed in the Address bar. The value %2 represents the type of search option chosen by the user. Possible values for %2 are 3, 2, 1, and 0, where:
-
3 = Display the results and go to the most likely site.
-
2 = Just go to the most likely site.
-
1 = Just display the results in the main window.
-
0 = Do not search from the Address bar.
To set up Automatic Search
-
Create a script and post it to an intranet server.
The search page can be a script file, such as an Active Server Page (.asp) file, that conditionally checks for search terms. The script needs to be hosted at this location: http://ieautosearch/response.asp?MT=%1&srch=%2. If you are not using IIS, then you would need to remap this URL to the address where your script is located.
-
If you are setting this option on the System Policies and Restrictions screen in Stage 5 of the Customization wizard, click Internet Settings.
If you are setting this option in the Profile Manager, click Policies and Restrictions, and then click Internet Settings.
-
Click Advanced Settings, and then in the Searching area, type intranet into the Search Provider Keyword box.
If you're just redirecting users to another site rather than returning search results, then select Just go to the most likely site in the When Searching From The Address Bar box.
Note If you are a corporate administrator, you are not customizing search, and your organization doesn't have Internet access, you may want to disable automatic searching. To do this, in the Searching area on the Advanced Settings screen, select Never search from the Address bar.
Sample .asp AutoSearch Script
The following is a script that shows how search queries on an intranet can be redirected to the appropriate Web page.
<%@ Language=VBScript %>
<%
' search holds the words typed in the Address bar by the user, without
' the "go" or ' "find" or any delimiters like "+" for spaces.
' If the user types "Apple pie," search = "Apple pie."
' If the user types "find Apple pie," search = "Apple pie."
search = Request.QueryString("MT")
search = UCase(search)
searchOption = Request.QueryString("srch")
' This is a simple if/then/else script to redirect the browser
' to the site of your choice based on what the user typed.
' Example: expense report is an intranet page about
' filling out an expense report
if (search = "NEW HIRE") then
Response.Redirect("http://admin/hr/newhireforms.htm")
elseif (search = "LIBRARY CATALOG") then
Response.Redirect("http://library/catalog")
elseif (search = "EXPENSE REPORT") then
Response.Redirect("http://expense")
elseif (search = "LUNCH MENU") then
Response.Redirect("http://cafe/menu/")
else
' If there is not a match, use the
' default IE autosearch server
Response.Redirect("http://auto.search.msn.com/response.asp?MT="
+ search + "&srch=" + searchOption +
"&prov=&utf8")
end if
%>
Working with Roaming User Profiles (Corporate Administrators)
The roaming user profiles feature allows multiple users to use a single installation of Internet Explorer while retaining unique individual settings for each user. This feature also allows settings to follow a user to another computer. Corporate administrators should consider how best to configure roaming user profiles for network configuration and user needs.
If a network is used, user profiles can roam. This means that the user's copy of User.dat is stored on a central server and downloaded to any workstation that the user logs on to. This way, users can see the same environment no matter what workstation they use. It also allows administrators to have central control over individual user settings.
Internet Explorer and the Internet Explorer Customization wizard include options for caching temporary Internet files. These options can be useful when you are using roaming user profiles on a network. If you do not use these options, all temporary Internet files are copied to the user's profile folder when the user logs off. The temporary Internet files are then copied back to the local computer the next time the user logs on. This can be time-consuming and can use a lot of server space.
Caching Options
You can use a caching option in Internet Explorer to delete all cached Internet files when a user quits the browser. This option does not delete cookie information. Cookie information (which is usually small) is copied when the profile is saved. To set this option in the browser, carry out the following procedure:
To set caching options in Internet Explorer
-
On the Tools menu in Internet Explorer, click Internet Options.
-
Click the Advanced tab.
-
In the Security area, select the Empty Temporary Internet Files folder when browser is closed check box.
You can also use the System Policies and Restrictions screen of the Internet Explorer Customization wizard or the Internet Restrictions screen of the IEAK Profile Manager to set this option before deployment. In the Security area, select the Delete saved pages when browser closed check box.
Understanding Roaming Profiles
The Personalized Item Settings dialog box in Control Panel can control the content and settings saved on a per-user basis. This control is especially useful for conserving disk space and for avoiding excessive network traffic. Even if a server might have unlimited disk space to store content, it is not always practical for content in a profile to pass back and forth between the server and a client. Thus, to minimize the amount of data stored in profiles, you can specify personalized item settings as follows:
-
Desktop folder and Documents menu—If the Active Desktop is part of the corporate installation, this setting can be left on.
