Monitoring ISA Server 2004 Connectivity, Sessions, and Services - Dr. Tom Shinderamp;#039;s Configuring ISA Server 1002004 [Electronic resources] نسخه متنی

Monitoring ISA Server 2004 Connectivity, Sessions, and Services

You can monitor connectivity between the ISA Server and other computers from the Connectivity tab. You can monitor current sessions for Firewall, Web Proxy, and SecureNAT clients from the Sessions tab. You can monitor the status of ISA Server services from the Services tab. In the following sections, we will look at each of these individually.

Configuring and Monitoring Connectivity

You can monitor the connections between the ISA Server and specific servers on any network (by server name or IP address) or between the ISA Server and a specific Web server (by URL). You can use one of three methods to verify the connectivity:

Ping: The ISA server will send a ping (ICMP ECHO_REQUEST message) to the server. When the server sends back an ECHO_REPLY message, this confirms that it is reachable by the ISA server.

TCP Connect: The ISA server will attempt to make a TCP connection to a specified port on the server. This can be used to ensure that a particular service is running on the server.

HTTP Request: The ISA server will send an HTTP GET command to the specified Web server. A response indicates that the Web server is up and running and reachable by the ISA server.

To monitor connectivity to a server by any of these methods, you need to create a connectivity verifier and place it into one of the predefined groups. The groups include:

Active Directory

DHCP

DNS

Published servers

Web (Internet)

Others

The status of each group is shown in the Dashboard view. This will allow you to quickly determine if one of the servers in the group has a problem. Then you can click the Connectivity tab for details about which server(s) in the group has the connectivity problem.

In the following sections, we'll show you how to create connectivity verifiers, how to assign them to groups, and how to monitor connectivity with the verifiers you have created.

Creating Connectivity Verifiers

The first step in monitoring connections between the ISA server and other computers is to create a connectivity verifier. To do so, click the Connectivity tab in the Monitoring node, and then click Create New Connectivity Verifier in the right task pane. This invokes the New Connectivity Verifier Wizard. On the first page of the wizard, you need to give the verifier a name (for example, if you are going to monitor the connection to a Web site, you might give it the name of the site's URL).

Next, you'll be asked to provide connectivity verification details. First, enter a server name, IP address, or URL in the Connection details field (you can also browse to a location to monitor by clicking the Browse button).

Select the group type in the drop-down box, as shown in Figure 12.24.

Figure 12.24: Entering Connectivity Verification Details

You can also select the verification method. If you are monitoring connectivity to a Web server (URL), you should select Web (Internet) as the group type and Send HTTP 'GET' request as the verification method. If you want to verify that a specific program or service is running on the server connection you will be monitoring, select Establish a TCP connection to port: and select from the available applications in the drop-down box. The port number will be entered for you, or you can choose Custom and enter the port number.

Applications from which you can choose in the drop-down box include:

AOL Instant Messenger

Chargen (TCP)

Daytime (TCP)

Discard (TCP)

DNS

Echo (TCP)

Finger

FTP

Gopher

H.323 Protocol

HTTP

HTTPS

ICA

ICQ 2000

Ident

IMAP4

IMAP5

IRC

Kerberos-Adm (TCP)

Kerberos-Adm (TCP) LDAP

LDAP GC (Global Catalog)

LDAPS

LDAPS GC (Global Catalog)

Microsoft CIFS (TCP)

Microsoft Operations Manager Agent

Microsoft SQL (TCP)

Microsoft Operations Manager Agent

Microsoft SQL (TCP)

MMS (Microsoft Media Server)

MS Firewall Control

MSN

MSN Messenger

Net2Phone Registration NetBios Session

News

NNTP

NNTPS

PNM (Progressive Networks Media)

POP2

POP3

POP3S

PPTP

Quote (TCP)

RDP (Terminal Services)

Rlogin

RPC (all interfaces)

TRSP (Real Time Streaming Protocol

SMTPS

SSH

Telnet

Time

WhoIs

The last page of the wizard summarizes your choices. Use the Back button if you want to change anything. Otherwise, click Finish.

If you have selected to verify an HTTP connection, you will see a dialog box informing you that a rule allowing HTTP or HTTPS to the specified destination must be configured in order to do this, and asking if you want to enable the system policy rule to 'allow HTTP/HTTPS requests from ISA Server to the selected servers for connectivity verifiers.' This is shown in Figure 12.25. Click Yes to enable the rule.

