ISA Server 2004 UNLEASHED [Electronic resources] نسخه متنی

Documenting the ISA Server 2004 Design

The process of designing an ISA Server environment can include multiple design decisions, various decision rationales, and specific implementation settings. It is often difficult, after the design is complete, to retain the knowledge of why particular decisions were made during the design process. Subsequently, one of the first and most important sets of documentation for an ISA environment relates to the design of the environment itself.

This type of documentation can take many forms, but typically involves a formal design document, a server as-built document, and specific information on configured rules and settings, which can be ascertained through the creation of a custom script. Examples of this type of script, which can be extremely valuable in the documentation of ISA settings, is provided in this section of the chapter.

For more information on designing an ISA Server environment, refer to Chapter 4, "Designing an ISA Server 2004 Environment."

Documenting the ISA Design Process

The first step in the implementation of an ISA Server 2004 environment is the development and approval of a design. Documenting this design contributes to the success of the project. The design document records the decisions made during the design process and provides a reference for testing, implementation, and support. The key components to a design document include

The goals and objectives of the project

The background or what led up to the design

The approach that will be used to implement the solution

The details of the end state of the project

Goals and objectives can be surprisingly hard to pin down. They need to be detailed and concrete enough to define the results that you want while staying at a high level. For instance, "reduce down time" is too vague to be considered a functional goal, whereas "implement Network Load Balancing with ISA Server 2004 Enterprise Edition to reduce downtime to less than one minute in the case of single server failure" is much more specific.

Including the background of meetings and brainstorming sessions that led up to the decisions for the end state of the project provides the groundwork for the detailed designs provided later in the document. For example, a decision may have been made "because the CEO wants it that way," which affects the post-migration environment. Other decisions may have come about after many hours of debates over the particulars and required technical research to come up with the "right" answer. Recording this level of information can be extremely useful in the future if performance issues are encountered or additional changes to the network are being considered.

The description of the end state to be implemented can be very high level or can drill down to more specific configurations of each server, depending on the document's audience. However, it is recommended that the design document not include step-by-step procedures or other details of how the process is to be accomplished. This level of detail is better handled, in most cases, in dedicated configuration or training documents as discussed later in this chapter.

Formalizing ISA Server Configuration with As-Built Documentation

The configuration document, often referred to as an as-built, details a snapshot configuration of the ISA Server 2004 system as it is built. This document contains essential information required to rebuild a server.

One way to create an as-built document is to export settings on a server using tools such as the script illustrated in the next section of this chapter and with built-in Windows utilities such as WinMSD. WinMSD is a simple export utility that is included in the base Windows operating system, and exports server-specific settings to a text file. This data can then be imported into formal documentation easily.

To export the configuration of an ISA Server using WinMSD, perform the following steps:

After the specific settings on an ISA server have been acquired, they can be formalized into as-built documentation. The following is an example of an ISA Server 2004 as-built document template:

Introduction
The purpose of this ISA Server 2004 as-built document is to assist an
experienced network administrator or engineer in restoring the server in the
event of a hardware failure. This document contains screen shots and
configuration settings for the server at the time it was built. If settings
are not implicitly defined in this document, they are assumed to be set to
defaults. It is not intended to be a comprehensive disaster recovery plan with
step-by-step procedures for rebuilding the server. For this document
to remain useful as a recovery aid, it must be updated as configuration
settings change
System Configuration
Hardware Summary
Disk Configuration
Physical Disk Configuration
Logical Disk Configuration
System Summary
Device Manager
RAID Configuration
TCP/IP Configuration
ISA Configuration
Networks       Network Rules
Firewall Policy Rules
VPN Configuration
Antivirus Configuration
Add-Ons

Documenting Specific ISA Configuration with Custom Scripting

The ISA Server Console gives easy view access to firewall policy rules, network rules, VPN configuration, and other ISA settings. Although individual elements and entire configurations can be exported for backup or migration purposes, there is no built-in way to export these settings to simple text format for documentation purposes.

Fortunately, the ISA Server development team included a relatively straightforward scripting mechanism called the FPC object that allows for the export of ISA settings to text, CSV, or other formats. This enables administrators with scripting knowledge to generate documentation from an ISA server easily, without having to decipher the XML export files. For more information about the FPC object, reference the following Microsoft website:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/isa/isaobj1_97lg.asp

The following custom script gives an example of the type of capabilities that the FPC object can give an administrator who is tasked with the documentation of ISA rules. It exports the ISA Firewall Policy rules on the local server on which it is run. All the rules information is exported to a CSV file, such as the one shown in Figure 20.2.

NOTE

The isaconfig.wsf script, along with others referenced in this book, can be downloaded from the Sams Publishing website.