-
Start Menu and Program folders—Because these folders are dependent on the programs installed in a standard corporate installation, this setting can be turned off.
-
Favorites folder—This setting should be left on so that users can maintain a personal Favorites list.
-
Downloaded Web pages—This setting affects the Temporary Internet Files folder, which contains Cookies and History. If strict size limitations are necessary, this setting can be left on, but in most cases it can be left off.
-
My Documents folder—Network traffic can be minimized if this setting is turned off and a network share is used for document storage.
If roaming profiles are already enabled on a computer, installing Internet Explorer does not automatically move the new folders to the profile. You need to select the items from the User Profiles Manager by clicking the Users icon in Control Panel in Windows. If you run Internet Explorer on Windows NT 4.0, the Users icon does not appear in Control Panel. Windows NT 4.0 either uses a preconfigured profile or creates a local user profile automatically when you log on.
Note Because roaming profiles are handled by the operating system, they are bound by the differences between user profiles for specific operating systems.
Creating User Profiles
Before you can create a user profile, you first need to enable them on the User Profiles tab of the Passwords Properties dialog box (to access this dialog box, click the Passwords icon in Control Panel.)
To create a new profile in Windows, just log on using a user name that is new to the system and, therefore, has no corresponding password list (.pwl) file. The system prompts you to confirm the new user password and asks whether you would like to use global settings or per-user settings.
Instead of logging on with a new user name, you can click the Users icon in Control Panel to run the User Profile wizard, which you can use to add and configure user profiles. This is an alternate user interface for creating a new profile.
Understanding Advanced User Profile Functionality
If a path is stored in the per-user registry, it probably points to a folder with contents that are also per-user. You should consider whether these contents also should roam from one computer to another. Keep in mind that although any file can be made to roam, not all files should. In addition to performance issues when large numbers of files are copied to and from the user's logon server, there are security issues. For example, a user may not want or expect sensitive documents to be copied to any workstation on which they log on and to remain there even after they log off.
You need to be particularly careful with links to programs. Links usually contain hard-coded paths (such as a shortcut to C:\Program Files\Internet Explorer\IExplore.exe), which may not roam well. If you want the contents of a folder full of shortcuts to roam, create shortcuts that don't contain absolute paths.
When working with roaming profiles, there are several ways you can use folder settings:
-
Not per-user—The setting is the same for all users and does not follow the user to other computers.
-
Optionally per-user—The user or network administrator can choose whether users get their own version of the setting. Note that it's possible for this optional configuration to be per-user. That is, either all users get their own version of the setting or none of them do, or some users get their own setting and others use the default.
-
Optionally both per-user and roaming—Either all users get the same setting and the contents do not follow them from computer to computer, or users get their own settings and the contents follow them. This is how the Desktop and Start menus work in Windows 95. Whether a particular user gets a unique copy or uses the default is determined on a per-user basis.
-
Always per-user, optionally roaming—All users on a computer get their own version of the setting, but the contents of the folder do not follow the user to other computers on the network.
-
Always per-user, always roaming—Users each get their own content because their individual content always follows them. This is the way typical per-user registry items work; it is also how the user's Favorites, Cookies, and History folders are expected to work.
Preparing Servers for Internet Sign-up (ISPs)
An Internet sign-up server is an HTTP server that automates the task of adding new customers to an ISP's customer database. The Internet sign-up server collects information from each new customer, adds the information to the ISP's customer database, and then passes a configuration packet back to the customer's desktop computer. The configuration packet contains information that is used to configure the customer's Internet browser for subsequent connection to the ISP's services.
To add a new customer to the ISP's database, the Internet sign-up server:
-
Causes the client computer to establish an HTTP connection with the sign-up server.
-
Collects sign-up information from the customer.
-
Handles the customer's acceptance or refusal of the ISP's services.
When using the IEAK, three options are available for performing Internet sign-up:
Server-based sign-up is preferred, unless you can't provide a sign-up server, because settings are easier to change on the server than on the client. Of the two server-based options, the ICW method is recommended, because it uses a standard wizard interface that can be customized to fit your needs. This section will help you prepare for Internet sign-up by using the ICW.
If you're an ISP, you can specify the ICW as the tool that customers use to sign up for Internet services and configure their computers.
Important If you are using single-disk branding and you anticipate that some of your users will have Internet Explorer 4.01 Service Pack 1, you should not use ICW mode sign-up; you should Kiosk-mode sign-up instead. If you think some customers will have a later version of Internet Explorer, then you can create an IEAK package that contains both sign-up solutions.