Figure 12.25: Enabling a Rule to allow HTTP/HTTPS Requests

The new connectivity verifier will be shown in the middle pane when the Connectivity tab is selected, as shown in Figure 12.26.

Figure 12.26: The New Connectivity Verifier

After you select to enable the rule, you must click Apply at the top of the console. This saves your changes and updates the configuration. You'll see a progress bar as the changes are applied, then the dialog box will advise that the changes to the configuration were successfully applied. Click OK to close the dialog box.

Now 'Verifying' will disappear from the Result column and a result time (in milliseconds) will replace it.

You can delete or disable a verifier by right clicking it and selecting Delete or Disable from the context menu. You can also export or import verifiers from this menu. Another way to perform these tasks is to highlight the selected verifier and click the appropriate task in the right task pane (Delete Selected Verifiers, Disable Selected Verifiers, Export Connectivity Verifiers or Import Connectivity Verifiers).

If you want to change any of the properties of your connectivity verifier, right-click it and select Properties from the context menu, or highlight it and click Edit Selected Verifier in the right task pane.

On the General tab of the properties box, you can change the name, enable or disable the verifier, and type an optional description. On the Properties tab, you can change the URL, server name or IP address of the connection being monitored, change the group type, or change the verification method. You can also specify a timeout response threshold (by default, 5000 msec). Finally, you can select whether to trigger an alert if the server response is not within the specified timeout period (by default, an alert is triggered), as shown in Figure 12.27.

Figure 12.27: Modifying Properties of a Connectivity Verifier

Monitoring Connectivity

Once you've configured your verifiers, you can tell at a glance whether there are any problems with the servers in a particular group by viewing the Connectivity section of the Dashboard. As you can see in Figure 12.28, the group types that have verifiers configured show a status of 'Good' as long as the connections in that group type are verified.

Figure 12.28: Monitoring Connectivity from the Dashboard

If there is a problem with one of the servers in a group, the group status will show the problem (even though other servers in the group may be connected without any problem). For example, if one of the servers in the Others group is experiencing a slow connection, this will be indicated in the Status column on the Dashboard, as shown in Figure 12.29.

Figure 12.29: Connectivity Problems Displayed on Dashboard

To determine which server has the problem, you'll need to go to the Connectivity tab. Then you'll be able to see exactly which verifier reports a problem, as shown in Figure 12.30.

Figure 12.30: The Connectivity Tab Shows Which Server Has a Problem

'Unresolved Name' is one of several status indicators that can occur for verifiers using the HTTP method. It occurs when the server's name cannot be resolved to an IP address. Other results, depending on the response from the Web server, include:

OK: This result is reported when a 401 message (Web server authentication required) is returned from the server.

Error (Windows Server 2003): This result is reported when a 407 message (proxy authentication required) is returned, because ISA Server could not verify connectivity to the actual Web server.

Authentication required (Windows 2000 Server): This result is reported when a 407 message is returned if the server is running Windows 2000.

Error: This result is reported if any 4xx message is returned (except 401 or 407) or if any 5xx message is returned.

Time-out: This result is reported if the request times out before the server responds.

Unable to verify: This result is reported if the ISA Server is down or the Firewall service is otherwise unavailable.

When should you create connectivity verifiers, and to which servers should you monitor connectivity? If you have mission critical servers on the network (for example, your Exchange e-mail server) that have been published to make them available to external clients, you might want to create a connectivity verifier so you can easily keep tabs on whether it's working properly.

You might also want to create connectivity verifiers to some popular external Web sites that are considered reliable in terms of up-time, so you can tell at a glance if the ISA Server has connectivity to those external sites.

Monitoring Sessions

A handy feature in ISA Server 2004 is the ability to monitor real-time sessions, that is, the activity of a particular client computer (IP address) by a particular user (account name). You can monitor sessions from all three types of clients: Firewall, Web Proxy, and SecureNAT.

Viewing, Stopping and Pausing Monitoring of Sessions

To view current sessions being conducted through the ISA Server, click the Sessions tab and you will see a list of sessions as shown in Figure 12.31.

Figure 12.31: Viewing Current Sessions

As you can see, the display shows you the following information about each session:

Date and time the session was activated

Session type (Firewall, Web Proxy, SecureNAT client, VPN client, or Remote VPN site)

Client IP address

Source network

Client user name (if authentication is required)

Client host name (for Firewall Client sessions)

Application name (for Firewall Client sessions)

Server name (name of the ISA Server)

The Server name and Application name columns are not displayed by default in Standard Edition. To display them, right-click on one of the column headers and check Server name or Application name in the context menu.