This particular script can be run by executing the following command from the directory where the script is located:

Cscript isaconfig.wsf /path:C:

Listing 20.1 shows the code for the custom documentation script.

Listing 20.1. Examining the isaconfig.wsf Documentation Script

[View full width]

<?xml version="1.0" ?>
<package>
<job id="isaconfig">
<runtime>
<description>
************************************************************
ISA Configuration Report Job
************************************************************
</description>
<named name="path" helpstring="The UNC or file path you want to export the
 configuration report to."type="string" required="1" />
<named name="silent" helpstring="Runs script in silent mode." type="simple"
 required="0" />
<example>
Example:
cscript isaconfig.wsf /path:"\\remoteserver\sharename"
cscript isaconfig.wsf /path:"c:\isainfo"
</example>
</runtime>
<form>
</form>
<script language="VBScript">
<![CDATA[
'===================================================================
' Comments about the script
'===================================================================
' This script uses the FPC object to produce a report of the policies in an
' ISA configuration.  As currently written, this script can be run only on the
' local ISA server that you are trying to export the configuration from.
In conjunction with the FPCArray object the
' script can be modified to produce a script that would allow for a centralized
' report of all ISA servers in an organization.
'
' It is also important to note that this script was developed in an effort to
' try to give a visual representation of the policy configuration that is
' present on an ISA server.  Not all the elements that are in a policy are
' represented in the report.  The report is therefore not a complete
' configuration and should be used only to document the current policies that
' are in place.
'
' To expand upon the script and for more information about the FPC object
' please see the following URL:
'
' http://msdn.microsoft.com/library/default.asp?url=/library/en-us/isasdk /isa/fpc_object.asp
'
' Please note that in all cases usage of the FPC object is limited to a
' server that has ISA 2004 or greater installed on it.
'
'===================================================================
' Check args
'===================================================================
If WScript.Arguments.Named.Exists("path") = FALSE Then
WScript.Arguments.ShowUsage()
WScript.Quit
End If
Const ForWriting = 2
Dim FSO, WSHNetwork
Dim objLogFile
Dim strPath
Dim strFileName
Dim dtmThisMinute, dtmThisHour
Dim dtmThisDay, dtmThisMonth, dtmThisYear
Set WSHNetwork = CreateObject("WScript.Network")
strPath = WScript.Arguments.Named("path")
Set FSO = CreateObject("Scripting.FileSystemObject")
dtmThisMinute = PadDigits(Minute(Now), 2)
dtmThisHour = PadDigits(Hour(Now), 2)
dtmThisDay = PadDigits(Day(Now), 2)
dtmThisMonth = PadDigits(Month(Now), 2)
dtmThisYear = Year(Now)
strFileName = WSHNetwork.ComputerName & "-" & dtmThisYear & "-" & dtmThisMonth & "-" &_
dtmThisDay & "-" & dtmThisHour & "-" & dtmThisMinute & ".csv"
Set objLogFile = FSO.OpenTextFile(strPath & "\" & strFileName, ForWriting, true)
Dim objRoot   ' The FPCLib.FPC root object
Dim isaArray  ' An FPCArray object
Set objRoot = CreateObject("FPC.Root")
Set isaArray = objRoot.GetContainingArray()
'--------------------
' Write Headers
'--------------------
objLogFile.Write("Order")
objLogFile.Write(",")
objLogFile.Write("Name")
objLogFile.Write(",")
objLogFile.Write("Action")
objLogFile.Write(",")
objLogFile.Write("Type")
objLogFile.Write(",")
objLogFile.Write("Protocols")
objLogFile.Write(",")
objLogFile.Write("From/Listener")
objLogFile.Write(",")
objLogFile.Write("To")
objLogFile.Write(",")
objLogFile.Write("Condition")
objLogFile.WriteLine()
For Each Policy in isaArray.ArrayPolicy.PolicyRules
objLogFile.Write(Policy.Order)
objLogFile.Write(",")
objLogFile.Write(Policy.Name)
objLogFile.Write(",")
strPolicyAction = Policy.Action
If strPolicyAction = 0 Then
objLogFile.Write("Allow")
Else
objLogFile.Write("Deny")
End If
objLogFile.Write(",")
strPolicyType = Policy.Type
'--------------------
' Policy Type Cases
'--------------------
' There are three basic ISA Policy Types (Access Rule, Server Publishing Rule,
' Web Publishing Rule)
Select Case strPolicyType
Case "0"
objLogFile.Write("Access Rule")
objLogFile.Write(",")
'--------------------
' Get Protocol Information
'--------------------
j = 1
strProSelctMethod = Policy.AccessProperties.ProtocolSelectionMethod
If strProSelctMethod = 0 Then
objLogFile.Write("All Outbound Taffic")
ElseIf strProSelctMethod = 2 Then
objLogFile.Write("All Except:")
End If
For Each Item in Policy.AccessProperties.SpecifiedProtocols
objLogFile.Write(Item)
If j <> Policy.AccessProperties.SpecifiedProtocols.Count Then
objLogFile.Write("; ")
End IF
j = j + 1
Next
objLogFile.Write(",")
'--------------------
' Get Source Network Information
'--------------------
GetNet(Policy.SourceSelectionIPs)
'--------------------
' Get Destion Network Information
'--------------------
GetNet(Policy.AccessProperties.DestinationSelectionIPs)
'--------------------
' Get Conditions
'--------------------
GetConditions(Policy.AccessProperties.UserSets)
Case "1"
objLogFile.Write("Server Publishing Rule")
objLogFile.Write(",")
'--------------------
' Get Published Protocol
'--------------------
objLogFile.Write(Policy.ServerPublishingProperties.PublishedProtocol)
objLogFile.Write(",")
'--------------------
' Get Source Network Information
'--------------------
GetNet(Policy.SourceSelectionIPs)
'--------------------
' Get Published Server
'--------------------
objLogFile.Write(Policy.ServerPublishingProperties.PublishedServerIP)
Case "2"
objLogFile.Write("Web Publishing Rule")
objLogFile.Write(",")
'--------------------
' Get Web Server Type
'--------------------
strWebPubType = Policy.WebPublishingProperties.PublishedServerType
If strWebPubType = 0 Then
objLogFile.Write("HTTP")
ElseIf strWebPubType = 1 Then
objLogFile.Write("HTTPS")
ElseIf strWebPubType = 2 Then
objLogFile.Write("HTTP & HTTPS")
ElseIf strWebPubType = 3 Then
objLogFile.Write("FTP")
End If
objLogFile.Write(",")
'--------------------
' Get Web Listener
'--------------------
objLogFile.Write(Policy.WebPublishingProperties.WebListenerUsed)
objLogFile.Write(",")
'--------------------
' Get Published Web Site Name
'--------------------
objLogFile.Write(Policy.WebPublishingProperties.WebSite)
objLogFile.Write(",")
'--------------------
' Get Conditions
'--------------------
GetConditions(Policy.WebPublishingProperties.UserSets)
Case Else
End Select
objLogFile.WriteLine()
Next
If WScript.Arguments.Named.Exists("silent") = FALSE Then
WScript.Echo("Finished export to " & strPath & "\" & strFileName)
End If
'===================================================================
' Functions
'===================================================================
'--------------------
' Pad Digits
'--------------------
' This function is used to pad date variables that contain only one digit.
Function PadDigits(n, totalDigits)
If totalDigits > len(n) then
PadDigits = String(totalDigits-len(n),"0") & n
Else
PadDigits = n
End If
End Function
'--------------------
' Get Conditions
'--------------------
' This function is used to get the conditions of a rule.
Function GetConditions(ObjectPath)
Dim objConditions, objConditionsDict
Set objConditions = ObjectPath
Set objConditionsDict = CreateObject("Scripting.Dictionary")
j = 1