Customizable solutions for Internet sign-up are located in the IEAK Toolkit. The code is provided in Active Server Pages as well as in Perl format, allowing you to build an ICW sign-up process for Web servers on different platforms with a minimum of effort. If you use the sample code, the only work you need to do is to integrate the sign-up server with your registration and billing systems. In the Windows 98 Referral Server Program, the sign-up server code is similar for both IEAK sign-up and Referral Server registrations.
The following sections describe how to develop a sign-up process for the ICW. Although these sections describe a tested, comprehensive sign-up solution, which is recommended in most cases, you can customize the sign-up process further to meet the needs of your organization.
Note Because the IEAK solution includes multiple Internet sign-up (.isp) files for different customer needs, you must also include the Dynamic HTML Data Binding component in your custom package.
For general information about Internet sign-up and implementing the sign-up process, see Chapter 20, "Implementing the Sign-up Process."
Meeting Coding and Accessibility Requirements for Internet Sign-up by Using the ICW
To prepare your Internet server, you need to design HTML pages on your server that will interact with the customer during Internet sign-up.
The new ICW-mode sign-up mechanism in the IEAK is designed so that an Internet sign-up server looks and acts like a standard Windows wizard. Although the ICW uses the power and flexibility of HTML, it does not use the same formatting as HTML.
HTML pages in the ICW must use the Windows system colors and fonts and also must meet accessibility requirements. Unless otherwise specified, the ICW HTML pages cannot contain any special HTML formatting, such as tables with visible borders, images, or anchors. Only plain text and FORM elements (where required) are allowed. Tables with invisible borders can be used for layout.
To match the user's system colors, all HTML pages except the Icwsign.htm page should contain no color or font attributes unless otherwise specified.
The only requirement for implementing forms within the HTML pages is that the forms use the NAME attribute in FORM elements defined in the specification.
Back and Next Button Functionality
ICW-mode sign-up has specific requirements that must be met for the Back and Next buttons in the Internet Connection wizard to work correctly.
Back Button
For the Back button to work correctly, you must add a FORM element to the sign-up server page that specifies the URL of the Back button. To retain the data previously collected in the sign-up process, you must append it to the URL for the Back button page.
The following example shows the FORM element that's used with the Back button for sending the user to the previous page of the sign-up process. Note that the data for the first and last names is appended to the URL in name/value pairs:
<FORM NAME="BACK"ACTION="http://myserver/page2.asp"?firstname=bob&lastname=smith&address=..."></FORM>
Note All letters in the NAME attribute and its value must be capitalized because the ICW is case-sensitive.
Next Button
For the Next button to work properly, you must add a FORM element to the sign-up server page that specifies the URL of the Next button. For the data collected to be passed to the next page in the sign-up process, you must add hidden FORM fields on each of your sign-up server pages that contain the data elements collected on this and all previous pages. The URL you reference must contain code that collects the data from the previous page and displays the next page of the sign-up process.
The following example shows the FORM element that's used with the Next button for sending the user to the next page of the sign-up process:
<FORM NAME="NEXT" ACTION="http://myserver/page2.asp"></FORM>
The sample sign-up server code included in the IEAK already conforms to these requirements.
Accessibility
To ensure that the elements on the page are accessible by using only the keyboard, you should check that each FORM element meets the following requirements:
-
An access key (hot key) must be associated with the FORM element. Use the Internet Explorer ACCESSKEY attribute in the INPUT element. The access-key character should be highlighted with an underline by using an Underline tag. The letters b, f, g, n, and o are reserved for the ICW and cannot be used as access keys. For more information about the ACCESSKEY attribute, see the MSDN Online Web site.
-
Each FORM element on the page must be part of the ICW tab-key order. To be included in the ICW tab-key order, the element must have a unique ID in the INPUT element.
-
Each FORM element should have a label associated with it. To associate a label for the different FORM input types, use the Internet Explorer LABEL attribute.
The following example shows a radio button FORM element that meets these accessibility requirements:
<input ID="option2"
type="radio"
name="billing"
value="hour"
accesskey="h"
checked>
<label for="option2">
5 <u>H</u>ours per month for $10.
</label>
Designing HTML Pages for ICW Sign-up
Each page of the Internet Connection wizard should have the following design elements and adhere to the following design conventions.
