STEP 4: Installing and Configuring the ISA Server 2004 Software

The Windows 2000 Server or Windows Server 2003 computer is now ready for the ISA Server 2004 software. The installation procedure is the same for both Windows 2000 Server and Windows Server 2003. However, if you install ISA Server 2004 on Windows 2000 Server, Service Pack 4 or higher must first be installed.

In the following installation example, the machine has two Ethernet cards with permanent addresses assigned to the Internal and External network interfaces. This is the situation you might have if you have a T1, cable or DSL connection. In the case of DSL and cable connections, there would be a DSL or cable router in front of the ISA Server 2004 firewall and the default gateway on the External interface is the IP address of the Internal interface of the router.

The following steps demonstrate how to install the ISA Server 2004 software on a dual-homed (two Ethernet cards) Windows Server 2003 machine:

1. Insert the ISA Server 2004 installation media into the CD-ROM drive or connect to a network share point hosting the ISA Server 2004 installation files. If the installation routine does not start automatically, double click the isaautorun.exe file in the root of the installation files tree.
2. On the Microsoft Internet Security and Acceleration Server 2004 page, click the link for Review Release Notes and read the release notes. The release notes contain useful information about important issues and configuration options. After reading the release notes, click the Read Setup and Feature Guide link. You don’t need to read the entire guide right now, but you may want to print it to read later. Click the Install ISA Server 2004 link.

1. Click Next on the Welcome to the Installation Wizard for Microsoft ISA Server 2004 page.

1. Select the I accept the terms in the license agreement option on the License Agreement page. Click Next.
2. On the Customer Information page, enter your name and the name of your organization in the User Name and Organization text boxes. Enter your serial number in the Product Serial Number text box. Click Next.
3. On the Setup Type page, select the Custom option. If you do not want to install the ISA Server 2004 software on the C: drive, click the Change button to change the location of the program files on the hard disk. Click Next.

1. On the Custom Setup page, you can choose which components to install. By default, the Firewall Services, ISA Server Management and Firewall Client Installation Share are installed. The Message Screener, which is used to control spam and file attachments from entering and leaving the network, is not installed by default. You must install the IIS 6.0 SMTP service on the ISA Server 2004 firewall computer before you install the Message Screener. Use the default settings and click Next.

1. On the Internal Network page, click the Add button. The Internal network is different from the Local Address Table (LAT) that was used by ISA Server 2000. In the case of ISA Server 2004, the Internal network contains trusted network services with which the ISA Server 2004 firewall must communicate. Examples of such services include Active Directory domain controllers, DNS, DHCP, terminal services client management workstations, and others. The firewall System Policy automatically uses the Internal network. We will look at the System Policy later in this document.

1. On the Internal Network setup page, click the Select Network Adapter button.

1. In the Configure Internal Network dialog box, remove the checkmark from the Add the following private ranges… checkbox. Leave the checkmark in the Add address ranges based on the Windows Routing Table checkbox. Put a checkmark in the checkbox next to the adapter connected to the Internal network. In this example we have renamed the network interfaces so that the interface name reflects its location. Click OK.

1. Click OK in the dialog box informing you that the Internal network was defined, based on the Windows routing table.

1. Click OK on the Internal network address ranges dialog box.

1. Click Next on the Internal Network page.

1. Put a checkmark in the Allow computers running earlier versions of Firewall Client software to connect checkbox. This will allow you to continue using the ISA Server 2000 Firewall client software as you migrate to ISA Server 2004. Click Next.

1. On the Services page, note that the SNMP and IIS Admin Service will be stopped during installation. If the Internet Connection Firewall (ICF) / Internet Connection Sharing (ICF) and/or IP Network Address Translation services are installed on the ISA Server 2004 machine, they will be disabled, as they conflict with the ISA Server 2004 firewall software.

1. Click Install on the Ready to Install the Program page.
2. On the Installation Wizard Completed page, click Finish.

1. Click Yes on the Microsoft ISA Server dialog box informing that you must restart the server.

1. Log on as an Administrator after the machine restarts.
2. Click Start and point to All Programs. Point to Microsoft ISA Server and click ISA Server Management. The Microsoft Internet Security and Acceleration Server 2004 management console opens and displays the Welcome to Microsoft Internet Security and Acceleration Server 2004 page.

Configuring ISA Server 2004

ISA Server 2004 configuration is the same for both Windows 2000 Server and Windows Server 2003. You need to create four Access Rules and make a change to the firewall’s System Policy if the external interface does not have a permanent IP address.

Tables 1 through 4 show the details of each of these rules.