For Each Item in objConditions
objConditionsDict.Add j, Item
j = j + 1
Next
j = 1
For Each Condition in objConditionsDict
objLogFile.Write(objConditionsDict.item(Condition))
If j <> objConditionsDict.Count Then
objLogFile.Write("; ")
End If
j = j + 1
Next
Set objConditionsDict = Nothing
Set objConditions = Nothing
End Function
'--------------------
' Get Network Information
'--------------------
' This function is used to get the network information for a rule.
Function GetNet(ObjectPath)
Dim objNet, objNetDict
Set objNet = ObjectPath
Set objNetDict = CreateObject("Scripting.Dictionary")
j = 1
For Each Item in objNet.AddressRanges
objNetDict.Add j, Item
j = j + 1
Next
For Each Item in objNet.Computers
objNetDict.Add j, Item
j = j + 1
Next
For Each Item in objNet.ComputerSets
objNetDict.Add j, Item
j = j + 1
Next
For Each Item in objNet.Networks
objNetDict.Add j, Item
j = j + 1
Next
For Each Item in objNet.NetworkSets
objNetDict.Add j, Item
j = j + 1
Next
For Each Item in objNet.Subnets
objNetDict.Add j, Item
j = j + 1
Next
j = 1
For Each Net in objNetDict
objLogFile.Write(objNetDict.item(Net))
If j <> objNetDict.Count Then
objLogFile.Write("; ")
End If
j = j + 1
Next
objLogFile.Write(",")
Set objNetDict = Nothing
Set objNet = Nothing
End Function
]]>
</script>
</job>
</package>