Style Sheet
If you use a style sheet, do not specify any font style or color attributes in it. The parent wizard sets these attributes. If you use a TABLE element in your error pages, the element must include a STYLE attribute—for example:
<TABLE style="font: 8pt 'ms sans serif' buttontext"> </TABLE>
Design Restrictions
Only text and FORM elements are allowed. Do not use images, links, or scroll bars in your design.
Required Form Elements
The HTML page must include four FORM elements that specify different page properties:
-
The unique PAGEID for the page—The NAME attribute for the FORM element must be "PAGEID" (case sensitive). The ACTION attribute of the FORM element must be a unique ID that does not match the PAGEID of any other page in the ISP section of the wizard, as shown in this example:
<FORM NAME="PAGEID" ACTION="page4"></FORM>
-
The Back button function—The NAME attribute for the FORM element must be "BACK" (case sensitive). The ACTION attribute for the FORM element should be the absolute URL for the previous page, as shown in this example:
<FORM NAME="PAGEID" ACTION="HTTP://signup/bin/page1.cgi"></FORM>
Note, however, that no data is posted to this page.
-
The characteristics of the page—The NAME attribute for the FORM element must be "PAGETYPE" (case sensitive). Because this is a standard frame where the ISP defines the entire space, the ACTION attribute for the FORM element must be an empty string, as shown in this example:
<FORM NAME="PAGETYPE" ACTION=""></FORM>
-
The Next button function—The NAME attribute for the FORM element must be "NEXT" (case sensitive). There are no restrictions on the token names for the INPUT elements within the FORM element. The ACTION attribute for the FORM element should be the absolute URL where the form information should be posted. The URL that you post on your server should contain a script that receives the data and then displays the next HTML page of the wizard.
Working with the ICW Sample Sign-up Files
If you want to simulate the sign-up process before creating your own files, you can use the sample files from the IEAK Toolkit. The sample files can give you a general idea of how the sign-up process works and the type of information that you'll need to provide.
To test the sample sign-up files on your server
-
Create a subfolder named Signup in the wwwroot folder on your server.
-
Copy the files from the Toolkit folder to the Signup subfolder.
-
In the files, change all the references to point to your sign-up server.
-
In the HTML code of the sign-up server pages, change all the references from the sample company name to your organization's name.
-
Modify the last sign-up server page to reflect your .ins settings.
Creating Initial, Error, and Finish Pages for ICW Sign-up
For ICW sign-up, you need to design the initial page the user sees (Icwsign.htm), error pages, and the finish page.
Initial Page (Icwsign.htm)
The initial page that the user sees after installing Internet Explorer 5 and restarting the computer is the branded Icwsign.htm page. This page is specified in the IEAK and is included in your build of Internet Explorer 5. It is not hosted on your sign-up server.
On the Icwsign.htm page, the user sees welcome information from the ISP and is asked to either click Next to begin the sign-up process (if there is only one ISP file needed for sign-up) or to select the city and state being dialed from so that the ICW can select the appropriate sign-up server ISP file to use. When the user clicks Next, the ICW dials and connects the user to the ISP sign-up server.
Error Pages for ICW Sign-up
If the data submitted to the sign-up server is invalid at any time during the sign-up process, the server can display an HTML page with a friendly error message. An example would be if the user requests an e-mail name that is already in use.
The error HTML page that is sent by the ISP's sign-up server is displayed in a floating frame within the wizard. The frame is 444 pixels wide by 273 pixels high. Scroll bars do not appear if the HTML page exceeds these dimensions.
The frame should contain text that lets the user know that the data entered was invalid and provides the FORM elements required for the user to enter new data.
For information about HTML design and required FORM elements, see "Designing HTML Pages for ICW Sign-up" earlier in this chapter.
Finish Page for ICW Sign-up
When the user clicks Next on the ISP finish page, the .ins file is processed and the computer is configured for the new Internet account. After this is done, the ICW displays its final page, which informs the user that the Internet connection is ready and tells the user how to begin browsing the Internet. There is no ISP-configurable interface on this page.
The finish page also provides the option of beginning browsing immediately when the user selects the Begin browsing immediately check box. You can use the StartURL value in the .ins file to specify the page the browser displays when it first opens.
Note After the user has finished the sign-up process, your sign-up server must return information about how to configure the user's computer for Internet access. The .ins file, downloaded at the end of your sign-up process, contains this information.
Creating the Name and Address Page for ICW Sign-up
When a user connects to your sign-up server, the first page the user sees is the name and address page.
The name and address HTML page is displayed in a frame within the wizard. The frame is 444 pixels wide by 273 pixels high. Scroll bars do not appear if the HTML page exceeds these dimensions.