If you want to stop monitoring sessions, just select Stop Monitoring Sessions in the right task pane. All the sessions information will then disappear from the Sessions tab. To start monitoring again, click Start Monitoring Sessions (which only appears when you have stopped monitoring).

You can also stop ISA Server from adding new sessions to the display by selecting Pause Monitoring Sessions. When you do so, that selection will be replaced by Resume Monitoring Sessions. When you are paused, the sessions that were already in the display will stay there.

Monitoring Specific Sessions Using Filter Definitions

If you have many sessions going through the ISA server, it can be difficult to find the ones in which you're interested. You can use ISA Server 2004's filtering mechanism to sort the sessions data and display only sessions that meet specified criteria. If you specify multiple criteria, only the sessions that meet all of your specifications will be displayed.

To define a filter, do the following:

In the right task pane, click Edit Filter, or right-click in the middle pane and select Edit Filter from the context menu.

In the Edit Filter dialog box, select filter criteria for the Filter by field from the drop-down box, as shown in Figure 12.32.

Figure 12.32: Setting Filter Criteria

You can select to filter by any of the following:

Activation

Application name

Client host name

Client IP address

Client user name

Server name

Session type

Source network

Next, you'll need to select a condition (in this case, 'equals' or 'not equal').

In the Value field, your choices depend on which criteria you are filtering by. In our example, we chose to filter by session type, so our value choices are Firewall Client, SecureNAT, VPN Client, VPN Remote Site, or Web Proxy. We want to view all Web Proxy sessions.

Click Add to list to add your filter criteria to the list

If you want to further narrow the scope of sessions listed, you can add more criteria by going through the same process again. In our example, as shown in Figure 12.33, we want to view only the Web Proxy sessions for client IP address 192.168.1.121 (the local host).

Figure 12.33: Specifying Multiple Filtering Criteria

When you have added all the criteria that you want, click Start Query and the filtering process will begin. The session(s) that meet all of the specified criteria will be displayed as shown in Figure 12.34.

Figure 12.34: Result of Filtering

You can save a filter definition so you can use it again by exporting it to an .xml file. See Exporting and Importing Filter Definitions later in this section.

In the ISA Server 2004 Help files, you'll see instructions for saving filter definitions and 'loading' filter definitions that tell you to select Save Filter Definitions or Load Filter Definitions on the Tasks tab. The problem is that no such selections exist (they did in some beta versions). In the final release of the product, you use the Export and Import functions for this purpose.

Disconnecting Sessions

You can disconnect a session quickly and easily by right-clicking it in the Sessions window and selecting Disconnect Session in the context menu. You will be asked if you're sure you want to disconnect the session. Click Yes to do so. Alternatively, you can highlight the session, and then click Disconnect Session in the right task pane.

Exporting and Importing Filter Definitions

You can save filters by exporting them to .xml files, and then load them by importing them. If you do a lot of filtering, you will probably want to make a number of predefined filters so you can quickly view, for example, all Web Proxy sessions with one filter, all Firewall sessions with another filter, all sessions for a particular application with another, all sessions for a particular client user name with another, and so forth.

Once you have defined a filter you want to save and conducted a query with it, click Export Filter Definitions in the right task pane. Select a location in which to save it (we suggest creating a folder for all your filters) and give it a descriptive name (for example, FirewallSessionFilter). Click the Save button.

When you're ready to use that filter again, just click Import Filter Definitions in the right task pane, navigate to the location of the saved filter and select it, and click the Load button. You may need to click the Refresh button in the top toolbar to view the new filter results after loading the filter.

Monitoring Services

You can view the ISA Server services that are running on the firewall by using the Services tab in the Monitoring node. By default, the Services window in the middle pane will show the names of services, the status of each (running or stopped), and in some cases, the service uptime (how long the service has been running in days, hours, minutes, and seconds.

You can stop and start services from this interface. Just right-click a running service and select Stop, or highlight a service and click Stop Selected Service in the right task pane. The service's status will change to 'Stopped' as shown in Figure 12.35. You can then restart the service by right-clicking and selecting Start, or highlighting and selecting Start Selected Service in the task pane.

Figure 12.35: Stopping and Starting Services