Table 1 DHCP Request (Server)

Name	DHCP Request (Server)
Action	Allow
Protocols	DHCP (request)
From	Anywhere
To	Local Host
Users	All Users
Schedule	Always
Content Types	All content types
Purpose	Allow DHCP clients to send DHCP requests to the DHCP server on the ISA Server 2004 firewall

Table 2 DHCP Reply (Server)

Name	DHCP Reply (Server)
Action	Allow
Protocols	DHCP (reply)
From	Local Host
To	Internal
Users	All Users
Schedule	Always
Content Types	All content types
Purpose	Allow the DHCP server on the ISA Server 2004 firewall machine to reply to DHCP requests made by Internal network DHCP clients

Table 3 Internal DNS Server to Forwarder

Name	Internal DNS Server to forwarder
Action	Allow
Protocols	DNS
From	DNS Server*
To	Local Host
Users	All Users
Schedule	Always
Content Types	All content types
Purpose	Allow Internal network DNS server to forward queries to the DNS forwarder on the ISA Server 2004 firewall machine

* User defined

Table 4 All Open

Name	All Open
Action	Allow
Protocols	All Outbound Traffic
From	Internal
To	External
Users	All Users
Schedule	Always
Content Types	All content types
Purpose	Allow Internal network clients access to all protocols and sites on the Internet

In addition to these Access Rules, you should configure the firewall System Policy to allow DHCP replies from External network DHCP servers.

Perform the following steps to create the DHCP Request (Server) rule:

1. In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name and then click the Firewall Policy node.
2. In the Firewall Policy node, click the Tasks tab in the Task Pane. On the Task Pane, click the Create a New Access Rule link.

1. On the Welcome to the New Access Rule Wizard page, enter DHCP Request (Server) in the Access Rule name text box. Click Next.
2. On the Rule Action page, select the Allow option and click Next.
3. On the Protocols page, select the Selected protocols option from the This rule applies to list and then click the Add button.

1. In the Add Protocols dialog box, click the Infrastructure folder. Double click the DHCP (request) entry and then click Close.

1. Click Next on the Protocols page.

1. On the Access Rule Sources page, click the Add button.

1. In the Add Network Entities dialog box, click the Computer Sets folder. Double click the Anywhere entry and click Close.

1. Click Next on the Access Rule Sources page.

1. On the Access Rule Destinations page, click the Add button.

1. In the Add Network Entities dialog box, click the Networks folder and then double click the Local Host entry. Click Close.

1. Click Next on the Access Rule Destinations page.

1. On the User Sets page, accept the default entry, All Users, and click Next.

1. On the Completing the New Access Rule Wizard page, review the settings and click Finish.

Perform the following steps to create the DHCP Reply (Server) rule:

1. In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name and then click the Firewall Policy node.
2. In the Firewall Policy node, click the Tasks tab in the Task Pane. On the Task Pane, click the Create a New Access Rule link.

1. On the Welcome to the New Access Rule Wizard page, enter DHCP Reply (Server) in the Access Rule name text box. Click Next.
2. On the Rule Action page, select the Allow option and click Next.
3. On the Protocols page, select the Selected protocols option from the This rule applies to list and then click the Add button.
4. In the Add Protocols dialog box, click the Infrastructure folder. Double click the DHCP (request) entry and then click Close.

1. Click Next on the Protocols page.

1. On the Access Rule Sources page, click the Add button.
2. In the Add Network Entities dialog box, click the Networks folder. Double click the Local Host entry and click Close.
3. Click Next on the Access Rule Sources page.
4. On the Access Rule Destinations page, click the Add button.
5. In the Add Network Entities dialog box, click the Networks folder and then double click the Internal entry. Click Close.
6. Click Next on the Access Rule Destinations page.
7. On the User Sets page, accept the default entry, All Users, and click Next.
8. On the Completing the New Access Rule Wizard page, review the settings and click Finish.

Perform the following steps to create the Internal DNS Server to Forwarder rule:

1. In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name and then click the Firewall Policy node.
2. In the Firewall Policy node, click the Tasks tab in the Task Pane. On the Task Pane, click the Create a New Access Rule link.

1. On the Welcome to the New Access Rule Wizard page, enter Internal DNS Server to Forwarder in the Access Rule name text box. Click Next.
2. On the Rule Action page, select the Allow option and click Next.
3. On the Protocols page, select the Selected protocols option from the This rule applies to list and then click the Add button.
4. In the Add Protocols dialog box, click the Infrastructure folder. Double click the DNS entry and then click Close.

1. Click Next on the Protocols page.

1. On the Access Rule Sources page, click the Add button.
2. In the Add Network Entities dialog box, click the New menu, then click Computer.

1. In the New Computer Rule Element dialog box, enter Internal DNS Server in the Name text box. Enter 10.0.0.2 in the Computer IP Address text box. Click OK.