For information about HTML design and required form elements, see "Designing HTML Pages for ICW Sign-up" earlier in this chapter.
Creating the Billing Options Page for ICW Sign-up
On the Billing Options page, you can present the service billing options from which the user can choose. The options are presented using an HTML form within a frame in the wizard window.
The user should be able to select an option by clicking an HTML radio button, and one of the radio-button options must be selected by default. If the user needs to make multiple selections, you can also include HTML check boxes in the frame.
The billing-option HTML page that you supply is displayed in a floating frame within the wizard. The frame is 444 pixels wide by 273 pixels high. Scroll bars do not appear if the HTML page exceeds these dimensions.
For information about HTML design and required form elements, see "Designing HTML Pages for ICW Sign-up" earlier in this chapter.
Creating the Method of Payment Page for ICW Sign-up
The Method of Payment page is where users specify how they want to pay for the Internet service. Each ISP controls which payment methods are available in the Payment Method list. Payment information is collected in the form that appears in a frame below the selection, which changes depending on the payment method selected in the list.
You can choose to offer any type of payment method:
For information about HTML design and required form elements, see "Designing HTML Pages for ICW Sign-up" earlier in this chapter.
Creating the ISP Account Login/E-Mail Screen for ICW Sign-up
The account login/e-mail page enables the user to select an account login and/or e-mail ID and password.
The HTML page that is sent by your sign-up server for account login and e-mail is displayed in a floating frame within the wizard. The frame is 444 pixels wide by 273 pixels high. Scroll bars do not appear if the HTML page exceeds these dimensions.
For information about HTML design and required form elements, see "Designing HTML Pages for ICW Sign-up" earlier in this chapter.
Creating the ISP POP Selection Page for ICW Sign-up
The POP selection page is where the user selects a local phone number for Internet access.
The HTML page that is sent by the ISP's sign-up server for POP selection is displayed in a floating frame within the wizard. The frame is 444 pixels wide by 273 pixels high. Scroll bars do not appear if the HTML page exceeds these dimensions.
The user should not be asked to enter an area code or phone number a second time. Any area code or phone number fields in the frame should be prepopulated using the information already sent to the ISP's sign-up server from the name and address page.
For information about HTML design and required form elements, see "Designing HTML Pages for ICW Sign-up" earlier in this chapter.
Creating the ISP Terms and Conditions Page for ICW Sign-up
The ISP Terms and Conditions page is where the ISP displays the legal agreement that the user must read to subscribe to the service. To ensure that the user accepts the agreement, the Next button of the ICW is not available until the user clicks the I accept the agreement check box.
The user can save the HTML page for ISP terms and conditions for viewing later by clicking the Save Copy button. After clicking the button, the user is prompted to enter a file name and path for where the file should be saved. The actual terms and conditions HTML file from the ISP's sign-up server will be saved to that location.
The HTML page that is sent by the ISP's sign-up server for Terms and Conditions is displayed in a floating frame with a 2-pixel border within the wizard. The frame's width is 426 pixels (without the 2-pixel border and vertical scroll bar). A horizontal scroll bar does not appear if the HTML page exceeds the width dimension.
The Terms and Conditions page should begin with the document's title and instructions explaining how users can find a copy of the legal document on the ISP's Web site if they want to view it again or print it.
For information about HTML design and required form elements, see "Designing HTML Pages for ICW Sign-up" earlier in this chapter.
Note There are no accessibility requirements for this page because no HTML form elements are allowed on the page.
Using ICW Automatic Reconfiguration for ISP Sign-up
ICW Automatic Reconfiguration enables users who already have an Internet account with an Internet service provider to have an account setting automatically reconfigured. When users buy a new computer, this feature helps them configure it for the same Internet account they had on a previous computer or on a computer at work. It also helps users whose Internet settings have become corrupted. The Automatic Reconfiguration feature restores the user's settings; the user needs to know only the user name, password, and POP server.
In a custom version of Internet Explorer, the user reaches the automatic reconfiguration server by clicking a link on the Icwsign.htm page. This link connects the user to the registration server.
After the user is connected to your sign-up server, you can ask for the user name, password, and POP server. With this information, you can send an .ins file to the user's computer to reconfigure the user's account.
Supporting ICW Automatic Reconfiguration
You can use two methods with ICW Automatic Reconfiguration to restore user accounts:
-
Ask the user for the user name, password, and POP server. This should be sufficient information for you to recreate the .ins file, send it to the user, and reconfigure the account. If you are concerned about abuse of this feature, you might want to recollect the user's credit card number and run a check against the registration database.
-
Store .ins files in the same location as the rest of the user's account information. When a user connects to the Automatic Reconfiguration server, the user can obtain the .ins file by providing only the user name and password. The server would then look up the user's account and deliver a copy of the user's original .ins file. As noted for the previous method, if you are concerned about abuse of this feature, you might want to recollect the user's credit card number and run a check against the registration database.
To set up ICW Automatic Reconfiguration, follow the coding and accessibility requirements for ICW sign-up and design the ISP account login/e-mail page, the ISP POP selection page, and the ISP finish page.
Working with the Sample Sign-up Automatic Reconfiguration Files
If you want to simulate the Automatic Reconfiguration process before creating your own files, you can use the sample files from the IEAK Toolkit. To do this, carry out the following steps:
To work with the sample sign-up pages for Automatic Reconfiguration
-
Create a folder named Autocfg in the wwwroot folder on your server.
-
Copy the files from the Toolkit folder to the Autocfg folder.
-
In the files, change all the references to point to your sign-up server.
-
In the HTML code of the sign-up server pages, change all the references from Acme ISP to your organization's name.
-
Modify the last sign-up server page to reflect your .ins settings.
The following sample files can give you a general idea of how the sign-up process works and the type of information that you'll need to provide.
-
ISP Account Login/E-mail page—This is the first page on the Automatic Reconfiguration server, which asks the user to provide the account login and/or e-mail ID and password. It is similar in design to the ISP Account Login/E-mail page for traditional ICW sign-up.
-
ISP POP selection page—The POP selection page is where the user selects a local phone number for Internet access. After the user provides this information, the ISP should have sufficient information to recreate the .ins file. It is similar in design to the ISP Account Login/E-mail page for traditional ICW sign-up.
-
ISP finish page—This is the last page of the Automatic Reconfiguration account restoration. The text provided by your HTML page is purely informational with no visible FORM elements. The check box and text at the bottom of the page are provided by the ICW. If the user selects the check box and clicks Next, the HTML code from your sign-up server shown on this page is saved to the user's desktop as an HTML file. The user can refer to this file to remember passwords or service information.
You can also decide whether you want to display the Save Information check box and text. By default, it is not shown. To turn on the check box, add the following form type to the HTML code for the finish page:
<FORM NAME=PAGEFLAG ACTION=1></FORM>
Sign-up Server Considerations for Internet Information Server
If you are using IIS as your sign-up server, you must configure the Internet sign-up server to provide a DHCP IP address to the client when the client connects to the server. Because the sign-up process is relatively short, the expiration time for the IP address lease can be small, possibly only a few minutes.
The sign-up processing is intended to be used over a point-to-point dial-up connection, so the IP addresses allocated for the DHCP server need not be formally assigned IP addresses. It is your responsibility to determine whether the DHCP IP addresses will be valid Internet addresses or arbitrary addresses.
For the client to process the .ins file automatically, you must register a Multipurpose Internet Mail Extensions (MIME) type for the .ins file with the sign-up server. The .ins file has been assigned the "application/x-Internet-signup" Type. When the client requests an .ins file, the sign-up server responds with this MIME type, which starts the associated installation application on the client side.
Server Considerations for NetMeeting
When configuring your network for NetMeeting, you should consider how to handle standardization requirements:
-
Particularly in the corporate environment, communication between local and remote locations is a necessity. To support these user communities, products must interoperate in a standard fashion across platforms and networks.
-
Products of varying levels of functionality must be able to communicate; standards enable compatibility of applications that have a variety of functions and features.
-
As more vendors develop standards-based products, customers benefit from competitive pricing, improved quality, and product upgrades.
The following sections describe the specific types of products and services, including clients, servers, and gateways, that interoperate with NetMeeting. Interoperability testing is described for two International Telecommunications Unions (ITU) standards that NetMeeting currently supports: T.120 for data conferencing and H.323 for audio and video conferencing. This section also discusses the elements that make T.120 and H.323 standards-based products interoperate.
Interoperability Scenarios and NetMeeting
For corporate and home users, many interoperability scenarios are possible between NetMeeting and compatible, standards-based clients, servers, bridges, and gateways:
-
Within an organization, NetMeeting users can connect with each other over the corporate intranet. A T.120 or H.323 conferencing server can provide inbound and outbound connectivity with compatible clients for data, audio, or video conferencing.