1. In the Add Network Entities dialog box, click the Computers folder and then double click the Internal DNS Server entry. Click Close.

1. Click Next on the Access Rule Sources page.

1. On the Access Rule Destinations page, click the Add button.
2. In the Add Network Entities dialog box, click the Networks folder and then double click the Local Host entry. Click Close.
3. Click Next on the Access Rule Destinations page.
4. On the User Sets page, accept the default entry, All Users, and click Next.
5. On the Completing the New Access Rule Wizard page, review the settings and click Finish.

Perform the following steps to create the All Open rule:

1. In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name and then click the Firewall Policy node.
2. In the Firewall Policy node, click the Tasks tab in the Task Pane. On the Task Pane, click the Create a New Access Rule link.

1. On the Welcome to the New Access Rule Wizard page, enter DHCP Reply (Server) in the Access Rule name text box. Click Next.
2. On the Rule Action page, select the Allow option and click Next.
3. On the Protocols page, select the All outbound traffic option from the This rule applies to list and then click Next.

1. Click Next on the Protocols page.
2. On the Access Rule Sources page, click the Add button.
3. In the Add Network Entities dialog box, click the Networks folder. Double click the Internal entry and click Close.
4. Click Next on the Access Rule Sources page.
5. On the Access Rule Destinations page, click the Add button.
6. In the Add Network Entities dialog box, click the Networks folder and then double click the External entry. Click Close.
7. Click Next on the Access Rule Destinations page.
8. On the User Sets page, accept the default entry, All Users, and click Next.
9. On the Completing the New Access Rule Wizard page, review the settings and click Finish.

Your Access Rule should look like those in the figure below. Note that in this example, you do not need to reorder the rules. When you start creating advanced Access Rules to control inbound and outbound access, you may need to reorder rules to obtain the desired results.

Configuring System Policy to Support Dynamic Addresses on the External Interface

ISA Server introduces a System Policy, which is a set of firewall policy rules that control how the ISA Server computer enables communications with network infrastructure elements that are necessary to manage network security and connectivity. ISA Server 2004 is installed with a default system policy, designed to address the balance between security and connectivity.

Some system policy rules are enabled upon installation. These are considered the most basic and necessary rules for effectively managing the ISA Server environment. You can subsequently identify those services and tasks that you require to manage your network, and enable the appropriate system policy rules. You should work on locking down the ISA Server 2004 System Policy after you have become more familiar with the ISA Server 2004 operations. We will not cover locking down System Policy in this ISA Server 2004 Quick Start Guide.

System Policy rules are evaluated before Access Rules that are created by the firewall administrator. Because of this, we must modify System Policy Rule to allow the ISA Server 2004 firewall to communicate with DHCP servers on the External network when the External interface uses DHCP to obtain IP addressing information.

Perform the following steps to configure this System Policy:

1. In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name in the left pane of the console and then click the Firewall Policy node. Click the Tasks tab in the Task Pane and then click the Edit System Policy link.

1. In the System Policy Editor, locate the Network Services node in the Configuration Groups section and then click the DHCP entry.

1. Click the From tab in the System Policy Editor and then click Add. In the Add Network Entities dialog box, double click External and click Close.

1. In the System Policy Editor, the External network appears in the This rule applies to traffic from these sources section. Click OK.

Configuring Dial-up Preferences (dial-up connections only)

You must configure Dial-up preferences for ISA Server 2004 firewalls that use dial-up connections to the Internet. The dial-up connectoid must be created before you configure the Dial-up Preferences.

Perform the following steps to configure the Dial-up Preferences:

1. In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name in the left pane of the console and then expand the Configuration node. Click the General node.
2. In the General node, click the Specify Dial-up Preferences link.

1. In the Dialing Configuration dialog box, select the Allow automatic dialing to this network option so that the ISA Server 2004 firewall automatically dials the connection when a request comes from a host on the internal network. Select the External network from the list of networks under this option. Put a checkmark in the Configure this dial-up connection as the default gateway checkbox. This enables the ISA Server 2004 firewall to use the dialup connection to connect to the Internet.

1. Click the Select button. In the Select Network Dial-up Connection dialog box, select the dial-up connection you created to connect to the Internet. Click OK.

1. On the Dialing Configuration dialog box, click the Set Account button. In the Set Account dialog box, enter the User account that is used by the dial-up connection to connect to the Internet. This is the user account assigned to you by your ISP. Do not use the Browse button to find this account. Enter the ISP account’s password and confirm the password in the Password and Confirm password text boxes. Click OK.

1. Click Apply and then click OK in the Dialing Configuration dialog box.

1. Click Apply to save the changes and update the firewall policy.

1. Click OK in the Apply New Configuration dialog box.