-
An H.323 gateway can be used to bridge internal and external networks over a corporate firewall, supporting connections for audio and video conferencing.
-
NetMeeting users can initiate multipoint connections with third-party T.120 clients. T.120 servers can provide administration services for this data conferencing scenario.
-
NetMeeting users can initiate point-to-point connections with H.323 clients. T.120 data conferencing can be supported in conjunction with H.323 audio and video conferencing. H.323 servers can provide administration services for this data conferencing scenario.
-
Through an H.32x gateway, NetMeeting users can connect to H.320 and H.324 systems. Also, an H.320 server can be used for connectivity with multiple H.320 systems.
-
An H.323 gateway also enables NetMeeting users to connect to people over public switched telephone network (PSTN) lines.
Internet Locator Server
Internet Locator Server (ILS) offers a standards-based, dynamic directory solution to the user location problem on the Internet. ILS supports LDAP conferencing servers and directory servers. These server types are described in following sections.
ILS provides organizations with a directory server for NetMeeting users. Like User Location Service (ULS), which was developed for NetMeeting 1.0, ILS provides a memory-resident database for storing dynamic directory information. This database enables users to find dynamic information, such as an IP address, for people currently logged on to an Internet service or site. The ILS database maintains the entries, which clients update periodically. This process ensures that clients can always access the most current information about each user's Internet location.
The following features distinguish ILS:
-
Support for industry-standard protocols—ILS provides both an LDAP interface for NetMeeting support and a proprietary user location protocol (ULP) interface for legacy support of NetMeeting 1.0. Through these built-in protocols, ILS provides directory server support for NetMeeting. These interfaces allow NetMeeting to access the server for dynamic directory information and facilitate point-to-point Internet communication sessions. Other clients can access ILS through the LDAP interface. For more information, see the Microsoft NetMeeting Software Development Kit. All client applications must migrate to LDAP to access dynamic directory information.
-
Performance monitoring—ILS supports Windows NT Server administration features—including performance monitoring (Perfmon counters), Simple Network Management Protocol (SNMP) monitoring, and event logs—to measure activity and system performance. Operators can make use of administration features, such as transaction logs that collect usage statistics, track messages and transactions, and allow administrators to examine usage patterns. These tools enable administrators to proactively monitor server performance and identify potential problems.
-
Stable, robust server capabilities—As a standards-based Internet directory server, ILS was designed to provide stable, robust directory services. ILS uses thread pooling and connection management to enable more efficient handling of system resources. ILS users experience better performance, because ILS uses binary data packets to optimize performance. Also, the server uses a spanning tree architecture to support many concurrent users in a single server configuration.
-
Customization through Active Server Pages—Using Active Server Pages (.asp files), administrators can combine HTML and scripting components to customize their ILS interface. They can create scripts to display a specific group of NetMeeting users currently online, enable user searches, and initiate real-time communication sessions with other users.
-
Easy setup and administration—ILS provides a graphical setup program so that administrators can install server components quickly and easily. Then, administrators can set options for user logon, security, and server access through the Microsoft Internet Service Manager.
-
Microsoft product support—Microsoft provides worldwide product support through the Microsoft Support Network. ILS users can choose from standard or priority support.
For information about setting up and implementing ILS, see the Microsoft Internet Locator Server Operations Guide or its companion, the Microsoft Internet Locator Service Operations Reference.
LDAP Conferencing Servers
ILS supports the IETF Lightweight Directory Access Protocol (LDAP) version 2 standard for NetMeeting directory services. LDAP servers support the same LDAP protocol, but each server extends LDAP for a particular purpose. For example, ILS applies LDAP for use with dynamic records.
LDAP version 3 designers have proposed dynamic directory services as part of the LDAP protocol. When version 3 is finalized and implemented within NetMeeting, developers can access standards information from the IETF Web site for developing compatible servers. Currently, vendors can develop interoperable servers for NetMeeting by obtaining information about the LDAP extension from Microsoft.
In addition, many people use ULS for locating and connecting to other NetMeeting users. Third-party vendors have developed many interoperable ULSs, such as uls.four11.com, which users can log on to from NetMeeting.
Directory Servers
ILS, an optional component of IIS, supports directory servers that enable NetMeeting users to locate each other on the Internet or corporate intranets. These servers create a directory of NetMeeting users. From this directory, users can select participants for real-time conferencing and collaboration. ILS provides all of the ULS functionality, as well as introducing advanced server technology not previously available. Users can benefit from enhanced features and functions, better performance, and higher scalability to support more NetMeeting users.
Firewall Configuration for NetMeeting
Microsoft NetMeeting can be configured to work with most organizations' existing firewall security. However, because of limitations in most firewall technology, few products are available that allow you to securely transport inbound and outbound NetMeeting calls containing audio, video, and data across a firewall. You might want to consider carefully the relative security risks of enabling different parts of a NetMeeting call in your firewall product. You must especially consider the security risks involved when modifying your firewall configuration to enable any component of an inbound NetMeeting call.
NetMeeting and Firewalls
A firewall is a set of security mechanisms that an organization implements, both logically and physically, to prevent unsecured access to an internal network. Firewall configurations vary from organization to organization. Most often, the firewall consists of several components, which can include a combination of routers, proxy servers, host computers, gateways, and networks with the appropriate security software. Very rarely is a firewall a single component, although a number of newer commercial firewalls attempt to put all of the components in a single package.
For most organizations, an Internet connection is part of the firewall. The firewall identifies itself to the outside network as a number of IP addresses—or as capable of routing to a number of IP addresses—all associated with DNS server entries. The firewall might respond as all of these hosts (a virtual computer) or pass on packets bound for these hosts to assigned computers.
You can configure firewall components in a variety of ways, depending on your organization's specific security policies and overall operations. Although most firewalls are capable of allowing primary (initial) and secondary (subsequent) TCP and User Datagram Protocol (UDP) connections, they might be configured to support only specific connections based on security considerations. For example, some firewalls allow only primary TCP connections, which are considered the most secure and reliable.
To enable NetMeeting multipoint data conferencing (application sharing, whiteboard, chat, file transfer, and directory lookups), your firewall only needs to pass through primary TCP connections on assigned ports. For NetMeeting to make calls that use audio and video conferencing, your firewall must be able to pass through secondary TCP and UDP connections on dynamically assigned ports. Some firewalls can pass through primary TCP connections on assigned ports, but cannot pass through secondary TCP or UDP connections on dynamically assigned ports.
Note NetMeeting audio and video features require secondary TCP and UDP connections. Therefore, when you establish connections through firewalls that accept only primary TCP connections, you are not able to use the audio or video features of NetMeeting.
Establishing a NetMeeting Connection with a Firewall
When you use NetMeeting to call other users over the Internet, several IP ports are required in order to establish the outbound connection. If you use a firewall to connect to the Internet, it must be configured so that the following IP ports are not blocked.
|
This port
|
Is used for
|
|
389
|
Internet Locator Server (TCP)
|
|
522
|
User Location Service (TCP)
|
|
1503
|
T.120 (TCP)
|
|
1720
|
H.323 call setup (TCP)
|
|
1731
|
Audio call control (TCP)
|
|
Dynamic
|
H.323 call control (TCP)
|
|
Dynamic
|
H.323 streaming (Real Time Protocol over User Datagram Protocol)
|
To establish outbound NetMeeting connections through a firewall, the firewall must be configured to do the following:
-
Pass through primary TCP connections on ports 389, 522, 1503, 1720, and 1731
-
Pass through secondary TCP and UDP connections on dynamically assigned ports (1024-65535)
The H.323 call setup protocol (over port 1720) dynamically negotiates a TCP port for use by the H.323 call control protocol. Also, both the audio call control protocol (over port 1731) and the H.323 call setup protocol (over port 1720) dynamically negotiate UDP ports for use by the H.323 streaming protocol, which is the Real Time Protocol (RTP). In NetMeeting, two UDP ports are determined on each side of the firewall for audio and video streaming, for a total of four ports for inbound and outbound audio and video. These dynamically negotiated ports are selected arbitrarily from all ports that can be assigned dynamically.
NetMeeting directory services require either port 389 or port 522, depending on the type of server you are using. ILS, which supports LDAP for NetMeeting, requires port 389. ULS, developed for NetMeeting 1.0, requires port 522.
Firewall Limitations for NetMeeting
Some firewalls cannot support an arbitrary number of virtual internal IP addresses, or cannot do so dynamically. With these firewalls, you can establish outbound NetMeeting connections from computers inside the firewall to computers outside the firewall, and you can use the audio and video features of NetMeeting. Other people, though, cannot establish inbound connections from outside the firewall to computers inside the firewall. Typically, this restriction is due to limitations in the network implementation of the firewall.
Note Some firewalls are capable of accepting only certain protocols and cannot handle TCP connections. For example, if your firewall is a Web proxy server with no generic connection-handling mechanism, you will not be able to use NetMeeting through the firewall.